@orbinum/sdk 0.8.1 → 0.10.0

package/dist/index.d.mts

@@ -542,6 +542,35 @@ interface SpentNullifier {
     txType: 'unshield' | 'private_transfer';
     timestampMs: number | null;
 }
+/** One sealed, immutable chunk of the spent-nullifier set (manifest entry). */
+interface NullifierChunkInfo {
+    idx: number;
+    /** Exact number of nullifiers in the chunk. */
+    count: number;
+    /** sha256 (hex) of the chunk's nullifier hexes sorted ascending — goes in the chunk URL. */
+    digest: string;
+}
+/**
+ * Universal index of the sealed nullifier chunks — identical for every caller.
+ * No client-supplied position parameter exists anywhere in the chunk flow, so
+ * the PIR-A property of `/nullifiers/all` is preserved while transfers become
+ * incremental (clients persist chunks locally and only fetch new ones).
+ */
+interface NullifierManifest {
+    /** Bumped by the operator on semantic corrections; a change means: resync from zero. */
+    generation: string;
+    /** Target chunk size (informational; each chunk's exact size is its `count`). */
+    chunkSize: number;
+    chunks: NullifierChunkInfo[];
+    /** Σ sealed counts + current tail size. */
+    total: number;
+}
+/** The mutable remainder of the nullifier set after the last sealed chunk. */
+interface NullifierTail {
+    /** Number of sealed chunks the tail starts after (detects a chunk sealed mid-sync). */
+    afterChunks: number;
+    data: string[];
+}
 /** Temporal metadata for a private transfer. No graph data (inputs ↔ outputs) exposed. */
 interface PrivateTransferTimestamp {
     blockNumber: number;
@@ -840,10 +869,32 @@ declare class IndexerClient {
      * The server sees an identical GET request regardless of which notes the wallet holds —
      * the intersection is computed locally (PIR-A privacy model).
      *
-     * Suitable for wallets with up to ~1M spent nullifiers (~70 MB raw, <20 MB gzip).
-     * For the current Orbinum testnet/mainnet scale this is the recommended approach.
+     * Kept as the FALLBACK for readers that don't serve sealed chunks yet (and for
+     * small sets). New integrations should prefer the incremental chunk flow:
+     * `getNullifierManifest` → `getNullifierChunk` for missing chunks →
+     * `getNullifierTail`, persisting the set locally between rescans.
      */
     getAllSpentNullifiers(): Promise<Set<string>>;
+    /**
+     * Universal index of the sealed nullifier chunks — identical request and
+     * response for every caller (no client-supplied position: PIR-A preserved).
+     *
+     * Returns `null` when the reader does not serve chunks yet (404) — the
+     * caller should fall back to `getAllSpentNullifiers`.
+     */
+    getNullifierManifest(): Promise<NullifierManifest | null>;
+    /**
+     * One sealed, immutable chunk of the spent-nullifier set (ascending hex,
+     * lowercased). The digest comes from the manifest and lives in the URL, so
+     * a corrected chunk is a different URL — safe to cache forever client-side.
+     */
+    getNullifierChunk(idx: number, digest: string): Promise<string[]>;
+    /**
+     * The mutable remainder of the nullifier set after the last sealed chunk.
+     * Identical request for every caller (no input). `afterChunks` lets the
+     * client detect a chunk sealed between its manifest fetch and this one.
+     */
+    getNullifierTail(): Promise<NullifierTail>;
     /** Server-enforced max items per by-nullifiers / by-commitments request. */
     private static readonly TRANSFER_LOOKUP_CHUNK;
     /**
@@ -2820,6 +2871,25 @@ declare function vaultReviver(_key: string, value: unknown): unknown;
  * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
  */
 declare function deriveVaultKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Derives an HMAC-SHA-256 key ("blind key") from the same master key bytes,
+ * for deterministically tagging note identifiers (commitment/nullifier) in the
+ * vault WITHOUT storing them in plaintext.
+ *
+ * The tag `HMAC(blindKey, hex)` is stable, so equality lookups still work
+ * (find a note by commitment/nullifier), but a raw storage dump reveals no
+ * on-chain identifiers — an attacker with disk access can't link the vault to
+ * chain activity. Derived from masterBytes, so it's device-independent and
+ * survives reload (unlike a random per-session salt).
+ *
+ * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
+ */
+declare function deriveVaultBlindKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Deterministic tag for a note identifier hex, as `0x`-prefixed HMAC-SHA-256.
+ * Used as the blinded storage key for commitment / nullifier / assetId.
+ */
+declare function blindTag(blindKey: CryptoKey, value: string): Promise<string>;
 /**
  * Serialises `payload` to JSON (bigint-safe) and encrypts it with AES-GCM.
  * Returns base64-encoded `iv` and `ciphertext`.
@@ -2841,18 +2911,26 @@ declare function decryptJson(key: CryptoKey, iv: string, ciphertext: string): Pr
  * Any backend (IndexedDB, SQLite, remote…) must produce/consume this shape
  * so that encryptNote / decryptNoteRecord work without modification.
  */
-/** A single encrypted note record as stored in the vault backend. */
+/**
+ * A single encrypted note record as stored in the vault backend.
+ *
+ * Note identifiers are BLINDED — stored as HMAC tags derived from the vault
+ * blind key, not the raw on-chain hex. A storage dump reveals no
+ * commitment/nullifier/asset that could be linked to chain activity, yet
+ * equality lookups (find-my-note) still work by comparing tags. `spent` /
+ * `spentAt` stay plaintext: they're local flags with no on-chain linkage.
+ */
 interface EncryptedNoteRecord {
-    /** Primary key — note commitmentHex */
-    commitmentHex: string;
+    /** Primary key — blinded commitment tag: HMAC(blindKey, commitmentHex). */
+    commitmentTag: string;
     /** AES-GCM IV for this record — base64 */
     iv: string;
     /** AES-GCM ciphertext of the full ZkNote JSON — base64 */
     ciphertext: string;
-    /** Unencrypted nullifierHex for quick spent-check without unlocking */
-    nullifierHex: string;
-    /** Unencrypted assetId (string form of bigint) for filtering */
-    assetId: string;
+    /** Blinded nullifier tag: HMAC(blindKey, nullifierHex). Quick spent-check. */
+    nullifierTag: string;
+    /** Blinded asset tag: HMAC(blindKey, assetId). Filter by asset without unlock. */
+    assetTag: string;
     /** Whether the note has already been spent/nullified on-chain. */
     spent?: boolean;
     /** When the app marked the note as spent locally, if known. */
@@ -2886,17 +2964,25 @@ declare class VaultLockedError extends Error {
  */
 declare function applyNoteStatus(note: ZkNote, status?: NoteStatusUpdate): ZkNote;
 /**
- * Encrypts a ZkNote into an EncryptedNoteRecord using AES-GCM.
- * The commitmentHex, nullifierHex, and assetId are stored in plaintext
- * for efficient filtering without requiring vault unlock.
+ * Encrypts a ZkNote into a v2 EncryptedNoteRecord.
+ *
+ * The full note (values, secrets) is AES-GCM encrypted under `key`; the note
+ * identifiers (commitment, nullifier, asset) are stored as BLIND TAGS under
+ * `blindKey` instead of plaintext — a storage dump reveals nothing linkable to
+ * chain activity, while equality lookups still work (compare tags).
  */
-declare function encryptNote(key: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
+declare function encryptNote(key: CryptoKey, blindKey: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
 /**
- * Decrypts an EncryptedNoteRecord back into a ZkNote using AES-GCM.
+ * Decrypts a note record back into a ZkNote.
  * Applies the record's spent/spentAt metadata onto the decrypted note.
  * Throws DOMException on authentication failure (wrong key or corrupted data).
  */
 declare function decryptNoteRecord(key: CryptoKey, rec: EncryptedNoteRecord): Promise<ZkNote>;
+/**
+ * Blind tag for a note identifier hex — use to build the storage key or to
+ * look a record up by commitment/nullifier without exposing the raw hex.
+ */
+declare function noteBlindTag(blindKey: CryptoKey, hex: string): Promise<string>;
 
 /**
  * Inputs required to generate an Unshield proof.
@@ -4491,4 +4577,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierStatusResult, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierChunkInfo, type NullifierManifest, type NullifierStatusResult, type NullifierTail, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.d.ts

@@ -542,6 +542,35 @@ interface SpentNullifier {
     txType: 'unshield' | 'private_transfer';
     timestampMs: number | null;
 }
+/** One sealed, immutable chunk of the spent-nullifier set (manifest entry). */
+interface NullifierChunkInfo {
+    idx: number;
+    /** Exact number of nullifiers in the chunk. */
+    count: number;
+    /** sha256 (hex) of the chunk's nullifier hexes sorted ascending — goes in the chunk URL. */
+    digest: string;
+}
+/**
+ * Universal index of the sealed nullifier chunks — identical for every caller.
+ * No client-supplied position parameter exists anywhere in the chunk flow, so
+ * the PIR-A property of `/nullifiers/all` is preserved while transfers become
+ * incremental (clients persist chunks locally and only fetch new ones).
+ */
+interface NullifierManifest {
+    /** Bumped by the operator on semantic corrections; a change means: resync from zero. */
+    generation: string;
+    /** Target chunk size (informational; each chunk's exact size is its `count`). */
+    chunkSize: number;
+    chunks: NullifierChunkInfo[];
+    /** Σ sealed counts + current tail size. */
+    total: number;
+}
+/** The mutable remainder of the nullifier set after the last sealed chunk. */
+interface NullifierTail {
+    /** Number of sealed chunks the tail starts after (detects a chunk sealed mid-sync). */
+    afterChunks: number;
+    data: string[];
+}
 /** Temporal metadata for a private transfer. No graph data (inputs ↔ outputs) exposed. */
 interface PrivateTransferTimestamp {
     blockNumber: number;
@@ -840,10 +869,32 @@ declare class IndexerClient {
      * The server sees an identical GET request regardless of which notes the wallet holds —
      * the intersection is computed locally (PIR-A privacy model).
      *
-     * Suitable for wallets with up to ~1M spent nullifiers (~70 MB raw, <20 MB gzip).
-     * For the current Orbinum testnet/mainnet scale this is the recommended approach.
+     * Kept as the FALLBACK for readers that don't serve sealed chunks yet (and for
+     * small sets). New integrations should prefer the incremental chunk flow:
+     * `getNullifierManifest` → `getNullifierChunk` for missing chunks →
+     * `getNullifierTail`, persisting the set locally between rescans.
      */
     getAllSpentNullifiers(): Promise<Set<string>>;
+    /**
+     * Universal index of the sealed nullifier chunks — identical request and
+     * response for every caller (no client-supplied position: PIR-A preserved).
+     *
+     * Returns `null` when the reader does not serve chunks yet (404) — the
+     * caller should fall back to `getAllSpentNullifiers`.
+     */
+    getNullifierManifest(): Promise<NullifierManifest | null>;
+    /**
+     * One sealed, immutable chunk of the spent-nullifier set (ascending hex,
+     * lowercased). The digest comes from the manifest and lives in the URL, so
+     * a corrected chunk is a different URL — safe to cache forever client-side.
+     */
+    getNullifierChunk(idx: number, digest: string): Promise<string[]>;
+    /**
+     * The mutable remainder of the nullifier set after the last sealed chunk.
+     * Identical request for every caller (no input). `afterChunks` lets the
+     * client detect a chunk sealed between its manifest fetch and this one.
+     */
+    getNullifierTail(): Promise<NullifierTail>;
     /** Server-enforced max items per by-nullifiers / by-commitments request. */
     private static readonly TRANSFER_LOOKUP_CHUNK;
     /**
@@ -2820,6 +2871,25 @@ declare function vaultReviver(_key: string, value: unknown): unknown;
  * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
  */
 declare function deriveVaultKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Derives an HMAC-SHA-256 key ("blind key") from the same master key bytes,
+ * for deterministically tagging note identifiers (commitment/nullifier) in the
+ * vault WITHOUT storing them in plaintext.
+ *
+ * The tag `HMAC(blindKey, hex)` is stable, so equality lookups still work
+ * (find a note by commitment/nullifier), but a raw storage dump reveals no
+ * on-chain identifiers — an attacker with disk access can't link the vault to
+ * chain activity. Derived from masterBytes, so it's device-independent and
+ * survives reload (unlike a random per-session salt).
+ *
+ * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
+ */
+declare function deriveVaultBlindKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Deterministic tag for a note identifier hex, as `0x`-prefixed HMAC-SHA-256.
+ * Used as the blinded storage key for commitment / nullifier / assetId.
+ */
+declare function blindTag(blindKey: CryptoKey, value: string): Promise<string>;
 /**
  * Serialises `payload` to JSON (bigint-safe) and encrypts it with AES-GCM.
  * Returns base64-encoded `iv` and `ciphertext`.
@@ -2841,18 +2911,26 @@ declare function decryptJson(key: CryptoKey, iv: string, ciphertext: string): Pr
  * Any backend (IndexedDB, SQLite, remote…) must produce/consume this shape
  * so that encryptNote / decryptNoteRecord work without modification.
  */
-/** A single encrypted note record as stored in the vault backend. */
+/**
+ * A single encrypted note record as stored in the vault backend.
+ *
+ * Note identifiers are BLINDED — stored as HMAC tags derived from the vault
+ * blind key, not the raw on-chain hex. A storage dump reveals no
+ * commitment/nullifier/asset that could be linked to chain activity, yet
+ * equality lookups (find-my-note) still work by comparing tags. `spent` /
+ * `spentAt` stay plaintext: they're local flags with no on-chain linkage.
+ */
 interface EncryptedNoteRecord {
-    /** Primary key — note commitmentHex */
-    commitmentHex: string;
+    /** Primary key — blinded commitment tag: HMAC(blindKey, commitmentHex). */
+    commitmentTag: string;
     /** AES-GCM IV for this record — base64 */
     iv: string;
     /** AES-GCM ciphertext of the full ZkNote JSON — base64 */
     ciphertext: string;
-    /** Unencrypted nullifierHex for quick spent-check without unlocking */
-    nullifierHex: string;
-    /** Unencrypted assetId (string form of bigint) for filtering */
-    assetId: string;
+    /** Blinded nullifier tag: HMAC(blindKey, nullifierHex). Quick spent-check. */
+    nullifierTag: string;
+    /** Blinded asset tag: HMAC(blindKey, assetId). Filter by asset without unlock. */
+    assetTag: string;
     /** Whether the note has already been spent/nullified on-chain. */
     spent?: boolean;
     /** When the app marked the note as spent locally, if known. */
@@ -2886,17 +2964,25 @@ declare class VaultLockedError extends Error {
  */
 declare function applyNoteStatus(note: ZkNote, status?: NoteStatusUpdate): ZkNote;
 /**
- * Encrypts a ZkNote into an EncryptedNoteRecord using AES-GCM.
- * The commitmentHex, nullifierHex, and assetId are stored in plaintext
- * for efficient filtering without requiring vault unlock.
+ * Encrypts a ZkNote into a v2 EncryptedNoteRecord.
+ *
+ * The full note (values, secrets) is AES-GCM encrypted under `key`; the note
+ * identifiers (commitment, nullifier, asset) are stored as BLIND TAGS under
+ * `blindKey` instead of plaintext — a storage dump reveals nothing linkable to
+ * chain activity, while equality lookups still work (compare tags).
  */
-declare function encryptNote(key: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
+declare function encryptNote(key: CryptoKey, blindKey: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
 /**
- * Decrypts an EncryptedNoteRecord back into a ZkNote using AES-GCM.
+ * Decrypts a note record back into a ZkNote.
  * Applies the record's spent/spentAt metadata onto the decrypted note.
  * Throws DOMException on authentication failure (wrong key or corrupted data).
  */
 declare function decryptNoteRecord(key: CryptoKey, rec: EncryptedNoteRecord): Promise<ZkNote>;
+/**
+ * Blind tag for a note identifier hex — use to build the storage key or to
+ * look a record up by commitment/nullifier without exposing the raw hex.
+ */
+declare function noteBlindTag(blindKey: CryptoKey, hex: string): Promise<string>;
 
 /**
  * Inputs required to generate an Unshield proof.
@@ -4491,4 +4577,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierStatusResult, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierChunkInfo, type NullifierManifest, type NullifierStatusResult, type NullifierTail, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.js

@@ -59,6 +59,7 @@ __export(index_exports, {
   bigintTo32Be: () => bigintTo32Be,
   bigintTo32Le: () => bigintTo32Le,
   bigintTo32LeArr: () => bigintTo32LeArr,
+  blindTag: () => blindTag,
   buildDummyTransferInput: () => buildDummyTransferInput,
   bytesToBigintLE: () => bytesToBigintLE,
   computeNullifier: () => computeNullifier,
@@ -75,6 +76,7 @@ __export(index_exports, {
   deriveSpendingKeyMessage: () => deriveSpendingKeyMessage,
   deriveStealthOwnerPk: () => deriveStealthOwnerPk,
   deriveStealthSk: () => deriveStealthSk,
+  deriveVaultBlindKey: () => deriveVaultBlindKey,
   deriveVaultKey: () => deriveVaultKey,
   deriveViewingPublicKey: () => deriveViewingPublicKey,
   deriveViewingSecretKey: () => deriveViewingSecretKey,
@@ -109,6 +111,7 @@ __export(index_exports, {
   mapExtrinsicArgs: () => mapExtrinsicArgs,
   mapZkEventData: () => mapZkEventData,
   normalizeEvmAddress: () => normalizeEvmAddress,
+  noteBlindTag: () => noteBlindTag,
   randomBlinding: () => randomBlinding,
   recoverOwnerPkPoint: () => recoverOwnerPkPoint,
   selectNotes: () => selectNotes,
@@ -1239,13 +1242,45 @@ var IndexerClient = class _IndexerClient {
    * The server sees an identical GET request regardless of which notes the wallet holds —
    * the intersection is computed locally (PIR-A privacy model).
    *
-   * Suitable for wallets with up to ~1M spent nullifiers (~70 MB raw, <20 MB gzip).
-   * For the current Orbinum testnet/mainnet scale this is the recommended approach.
+   * Kept as the FALLBACK for readers that don't serve sealed chunks yet (and for
+   * small sets). New integrations should prefer the incremental chunk flow:
+   * `getNullifierManifest` → `getNullifierChunk` for missing chunks →
+   * `getNullifierTail`, persisting the set locally between rescans.
    */
   async getAllSpentNullifiers() {
     const res = await this.get("/shielded/nullifiers/all");
     return new Set(res.data.map((h) => h.toLowerCase()));
   }
+  /**
+   * Universal index of the sealed nullifier chunks — identical request and
+   * response for every caller (no client-supplied position: PIR-A preserved).
+   *
+   * Returns `null` when the reader does not serve chunks yet (404) — the
+   * caller should fall back to `getAllSpentNullifiers`.
+   */
+  async getNullifierManifest() {
+    return this.getOrNull("/shielded/nullifiers/manifest");
+  }
+  /**
+   * One sealed, immutable chunk of the spent-nullifier set (ascending hex,
+   * lowercased). The digest comes from the manifest and lives in the URL, so
+   * a corrected chunk is a different URL — safe to cache forever client-side.
+   */
+  async getNullifierChunk(idx, digest) {
+    const res = await this.get(
+      `/shielded/nullifiers/chunks/${idx}/${encodeURIComponent(digest)}`
+    );
+    return res.data.map((h) => h.toLowerCase());
+  }
+  /**
+   * The mutable remainder of the nullifier set after the last sealed chunk.
+   * Identical request for every caller (no input). `afterChunks` lets the
+   * client detect a chunk sealed between its manifest fetch and this one.
+   */
+  async getNullifierTail() {
+    const res = await this.get("/shielded/nullifiers/tail");
+    return { afterChunks: res.afterChunks, data: res.data.map((h) => h.toLowerCase()) };
+  }
   // ─── Private transfers ─────────────────────────────────────────────────────
   /** Server-enforced max items per by-nullifiers / by-commitments request. */
   static TRANSFER_LOOKUP_CHUNK = 50;
@@ -4484,6 +4519,7 @@ function fromBase64(b64) {
 
 // src/vault/VaultCrypto.ts
 var VAULT_KEY_INFO = new TextEncoder().encode("orbinum-vault-key-v1");
+var VAULT_BLIND_INFO = new TextEncoder().encode("orbinum-vault-blind-v1");
 var IV_BYTES = 12;
 async function deriveVaultKey(masterBytes) {
   const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
@@ -4502,6 +4538,28 @@ async function deriveVaultKey(masterBytes) {
     ["encrypt", "decrypt"]
   );
 }
+async function deriveVaultBlindKey(masterBytes) {
+  const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
+    "deriveKey"
+  ]);
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: VAULT_BLIND_INFO
+    },
+    keyMaterial,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
+    false,
+    ["sign"]
+  );
+}
+async function blindTag(blindKey, value) {
+  const data = new TextEncoder().encode(value.toLowerCase());
+  const sig = await crypto.subtle.sign("HMAC", blindKey, data);
+  return "0x" + toBase64(sig).replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+}
 async function encryptJson(key, payload) {
   const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload, vaultReplacer));
@@ -4533,14 +4591,19 @@ function applyNoteStatus(note, status) {
     spentAt: status?.spentAt ?? note.spentAt ?? null
   };
 }
-async function encryptNote(key, note) {
+async function encryptNote(key, blindKey, note) {
   const { iv, ciphertext } = await encryptJson(key, note);
+  const [commitmentTag, nullifierTag, assetTag] = await Promise.all([
+    blindTag(blindKey, note.commitmentHex),
+    blindTag(blindKey, note.nullifierHex),
+    blindTag(blindKey, note.assetId.toString())
+  ]);
   return {
-    commitmentHex: note.commitmentHex,
+    commitmentTag,
     iv,
     ciphertext,
-    nullifierHex: note.nullifierHex,
-    assetId: note.assetId.toString(),
+    nullifierTag,
+    assetTag,
     spent: note.spent,
     spentAt: note.spentAt,
     updatedAt: Date.now()
@@ -4553,6 +4616,9 @@ async function decryptNoteRecord(key, rec) {
     spentAt: rec.spentAt ?? null
   });
 }
+async function noteBlindTag(blindKey, hex) {
+  return blindTag(blindKey, hex);
+}
 
 // src/proof-generator/unshield.ts
 var import_proof_generator = require("@orbinum/proof-generator");
@@ -5459,6 +5525,7 @@ var import_polkadot_api4 = require("polkadot-api");
   bigintTo32Be,
   bigintTo32Le,
   bigintTo32LeArr,
+  blindTag,
   buildDummyTransferInput,
   bytesToBigintLE,
   computeNullifier,
@@ -5475,6 +5542,7 @@ var import_polkadot_api4 = require("polkadot-api");
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
   deriveStealthSk,
+  deriveVaultBlindKey,
   deriveVaultKey,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
@@ -5509,6 +5577,7 @@ var import_polkadot_api4 = require("polkadot-api");
   mapExtrinsicArgs,
   mapZkEventData,
   normalizeEvmAddress,
+  noteBlindTag,
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,

package/dist/index.mjs

@@ -1112,13 +1112,45 @@ var IndexerClient = class _IndexerClient {
    * The server sees an identical GET request regardless of which notes the wallet holds —
    * the intersection is computed locally (PIR-A privacy model).
    *
-   * Suitable for wallets with up to ~1M spent nullifiers (~70 MB raw, <20 MB gzip).
-   * For the current Orbinum testnet/mainnet scale this is the recommended approach.
+   * Kept as the FALLBACK for readers that don't serve sealed chunks yet (and for
+   * small sets). New integrations should prefer the incremental chunk flow:
+   * `getNullifierManifest` → `getNullifierChunk` for missing chunks →
+   * `getNullifierTail`, persisting the set locally between rescans.
    */
   async getAllSpentNullifiers() {
     const res = await this.get("/shielded/nullifiers/all");
     return new Set(res.data.map((h) => h.toLowerCase()));
   }
+  /**
+   * Universal index of the sealed nullifier chunks — identical request and
+   * response for every caller (no client-supplied position: PIR-A preserved).
+   *
+   * Returns `null` when the reader does not serve chunks yet (404) — the
+   * caller should fall back to `getAllSpentNullifiers`.
+   */
+  async getNullifierManifest() {
+    return this.getOrNull("/shielded/nullifiers/manifest");
+  }
+  /**
+   * One sealed, immutable chunk of the spent-nullifier set (ascending hex,
+   * lowercased). The digest comes from the manifest and lives in the URL, so
+   * a corrected chunk is a different URL — safe to cache forever client-side.
+   */
+  async getNullifierChunk(idx, digest) {
+    const res = await this.get(
+      `/shielded/nullifiers/chunks/${idx}/${encodeURIComponent(digest)}`
+    );
+    return res.data.map((h) => h.toLowerCase());
+  }
+  /**
+   * The mutable remainder of the nullifier set after the last sealed chunk.
+   * Identical request for every caller (no input). `afterChunks` lets the
+   * client detect a chunk sealed between its manifest fetch and this one.
+   */
+  async getNullifierTail() {
+    const res = await this.get("/shielded/nullifiers/tail");
+    return { afterChunks: res.afterChunks, data: res.data.map((h) => h.toLowerCase()) };
+  }
   // ─── Private transfers ─────────────────────────────────────────────────────
   /** Server-enforced max items per by-nullifiers / by-commitments request. */
   static TRANSFER_LOOKUP_CHUNK = 50;
@@ -4357,6 +4389,7 @@ function fromBase64(b64) {
 
 // src/vault/VaultCrypto.ts
 var VAULT_KEY_INFO = new TextEncoder().encode("orbinum-vault-key-v1");
+var VAULT_BLIND_INFO = new TextEncoder().encode("orbinum-vault-blind-v1");
 var IV_BYTES = 12;
 async function deriveVaultKey(masterBytes) {
   const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
@@ -4375,6 +4408,28 @@ async function deriveVaultKey(masterBytes) {
     ["encrypt", "decrypt"]
   );
 }
+async function deriveVaultBlindKey(masterBytes) {
+  const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
+    "deriveKey"
+  ]);
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: VAULT_BLIND_INFO
+    },
+    keyMaterial,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
+    false,
+    ["sign"]
+  );
+}
+async function blindTag(blindKey, value) {
+  const data = new TextEncoder().encode(value.toLowerCase());
+  const sig = await crypto.subtle.sign("HMAC", blindKey, data);
+  return "0x" + toBase64(sig).replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+}
 async function encryptJson(key, payload) {
   const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload, vaultReplacer));
@@ -4406,14 +4461,19 @@ function applyNoteStatus(note, status) {
     spentAt: status?.spentAt ?? note.spentAt ?? null
   };
 }
-async function encryptNote(key, note) {
+async function encryptNote(key, blindKey, note) {
   const { iv, ciphertext } = await encryptJson(key, note);
+  const [commitmentTag, nullifierTag, assetTag] = await Promise.all([
+    blindTag(blindKey, note.commitmentHex),
+    blindTag(blindKey, note.nullifierHex),
+    blindTag(blindKey, note.assetId.toString())
+  ]);
   return {
-    commitmentHex: note.commitmentHex,
+    commitmentTag,
     iv,
     ciphertext,
-    nullifierHex: note.nullifierHex,
-    assetId: note.assetId.toString(),
+    nullifierTag,
+    assetTag,
     spent: note.spent,
     spentAt: note.spentAt,
     updatedAt: Date.now()
@@ -4426,6 +4486,9 @@ async function decryptNoteRecord(key, rec) {
     spentAt: rec.spentAt ?? null
   });
 }
+async function noteBlindTag(blindKey, hex) {
+  return blindTag(blindKey, hex);
+}
 
 // src/proof-generator/unshield.ts
 import {
@@ -5354,6 +5417,7 @@ export {
   bigintTo32Be,
   bigintTo32Le,
   bigintTo32LeArr,
+  blindTag,
   buildDummyTransferInput,
   bytesToBigintLE,
   computeNullifier,
@@ -5370,6 +5434,7 @@ export {
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
   deriveStealthSk,
+  deriveVaultBlindKey,
   deriveVaultKey,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
@@ -5404,6 +5469,7 @@ export {
   mapExtrinsicArgs,
   mapZkEventData,
   normalizeEvmAddress,
+  noteBlindTag,
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orbinum/sdk",
-  "version": "0.8.1",
+  "version": "0.10.0",
   "description": "Official TypeScript SDK for Orbinum.",
   "author": "Orbinum",
   "license": "MIT",