@orbinum/sdk 1.0.0 → 1.1.0

package/dist/index.d.mts

@@ -1809,12 +1809,15 @@ declare class PrivacyKeyManager {
      * Exports a shareable privacy address encoding the owner public key and
      * viewing PUBLIC key of the currently loaded identity.
      *
-     * Format: `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`
+     * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
      *
      * The recipient uses this address so the sender can:
      *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
      *  2. Encrypt the memo via ECDH with the recipient's `viewingPublicKey`.
      *
+     * The trailing checksum (see `privacyAddressChecksum`) makes a corrupted
+     * paste fail to decode rather than pay into an unspendable note.
+     *
      * SECURITY: Only the viewing PUBLIC key is embedded — the viewing secret key
      * (used for decryption) is never exported. Holders of this address cannot
      * decrypt the recipient's notes.
@@ -1823,9 +1826,14 @@ declare class PrivacyKeyManager {
      */
     encodePrivacyAddress(): string;
     /**
-     * Decode a privacy address of the form `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`.
-     * Returns `{ ownerPkHex, viewingPublicKeyHex }` on success, or `null` if the input
-     * does not match the expected format.
+     * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
+     * `null` if it does not parse.
+     *
+     * Accepts both:
+     *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
+     *    (corrupted paste) returns null.
+     *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
+     *    shared before v2 keep resolving; only v2 is emitted.
      */
     static decodePrivacyAddress(address: string): {
         ownerPkHex: string;
@@ -4771,6 +4779,84 @@ declare function decodeNoteTransferPage(uri: string): NoteTransferPayload;
  */
 declare function assembleNoteTransfer(pages: NoteTransferPayload[]): NoteTransferEntry[];
 
+/**
+ * CLOSED JSON backup of notes — the same notes moved between a user's devices as
+ * a plain file, WITHOUT exposing any spending key.
+ *
+ * ## The idea
+ *
+ * A backup entry carries only what is already PUBLIC on chain: the commitment and
+ * the encrypted memo. It contains no spending key, so the file is safe to hold
+ * and even share — it grants nothing on its own.
+ *
+ * On import, the recipient DECRYPTS each memo with their own viewing key
+ * (`importNotesFromBackup`). Decryption is the proof of ownership:
+ *   - the memo decrypts → the note is theirs → a full spendable `ZkNote` is
+ *     reconstructed, spending key and stealth key derived from their identity;
+ *   - the memo does not decrypt → the note is someone else's → it is dropped.
+ *
+ * This is NOT a chain scan: only the N memos in the backup are tried, not the
+ * whole pool. It moves notes between devices without re-scanning, and a note that
+ * is not yours simply fails to import.
+ *
+ * ## What travels vs what does not
+ *
+ * Travels: `commitmentHex`, `encryptedMemo`, and `leafIndex` (informational).
+ * Does NOT travel: value, ownerPk, blinding, spendingKey — all recovered by
+ * decrypting the memo. The Merkle proof is re-fetched at spend time.
+ */
+
+/** Current backup format version. Bumped only if the entry shape changes. */
+declare const NOTE_BACKUP_VERSION: 1;
+/**
+ * One note in a closed backup — public data only. Field names are short but not
+ * cryptic; readability matters more than density in a file (unlike the QR path).
+ */
+interface NoteBackupEntry {
+    /** 0x-prefixed 32-byte LE commitment hex. */
+    commitmentHex: string;
+    /** 0x-prefixed encrypted memo hex (180 bytes). Decrypted on import. */
+    encryptedMemo: string;
+    /** Merkle leaf index, when known. Informational — spends re-fetch the proof. */
+    leafIndex?: number;
+}
+interface NoteBackup {
+    v: typeof NOTE_BACKUP_VERSION;
+    /** Export time (ms). Informational. */
+    ts: number;
+    notes: NoteBackupEntry[];
+}
+/** Keys the importer needs to prove ownership by decrypting each memo. */
+interface BackupImportKeys {
+    /** 32-byte viewing secret key (ivsk). */
+    viewingSecretKey: Uint8Array;
+    /** Spending key scalar — folded into the derived stealth key / nullifier. */
+    spendingKey: bigint;
+    /** The importer's global owner pk (Ax), for stealth detection. */
+    ownerPk: bigint;
+}
+/**
+ * Encode notes into a closed JSON backup. Carries the memo, not the keys.
+ * `now` is injectable for a deterministic export (tests).
+ */
+declare function encodeNoteBackup(notes: ZkNote[], options?: {
+    now?: () => number;
+}): NoteBackup;
+/**
+ * Decode a JSON backup (string or object) into entries. Strict: a malformed
+ * payload is rejected rather than partially imported.
+ */
+declare function decodeNoteBackup(json: string | object): NoteBackupEntry[];
+/**
+ * Import a closed backup: decrypt each entry's memo with the importer's keys and
+ * return the notes that belong to them as full, spendable `ZkNote`s.
+ *
+ * Ownership is proven by decryption — an entry whose memo does not open under
+ * these keys is silently skipped (it is not this user's note). No chain access:
+ * only the backup's own memos are tried.
+ */
+declare function importNotesFromBackup(entries: NoteBackupEntry[], keys: BackupImportKeys): ZkNote[];
+
 /**
  * The steps every spend shares, in the order a spend performs them.
  *
@@ -5378,4 +5464,4 @@ declare class OrbinumWallet {
     private requireKey;
 }
 
-export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, PAGE_SIZE, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteTransferPages, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };
+export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, PAGE_SIZE, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };

package/dist/index.d.ts

@@ -1809,12 +1809,15 @@ declare class PrivacyKeyManager {
      * Exports a shareable privacy address encoding the owner public key and
      * viewing PUBLIC key of the currently loaded identity.
      *
-     * Format: `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`
+     * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
      *
      * The recipient uses this address so the sender can:
      *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
      *  2. Encrypt the memo via ECDH with the recipient's `viewingPublicKey`.
      *
+     * The trailing checksum (see `privacyAddressChecksum`) makes a corrupted
+     * paste fail to decode rather than pay into an unspendable note.
+     *
      * SECURITY: Only the viewing PUBLIC key is embedded — the viewing secret key
      * (used for decryption) is never exported. Holders of this address cannot
      * decrypt the recipient's notes.
@@ -1823,9 +1826,14 @@ declare class PrivacyKeyManager {
      */
     encodePrivacyAddress(): string;
     /**
-     * Decode a privacy address of the form `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`.
-     * Returns `{ ownerPkHex, viewingPublicKeyHex }` on success, or `null` if the input
-     * does not match the expected format.
+     * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
+     * `null` if it does not parse.
+     *
+     * Accepts both:
+     *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
+     *    (corrupted paste) returns null.
+     *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
+     *    shared before v2 keep resolving; only v2 is emitted.
      */
     static decodePrivacyAddress(address: string): {
         ownerPkHex: string;
@@ -4771,6 +4779,84 @@ declare function decodeNoteTransferPage(uri: string): NoteTransferPayload;
  */
 declare function assembleNoteTransfer(pages: NoteTransferPayload[]): NoteTransferEntry[];
 
+/**
+ * CLOSED JSON backup of notes — the same notes moved between a user's devices as
+ * a plain file, WITHOUT exposing any spending key.
+ *
+ * ## The idea
+ *
+ * A backup entry carries only what is already PUBLIC on chain: the commitment and
+ * the encrypted memo. It contains no spending key, so the file is safe to hold
+ * and even share — it grants nothing on its own.
+ *
+ * On import, the recipient DECRYPTS each memo with their own viewing key
+ * (`importNotesFromBackup`). Decryption is the proof of ownership:
+ *   - the memo decrypts → the note is theirs → a full spendable `ZkNote` is
+ *     reconstructed, spending key and stealth key derived from their identity;
+ *   - the memo does not decrypt → the note is someone else's → it is dropped.
+ *
+ * This is NOT a chain scan: only the N memos in the backup are tried, not the
+ * whole pool. It moves notes between devices without re-scanning, and a note that
+ * is not yours simply fails to import.
+ *
+ * ## What travels vs what does not
+ *
+ * Travels: `commitmentHex`, `encryptedMemo`, and `leafIndex` (informational).
+ * Does NOT travel: value, ownerPk, blinding, spendingKey — all recovered by
+ * decrypting the memo. The Merkle proof is re-fetched at spend time.
+ */
+
+/** Current backup format version. Bumped only if the entry shape changes. */
+declare const NOTE_BACKUP_VERSION: 1;
+/**
+ * One note in a closed backup — public data only. Field names are short but not
+ * cryptic; readability matters more than density in a file (unlike the QR path).
+ */
+interface NoteBackupEntry {
+    /** 0x-prefixed 32-byte LE commitment hex. */
+    commitmentHex: string;
+    /** 0x-prefixed encrypted memo hex (180 bytes). Decrypted on import. */
+    encryptedMemo: string;
+    /** Merkle leaf index, when known. Informational — spends re-fetch the proof. */
+    leafIndex?: number;
+}
+interface NoteBackup {
+    v: typeof NOTE_BACKUP_VERSION;
+    /** Export time (ms). Informational. */
+    ts: number;
+    notes: NoteBackupEntry[];
+}
+/** Keys the importer needs to prove ownership by decrypting each memo. */
+interface BackupImportKeys {
+    /** 32-byte viewing secret key (ivsk). */
+    viewingSecretKey: Uint8Array;
+    /** Spending key scalar — folded into the derived stealth key / nullifier. */
+    spendingKey: bigint;
+    /** The importer's global owner pk (Ax), for stealth detection. */
+    ownerPk: bigint;
+}
+/**
+ * Encode notes into a closed JSON backup. Carries the memo, not the keys.
+ * `now` is injectable for a deterministic export (tests).
+ */
+declare function encodeNoteBackup(notes: ZkNote[], options?: {
+    now?: () => number;
+}): NoteBackup;
+/**
+ * Decode a JSON backup (string or object) into entries. Strict: a malformed
+ * payload is rejected rather than partially imported.
+ */
+declare function decodeNoteBackup(json: string | object): NoteBackupEntry[];
+/**
+ * Import a closed backup: decrypt each entry's memo with the importer's keys and
+ * return the notes that belong to them as full, spendable `ZkNote`s.
+ *
+ * Ownership is proven by decryption — an entry whose memo does not open under
+ * these keys is silently skipped (it is not this user's note). No chain access:
+ * only the backup's own memos are tried.
+ */
+declare function importNotesFromBackup(entries: NoteBackupEntry[], keys: BackupImportKeys): ZkNote[];
+
 /**
  * The steps every spend shares, in the order a spend performs them.
  *
@@ -5378,4 +5464,4 @@ declare class OrbinumWallet {
     private requireKey;
 }
 
-export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, PAGE_SIZE, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteTransferPages, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };
+export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, PAGE_SIZE, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };

package/dist/index.js

@@ -45,6 +45,7 @@ __export(index_exports, {
   MIN_SIGNATURE_BYTES: () => MIN_SIGNATURE_BYTES,
   MemoryVaultStorage: () => MemoryVaultStorage,
   NATIVE_ASSET_ID: () => NATIVE_ASSET_ID,
+  NOTE_BACKUP_VERSION: () => NOTE_BACKUP_VERSION,
   NOTE_BIGINT_FIELDS: () => NOTE_BIGINT_FIELDS,
   NOTE_TRANSFER_URI_SCHEME: () => NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder: () => NoteBuilder,
@@ -120,6 +121,7 @@ __export(index_exports, {
   createNotesCache: () => createNotesCache,
   createWalletSession: () => createWalletSession,
   createWorkerPool: () => createWorkerPool,
+  decodeNoteBackup: () => decodeNoteBackup,
   decodeNoteDisclosureKey: () => decodeNoteDisclosureKey,
   decodeNoteTransferPage: () => decodeNoteTransferPage,
   decodePrecompileCalldata: () => decodePrecompileCalldata,
@@ -143,6 +145,7 @@ __export(index_exports, {
   deriveViewingPublicKey: () => deriveViewingPublicKey,
   deriveViewingSecretKey: () => deriveViewingSecretKey,
   detectCommitmentMismatch: () => detectCommitmentMismatch,
+  encodeNoteBackup: () => encodeNoteBackup,
   encodeNoteTransferPages: () => encodeNoteTransferPages,
   encryptJson: () => encryptJson,
   encryptNote: () => encryptNote,
@@ -179,6 +182,7 @@ __export(index_exports, {
   hexToNumber: () => hexToNumber,
   implicitSubstrateToEvm: () => implicitSubstrateToEvm,
   importDeviceKey: () => importDeviceKey,
+  importNotesFromBackup: () => importNotesFromBackup,
   isAbortError: () => isAbortError,
   isAlreadySpentError: () => isAlreadySpentError,
   isConnectionLossError: () => isConnectionLossError,
@@ -1574,6 +1578,12 @@ function deriveOwnerPk(spendingKey) {
 }
 
 // src/protocol/keys/PrivacyKeyManager.ts
+var import_sha26 = require("@noble/hashes/sha2.js");
+function privacyAddressChecksum(ownerPkHex, ivkHex) {
+  const body = `orbpriv2:${ownerPkHex}:${ivkHex}`;
+  const digest = (0, import_sha26.sha256)(new TextEncoder().encode(body));
+  return toHex(digest.slice(0, 4)).slice(2);
+}
 var PrivacyKeyManager = class {
   _state = {
     spendingKey: null,
@@ -1683,12 +1693,15 @@ var PrivacyKeyManager = class {
    * Exports a shareable privacy address encoding the owner public key and
    * viewing PUBLIC key of the currently loaded identity.
    *
-   * Format: `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`
+   * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
    *
    * The recipient uses this address so the sender can:
    *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
    *  2. Encrypt the memo via ECDH with the recipient's `viewingPublicKey`.
    *
+   * The trailing checksum (see `privacyAddressChecksum`) makes a corrupted
+   * paste fail to decode rather than pay into an unspendable note.
+   *
    * SECURITY: Only the viewing PUBLIC key is embedded — the viewing secret key
    * (used for decryption) is never exported. Holders of this address cannot
    * decrypt the recipient's notes.
@@ -1700,21 +1713,35 @@ var PrivacyKeyManager = class {
     const ivkPacked = this.getViewingPublicKeyPacked();
     const ownerPkHex = scalarToHex(ownerPk);
     const ivkHex = toHex(ivkPacked);
-    return `orbpriv1:${ownerPkHex}:${ivkHex}`;
+    const checksum = privacyAddressChecksum(ownerPkHex, ivkHex);
+    return `orbpriv2:${ownerPkHex}:${ivkHex}:${checksum}`;
   }
   /**
-   * Decode a privacy address of the form `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`.
-   * Returns `{ ownerPkHex, viewingPublicKeyHex }` on success, or `null` if the input
-   * does not match the expected format.
+   * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
+   * `null` if it does not parse.
+   *
+   * Accepts both:
+   *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
+   *    (corrupted paste) returns null.
+   *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
+   *    shared before v2 keep resolving; only v2 is emitted.
    */
   static decodePrivacyAddress(address) {
-    if (!address.startsWith("orbpriv1:")) return null;
     const parts = address.split(":");
-    if (parts.length !== 3) return null;
-    const ownerPkHex = parts[1];
-    const viewingPublicKeyHex = parts[2];
-    if (!ownerPkHex || !viewingPublicKeyHex) return null;
-    return { ownerPkHex, viewingPublicKeyHex };
+    if (parts[0] === "orbpriv2") {
+      if (parts.length !== 4) return null;
+      const [, ownerPkHex, viewingPublicKeyHex, checksum] = parts;
+      if (!ownerPkHex || !viewingPublicKeyHex || !checksum) return null;
+      if (privacyAddressChecksum(ownerPkHex, viewingPublicKeyHex) !== checksum) return null;
+      return { ownerPkHex, viewingPublicKeyHex };
+    }
+    if (parts[0] === "orbpriv1") {
+      if (parts.length !== 3) return null;
+      const [, ownerPkHex, viewingPublicKeyHex] = parts;
+      if (!ownerPkHex || !viewingPublicKeyHex) return null;
+      return { ownerPkHex, viewingPublicKeyHex };
+    }
+    return null;
   }
   /**
    * Load keys from a cached "mk:0x{masterBytes_hex}" string produced by exportHex().
@@ -1740,7 +1767,7 @@ var PrivacyKeyManager = class {
 
 // src/protocol/keys/spendingKeyDerivation.ts
 var import_hkdf3 = require("@noble/hashes/hkdf.js");
-var import_sha26 = require("@noble/hashes/sha2.js");
+var import_sha27 = require("@noble/hashes/sha2.js");
 var MIN_SIGNATURE_BYTES = 32;
 var MIN_DISTINCT_BYTES = 8;
 function assertUsableSignature(sigBytes) {
@@ -1762,7 +1789,7 @@ async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const info = new TextEncoder().encode(
     `orbinum-sk-${KEY_VERSION}:${chainId}:${canonicalAccountId(address)}`
   );
-  return (0, import_hkdf3.hkdf)(import_sha26.sha256, sigBytes, new Uint8Array(0), info, 32);
+  return (0, import_hkdf3.hkdf)(import_sha27.sha256, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   return deriveSpendingKeyFromMaster(await deriveMasterKeyBytes(signatureHex, chainId, address));
@@ -6303,6 +6330,72 @@ function assembleNoteTransfer(pages) {
   return [...pages].sort((a, b) => a.p - b.p).flatMap((p) => p.notes);
 }
 
+// src/wallet/ops/notes/noteBackup.ts
+var NOTE_BACKUP_VERSION = 1;
+function noteToBackupEntry(note) {
+  return {
+    commitmentHex: note.commitmentHex,
+    encryptedMemo: toHex(Uint8Array.from(note.memo)),
+    ...note.leafIndex !== void 0 ? { leafIndex: note.leafIndex } : {}
+  };
+}
+function encodeNoteBackup(notes, options = {}) {
+  const now = options.now ?? Date.now;
+  return {
+    v: NOTE_BACKUP_VERSION,
+    ts: now(),
+    notes: notes.map(noteToBackupEntry)
+  };
+}
+function decodeNoteBackup(json) {
+  let payload;
+  if (typeof json === "string") {
+    try {
+      payload = JSON.parse(json);
+    } catch {
+      throw new Error("Note backup is not valid JSON.");
+    }
+  } else {
+    payload = json;
+  }
+  const p = payload;
+  if (p.v !== NOTE_BACKUP_VERSION) {
+    throw new Error(`Unsupported note-backup version: ${String(p.v)}.`);
+  }
+  if (!Array.isArray(p.notes) || p.notes.some((n) => !isEntry2(n))) {
+    throw new Error("Note backup is missing required fields.");
+  }
+  return p.notes;
+}
+function importNotesFromBackup(entries, keys) {
+  const out = [];
+  for (const entry of entries) {
+    const commitment = {
+      commitmentHex: entry.commitmentHex,
+      leafIndex: entry.leafIndex ?? -1,
+      encryptedMemo: entry.encryptedMemo
+    };
+    const note = tryDecryptNote(
+      commitment,
+      keys.viewingSecretKey,
+      keys.spendingKey,
+      keys.ownerPk
+    );
+    if (note) out.push(note);
+  }
+  return out;
+}
+function isEntry2(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const e = value;
+  if (typeof e["commitmentHex"] !== "string" || e["commitmentHex"].length === 0) return false;
+  if (typeof e["encryptedMemo"] !== "string" || e["encryptedMemo"].length === 0) return false;
+  if ("leafIndex" in e && e["leafIndex"] !== void 0 && typeof e["leafIndex"] !== "number") {
+    return false;
+  }
+  return true;
+}
+
 // src/wallet/ops/spend/transfer.ts
 var import_proof_generator6 = require("@orbinum/proof-generator");
 
@@ -7391,6 +7484,7 @@ var OrbinumWallet = class {
   MIN_SIGNATURE_BYTES,
   MemoryVaultStorage,
   NATIVE_ASSET_ID,
+  NOTE_BACKUP_VERSION,
   NOTE_BIGINT_FIELDS,
   NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder,
@@ -7466,6 +7560,7 @@ var OrbinumWallet = class {
   createNotesCache,
   createWalletSession,
   createWorkerPool,
+  decodeNoteBackup,
   decodeNoteDisclosureKey,
   decodeNoteTransferPage,
   decodePrecompileCalldata,
@@ -7489,6 +7584,7 @@ var OrbinumWallet = class {
   deriveViewingPublicKey,
   deriveViewingSecretKey,
   detectCommitmentMismatch,
+  encodeNoteBackup,
   encodeNoteTransferPages,
   encryptJson,
   encryptNote,
@@ -7525,6 +7621,7 @@ var OrbinumWallet = class {
   hexToNumber,
   implicitSubstrateToEvm,
   importDeviceKey,
+  importNotesFromBackup,
   isAbortError,
   isAlreadySpentError,
   isConnectionLossError,

package/dist/index.mjs

@@ -463,6 +463,12 @@ ${canonicalAccountId(address)}`;
 }
 
 // src/protocol/keys/PrivacyKeyManager.ts
+import { sha256 } from "@noble/hashes/sha2.js";
+function privacyAddressChecksum(ownerPkHex, ivkHex) {
+  const body = `orbpriv2:${ownerPkHex}:${ivkHex}`;
+  const digest = sha256(new TextEncoder().encode(body));
+  return toHex(digest.slice(0, 4)).slice(2);
+}
 var PrivacyKeyManager = class {
   _state = {
     spendingKey: null,
@@ -572,12 +578,15 @@ var PrivacyKeyManager = class {
    * Exports a shareable privacy address encoding the owner public key and
    * viewing PUBLIC key of the currently loaded identity.
    *
-   * Format: `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`
+   * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
    *
    * The recipient uses this address so the sender can:
    *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
    *  2. Encrypt the memo via ECDH with the recipient's `viewingPublicKey`.
    *
+   * The trailing checksum (see `privacyAddressChecksum`) makes a corrupted
+   * paste fail to decode rather than pay into an unspendable note.
+   *
    * SECURITY: Only the viewing PUBLIC key is embedded — the viewing secret key
    * (used for decryption) is never exported. Holders of this address cannot
    * decrypt the recipient's notes.
@@ -589,21 +598,35 @@ var PrivacyKeyManager = class {
     const ivkPacked = this.getViewingPublicKeyPacked();
     const ownerPkHex = scalarToHex(ownerPk);
     const ivkHex = toHex(ivkPacked);
-    return `orbpriv1:${ownerPkHex}:${ivkHex}`;
+    const checksum = privacyAddressChecksum(ownerPkHex, ivkHex);
+    return `orbpriv2:${ownerPkHex}:${ivkHex}:${checksum}`;
   }
   /**
-   * Decode a privacy address of the form `orbpriv1:{ownerPk_hex}:{viewingPublicKey_hex}`.
-   * Returns `{ ownerPkHex, viewingPublicKeyHex }` on success, or `null` if the input
-   * does not match the expected format.
+   * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
+   * `null` if it does not parse.
+   *
+   * Accepts both:
+   *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
+   *    (corrupted paste) returns null.
+   *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
+   *    shared before v2 keep resolving; only v2 is emitted.
    */
   static decodePrivacyAddress(address) {
-    if (!address.startsWith("orbpriv1:")) return null;
     const parts = address.split(":");
-    if (parts.length !== 3) return null;
-    const ownerPkHex = parts[1];
-    const viewingPublicKeyHex = parts[2];
-    if (!ownerPkHex || !viewingPublicKeyHex) return null;
-    return { ownerPkHex, viewingPublicKeyHex };
+    if (parts[0] === "orbpriv2") {
+      if (parts.length !== 4) return null;
+      const [, ownerPkHex, viewingPublicKeyHex, checksum] = parts;
+      if (!ownerPkHex || !viewingPublicKeyHex || !checksum) return null;
+      if (privacyAddressChecksum(ownerPkHex, viewingPublicKeyHex) !== checksum) return null;
+      return { ownerPkHex, viewingPublicKeyHex };
+    }
+    if (parts[0] === "orbpriv1") {
+      if (parts.length !== 3) return null;
+      const [, ownerPkHex, viewingPublicKeyHex] = parts;
+      if (!ownerPkHex || !viewingPublicKeyHex) return null;
+      return { ownerPkHex, viewingPublicKeyHex };
+    }
+    return null;
   }
   /**
    * Load keys from a cached "mk:0x{masterBytes_hex}" string produced by exportHex().
@@ -629,7 +652,7 @@ var PrivacyKeyManager = class {
 
 // src/protocol/keys/spendingKeyDerivation.ts
 import { hkdf } from "@noble/hashes/hkdf.js";
-import { sha256 } from "@noble/hashes/sha2.js";
+import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
 var MIN_SIGNATURE_BYTES = 32;
 var MIN_DISTINCT_BYTES = 8;
 function assertUsableSignature(sigBytes) {
@@ -651,7 +674,7 @@ async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const info = new TextEncoder().encode(
     `orbinum-sk-${KEY_VERSION}:${chainId}:${canonicalAccountId(address)}`
   );
-  return hkdf(sha256, sigBytes, new Uint8Array(0), info, 32);
+  return hkdf(sha2562, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   return deriveSpendingKeyFromMaster(await deriveMasterKeyBytes(signatureHex, chainId, address));
@@ -5203,6 +5226,72 @@ function assembleNoteTransfer(pages) {
   return [...pages].sort((a, b) => a.p - b.p).flatMap((p) => p.notes);
 }
 
+// src/wallet/ops/notes/noteBackup.ts
+var NOTE_BACKUP_VERSION = 1;
+function noteToBackupEntry(note) {
+  return {
+    commitmentHex: note.commitmentHex,
+    encryptedMemo: toHex(Uint8Array.from(note.memo)),
+    ...note.leafIndex !== void 0 ? { leafIndex: note.leafIndex } : {}
+  };
+}
+function encodeNoteBackup(notes, options = {}) {
+  const now = options.now ?? Date.now;
+  return {
+    v: NOTE_BACKUP_VERSION,
+    ts: now(),
+    notes: notes.map(noteToBackupEntry)
+  };
+}
+function decodeNoteBackup(json) {
+  let payload;
+  if (typeof json === "string") {
+    try {
+      payload = JSON.parse(json);
+    } catch {
+      throw new Error("Note backup is not valid JSON.");
+    }
+  } else {
+    payload = json;
+  }
+  const p = payload;
+  if (p.v !== NOTE_BACKUP_VERSION) {
+    throw new Error(`Unsupported note-backup version: ${String(p.v)}.`);
+  }
+  if (!Array.isArray(p.notes) || p.notes.some((n) => !isEntry2(n))) {
+    throw new Error("Note backup is missing required fields.");
+  }
+  return p.notes;
+}
+function importNotesFromBackup(entries, keys) {
+  const out = [];
+  for (const entry of entries) {
+    const commitment = {
+      commitmentHex: entry.commitmentHex,
+      leafIndex: entry.leafIndex ?? -1,
+      encryptedMemo: entry.encryptedMemo
+    };
+    const note = tryDecryptNote(
+      commitment,
+      keys.viewingSecretKey,
+      keys.spendingKey,
+      keys.ownerPk
+    );
+    if (note) out.push(note);
+  }
+  return out;
+}
+function isEntry2(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const e = value;
+  if (typeof e["commitmentHex"] !== "string" || e["commitmentHex"].length === 0) return false;
+  if (typeof e["encryptedMemo"] !== "string" || e["encryptedMemo"].length === 0) return false;
+  if ("leafIndex" in e && e["leafIndex"] !== void 0 && typeof e["leafIndex"] !== "number") {
+    return false;
+  }
+  return true;
+}
+
 // src/wallet/ops/spend/transfer.ts
 import { CircuitType as CircuitType5 } from "@orbinum/proof-generator";
 
@@ -6013,6 +6102,7 @@ export {
   MIN_SIGNATURE_BYTES,
   MemoryVaultStorage,
   NATIVE_ASSET_ID,
+  NOTE_BACKUP_VERSION,
   NOTE_BIGINT_FIELDS,
   NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder,
@@ -6088,6 +6178,7 @@ export {
   createNotesCache,
   createWalletSession,
   createWorkerPool,
+  decodeNoteBackup,
   decodeNoteDisclosureKey,
   decodeNoteTransferPage,
   decodePrecompileCalldata,
@@ -6111,6 +6202,7 @@ export {
   deriveViewingPublicKey,
   deriveViewingSecretKey,
   detectCommitmentMismatch,
+  encodeNoteBackup,
   encodeNoteTransferPages,
   encryptJson,
   encryptNote,
@@ -6147,6 +6239,7 @@ export {
   hexToNumber,
   implicitSubstrateToEvm,
   importDeviceKey,
+  importNotesFromBackup,
   isAbortError,
   isAlreadySpentError,
   isConnectionLossError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orbinum/sdk",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Official TypeScript SDK for Orbinum.",
   "author": "Orbinum",
   "license": "MIT",