@orbinum/sdk 1.1.0 → 1.2.0

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, a as DecryptPool, b as ScanKeys } from './index-JYVjYJtf.mjs';
-export { C as CURRENT_CIRCUIT_VERSION, c as DECRYPT_YIELD_EVERY, d as DecryptBatchResult, e as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, f as KnownEphWindow, M as MAX_WORKERS, g as MatchSource, h as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, i as SELF_EPH_WINDOW, W as WORKER_CRASHED, j as WorkerFactory, k as WorkerLike, l as WorkerMessage, m as clearKnownEphWindow, n as createDecryptPool, o as createMainThreadPool, p as createWorkerPool, q as decryptHintBatch, r as getKnownEphWindow } from './index-JYVjYJtf.mjs';
+import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, O as OutgoingNoteRecord, a as DecryptPool, b as ScanKeys } from './index-V5Z9igEN.mjs';
+export { C as CURRENT_CIRCUIT_VERSION, c as DECRYPT_YIELD_EVERY, d as DecryptBatchResult, e as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, f as KnownEphWindow, M as MAX_WORKERS, g as MatchSource, h as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, i as SELF_EPH_WINDOW, W as WORKER_CRASHED, j as WorkerFactory, k as WorkerLike, l as WorkerMessage, m as clearKnownEphWindow, n as createDecryptPool, o as createMainThreadPool, p as createWorkerPool, q as decryptHintBatch, r as getKnownEphWindow } from './index-V5Z9igEN.mjs';
 import { ArtifactProvider, ProofResult, CircuitType } from '@orbinum/proof-generator';
 export { ArtifactProvider, CircuitType, ProofResult, WebArtifactProvider, shouldProveSingleThreaded } from '@orbinum/proof-generator';
 import * as polkadot_api from 'polkadot-api';
@@ -1107,6 +1107,115 @@ declare function serializeMemo(value: bigint, ownerPk: Uint8Array, blinding: Uin
  */
 declare function deriveViewTag(sharedSecret: Uint8Array): number;
 
+/**
+ * OutgoingBlob — the OVK "wrap-the-key" primitive.
+ *
+ * When a wallet sends a private_transfer, the recipient's memo is encrypted ECDH
+ * toward the RECIPIENT's ivk; the sender cannot reopen it, so a cold restore
+ * loses the outgoing history (who/how much). This blob fixes that: it wraps the
+ * memo's 32-byte `sharedSecret` under a key derived from the SENDER's ovk. On
+ * restore the sender unwraps the sharedSecret and feeds it to the SAME memo
+ * decryption path the recipient uses — one decryption routine in the whole
+ * system (OVK plan requirement #7).
+ *
+ * This is Zcash Sapling's `outCiphertext` / Penumbra's `OvkWrappedKey`, adapted
+ * to a shared secret that is a field element (32 bytes), not a group point — so
+ * the blob contains no group element to decode, sidestepping Zcash's canonical-
+ * encoding class of bugs.
+ *
+ * Layout (56 bytes): nonce_suffix(8) || ciphertext(32) || MAC(16).
+ * Cipher: ChaCha20-Poly1305 (IETF), same primitive as EncryptedMemo.
+ *
+ * The outgoing cipher key binds every unique-per-output public value:
+ *   ock = HKDF(ikm=ovk, salt=commitment_bytes||ephPk_bytes, info=OCK_DOMAIN)
+ * so each ock encrypts exactly one message. Uniqueness comes from the COMMITMENT
+ * (Poseidon4 with random blinding, consensus rejects duplicates); the ephPk adds
+ * the on-chain binding, not the uniqueness — two self-notes can share an ephPk
+ * but never a commitment, so their ock still differs.
+ *
+ * SALT IS RAW ON-CHAIN BYTES. `commitment_bytes` and `ephPk_bytes` must be the
+ * exact bytes that are/go on chain, never a re-serialization of a decoded point:
+ * two encodings of "the same point" produce different ock and the AEAD fails —
+ * no ambiguity to exploit.
+ */
+/** Total on-chain blob size: nonce_suffix(8) || ciphertext(32) || MAC(16). */
+declare const OVK_BLOB_SIZE: number;
+/**
+ * Derive the 32-byte outgoing cipher key.
+ *   ock = HKDF-SHA256(ikm=ovk, salt=commitmentBytes||ephPkBytes, info=OCK_DOMAIN)
+ *
+ * Both salt parts must be the raw 32-byte on-chain values (see file header).
+ * Throws if either is not exactly 32 bytes — a wrong length here would silently
+ * change the key and make recovery fail far from the cause.
+ */
+declare function deriveOutgoingCipherKey(ovk: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array;
+/**
+ * Seal a sharedSecret into a 56-byte outgoing blob under the sender's ovk.
+ *
+ * @param ovk             sender's 32-byte outgoing viewing key
+ * @param sharedSecret    the memo's 32-byte ECDH shared secret (what we wrap)
+ * @param commitmentBytes raw 32-byte on-chain commitment of the recipient output
+ * @param ephPkBytes      raw 32-byte ephemeral public key (from the memo, not recomputed)
+ * @returns 56 bytes: nonce_suffix(8) || ciphertext(32) || MAC(16)
+ */
+declare function sealOutgoingBlob(ovk: Uint8Array, sharedSecret: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array;
+/**
+ * Open an outgoing blob, returning the wrapped sharedSecret or null.
+ *
+ * Never throws — this runs in recovery loops over hints that may be foreign,
+ * pre-OVK, or ovk=⊥ random. A wrong ovk, wrong commitment, wrong ephPk, or any
+ * corrupted byte fails the MAC and returns null.
+ */
+declare function openOutgoingBlob(ovk: Uint8Array, blob: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array | null;
+/**
+ * A 56-byte random blob for the ovk=⊥ case (sender opts out of recoverability).
+ *
+ * Indistinguishable on-chain from a real blob: a real one is a random 8-byte
+ * suffix plus ChaCha20/Poly1305 output, both uniform without the key. This is
+ * the ONLY path for ⊥ — never zeros (distinguishable), never omission (a length
+ * or SCALE-tag difference is a permanent, retroactive privacy label).
+ */
+declare function randomOutgoingBlob(): Uint8Array;
+
+/** The fields a payment slip carries — all public on-chain. */
+interface PaymentSlipFields {
+    /** 0x-prefixed 32-byte LE commitment hex of the recipient output. */
+    commitmentHex: string;
+    /** 0x-prefixed encrypted memo hex (180 bytes) of the recipient output. */
+    encryptedMemo: string;
+    /** Merkle leaf index, when known. Informational — spends re-fetch the proof. */
+    leafIndex?: number;
+    /** Transaction hash of the transfer, when known. Informational — a reference
+     *  the recipient can show as proof of the payment; not needed to reconstruct. */
+    txHash?: string;
+}
+/**
+ * Seal slip fields toward a recipient.
+ *
+ * A fresh ephemeral keypair is generated; `sharedSecret = [ephSk]·recipientIvk`
+ * is the ECDH secret only the recipient can reproduce (with their `ivsk`). The
+ * ephemeral public key travels in the clear so the recipient can run ECDH.
+ *
+ * @param recipientIvkPacked  32-byte LE packed BJJ viewing public key of the recipient
+ * @param fields              the slip fields to seal
+ * @returns envelope: ephPk(32) || nonce_suffix(8) || ciphertext || MAC(16)
+ */
+declare function sealPaymentSlip(recipientIvkPacked: Uint8Array, fields: PaymentSlipFields): Uint8Array;
+/**
+ * Open a payment slip with the recipient's viewing secret key. Returns the fields
+ * or null (not ours / corrupt). Never throws — safe in import loops.
+ */
+declare function openPaymentSlip(recipientIvsk: Uint8Array, envelope: Uint8Array): PaymentSlipFields | null;
+/** URI scheme prefix. The version is in the name, so a v2 reader can refuse a v1. */
+declare const PAYMENT_SLIP_SCHEME = "orbslip1:";
+/** Encode a sealed slip envelope into a shareable `orbslip1:` string. */
+declare function encodePaymentSlip(envelope: Uint8Array): string;
+/**
+ * Decode an `orbslip1:` string back into the sealed envelope, or null. A wrong
+ * scheme, a bad checksum (mistyped/truncated), or malformed payload returns null.
+ */
+declare function decodePaymentSlip(text: string): Uint8Array | null;
+
 /**
  * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
  * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
@@ -1308,6 +1417,41 @@ declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecret
     note: ZkNote | null;
     reason?: string;
 };
+/** A scan hint plus the per-transaction OVK blob the indexer serves alongside it. */
+type OutgoingHint = ScanCommitment & {
+    ovkBlob?: string | null;
+};
+/**
+ * Recover a note the caller SENT, using their outgoing viewing key (ovk).
+ *
+ * The sender's memo was encrypted toward the RECIPIENT, so they cannot reopen it
+ * directly. Instead the ovk blob wraps the memo's shared secret; unwrapping it
+ * gives the same secret the recipient gets via ECDH, and feeding it to the shared
+ * decrypt-and-verify step rebuilds the sent note's public facts.
+ *
+ * Returns an OutgoingNoteRecord (value, recipient stealth pk, counterparty,
+ * circuit version) — NEVER a spendable note: no spendingKey, no nullifier. The
+ * sender does not own this note. Never throws (runs in recovery loops).
+ *
+ * Security (OVK plan §3.4), in three non-algebraic but sound layers:
+ *  1. The blob MAC (openOutgoingBlob) proves whoever wrote it knew the ovk, and
+ *     the ock binds it to THIS (commitment, ephPk) — blobs are not transplantable.
+ *  2. The memo MAC (inside decryptAndVerifyPlaintext) proves this shared secret
+ *     is the one that encrypted this memo — the same secret the recipient derives.
+ *  3. The commitment check ties the recovered fields to the note in the tree.
+ * Not verifiable by the sender: that `sharedSecret` corresponds to `ephPk` — that
+ * needs the recipient's ivsk. Residual: a leaked ovk lets an attacker fabricate a
+ * self-consistent (commitment, memo, blob) and plant false outgoing history. It
+ * moves no funds; Zcash accepts the same residual. Mitigated in the app by only
+ * running this over commitments from extrinsics that spent our own nullifiers.
+ *
+ * @param hint  scan hint with commitmentHex, encryptedMemo, and ovkBlob.
+ * @param ovk   the sender's 32-byte outgoing viewing key.
+ * @param opts  viewTagActivationLeaf gates the view-tag check for legacy memos.
+ */
+declare function tryRecoverOutgoing(hint: OutgoingHint, ovk: Uint8Array, opts?: {
+    viewTagActivationLeaf?: number;
+}): OutgoingNoteRecord | null;
 
 /**
  * Proving what ONE note holds, without granting any power to spend it.
@@ -1732,6 +1876,20 @@ declare function deriveViewingPublicKey(ivsk: Uint8Array): Uint8Array;
  * Returns 0n if BabyJubJub computation fails (e.g. invalid scalar).
  */
 declare function deriveOwnerPk(spendingKey: bigint): bigint;
+/**
+ * Derive the 32-byte outgoing viewing key (ovk) from master bytes.
+ *   ovk = HKDF-SHA256(ikm=masterBytes, info="orbinum-ovk-v1")
+ *
+ * Mirror of the vault-key derivation: rooted at masterBytes, not the spendingKey
+ * scalar (see the derivation chain above for why). The ovk lets the SENDER of a
+ * private transfer recover what they sent — it wraps the memo's shared secret so
+ * a cold restore rebuilds the outgoing history. Sibling of the ivsk, delegable
+ * independently.
+ *
+ * SECRET. Never embed it in a shareable address — it stays out of
+ * encodePrivacyAddress by construction (there is no public component to derive).
+ */
+declare function deriveOutgoingViewingKey(masterBytes: Uint8Array): Uint8Array;
 
 /**
  * PrivacyKeyManager
@@ -1791,6 +1949,11 @@ declare class PrivacyKeyManager {
     getViewingPublicKeyPacked(): Uint8Array;
     /** Returns the BabyJubJub owner public key (x-coordinate). Throws if not loaded. */
     getOwnerPk(): bigint;
+    /**
+     * Returns the 32-byte outgoing viewing key (ovk). Throws if not loaded.
+     * Used to seal/open the outgoing blob that lets the sender recover a transfer.
+     */
+    getOutgoingViewingKey(): Uint8Array;
     /** Returns the spending key as a 32-byte little-endian Uint8Array. Throws if not loaded. */
     getSpendingKeyBytes(): Uint8Array;
     /**
@@ -4819,6 +4982,15 @@ interface NoteBackupEntry {
     encryptedMemo: string;
     /** Merkle leaf index, when known. Informational — spends re-fetch the proof. */
     leafIndex?: number;
+    /**
+     * Whether the note was already spent when exported. A local status flag (not
+     * a key or secret), carried so a restored vault separates available from spent
+     * without a chain round-trip. A host may still reconcile against the chain
+     * afterward — this is a fast, possibly-stale hint, not the source of truth.
+     */
+    spent?: boolean;
+    /** Local timestamp the note was marked spent, when known. */
+    spentAt?: number | null;
 }
 interface NoteBackup {
     v: typeof NOTE_BACKUP_VERSION;
@@ -4854,9 +5026,45 @@ declare function decodeNoteBackup(json: string | object): NoteBackupEntry[];
  * Ownership is proven by decryption — an entry whose memo does not open under
  * these keys is silently skipped (it is not this user's note). No chain access:
  * only the backup's own memos are tried.
+ *
+ * The decrypted note is reconstructed as unspent; the entry's `spent`/`spentAt`
+ * flags are then applied so a restored vault separates available from spent. A
+ * host may reconcile against the chain afterward if the backup could be stale.
  */
 declare function importNotesFromBackup(entries: NoteBackupEntry[], keys: BackupImportKeys): ZkNote[];
 
+/**
+ * Reconstruct a note from a payment slip.
+ *
+ * The recipient of a private transfer receives an `orbslip1:` string (or the raw
+ * envelope) that the sender produced. Opening it yields the note's public
+ * locators — commitment, encrypted memo, leaf index — which are fed to the SAME
+ * decryption path a scan uses (`tryDecryptNote`): it decrypts the memo with the
+ * recipient's viewing key, derives the stealth spending key, and verifies the
+ * commitment. The result is a fully spendable `ZkNote`, obtained without scanning
+ * the pool.
+ */
+
+/** Keys the recipient needs to open a slip and reconstruct the note. */
+interface SlipImportKeys {
+    /** 32-byte viewing secret key (ivsk) — opens the slip envelope AND the memo. */
+    viewingSecretKey: Uint8Array;
+    /** Spending key scalar — derives the note's nullifier / stealth key. */
+    spendingKey: bigint;
+    /** The recipient's global owner pk (Ax), for stealth detection. */
+    ownerPk: bigint;
+}
+/**
+ * Open a slip and reconstruct its note, or null.
+ *
+ * Accepts an `orbslip1:` string or a raw envelope. Returns null when the slip is
+ * not this recipient's (envelope does not decrypt), or when the memo does not
+ * belong to them, or when the recomputed commitment does not match — the last
+ * check (inside `tryDecryptNote`) is what stops a forged slip from planting a
+ * phantom note. Never throws.
+ */
+declare function importPaymentSlip(slip: string | Uint8Array, keys: SlipImportKeys): ZkNote | null;
+
 /**
  * The steps every spend shares, in the order a spend performs them.
  *
@@ -4976,7 +5184,15 @@ interface TransferParams {
     senderPk?: bigint | undefined;
     fee?: bigint | undefined;
 }
-declare function transferNotes(deps: TransferDeps, params: TransferParams, onProgress?: (step: TransferStep) => void): Promise<TxResult>;
+/**
+ * A transfer result, plus — for a transfer to another user — a `paymentSlip`:
+ * the `orbslip1:` string the sender can hand the recipient so they rebuild their
+ * note without scanning. Absent for self-transfers and change-only transfers.
+ */
+type TransferResult = TxResult & {
+    paymentSlip?: string;
+};
+declare function transferNotes(deps: TransferDeps, params: TransferParams, onProgress?: (step: TransferStep) => void): Promise<TransferResult>;
 
 type UnshieldStep = 'fetching-proof' | 'checking-nullifier' | 'generating-zk' | 'submitting';
 /** The extrinsic arguments, marshalled and ready for whatever transport submits them. */
@@ -5464,4 +5680,4 @@ declare class OrbinumWallet {
     private requireKey;
 }
 
-export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, PAGE_SIZE, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };
+export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, OVK_BLOB_SIZE, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, type OutgoingHint, OutgoingNoteRecord, PAGE_SIZE, PAYMENT_SLIP_SCHEME, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PaymentSlipFields, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, type SlipImportKeys, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferResult, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePaymentSlip, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOutgoingCipherKey, deriveOutgoingViewingKey, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encodePaymentSlip, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, importPaymentSlip, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, openOutgoingBlob, openPaymentSlip, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, randomOutgoingBlob, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, sealOutgoingBlob, sealPaymentSlip, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, tryRecoverOutgoing, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, a as DecryptPool, b as ScanKeys } from './index-JYVjYJtf.js';
-export { C as CURRENT_CIRCUIT_VERSION, c as DECRYPT_YIELD_EVERY, d as DecryptBatchResult, e as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, f as KnownEphWindow, M as MAX_WORKERS, g as MatchSource, h as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, i as SELF_EPH_WINDOW, W as WORKER_CRASHED, j as WorkerFactory, k as WorkerLike, l as WorkerMessage, m as clearKnownEphWindow, n as createDecryptPool, o as createMainThreadPool, p as createWorkerPool, q as decryptHintBatch, r as getKnownEphWindow } from './index-JYVjYJtf.js';
+import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, O as OutgoingNoteRecord, a as DecryptPool, b as ScanKeys } from './index-V5Z9igEN.js';
+export { C as CURRENT_CIRCUIT_VERSION, c as DECRYPT_YIELD_EVERY, d as DecryptBatchResult, e as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, f as KnownEphWindow, M as MAX_WORKERS, g as MatchSource, h as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, i as SELF_EPH_WINDOW, W as WORKER_CRASHED, j as WorkerFactory, k as WorkerLike, l as WorkerMessage, m as clearKnownEphWindow, n as createDecryptPool, o as createMainThreadPool, p as createWorkerPool, q as decryptHintBatch, r as getKnownEphWindow } from './index-V5Z9igEN.js';
 import { ArtifactProvider, ProofResult, CircuitType } from '@orbinum/proof-generator';
 export { ArtifactProvider, CircuitType, ProofResult, WebArtifactProvider, shouldProveSingleThreaded } from '@orbinum/proof-generator';
 import * as polkadot_api from 'polkadot-api';
@@ -1107,6 +1107,115 @@ declare function serializeMemo(value: bigint, ownerPk: Uint8Array, blinding: Uin
  */
 declare function deriveViewTag(sharedSecret: Uint8Array): number;
 
+/**
+ * OutgoingBlob — the OVK "wrap-the-key" primitive.
+ *
+ * When a wallet sends a private_transfer, the recipient's memo is encrypted ECDH
+ * toward the RECIPIENT's ivk; the sender cannot reopen it, so a cold restore
+ * loses the outgoing history (who/how much). This blob fixes that: it wraps the
+ * memo's 32-byte `sharedSecret` under a key derived from the SENDER's ovk. On
+ * restore the sender unwraps the sharedSecret and feeds it to the SAME memo
+ * decryption path the recipient uses — one decryption routine in the whole
+ * system (OVK plan requirement #7).
+ *
+ * This is Zcash Sapling's `outCiphertext` / Penumbra's `OvkWrappedKey`, adapted
+ * to a shared secret that is a field element (32 bytes), not a group point — so
+ * the blob contains no group element to decode, sidestepping Zcash's canonical-
+ * encoding class of bugs.
+ *
+ * Layout (56 bytes): nonce_suffix(8) || ciphertext(32) || MAC(16).
+ * Cipher: ChaCha20-Poly1305 (IETF), same primitive as EncryptedMemo.
+ *
+ * The outgoing cipher key binds every unique-per-output public value:
+ *   ock = HKDF(ikm=ovk, salt=commitment_bytes||ephPk_bytes, info=OCK_DOMAIN)
+ * so each ock encrypts exactly one message. Uniqueness comes from the COMMITMENT
+ * (Poseidon4 with random blinding, consensus rejects duplicates); the ephPk adds
+ * the on-chain binding, not the uniqueness — two self-notes can share an ephPk
+ * but never a commitment, so their ock still differs.
+ *
+ * SALT IS RAW ON-CHAIN BYTES. `commitment_bytes` and `ephPk_bytes` must be the
+ * exact bytes that are/go on chain, never a re-serialization of a decoded point:
+ * two encodings of "the same point" produce different ock and the AEAD fails —
+ * no ambiguity to exploit.
+ */
+/** Total on-chain blob size: nonce_suffix(8) || ciphertext(32) || MAC(16). */
+declare const OVK_BLOB_SIZE: number;
+/**
+ * Derive the 32-byte outgoing cipher key.
+ *   ock = HKDF-SHA256(ikm=ovk, salt=commitmentBytes||ephPkBytes, info=OCK_DOMAIN)
+ *
+ * Both salt parts must be the raw 32-byte on-chain values (see file header).
+ * Throws if either is not exactly 32 bytes — a wrong length here would silently
+ * change the key and make recovery fail far from the cause.
+ */
+declare function deriveOutgoingCipherKey(ovk: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array;
+/**
+ * Seal a sharedSecret into a 56-byte outgoing blob under the sender's ovk.
+ *
+ * @param ovk             sender's 32-byte outgoing viewing key
+ * @param sharedSecret    the memo's 32-byte ECDH shared secret (what we wrap)
+ * @param commitmentBytes raw 32-byte on-chain commitment of the recipient output
+ * @param ephPkBytes      raw 32-byte ephemeral public key (from the memo, not recomputed)
+ * @returns 56 bytes: nonce_suffix(8) || ciphertext(32) || MAC(16)
+ */
+declare function sealOutgoingBlob(ovk: Uint8Array, sharedSecret: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array;
+/**
+ * Open an outgoing blob, returning the wrapped sharedSecret or null.
+ *
+ * Never throws — this runs in recovery loops over hints that may be foreign,
+ * pre-OVK, or ovk=⊥ random. A wrong ovk, wrong commitment, wrong ephPk, or any
+ * corrupted byte fails the MAC and returns null.
+ */
+declare function openOutgoingBlob(ovk: Uint8Array, blob: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array | null;
+/**
+ * A 56-byte random blob for the ovk=⊥ case (sender opts out of recoverability).
+ *
+ * Indistinguishable on-chain from a real blob: a real one is a random 8-byte
+ * suffix plus ChaCha20/Poly1305 output, both uniform without the key. This is
+ * the ONLY path for ⊥ — never zeros (distinguishable), never omission (a length
+ * or SCALE-tag difference is a permanent, retroactive privacy label).
+ */
+declare function randomOutgoingBlob(): Uint8Array;
+
+/** The fields a payment slip carries — all public on-chain. */
+interface PaymentSlipFields {
+    /** 0x-prefixed 32-byte LE commitment hex of the recipient output. */
+    commitmentHex: string;
+    /** 0x-prefixed encrypted memo hex (180 bytes) of the recipient output. */
+    encryptedMemo: string;
+    /** Merkle leaf index, when known. Informational — spends re-fetch the proof. */
+    leafIndex?: number;
+    /** Transaction hash of the transfer, when known. Informational — a reference
+     *  the recipient can show as proof of the payment; not needed to reconstruct. */
+    txHash?: string;
+}
+/**
+ * Seal slip fields toward a recipient.
+ *
+ * A fresh ephemeral keypair is generated; `sharedSecret = [ephSk]·recipientIvk`
+ * is the ECDH secret only the recipient can reproduce (with their `ivsk`). The
+ * ephemeral public key travels in the clear so the recipient can run ECDH.
+ *
+ * @param recipientIvkPacked  32-byte LE packed BJJ viewing public key of the recipient
+ * @param fields              the slip fields to seal
+ * @returns envelope: ephPk(32) || nonce_suffix(8) || ciphertext || MAC(16)
+ */
+declare function sealPaymentSlip(recipientIvkPacked: Uint8Array, fields: PaymentSlipFields): Uint8Array;
+/**
+ * Open a payment slip with the recipient's viewing secret key. Returns the fields
+ * or null (not ours / corrupt). Never throws — safe in import loops.
+ */
+declare function openPaymentSlip(recipientIvsk: Uint8Array, envelope: Uint8Array): PaymentSlipFields | null;
+/** URI scheme prefix. The version is in the name, so a v2 reader can refuse a v1. */
+declare const PAYMENT_SLIP_SCHEME = "orbslip1:";
+/** Encode a sealed slip envelope into a shareable `orbslip1:` string. */
+declare function encodePaymentSlip(envelope: Uint8Array): string;
+/**
+ * Decode an `orbslip1:` string back into the sealed envelope, or null. A wrong
+ * scheme, a bad checksum (mistyped/truncated), or malformed payload returns null.
+ */
+declare function decodePaymentSlip(text: string): Uint8Array | null;
+
 /**
  * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
  * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
@@ -1308,6 +1417,41 @@ declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecret
     note: ZkNote | null;
     reason?: string;
 };
+/** A scan hint plus the per-transaction OVK blob the indexer serves alongside it. */
+type OutgoingHint = ScanCommitment & {
+    ovkBlob?: string | null;
+};
+/**
+ * Recover a note the caller SENT, using their outgoing viewing key (ovk).
+ *
+ * The sender's memo was encrypted toward the RECIPIENT, so they cannot reopen it
+ * directly. Instead the ovk blob wraps the memo's shared secret; unwrapping it
+ * gives the same secret the recipient gets via ECDH, and feeding it to the shared
+ * decrypt-and-verify step rebuilds the sent note's public facts.
+ *
+ * Returns an OutgoingNoteRecord (value, recipient stealth pk, counterparty,
+ * circuit version) — NEVER a spendable note: no spendingKey, no nullifier. The
+ * sender does not own this note. Never throws (runs in recovery loops).
+ *
+ * Security (OVK plan §3.4), in three non-algebraic but sound layers:
+ *  1. The blob MAC (openOutgoingBlob) proves whoever wrote it knew the ovk, and
+ *     the ock binds it to THIS (commitment, ephPk) — blobs are not transplantable.
+ *  2. The memo MAC (inside decryptAndVerifyPlaintext) proves this shared secret
+ *     is the one that encrypted this memo — the same secret the recipient derives.
+ *  3. The commitment check ties the recovered fields to the note in the tree.
+ * Not verifiable by the sender: that `sharedSecret` corresponds to `ephPk` — that
+ * needs the recipient's ivsk. Residual: a leaked ovk lets an attacker fabricate a
+ * self-consistent (commitment, memo, blob) and plant false outgoing history. It
+ * moves no funds; Zcash accepts the same residual. Mitigated in the app by only
+ * running this over commitments from extrinsics that spent our own nullifiers.
+ *
+ * @param hint  scan hint with commitmentHex, encryptedMemo, and ovkBlob.
+ * @param ovk   the sender's 32-byte outgoing viewing key.
+ * @param opts  viewTagActivationLeaf gates the view-tag check for legacy memos.
+ */
+declare function tryRecoverOutgoing(hint: OutgoingHint, ovk: Uint8Array, opts?: {
+    viewTagActivationLeaf?: number;
+}): OutgoingNoteRecord | null;
 
 /**
  * Proving what ONE note holds, without granting any power to spend it.
@@ -1732,6 +1876,20 @@ declare function deriveViewingPublicKey(ivsk: Uint8Array): Uint8Array;
  * Returns 0n if BabyJubJub computation fails (e.g. invalid scalar).
  */
 declare function deriveOwnerPk(spendingKey: bigint): bigint;
+/**
+ * Derive the 32-byte outgoing viewing key (ovk) from master bytes.
+ *   ovk = HKDF-SHA256(ikm=masterBytes, info="orbinum-ovk-v1")
+ *
+ * Mirror of the vault-key derivation: rooted at masterBytes, not the spendingKey
+ * scalar (see the derivation chain above for why). The ovk lets the SENDER of a
+ * private transfer recover what they sent — it wraps the memo's shared secret so
+ * a cold restore rebuilds the outgoing history. Sibling of the ivsk, delegable
+ * independently.
+ *
+ * SECRET. Never embed it in a shareable address — it stays out of
+ * encodePrivacyAddress by construction (there is no public component to derive).
+ */
+declare function deriveOutgoingViewingKey(masterBytes: Uint8Array): Uint8Array;
 
 /**
  * PrivacyKeyManager
@@ -1791,6 +1949,11 @@ declare class PrivacyKeyManager {
     getViewingPublicKeyPacked(): Uint8Array;
     /** Returns the BabyJubJub owner public key (x-coordinate). Throws if not loaded. */
     getOwnerPk(): bigint;
+    /**
+     * Returns the 32-byte outgoing viewing key (ovk). Throws if not loaded.
+     * Used to seal/open the outgoing blob that lets the sender recover a transfer.
+     */
+    getOutgoingViewingKey(): Uint8Array;
     /** Returns the spending key as a 32-byte little-endian Uint8Array. Throws if not loaded. */
     getSpendingKeyBytes(): Uint8Array;
     /**
@@ -4819,6 +4982,15 @@ interface NoteBackupEntry {
     encryptedMemo: string;
     /** Merkle leaf index, when known. Informational — spends re-fetch the proof. */
     leafIndex?: number;
+    /**
+     * Whether the note was already spent when exported. A local status flag (not
+     * a key or secret), carried so a restored vault separates available from spent
+     * without a chain round-trip. A host may still reconcile against the chain
+     * afterward — this is a fast, possibly-stale hint, not the source of truth.
+     */
+    spent?: boolean;
+    /** Local timestamp the note was marked spent, when known. */
+    spentAt?: number | null;
 }
 interface NoteBackup {
     v: typeof NOTE_BACKUP_VERSION;
@@ -4854,9 +5026,45 @@ declare function decodeNoteBackup(json: string | object): NoteBackupEntry[];
  * Ownership is proven by decryption — an entry whose memo does not open under
  * these keys is silently skipped (it is not this user's note). No chain access:
  * only the backup's own memos are tried.
+ *
+ * The decrypted note is reconstructed as unspent; the entry's `spent`/`spentAt`
+ * flags are then applied so a restored vault separates available from spent. A
+ * host may reconcile against the chain afterward if the backup could be stale.
  */
 declare function importNotesFromBackup(entries: NoteBackupEntry[], keys: BackupImportKeys): ZkNote[];
 
+/**
+ * Reconstruct a note from a payment slip.
+ *
+ * The recipient of a private transfer receives an `orbslip1:` string (or the raw
+ * envelope) that the sender produced. Opening it yields the note's public
+ * locators — commitment, encrypted memo, leaf index — which are fed to the SAME
+ * decryption path a scan uses (`tryDecryptNote`): it decrypts the memo with the
+ * recipient's viewing key, derives the stealth spending key, and verifies the
+ * commitment. The result is a fully spendable `ZkNote`, obtained without scanning
+ * the pool.
+ */
+
+/** Keys the recipient needs to open a slip and reconstruct the note. */
+interface SlipImportKeys {
+    /** 32-byte viewing secret key (ivsk) — opens the slip envelope AND the memo. */
+    viewingSecretKey: Uint8Array;
+    /** Spending key scalar — derives the note's nullifier / stealth key. */
+    spendingKey: bigint;
+    /** The recipient's global owner pk (Ax), for stealth detection. */
+    ownerPk: bigint;
+}
+/**
+ * Open a slip and reconstruct its note, or null.
+ *
+ * Accepts an `orbslip1:` string or a raw envelope. Returns null when the slip is
+ * not this recipient's (envelope does not decrypt), or when the memo does not
+ * belong to them, or when the recomputed commitment does not match — the last
+ * check (inside `tryDecryptNote`) is what stops a forged slip from planting a
+ * phantom note. Never throws.
+ */
+declare function importPaymentSlip(slip: string | Uint8Array, keys: SlipImportKeys): ZkNote | null;
+
 /**
  * The steps every spend shares, in the order a spend performs them.
  *
@@ -4976,7 +5184,15 @@ interface TransferParams {
     senderPk?: bigint | undefined;
     fee?: bigint | undefined;
 }
-declare function transferNotes(deps: TransferDeps, params: TransferParams, onProgress?: (step: TransferStep) => void): Promise<TxResult>;
+/**
+ * A transfer result, plus — for a transfer to another user — a `paymentSlip`:
+ * the `orbslip1:` string the sender can hand the recipient so they rebuild their
+ * note without scanning. Absent for self-transfers and change-only transfers.
+ */
+type TransferResult = TxResult & {
+    paymentSlip?: string;
+};
+declare function transferNotes(deps: TransferDeps, params: TransferParams, onProgress?: (step: TransferStep) => void): Promise<TransferResult>;
 
 type UnshieldStep = 'fetching-proof' | 'checking-nullifier' | 'generating-zk' | 'submitting';
 /** The extrinsic arguments, marshalled and ready for whatever transport submits them. */
@@ -5464,4 +5680,4 @@ declare class OrbinumWallet {
     private requireKey;
 }
 
-export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, PAGE_SIZE, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };
+export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, OVK_BLOB_SIZE, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, type OutgoingHint, OutgoingNoteRecord, PAGE_SIZE, PAYMENT_SLIP_SCHEME, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PaymentSlipFields, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, type SlipImportKeys, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferResult, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePaymentSlip, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOutgoingCipherKey, deriveOutgoingViewingKey, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encodePaymentSlip, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, importPaymentSlip, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, openOutgoingBlob, openPaymentSlip, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, randomOutgoingBlob, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, sealOutgoingBlob, sealPaymentSlip, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, tryRecoverOutgoing, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };