@orbinum/sdk 1.1.1 → 1.2.0

package/dist/index.js

@@ -49,11 +49,13 @@ __export(index_exports, {
   NOTE_BIGINT_FIELDS: () => NOTE_BIGINT_FIELDS,
   NOTE_TRANSFER_URI_SCHEME: () => NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder: () => NoteBuilder,
+  OVK_BLOB_SIZE: () => OVK_BLOB_SIZE,
   OrbinumClient: () => OrbinumClient,
   OrbinumClientProvider: () => OrbinumClientProvider,
   OrbinumWallet: () => OrbinumWallet,
   PAGE_SIZE: () => PAGE_SIZE,
   PAIRWISE_EPH_WINDOW: () => PAIRWISE_EPH_WINDOW,
+  PAYMENT_SLIP_SCHEME: () => PAYMENT_SLIP_SCHEME,
   PRECOMPILE_ADDR: () => PRECOMPILE_ADDR,
   PrivacyKeyManager: () => PrivacyKeyManager,
   PrivacyModule: () => PrivacyModule,
@@ -124,11 +126,14 @@ __export(index_exports, {
   decodeNoteBackup: () => decodeNoteBackup,
   decodeNoteDisclosureKey: () => decodeNoteDisclosureKey,
   decodeNoteTransferPage: () => decodeNoteTransferPage,
+  decodePaymentSlip: () => decodePaymentSlip,
   decodePrecompileCalldata: () => decodePrecompileCalldata,
   decryptHintBatch: () => decryptHintBatch,
   decryptJson: () => decryptJson,
   decryptNoteRecord: () => decryptNoteRecord,
   deriveMasterKeyBytes: () => deriveMasterKeyBytes,
+  deriveOutgoingCipherKey: () => deriveOutgoingCipherKey,
+  deriveOutgoingViewingKey: () => deriveOutgoingViewingKey,
   deriveOwnerPk: () => deriveOwnerPk,
   derivePairwiseEphSk: () => derivePairwiseEphSk,
   derivePairwiseSharedSecret: () => derivePairwiseSharedSecret,
@@ -147,6 +152,7 @@ __export(index_exports, {
   detectCommitmentMismatch: () => detectCommitmentMismatch,
   encodeNoteBackup: () => encodeNoteBackup,
   encodeNoteTransferPages: () => encodeNoteTransferPages,
+  encodePaymentSlip: () => encodePaymentSlip,
   encryptJson: () => encryptJson,
   encryptNote: () => encryptNote,
   ensureCreatedAt: () => ensureCreatedAt,
@@ -183,6 +189,7 @@ __export(index_exports, {
   implicitSubstrateToEvm: () => implicitSubstrateToEvm,
   importDeviceKey: () => importDeviceKey,
   importNotesFromBackup: () => importNotesFromBackup,
+  importPaymentSlip: () => importPaymentSlip,
   isAbortError: () => isAbortError,
   isAlreadySpentError: () => isAlreadySpentError,
   isConnectionLossError: () => isConnectionLossError,
@@ -212,6 +219,8 @@ __export(index_exports, {
   noteSpentTxHash: () => noteSpentTxHash,
   noteToTransferEntry: () => noteToTransferEntry,
   noteTxKind: () => noteTxKind,
+  openOutgoingBlob: () => openOutgoingBlob,
+  openPaymentSlip: () => openPaymentSlip,
   pairwiseEphWindow: () => pairwiseEphWindow,
   palletErrorKind: () => palletErrorKind,
   parseAmount: () => parseAmount,
@@ -221,6 +230,7 @@ __export(index_exports, {
   planTransfer: () => planTransfer,
   planUnshield: () => planUnshield,
   randomBlinding: () => randomBlinding,
+  randomOutgoingBlob: () => randomOutgoingBlob,
   reconstructOutgoingTxRecords: () => reconstructOutgoingTxRecords,
   recoverOwnerPkPoint: () => recoverOwnerPkPoint,
   recoverSelfStealthNote: () => recoverSelfStealthNote,
@@ -236,6 +246,8 @@ __export(index_exports, {
   runScan: () => runScan,
   scalarToHex: () => scalarToHex,
   scanAbortError: () => scanAbortError,
+  sealOutgoingBlob: () => sealOutgoingBlob,
+  sealPaymentSlip: () => sealPaymentSlip,
   selectGhosts: () => selectGhosts,
   selectNotes: () => selectNotes,
   selfEphWindow: () => selfEphWindow,
@@ -259,6 +271,7 @@ __export(index_exports, {
   truncateMiddle: () => truncateMiddle,
   tryDecryptNote: () => tryDecryptNote,
   tryDecryptNoteVerbose: () => tryDecryptNoteVerbose,
+  tryRecoverOutgoing: () => tryRecoverOutgoing,
   txLandedAfterError: () => txLandedAfterError,
   u128: () => import_substrate_bindings3.u128,
   u64: () => import_substrate_bindings3.u64,
@@ -1037,12 +1050,168 @@ var EncryptedMemo = {
   }
 };
 
-// src/protocol/eph/selfEph.ts
+// src/protocol/memo/OutgoingBlob.ts
+var import_chacha2 = require("@noble/ciphers/chacha.js");
+var import_utils2 = require("@noble/ciphers/utils.js");
+var import_hkdf2 = require("@noble/hashes/hkdf.js");
 var import_sha23 = require("@noble/hashes/sha2.js");
+var OCK_DOMAIN = new TextEncoder().encode("orbinum-outgoing-cipher-v1");
+var NONCE_PREFIX = new TextEncoder().encode("OVK1");
+var NONCE_SUFFIX_SIZE = 8;
+var SHARED_SECRET_SIZE = 32;
+var MAC_SIZE = 16;
+var OVK_BLOB_SIZE = NONCE_SUFFIX_SIZE + SHARED_SECRET_SIZE + MAC_SIZE;
+function deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes) {
+  if (commitmentBytes.length !== 32) {
+    throw new Error(
+      `OutgoingBlob: commitmentBytes must be 32 bytes, got ${commitmentBytes.length}`
+    );
+  }
+  if (ephPkBytes.length !== 32) {
+    throw new Error(`OutgoingBlob: ephPkBytes must be 32 bytes, got ${ephPkBytes.length}`);
+  }
+  const salt = new Uint8Array(64);
+  salt.set(commitmentBytes, 0);
+  salt.set(ephPkBytes, 32);
+  return (0, import_hkdf2.hkdf)(import_sha23.sha256, ovk, salt, OCK_DOMAIN, 32);
+}
+function buildNonce(suffix) {
+  const nonce = new Uint8Array(12);
+  nonce.set(NONCE_PREFIX, 0);
+  nonce.set(suffix, 4);
+  return nonce;
+}
+function sealOutgoingBlob(ovk, sharedSecret, commitmentBytes, ephPkBytes) {
+  if (sharedSecret.length !== SHARED_SECRET_SIZE) {
+    throw new Error(`OutgoingBlob: sharedSecret must be 32 bytes, got ${sharedSecret.length}`);
+  }
+  const ock = deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes);
+  const suffix = (0, import_utils2.randomBytes)(NONCE_SUFFIX_SIZE);
+  const cipher = (0, import_chacha2.chacha20poly1305)(ock, buildNonce(suffix));
+  const sealed = cipher.encrypt(sharedSecret);
+  const blob = new Uint8Array(OVK_BLOB_SIZE);
+  blob.set(suffix, 0);
+  blob.set(sealed, NONCE_SUFFIX_SIZE);
+  return blob;
+}
+function openOutgoingBlob(ovk, blob, commitmentBytes, ephPkBytes) {
+  if (blob.length !== OVK_BLOB_SIZE) return null;
+  if (commitmentBytes.length !== 32 || ephPkBytes.length !== 32) return null;
+  try {
+    const ock = deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes);
+    const suffix = blob.subarray(0, NONCE_SUFFIX_SIZE);
+    const sealed = blob.subarray(NONCE_SUFFIX_SIZE);
+    const cipher = (0, import_chacha2.chacha20poly1305)(ock, buildNonce(suffix));
+    return cipher.decrypt(sealed);
+  } catch {
+    return null;
+  }
+}
+function randomOutgoingBlob() {
+  return (0, import_utils2.randomBytes)(OVK_BLOB_SIZE);
+}
+
+// src/protocol/memo/PaymentSlip.ts
+var import_chacha3 = require("@noble/ciphers/chacha.js");
+var import_utils3 = require("@noble/ciphers/utils.js");
+var import_hkdf3 = require("@noble/hashes/hkdf.js");
+var import_sha24 = require("@noble/hashes/sha2.js");
 var import_baby_jubjub4 = require("@zk-kit/baby-jubjub");
+var SLIP_DOMAIN = new TextEncoder().encode("orbinum-payment-slip-v1");
+var NONCE_PREFIX2 = new TextEncoder().encode("SLP1");
+var EPH_PK_SIZE2 = 32;
+var NONCE_SUFFIX_SIZE2 = 8;
+function deriveSlipKey(sharedSecret) {
+  return (0, import_hkdf3.hkdf)(import_sha24.sha256, sharedSecret, void 0, SLIP_DOMAIN, 32);
+}
+function buildNonce2(suffix) {
+  const nonce = new Uint8Array(12);
+  nonce.set(NONCE_PREFIX2, 0);
+  nonce.set(suffix, 4);
+  return nonce;
+}
+function sealPaymentSlip(recipientIvkPacked, fields) {
+  if (recipientIvkPacked.length !== 32) {
+    throw new Error(
+      `PaymentSlip: recipientIvk must be 32 bytes, got ${recipientIvkPacked.length}`
+    );
+  }
+  const ivkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(recipientIvkPacked));
+  if (!ivkPoint) throw new Error("PaymentSlip: invalid recipient viewing public key");
+  const ephSkScalar = bytesToBjjScalar((0, import_utils3.randomBytes)(32));
+  const ephPkPacked = bigintTo32Le((0, import_baby_jubjub4.packPoint)(fastMulBase(ephSkScalar)));
+  const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
+  const sharedSecret = bigintTo32Le(sharedPoint[0]);
+  const slipKey = deriveSlipKey(sharedSecret);
+  const suffix = (0, import_utils3.randomBytes)(NONCE_SUFFIX_SIZE2);
+  const cipher = (0, import_chacha3.chacha20poly1305)(slipKey, buildNonce2(suffix));
+  const plaintext = new TextEncoder().encode(JSON.stringify(fields));
+  const sealed = cipher.encrypt(plaintext);
+  const envelope = new Uint8Array(EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2 + sealed.length);
+  envelope.set(ephPkPacked, 0);
+  envelope.set(suffix, EPH_PK_SIZE2);
+  envelope.set(sealed, EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2);
+  return envelope;
+}
+function openPaymentSlip(recipientIvsk, envelope) {
+  if (envelope.length < EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2 + 16) return null;
+  try {
+    const ephPkPacked = envelope.subarray(0, EPH_PK_SIZE2);
+    const ephPkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(ephPkPacked));
+    if (!ephPkPoint) return null;
+    const ivskScalar = bytesToBjjScalar(recipientIvsk);
+    const sharedSecret = bigintTo32Le(fastMulPoint(ephPkPoint, ivskScalar)[0]);
+    const slipKey = deriveSlipKey(sharedSecret);
+    const suffix = envelope.subarray(EPH_PK_SIZE2, EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2);
+    const sealed = envelope.subarray(EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2);
+    const cipher = (0, import_chacha3.chacha20poly1305)(slipKey, buildNonce2(suffix));
+    const plaintext = cipher.decrypt(sealed);
+    const fields = JSON.parse(new TextDecoder().decode(plaintext));
+    if (typeof fields.commitmentHex !== "string" || typeof fields.encryptedMemo !== "string") {
+      return null;
+    }
+    return fields;
+  } catch {
+    return null;
+  }
+}
+var PAYMENT_SLIP_SCHEME = "orbslip1:";
+function slipChecksum(payload) {
+  const digest = (0, import_sha24.sha256)(new TextEncoder().encode(PAYMENT_SLIP_SCHEME + payload));
+  return toHex(digest.slice(0, 4)).slice(2);
+}
+function encodePaymentSlip(envelope) {
+  const payload = base64UrlEncode(toHex(envelope));
+  return `${PAYMENT_SLIP_SCHEME}${payload}:${slipChecksum(payload)}`;
+}
+function decodePaymentSlip(text) {
+  if (!text.startsWith(PAYMENT_SLIP_SCHEME)) return null;
+  const rest = text.slice(PAYMENT_SLIP_SCHEME.length);
+  const sep = rest.lastIndexOf(":");
+  if (sep < 0) return null;
+  const payload = rest.slice(0, sep);
+  const checksum = rest.slice(sep + 1);
+  if (slipChecksum(payload) !== checksum) return null;
+  try {
+    const hex = base64UrlDecode(payload);
+    const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+    if (clean.length % 2 !== 0) return null;
+    const bytes = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+      bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+  } catch {
+    return null;
+  }
+}
+
+// src/protocol/eph/selfEph.ts
+var import_sha25 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
 var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
 function deriveSelfEphSk(spendingKey, index) {
-  const h = import_sha23.sha256.create();
+  const h = import_sha25.sha256.create();
   h.update(SELF_EPH_DOMAIN);
   h.update(bigintTo32Le(spendingKey));
   const idx = new Uint8Array(4);
@@ -1051,7 +1220,7 @@ function deriveSelfEphSk(spendingKey, index) {
   return h.digest();
 }
 function selfEphWindow(spendingKey, ivkPacked, from, count) {
-  const ivkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(ivkPacked));
+  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(ivkPacked));
   if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
   const entries = [];
   for (let i = from; i < from + count; i++) {
@@ -1060,7 +1229,7 @@ function selfEphWindow(spendingKey, ivkPacked, from, count) {
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
       index: i,
-      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub4.packPoint)(ephPk))),
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
       sharedSecret: bigintTo32Le(sharedPoint[0])
     });
   }
@@ -1068,17 +1237,17 @@ function selfEphWindow(spendingKey, ivkPacked, from, count) {
 }
 
 // src/protocol/eph/pairwiseEph.ts
-var import_sha24 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var import_sha26 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
 var PAIRWISE_EPH_DOMAIN = new TextEncoder().encode("orbinum-pairwise-eph-v1");
 function derivePairwiseSharedSecret(myViewingSk, theirIvkPacked) {
-  const theirPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(theirIvkPacked));
+  const theirPoint = (0, import_baby_jubjub6.unpackPoint)(bytesToBigintLE(theirIvkPacked));
   if (!theirPoint) throw new Error("derivePairwiseSharedSecret: invalid viewing public key");
   const shared = fastMulPoint(theirPoint, bytesToBjjScalar(myViewingSk));
   return bigintTo32Le(shared[0]);
 }
 function derivePairwiseEphSk(pairSecret, index) {
-  const h = import_sha24.sha256.create();
+  const h = import_sha26.sha256.create();
   h.update(PAIRWISE_EPH_DOMAIN);
   h.update(pairSecret);
   const idx = new Uint8Array(4);
@@ -1087,7 +1256,7 @@ function derivePairwiseEphSk(pairSecret, index) {
   return h.digest();
 }
 function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
-  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(receiverIvkPacked));
+  const ivkPoint = (0, import_baby_jubjub6.unpackPoint)(bytesToBigintLE(receiverIvkPacked));
   if (!ivkPoint) throw new Error("pairwiseEphWindow: invalid viewing public key");
   const entries = [];
   for (let i = from; i < from + count; i++) {
@@ -1096,7 +1265,7 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
       index: i,
-      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub6.packPoint)(ephPk))),
       sharedSecret: bigintTo32Le(sharedPoint[0])
     });
   }
@@ -1107,8 +1276,8 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
 var CURRENT_CIRCUIT_VERSION = 1;
 
 // src/protocol/note/NoteBuilder.ts
-var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
-var import_utils2 = require("@noble/ciphers/utils.js");
+var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
+var import_utils4 = require("@noble/ciphers/utils.js");
 var import_poseidon_lite = require("poseidon-lite");
 var NoteBuilder = class {
   /**
@@ -1137,13 +1306,13 @@ var NoteBuilder = class {
     if (useStealth) {
       const recipientOwnerPk = input.recipientOwnerPk;
       const recipientIvkPacked = input.viewingPublicKey;
-      const ephSk = (0, import_utils2.randomBytes)(32);
+      const ephSk = (0, import_utils4.randomBytes)(32);
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
-      const ivkPoint = (0, import_baby_jubjub6.unpackPoint)(ivkPackedBigint);
+      const ivkPoint = (0, import_baby_jubjub7.unpackPoint)(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("NoteBuilder.build: invalid recipient viewing public key");
       const ephSkScalar = BigInt(toHex(ephSk)) % BABYJUB_SUBORDER || 1n;
-      const sharedPoint = (0, import_baby_jubjub6.mulPointEscalar)(ivkPoint, ephSkScalar);
+      const sharedPoint = (0, import_baby_jubjub7.mulPointEscalar)(ivkPoint, ephSkScalar);
       const sharedSecret = bigintTo32Le(sharedPoint[0]);
       const recipientPkPoint = recoverOwnerPkPoint(recipientOwnerPk);
       if (!recipientPkPoint)
@@ -1178,6 +1347,21 @@ var NoteBuilder = class {
         throw new Error(
           `NoteBuilder.build: invariant violated \u2014 memo must be ${ENCRYPTED_MEMO_SIZE} bytes, got ${memo.length}`
         );
+      let ovkBlob;
+      if (input.outgoingViewingKey !== void 0) {
+        const ephPkBytes = Uint8Array.from(memo.slice(148, 180));
+        const sealed = sealOutgoingBlob(
+          input.outgoingViewingKey,
+          sharedSecret,
+          stealthCommitmentBytes,
+          ephPkBytes
+        );
+        if (sealed.length !== OVK_BLOB_SIZE)
+          throw new Error(
+            `NoteBuilder.build: invariant violated \u2014 ovkBlob must be ${OVK_BLOB_SIZE} bytes, got ${sealed.length}`
+          );
+        ovkBlob = Array.from(sealed);
+      }
       return {
         value,
         assetId,
@@ -1192,7 +1376,8 @@ var NoteBuilder = class {
         commitmentHex: toHex(commitmentBytes2),
         nullifierHex: toHex(nullifierBytes2),
         memo,
-        counterpartyPk
+        counterpartyPk,
+        ...ovkBlob ? { ovkBlob } : {}
       };
     }
     const commitment = (0, import_poseidon_lite.poseidon4)([value, assetId, ownerPk, blinding]);
@@ -1322,6 +1507,18 @@ function buildDummyTransferInput(assetId) {
 }
 
 // src/protocol/note/NoteDecryptor.ts
+function decryptAndVerifyPlaintext(memoBytes, commitmentBytes, sharedSecret, effectiveOwnerPk) {
+  const plaintext = EncryptedMemo.decryptWithSharedSecret(
+    memoBytes,
+    commitmentBytes,
+    sharedSecret
+  );
+  if (!plaintext) return null;
+  const ownerPk = effectiveOwnerPk ?? plaintext.ownerPk;
+  const recomputed = (0, import_poseidon_lite2.poseidon4)([plaintext.value, plaintext.assetId, ownerPk, plaintext.blinding]);
+  if (recomputed !== bytesToBigintLE(commitmentBytes)) return null;
+  return plaintext;
+}
 function computeNullifier(commitment, spendingKey) {
   return (0, import_poseidon_lite2.poseidon2)([commitment, spendingKey]);
 }
@@ -1404,6 +1601,40 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
     }
   };
 }
+function tryRecoverOutgoing(hint, ovk, opts) {
+  if (!hint.ovkBlob || !hint.encryptedMemo) return null;
+  let commitmentBytes;
+  let memoBytes;
+  let blobBytes;
+  try {
+    commitmentBytes = fromHex(hint.commitmentHex);
+    memoBytes = fromHex(hint.encryptedMemo);
+    blobBytes = fromHex(hint.ovkBlob);
+  } catch {
+    return null;
+  }
+  if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+  if (blobBytes.length !== OVK_BLOB_SIZE) return null;
+  const ephPkBytes = memoBytes.subarray(148, 180);
+  const sharedSecret = openOutgoingBlob(ovk, blobBytes, commitmentBytes, ephPkBytes);
+  if (!sharedSecret) return null;
+  const activation = opts?.viewTagActivationLeaf;
+  if (activation !== void 0 && isValidLeafIndex(hint.leafIndex) && hint.leafIndex >= activation && !EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
+    return null;
+  }
+  const plaintext = decryptAndVerifyPlaintext(memoBytes, commitmentBytes, sharedSecret, null);
+  if (!plaintext) return null;
+  return {
+    commitmentHex: hint.commitmentHex,
+    ...isValidLeafIndex(hint.leafIndex) ? { leafIndex: hint.leafIndex } : {},
+    value: plaintext.value,
+    assetId: plaintext.assetId,
+    recipientStealthPk: plaintext.ownerPk,
+    blinding: plaintext.blinding,
+    counterpartyPk: plaintext.counterpartyPk,
+    circuitVersion: plaintext.circuitVersion
+  };
+}
 
 // src/protocol/note/NoteDisclosure.ts
 var import_poseidon_lite3 = require("poseidon-lite");
@@ -1549,10 +1780,11 @@ ${canonicalAccountId(address)}`;
 }
 
 // src/protocol/keys/PrivacyKeys.ts
-var import_hkdf2 = require("@noble/hashes/hkdf.js");
-var import_sha25 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
+var import_hkdf4 = require("@noble/hashes/hkdf.js");
+var import_sha27 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub8 = require("@zk-kit/baby-jubjub");
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
+var OVK_DOMAIN = new TextEncoder().encode("orbinum-ovk-v1");
 var KEY_VERSION = "v2";
 function deriveSpendingKeyFromMaster(masterBytes) {
   const skBigint = BigInt(toHex(masterBytes)) % BABYJUB_SUBORDER;
@@ -1560,12 +1792,12 @@ function deriveSpendingKeyFromMaster(masterBytes) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return (0, import_hkdf2.hkdf)(import_sha25.sha256, ikm, void 0, IVK_DOMAIN, 32);
+  return (0, import_hkdf4.hkdf)(import_sha27.sha256, ikm, void 0, IVK_DOMAIN, 32);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
   const ivkPoint = fastMulBase(ivskScalar);
-  const packed = (0, import_baby_jubjub7.packPoint)(ivkPoint);
+  const packed = (0, import_baby_jubjub8.packPoint)(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
@@ -1576,12 +1808,15 @@ function deriveOwnerPk(spendingKey) {
     return 0n;
   }
 }
+function deriveOutgoingViewingKey(masterBytes) {
+  return (0, import_hkdf4.hkdf)(import_sha27.sha256, masterBytes, void 0, OVK_DOMAIN, 32);
+}
 
 // src/protocol/keys/PrivacyKeyManager.ts
-var import_sha26 = require("@noble/hashes/sha2.js");
+var import_sha28 = require("@noble/hashes/sha2.js");
 function privacyAddressChecksum(ownerPkHex, ivkHex) {
   const body = `orbpriv2:${ownerPkHex}:${ivkHex}`;
-  const digest = (0, import_sha26.sha256)(new TextEncoder().encode(body));
+  const digest = (0, import_sha28.sha256)(new TextEncoder().encode(body));
   return toHex(digest.slice(0, 4)).slice(2);
 }
 var PrivacyKeyManager = class {
@@ -1590,7 +1825,8 @@ var PrivacyKeyManager = class {
     masterBytes: null,
     viewingSecretKey: null,
     viewingPublicKeyPacked: null,
-    ownerPk: null
+    ownerPk: null,
+    outgoingViewingKey: null
   };
   /**
    * Load a spending key and its corresponding master bytes into the in-memory session.
@@ -1605,12 +1841,14 @@ var PrivacyKeyManager = class {
     const viewingSecretKey = deriveViewingSecretKey(spendingKey);
     const viewingPublicKeyPacked = deriveViewingPublicKey(viewingSecretKey);
     const ownerPk = deriveOwnerPk(spendingKey);
+    const outgoingViewingKey = deriveOutgoingViewingKey(masterBytes);
     this._state = {
       spendingKey,
       masterBytes,
       viewingSecretKey,
       viewingPublicKeyPacked,
-      ownerPk
+      ownerPk,
+      outgoingViewingKey
     };
   }
   /** Clear all key material from memory. Call on vault lock / sign-out. */
@@ -1620,7 +1858,8 @@ var PrivacyKeyManager = class {
       masterBytes: null,
       viewingSecretKey: null,
       viewingPublicKeyPacked: null,
-      ownerPk: null
+      ownerPk: null,
+      outgoingViewingKey: null
     };
   }
   /** Returns true if a spending key has been loaded. */
@@ -1665,6 +1904,16 @@ var PrivacyKeyManager = class {
     }
     return this._state.ownerPk;
   }
+  /**
+   * Returns the 32-byte outgoing viewing key (ovk). Throws if not loaded.
+   * Used to seal/open the outgoing blob that lets the sender recover a transfer.
+   */
+  getOutgoingViewingKey() {
+    if (this._state.outgoingViewingKey === null) {
+      throw new Error("PrivacyKeyManager: no key loaded. Call load() first.");
+    }
+    return this._state.outgoingViewingKey;
+  }
   /** Returns the spending key as a 32-byte little-endian Uint8Array. Throws if not loaded. */
   getSpendingKeyBytes() {
     return bigintTo32Le(this.getSpendingKey());
@@ -1766,8 +2015,8 @@ var PrivacyKeyManager = class {
 };
 
 // src/protocol/keys/spendingKeyDerivation.ts
-var import_hkdf3 = require("@noble/hashes/hkdf.js");
-var import_sha27 = require("@noble/hashes/sha2.js");
+var import_hkdf5 = require("@noble/hashes/hkdf.js");
+var import_sha29 = require("@noble/hashes/sha2.js");
 var MIN_SIGNATURE_BYTES = 32;
 var MIN_DISTINCT_BYTES = 8;
 function assertUsableSignature(sigBytes) {
@@ -1789,7 +2038,7 @@ async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const info = new TextEncoder().encode(
     `orbinum-sk-${KEY_VERSION}:${chainId}:${canonicalAccountId(address)}`
   );
-  return (0, import_hkdf3.hkdf)(import_sha27.sha256, sigBytes, new Uint8Array(0), info, 32);
+  return (0, import_hkdf5.hkdf)(import_sha29.sha256, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   return deriveSpendingKeyFromMaster(await deriveMasterKeyBytes(signatureHex, chainId, address));
@@ -1797,8 +2046,8 @@ async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
 
 // src/protocol/proving/unshield.ts
 var import_proof_generator = require("@orbinum/proof-generator");
-var import_utils3 = require("@noble/ciphers/utils.js");
-var import_baby_jubjub8 = require("@zk-kit/baby-jubjub");
+var import_utils5 = require("@noble/ciphers/utils.js");
+var import_baby_jubjub9 = require("@zk-kit/baby-jubjub");
 var import_poseidon_lite4 = require("poseidon-lite");
 
 // src/protocol/proving/merkle.ts
@@ -1830,8 +2079,8 @@ async function generateUnshieldProof(inputs, options = {}) {
   if (changeValue < 0n) {
     throw new Error("changeValue must be >= 0.");
   }
-  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub8.mulPointEscalar)(import_baby_jubjub8.Base8, inputs.spendingKey)[0];
-  const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE((0, import_utils3.randomBytes)(32)) : 0n);
+  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub9.mulPointEscalar)(import_baby_jubjub9.Base8, inputs.spendingKey)[0];
+  const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE((0, import_utils5.randomBytes)(32)) : 0n);
   const changeCommitment = changeValue > 0n ? (0, import_poseidon_lite4.poseidon4)([changeValue, inputs.assetId, changeOwnerPubkey, changeBlinding]) : 0n;
   const circuitInputs = {
     merkle_root: leHexToBigint(inputs.merkleRoot).toString(),
@@ -6404,6 +6653,22 @@ function isEntry2(value) {
   return true;
 }
 
+// src/wallet/ops/notes/paymentSlipImport.ts
+function importPaymentSlip(slip, keys) {
+  const envelope = typeof slip === "string" ? decodePaymentSlip(slip) : slip;
+  if (!envelope) return null;
+  const fields = openPaymentSlip(keys.viewingSecretKey, envelope);
+  if (!fields) return null;
+  const commitment = {
+    commitmentHex: fields.commitmentHex,
+    leafIndex: fields.leafIndex ?? -1,
+    encryptedMemo: fields.encryptedMemo
+  };
+  const note = tryDecryptNote(commitment, keys.viewingSecretKey, keys.spendingKey, keys.ownerPk);
+  if (!note) return null;
+  return fields.txHash ? stampCreatedTxHash(note, fields.txHash) : note;
+}
+
 // src/wallet/ops/spend/transfer.ts
 var import_proof_generator6 = require("@orbinum/proof-generator");
 
@@ -6613,6 +6878,18 @@ async function transferNotes(deps, params, onProgress) {
         await deps.vault.save(stampCreatedTxHash(selfNote, txResult.txHash, txKind));
       }
     }
+    const isSelf = deps.selfOwnerPk !== null && recipientPk === deps.selfOwnerPk;
+    if (recipientViewingPublicKey !== void 0 && !isSelf) {
+      try {
+        const envelope = sealPaymentSlip(recipientViewingPublicKey, {
+          commitmentHex: recipientNote.commitmentHex,
+          encryptedMemo: toHex(Uint8Array.from(recipientNote.memo)),
+          ...txResult.txHash ? { txHash: txResult.txHash } : {}
+        });
+        return { ...txResult, paymentSlip: encodePaymentSlip(envelope) };
+      } catch {
+      }
+    }
   }
   return txResult;
 }
@@ -7496,11 +7773,13 @@ var OrbinumWallet = class {
   NOTE_BIGINT_FIELDS,
   NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder,
+  OVK_BLOB_SIZE,
   OrbinumClient,
   OrbinumClientProvider,
   OrbinumWallet,
   PAGE_SIZE,
   PAIRWISE_EPH_WINDOW,
+  PAYMENT_SLIP_SCHEME,
   PRECOMPILE_ADDR,
   PrivacyKeyManager,
   PrivacyModule,
@@ -7571,11 +7850,14 @@ var OrbinumWallet = class {
   decodeNoteBackup,
   decodeNoteDisclosureKey,
   decodeNoteTransferPage,
+  decodePaymentSlip,
   decodePrecompileCalldata,
   decryptHintBatch,
   decryptJson,
   decryptNoteRecord,
   deriveMasterKeyBytes,
+  deriveOutgoingCipherKey,
+  deriveOutgoingViewingKey,
   deriveOwnerPk,
   derivePairwiseEphSk,
   derivePairwiseSharedSecret,
@@ -7594,6 +7876,7 @@ var OrbinumWallet = class {
   detectCommitmentMismatch,
   encodeNoteBackup,
   encodeNoteTransferPages,
+  encodePaymentSlip,
   encryptJson,
   encryptNote,
   ensureCreatedAt,
@@ -7630,6 +7913,7 @@ var OrbinumWallet = class {
   implicitSubstrateToEvm,
   importDeviceKey,
   importNotesFromBackup,
+  importPaymentSlip,
   isAbortError,
   isAlreadySpentError,
   isConnectionLossError,
@@ -7659,6 +7943,8 @@ var OrbinumWallet = class {
   noteSpentTxHash,
   noteToTransferEntry,
   noteTxKind,
+  openOutgoingBlob,
+  openPaymentSlip,
   pairwiseEphWindow,
   palletErrorKind,
   parseAmount,
@@ -7668,6 +7954,7 @@ var OrbinumWallet = class {
   planTransfer,
   planUnshield,
   randomBlinding,
+  randomOutgoingBlob,
   reconstructOutgoingTxRecords,
   recoverOwnerPkPoint,
   recoverSelfStealthNote,
@@ -7683,6 +7970,8 @@ var OrbinumWallet = class {
   runScan,
   scalarToHex,
   scanAbortError,
+  sealOutgoingBlob,
+  sealPaymentSlip,
   selectGhosts,
   selectNotes,
   selfEphWindow,
@@ -7706,6 +7995,7 @@ var OrbinumWallet = class {
   truncateMiddle,
   tryDecryptNote,
   tryDecryptNoteVerbose,
+  tryRecoverOutgoing,
   txLandedAfterError,
   u128,
   u64,