@orbinum/sdk 1.3.1 → 2.0.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, O as OutgoingNoteRecord, a as DecryptPool, b as ScanKeys } from './index-V5Z9igEN.js';
-export { C as CURRENT_CIRCUIT_VERSION, c as DECRYPT_YIELD_EVERY, d as DecryptBatchResult, e as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, f as KnownEphWindow, M as MAX_WORKERS, g as MatchSource, h as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, i as SELF_EPH_WINDOW, W as WORKER_CRASHED, j as WorkerFactory, k as WorkerLike, l as WorkerMessage, m as clearKnownEphWindow, n as createDecryptPool, o as createMainThreadPool, p as createWorkerPool, q as decryptHintBatch, r as getKnownEphWindow } from './index-V5Z9igEN.js';
+import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, a as NoteFacts, O as OutgoingNoteRecord, b as DecryptPool, c as ScanKeys } from './index-CLpM1984.js';
+export { C as CURRENT_CIRCUIT_VERSION, d as DECRYPT_YIELD_EVERY, e as DecryptBatchResult, f as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, g as KnownEphWindow, M as MAX_WORKERS, h as MatchSource, i as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, j as SELF_EPH_WINDOW, W as WORKER_CRASHED, k as WorkerFactory, l as WorkerLike, m as WorkerMessage, n as clearKnownEphWindow, o as createDecryptPool, p as createMainThreadPool, q as createWorkerPool, r as decryptHintBatch, s as getKnownEphWindow } from './index-CLpM1984.js';
 import { ArtifactProvider, ProofResult, CircuitType } from '@orbinum/proof-generator';
 export { ArtifactProvider, CircuitType, ProofResult, WebArtifactProvider, shouldProveSingleThreaded } from '@orbinum/proof-generator';
 import * as polkadot_api from 'polkadot-api';
@@ -188,8 +188,22 @@ declare class MemoryVaultStorage implements VaultStorage {
  * carry every ephemeral counter forward. See `buildConfig`.
  */
 
-/** The schema version this build writes and expects to read back. */
-declare const VAULT_SCHEMA_VERSION = 4;
+/**
+ * The schema version this build writes and expects to read back.
+ *
+ * v5: `counterpartyPk` became `sourcePk` on the persisted note. A v4 record
+ * carries the old key, and reading it back does NOT throw — `sourcePk` is in
+ * `ABSENT_MEANS_ZERO`, so its absence reads as a legitimate zero. The note
+ * loads fine, spends fine, and silently loses the other party's key: the only
+ * copy of the payee a sender can still open. The bump exists because that
+ * failure is quiet, not because the note becomes unusable.
+ *
+ * No data migration — wipe-and-rescan IS this repo's migration mechanism, and
+ * nothing is lost by it: notes live on chain and come back from a scan, while
+ * the ephemeral counters (the one piece that cannot be rebuilt) are carried
+ * forward by `mergeCounters` rather than wiped.
+ */
+declare const VAULT_SCHEMA_VERSION = 5;
 /**
  * Lowercases a chain fingerprint, or returns undefined when there is none —
  * so callers can chain `??` without distinguishing empty from absent.
@@ -240,8 +254,27 @@ declare function reserveSelfEphIndex(storage: NoteStorage): Promise<number>;
  * viewing public key. Registering the counterparty is a side effect worth
  * having: it makes the REVERSE direction cheap too, since their future payments
  * to this wallet become hash lookups instead of one trial ECDH per note.
+ *
+ * Returns `null` when this vault holds no history for that counterparty, and
+ * the caller must then use a random ephemeral. The reason is that "no history"
+ * has two causes this function cannot tell apart:
+ *
+ *   - a genuine first payment, where index 0 is correct;
+ *   - a counter that was LOST — a restored seed, a cleared IndexedDB, a wipe
+ *     and rescan — where index 0 was already published and re-deriving it
+ *     republishes that ephPk, linking the two notes in public.
+ *
+ * Unlike `selfEphCounter`, this one cannot be recovered: the index was
+ * published on a note encrypted toward someone else, so it never appears in
+ * this wallet's own scan, and asking a server whether a given ephPk exists
+ * would reveal which notes are ours. So the ambiguity is resolved the safe way
+ * — the caller degrades to random, costing the recipient one trial scan, and
+ * every later payment to the same counterparty takes the fast path again.
+ *
+ * The entry is still created: the NEXT payment has a counter, and registering
+ * the counterparty is what makes the reverse direction cheap.
  */
-declare function reservePairwiseIndex(storage: NoteStorage, ivkHex: string): Promise<number>;
+declare function reservePairwiseIndex(storage: NoteStorage, ivkHex: string): Promise<number | null>;
 
 /**
  * Turning a note into a stored record and back.
@@ -314,7 +347,7 @@ type NoteWithMeta = ZkNote & {
     txKind?: TxKind;
 };
 /** Shield deposit vs PrivateTransfer output (received or change) — the memo's
- * counterpartyPk is zero only for shield/unshield-built notes. */
+ * sourcePk is zero only for shield/unshield-built notes. */
 declare function noteOrigin(note: ZkNote): 'shield' | 'private-transfer';
 declare function noteCreatedAt(note: ZkNote): number | null;
 declare function stampCreatedAt(note: ZkNote, createdAt: number | null): ZkNote;
@@ -412,7 +445,7 @@ declare function removeByCommitment(notes: ZkNote[], commitmentHexes: Set<string
  * already exists.
  *
  * The field list belongs here because it is a fact about `ZkNote`, and a host
- * enumerating it independently would miss `counterpartyPk` — the one that is
+ * enumerating it independently would miss `sourcePk` — the one that is
  * optional on the way in and easy to overlook.
  */
 
@@ -423,7 +456,7 @@ declare function removeByCommitment(notes: ZkNote[], commitmentHexes: Set<string
  * without listing it here is a type error rather than a note that silently
  * normalises incompletely.
  */
-declare const NOTE_BIGINT_FIELDS: readonly ["value", "assetId", "ownerPk", "blinding", "spendingKey", "commitment", "nullifier", "counterpartyPk"];
+declare const NOTE_BIGINT_FIELDS: readonly ["value", "assetId", "ownerPk", "blinding", "spendingKey", "commitment", "nullifier", "sourcePk"];
 /**
  * Coerces a note's scalars to `bigint`, or throws naming the field that cannot
  * be repaired.
@@ -603,6 +636,20 @@ declare class VaultStore {
  */
 declare function detectCommitmentMismatch(notes: ZkNote[], validateCommitment?: (commitmentHex: string) => Promise<boolean>): Promise<boolean>;
 
+/**
+ * Is `value` a 0x-prefixed hex string of exactly `byteLen` bytes?
+ *
+ * A total predicate on `unknown`, for validating values that crossed a trust
+ * boundary — a decoded payment slip, an indexer response, a pasted string.
+ * Those arrive as `unknown` or as a `string` the type system already believes,
+ * and a bare `typeof === 'string'` check admits script tags, URLs and megabyte
+ * payloads into fields the wallet later stores and renders.
+ *
+ * Returns a boolean rather than throwing: callers at a boundary usually want to
+ * drop the value or reject the message, not unwind. Use `fromHex` when a throw
+ * is the right answer.
+ */
+declare function isHexOfLength(value: unknown, byteLen: number): value is string;
 /**
  * Converts a Uint8Array or number[] to a 0x-prefixed lowercase hex string.
  */
@@ -639,6 +686,8 @@ declare function scalarToHex(value: bigint): string;
 
 /**
  * Serialises a bigint as a 32-byte little-endian Uint8Array.
+ *
+ * Throws on a negative value or one ≥ 2^256 — see `assert32ByteRange`.
  */
 declare function bigintTo32Le(n: bigint): Uint8Array;
 /**
@@ -647,11 +696,17 @@ declare function bigintTo32Le(n: bigint): Uint8Array;
 declare function bytesToBigintLE(bytes: Uint8Array): bigint;
 /**
  * Serialises a bigint as a 32-byte big-endian Uint8Array.
+ *
+ * Throws on a negative value or one ≥ 2^256 — see `assert32ByteRange`.
  */
 declare function bigintTo32Be(n: bigint): Uint8Array;
 /**
  * Serialises a bigint as a 32-element little-endian number[].
  * Useful when building SCALE-encoded arguments via polkadot-api.
+ *
+ * Throws on a negative value or one ≥ 2^256 — see `assert32ByteRange`. This is
+ * the encoder that feeds commitments straight into extrinsic arguments, so a
+ * silently-wrong value here lands on chain.
  */
 declare function bigintTo32LeArr(n: bigint): number[];
 /**
@@ -986,7 +1041,7 @@ declare function addressToFieldElement(address: string): bigint;
  * tagActivationLeaf.
  *
  * Plaintext layout (120 bytes):
- *   value_lo(8 LE) || value_hi(8 LE) || owner_pk(32) || blinding(32) || asset_id(4 LE) || counterparty_pk(32) || circuit_version(4 LE)
+ *   value_lo(8 LE) || value_hi(8 LE) || owner_pk(32) || blinding(32) || asset_id(4 LE) || source_pk(32) || circuit_version(4 LE)
  *
  * value is stored as a 128-bit LE unsigned integer (two uint64 words), supporting
  * amounts up to ~3.4 × 10^38 planck — well above any realistic token supply.
@@ -1019,12 +1074,12 @@ declare const EncryptedMemo: {
      *                           (from PrivacyKeyManager.getViewingPublicKeyPacked() or
      *                           decoded from a privacy address).
      *                           Pass `new Uint8Array(32)` (all zeros) for a publicly-readable memo.
-     * @param counterpartyPk     32-byte counterparty BJJ Ax. Default: all zeros.
+     * @param sourcePk     32-byte counterparty BJJ Ax. Default: all zeros.
      * @param circuitVersion     ZK circuit version the note is spent under. Default: 0.
      * @param ephSkOverride      32-byte ephemeral secret key (stealth coordination). Optional.
      * @returns 180-byte encrypted memo: nonce(12) || ciphertext+MAC(136) || ephPk(32).
      */
-    encrypt(value: bigint, ownerPk: Uint8Array, blinding: Uint8Array, assetId: number, commitment: Uint8Array, recipientIvkPacked: Uint8Array, counterpartyPk?: Uint8Array, circuitVersion?: number, ephSkOverride?: Uint8Array): Uint8Array;
+    encrypt(value: bigint, ownerPk: Uint8Array, blinding: Uint8Array, assetId: number, commitment: Uint8Array, recipientIvkPacked: Uint8Array, sourcePk?: Uint8Array, circuitVersion?: number, ephSkOverride?: Uint8Array): Uint8Array;
     /**
      * Returns a 180-byte public memo encrypted with a zero viewing key.
      * Decryptable by anyone with `decrypt(memo, commitment, new Uint8Array(32))`.
@@ -1089,7 +1144,16 @@ declare const EncryptedMemo: {
     _decrypt(memoBytes: Uint8Array, commitment: Uint8Array, viewingSecretKey: Uint8Array): DecryptedMemo | null;
 };
 
-declare function serializeMemo(value: bigint, ownerPk: Uint8Array, blinding: Uint8Array, assetId: number, counterpartyPk: Uint8Array, circuitVersion: number): Uint8Array;
+/**
+ * Serialises the 120-byte memo plaintext.
+ *
+ * The BYTE OFFSETS are the frozen contract, not the parameter names — a golden
+ * vector pins them, and any other implementation has to agree with those
+ * offsets to interoperate. `sourcePk` occupies [84,116); older material calls
+ * that field `counterparty_pk`, which is the same 32 bytes under a name that
+ * wrongly suggested it identifies the sender.
+ */
+declare function serializeMemo(value: bigint, ownerPk: Uint8Array, blinding: Uint8Array, assetId: number, sourcePk: Uint8Array, circuitVersion: number): Uint8Array;
 /**
  * Derive the 1-byte view tag (Monero-style fast-scan filter) from the ECDH
  * shared secret:
@@ -1202,8 +1266,16 @@ interface PaymentSlipFields {
  */
 declare function sealPaymentSlip(recipientIvkPacked: Uint8Array, fields: PaymentSlipFields): Uint8Array;
 /**
- * Open a payment slip with the recipient's viewing secret key. Returns the fields
- * or null (not ours / corrupt). Never throws — safe in import loops.
+ * Open a payment slip with the recipient's viewing secret key.
+ *
+ * Returns the fields, or null when the slip is not ours, is corrupt, or carries
+ * a field that cannot be what it claims. Never throws: the input is a string a
+ * user pasted, and an exception here takes down the paste handler rather than
+ * one import.
+ *
+ * The result is REBUILT field by field rather than returned from `JSON.parse` —
+ * see the note on the MAC at the top of this file for why a decrypted slip is
+ * still untrusted input.
  */
 declare function openPaymentSlip(recipientIvsk: Uint8Array, envelope: Uint8Array): PaymentSlipFields | null;
 /** URI scheme prefix. The version is in the name, so a v2 reader can refuse a v1. */
@@ -1325,10 +1397,10 @@ declare class NoteBuilder {
      * @param note                    The ZkNote whose fields populate the plaintext.
      * @param recipientIvkPacked      32-byte LE packed BJJ viewing public key of the recipient.
      *                                Pass `new Uint8Array(32)` (default) for a public/dummy memo.
-     * @param counterpartyPk          32-byte counterparty BabyJubJub Ax.
+     * @param sourcePk          32-byte counterparty BabyJubJub Ax.
      *                                Pass `new Uint8Array(32)` (default) for no counterparty.
      */
-    static buildMemo(note: ZkNote, recipientIvkPacked?: Uint8Array, counterpartyPk?: Uint8Array): Uint8Array;
+    static buildMemo(note: ZkNote, recipientIvkPacked?: Uint8Array, sourcePk?: Uint8Array): Uint8Array;
 }
 
 /**
@@ -1452,6 +1524,24 @@ type OutgoingHint = ScanCommitment & {
 declare function tryRecoverOutgoing(hint: OutgoingHint, ovk: Uint8Array, opts?: {
     viewTagActivationLeaf?: number;
 }): OutgoingNoteRecord | null;
+/**
+ * Collect what a sender can still say about a note they sent.
+ *
+ * There is no decryption on this path and no key involved. The memo travels
+ * verbatim, exactly as published — the point is to FORWARD it to the recipient
+ * inside a fresh payment slip, not to read it. The recipient opens it with
+ * their own viewing key as they always would.
+ *
+ * That is what makes a slip recoverable after a lost device: re-issuing one
+ * needs the commitment, the memo, and the leaf index, all of them public.
+ *
+ * What is NOT recoverable this way is the amount and the recipient, which live
+ * inside the sealed memo. A sender restoring from a seed alone gets working
+ * slips, not their outgoing history.
+ *
+ * Never throws (runs in recovery loops).
+ */
+declare function collectOutgoingFacts(hint: ScanCommitment): NoteFacts | null;
 
 /**
  * Proving what ONE note holds, without granting any power to spend it.
@@ -2582,8 +2672,13 @@ declare class CircuitVersionResolver {
  */
 declare class EvmClient {
     private readonly rpcUrl;
-    /** @param rpcUrl - HTTP URL of the EVM JSON-RPC endpoint (e.g. `"http://localhost:9933"`). */
-    constructor(rpcUrl: string);
+    private readonly peerRpcUrl?;
+    /**
+     * @param rpcUrl - HTTP URL of the EVM JSON-RPC endpoint (e.g. `"http://localhost:9933"`).
+     * @param peerRpcUrl - Optional second endpoint, used only to tell a genuinely
+     *   pending transaction from one stranded on `rpcUrl` alone. See `waitForReceipt`.
+     */
+    constructor(rpcUrl: string, peerRpcUrl?: string | undefined);
     /**
      * Performs a single JSON-RPC call and returns the typed result.
      * Throws on HTTP errors, RPC-level errors, or a `null` result.
@@ -2605,8 +2700,16 @@ declare class EvmClient {
     getChainId(): Promise<number>;
     /** Returns the transaction count (nonce) for an EVM address. */
     getTransactionCount(address: string): Promise<number>;
-    /** Returns the current gas price in wei. */
-    getGasPrice(): Promise<bigint>;
+    /**
+     * Returns the current gas price in wei, padded by `bumpPercent`.
+     *
+     * `eth_gasPrice` reports the base fee exactly, and the base fee moves
+     * between signing and the pool's next revalidation. A transaction priced at
+     * the bare minimum is evicted as `GasPriceTooLow` the moment it rises, which
+     * leaves every later nonce from that account stranded in the future queue.
+     * The default 25% pad absorbs the usual movement.
+     */
+    getGasPrice(bumpPercent?: number): Promise<bigint>;
     /** Submits a signed raw transaction. Returns the transaction hash. */
     sendRawTransaction(signedHex: string): Promise<string>;
     /** Executes a read-only call without creating a transaction. Returns the raw ABI-encoded response. */
@@ -2641,6 +2744,13 @@ declare class EvmClient {
      * @throws If the transaction dropped, is still pending after the grace window, or reverted (`status == 0x0`).
      */
     waitForReceipt(txHash: string, intervalMs?: number, timeoutMs?: number): Promise<Record<string, unknown>>;
+    /**
+     * True when `rpcUrl` knows the transaction but the configured peer does not.
+     *
+     * Returns false without a peer configured, and on any peer error — an
+     * unreachable peer is not evidence that a live transaction is stranded.
+     */
+    private isStrandedOnThisNode;
 }
 
 /** Enriched EVM transaction model for explorer UIs. */
@@ -2852,6 +2962,12 @@ declare class EvmExplorer {
 type OrbinumClientCommon = {
     /** HTTP URL of the EVM JSON-RPC endpoint (e.g. `"http://localhost:9933"`). Omit to disable EVM support. */
     evmRpc?: string;
+    /**
+     * HTTP URL of a second, independent EVM endpoint. Never used for submission —
+     * only to tell a genuinely pending transaction from one stranded on `evmRpc`
+     * alone, which reports as pending forever but can never mine.
+     */
+    evmRpcPeer?: string;
     /**
      * Base URL of a circuits-artifact mirror serving `manifest.json` and the
      * artifacts beside it. Omit for the default npm CDN (unpkg).
@@ -3220,6 +3336,12 @@ type EvmTxRequest = {
     to: string;
     data: string;
     value?: bigint;
+    /**
+     * Explicit gas price in wei. Omit to let the wallet pick, which prices the
+     * transaction at the bare base fee — enough to be evicted as `GasPriceTooLow`
+     * the moment the base fee rises, stranding every later nonce from the account.
+     */
+    gasPrice?: bigint;
 };
 /** Callback that signs and submits an EVM transaction, returning the tx hash. */
 type EvmSigner = (tx: EvmTxRequest) => Promise<string>;
@@ -3236,121 +3358,73 @@ interface KnownPrecompileInfo {
  *
  * This precompile wraps `pallet-shielded-pool` extrinsics and dispatches them
  * on behalf of the EVM caller (resolved to an AccountId32 via
- * `EeSuffixAddressMapping`). No Substrate signer is required — an EVM wallet
- * is sufficient.
+ * `EeSuffixAddressMapping`). No Substrate signer is required — an EVM wallet is
+ * sufficient, so EVM-only users can shield, transfer and unshield without ever
+ * installing a Polkadot extension.
  *
- * ### Key benefit for apps
- * EVM-only users (MetaMask, Phantom bridge via chain links, etc.) can shield,
- * transfer, and unshield without ever needing a Polkadot extension.
- *
- * All write methods accept an `EvmSigner` callback so the module stays
- * transport-agnostic. See `buildShieldCalldata` etc. if you only need the
- * raw calldata for custom signing flows.
+ * This class is TRANSPORT only: the precompile address, the signer callback and
+ * gas estimation. The calldata itself is built by `shieldedPoolCalldata`, which
+ * needs no chain connection — import those functions directly for custom
+ * signing flows rather than constructing a client you never call.
  */
+
 declare class ShieldedPoolPrecompile {
     private readonly evm;
     private readonly addr;
     constructor(evm: EvmClient);
-    /**
-     * Returns the ABI-encoded calldata for `shield(uint32, bytes32, bytes)`.
-     * The token amount must be sent as `msg.value` (the `value` field of the EVM
-     * transaction) — this is what MetaMask and other wallets display to the user.
-     */
     buildShieldCalldata(params: ShieldParams): string;
+    buildPrivateTransferCalldata(params: PrivateTransferParams): string;
+    buildUnshieldCalldata(params: UnshieldParams): string;
+    buildClaimShieldedFeesCalldata(params: ClaimShieldedFeesParams): string;
     /**
      * Deposits tokens into the shielded pool from a payable EVM transaction.
      *
-     * The token amount is sent as `msg.value` so EVM wallets (MetaMask, etc.) display
-     * the correct amount on the confirmation screen. The precompile dispatches
-     * `shieldedPool.shield` with its own address as origin, so the funds flow:
-     *   caller → precompile (via msg.value, handled by EVM)
-     *   precompile → pool (via pallet transfer)
-     * This avoids double-deduction while keeping the displayed amount accurate.
+     * The amount rides as `msg.value` so EVM wallets show the correct figure on
+     * the confirmation screen. The precompile then dispatches with its OWN
+     * address as origin, so funds flow caller → precompile → pool. That avoids
+     * a double deduction while keeping the displayed amount accurate.
      *
      * Extrinsic: `shieldedPool.shield(assetId, amount, commitment, encryptedMemo)`
      */
     shield(params: ShieldParams, signer: EvmSigner): Promise<string>;
     /**
-     * Returns the ABI-encoded calldata for
-     * `privateTransfer(bytes, bytes32, bytes32[], bytes32[], bytes[], uint32, uint256, uint32)`.
-     * The trailing `uint32` is the circuit version the input notes were created under.
-     */
-    buildPrivateTransferCalldata(params: PrivateTransferParams): string;
-    /**
-     * Submits a private transfer within the shielded pool from an EVM transaction.
+     * Submits a private transfer within the shielded pool.
      *
-     * The EVM caller identity is **irrelevant to the ZK proof** — the sender is
-     * hidden by design. Any EVM address (including a relayer) can submit a valid proof.
+     * The EVM caller identity is IRRELEVANT to the ZK proof — the sender is
+     * hidden by design, so any address (a relayer included) can submit a valid
+     * proof.
      *
      * Extrinsic: `shieldedPool.privateTransfer(proof, merkleRoot, nullifiers, commitments, memos)`
      */
     privateTransfer(params: PrivateTransferParams, signer: EvmSigner): Promise<string>;
-    /**
-     * Params for an `unshield` call via the EVM precompile.
-     * The `recipient` is a full 32-byte AccountId32 (Substrate account or
-     * EeSuffix-derived: `H160 ++ [0x00; 12]`).
-     */
-    buildUnshieldCalldata(params: UnshieldParams): string;
     /**
      * Withdraws tokens from the shielded pool to a recipient account.
      *
-     * `params.recipientAddress` must be a 0x-prefixed 64-hex-char AccountId32.
-     * To send to an EVM address, use `evmToImplicitSubstrate(evmAddr)` from
-     * `@orbinum/sdk` to derive the AccountId32 first.
+     * `params.recipientAddress` must be a 0x-prefixed AccountId32. To send to an
+     * EVM address, derive it first with `evmToImplicitSubstrate(evmAddr)`.
      *
      * Extrinsic: `shieldedPool.unshield(proof, merkleRoot, nullifier, assetId, amount, recipient)`
      */
     unshield(params: UnshieldParams, signer: EvmSigner): Promise<string>;
     /**
-     * Estimates the EVM gas for a `shield` call without submitting.
-     * Requires `from` to be set to the actual sender address.
-     */
-    estimateShieldGas(params: ShieldParams, from: string): Promise<bigint>;
-    /**
-     * Estimates the EVM gas for a `privateTransfer` call.
-     */
-    estimatePrivateTransferGas(params: PrivateTransferParams, from: string): Promise<bigint>;
-    /**
-     * Estimates the EVM gas for an `unshield` call.
-     */
-    estimateUnshieldGas(params: UnshieldParams, from: string): Promise<bigint>;
-    /**
-     * Returns the ABI-encoded calldata for
-     * `claimShieldedFees(bytes32,uint256,uint32,bytes,bytes,bytes,uint32)`.
+     * Claims accrued relay fees as a private shielded note.
      *
-     * ABI layout (params after selector):
-     * - `commitment`    — bytes32 (fixed)
-     * - `amount`        — uint256 (fixed)
-     * - `asset_id`      — uint32  (fixed, right-aligned)
-     * - `memo`          — bytes   (dynamic)
-     * - `proof`         — bytes   (dynamic, 128 bytes Groth16)
-     * - `publicSignals` — bytes   (dynamic, 76 bytes)
-     * - `circuitVersion` — uint32 (fixed, right-aligned)
+     * For validators/relayers holding fees in `pallet-relayer` who want them
+     * paid privately into the shielded pool rather than as a public balance
+     * credit. The ZK `value_proof` binds `commitment` to
+     * `(amount, assetId, ownerPk, blinding)`, so the runtime can verify the note
+     * encodes exactly the claimed amount and a malicious relayer cannot inflate
+     * the withdrawal.
      *
-     * The validator identity is derived from `msg.sender` in the precompile —
-     * do NOT include it in the calldata.
-     */
-    buildClaimShieldedFeesCalldata(params: ClaimShieldedFeesParams): string;
-    /**
-     * Claims accumulated relay fees as a private shielded note.
-     *
-     * This extrinsic is for **validators/relayers** who have accrued fees in
-     * `pallet-relayer` and want to receive them privately inside the shielded pool
-     * instead of as a public balance credit.
-     *
-     * The ZK `value_proof` binds `commitment` to `(amount, assetId, ownerPk, blinding)`
-     * so the runtime can verify the note encodes exactly the claimed fee amount,
-     * preventing a malicious relayer from inflating the withdrawal.
-     *
-     * The `msg.sender` EVM address is used as the validator identity; it must match
-     * the address that has pending relay fees in `pallet-relayer`.
+     * The `msg.sender` address is the validator identity, and must match the
+     * one with pending fees.
      *
      * Extrinsic: `shieldedPool.claim_shielded_fees(commitment, amount, assetId, memo, proof, publicSignals)`
      */
     claimShieldedFees(params: ClaimShieldedFeesParams, signer: EvmSigner): Promise<string>;
-    /**
-     * Estimates the EVM gas for a `claimShieldedFees` call.
-     */
+    estimateShieldGas(params: ShieldParams, from: string): Promise<bigint>;
+    estimatePrivateTransferGas(params: PrivateTransferParams, from: string): Promise<bigint>;
+    estimateUnshieldGas(params: UnshieldParams, from: string): Promise<bigint>;
     estimateClaimShieldedFeesGas(params: ClaimShieldedFeesParams, from: string): Promise<bigint>;
 }
 
@@ -3543,6 +3617,8 @@ interface ClientProviderConfig {
     substrateWs: string;
     /** HTTP URL of the EVM JSON-RPC endpoint (e.g. `"http://localhost:9933"`). Omit to disable EVM support. */
     evmRpc?: string;
+    /** HTTP URL of a second EVM endpoint, used only to detect transactions stranded on `evmRpc`. */
+    evmRpcPeer?: string;
     /** Base URL of a circuits-artifact mirror (manifest.json + artifacts). Omit to use the default npm CDN. */
     circuitsBaseUrl?: string;
     /** Timeout for the initial WebSocket handshake in milliseconds. Default: `8_000`. */
@@ -4495,7 +4571,13 @@ declare function resolveSelfEphCeiling(params: {
 /**
  * Discovery window size for the next scan, given the persisted counter: at least
  * the default, rounded up so every index the wallet may already have used (plus
- * the gap margin) falls inside the fast path.
+ * the gap margin) falls inside the fast path, and never past `MAX_EPH_WINDOW`.
+ *
+ * The counter is read from a config that survives restores and hand-editing, so
+ * a non-finite value is treated as "no history" rather than propagated: `NaN`
+ * would make the builder's `i < from + count` false immediately and return an
+ * EMPTY window, silently disabling the fast path, while `Infinity` would make
+ * that same loop never terminate.
  */
 declare function windowSizeForCounter(counter: number): number;
 
@@ -4854,7 +4936,7 @@ interface BuildNoteParams {
     /** Packed viewing public key of the RECIPIENT, from their privacy address. */
     viewingPublicKey?: Uint8Array | undefined;
     /** Counterparty ownerPk. Zero for shield/unshield notes. */
-    counterpartyPk?: bigint | undefined;
+    sourcePk?: bigint | undefined;
     /** Recipient's global ownerPk. With `viewingPublicKey`, enables stealth. */
     recipientOwnerPk?: bigint | undefined;
     /**
@@ -5172,7 +5254,7 @@ interface TransferDeps {
         assetId: bigint;
         ownerPk: bigint;
         spendingKey?: bigint;
-        counterpartyPk: bigint;
+        sourcePk: bigint;
         viewingPublicKey?: Uint8Array;
         recipientOwnerPk?: bigint;
     }) => Promise<ZkNote>;
@@ -5529,6 +5611,218 @@ declare function getInjectedExtensions(): string[];
  */
 declare function connectInjectedExtension(name: string, origin?: string): Promise<InjectedExtension>;
 
+/**
+ * NoteProvenance — the single vocabulary for "where did this note come from,
+ * and where did it go".
+ *
+ * Several mechanisms answer that question, and before this module they had
+ * separate vocabularies and no contract between them:
+ *
+ *   - the memo's `sourcePk` field, readable by whoever can decrypt the note
+ *     (the recipient always; the sender only for the change note they kept);
+ *   - a lookup by commitment, which returns only what is already public — no
+ *     amount, no recipient, but enough to re-issue a payment slip.
+ *
+ * They are not competing designs. They are providers of the same fact, and
+ * `ProvenanceSource` records which one spoke. Nothing here derives a key: this
+ * layer only holds data already recovered.
+ *
+ * A sender cannot reopen a memo sealed toward someone else, so the amount and
+ * recipient of an outgoing transfer are NOT recoverable from a seed alone. What
+ * survives is the ability to hand the recipient a working slip again.
+ */
+
+/**
+ * Which operation produced a note.
+ *
+ * Replaces reading intent out of `sourcePk === 0n`, which had come to mean
+ * three unrelated things at once: "shield or unshield", "an older record that
+ * omitted the field", and "recipient not yet known". A note whose origin is
+ * genuinely unknown says so.
+ */
+type NoteOrigin = 'shield' | 'transfer-in' | 'transfer-change' | 'unshield-change' | 'fee-claim' | 'unknown';
+/**
+ * Who wrote this record, and therefore how much to trust it.
+ *
+ * `witnessed` is the wallet's own account of a transfer it submitted — the
+ * strongest, since nothing was recovered or guessed. `memo` is a decrypted
+ * fact. `chain` is a lookup by commitment: trustworthy but thin, carrying only
+ * public fields. `inferred` is arithmetic over the notes an extrinsic touched,
+ * and is the only one that can be wrong about the amount.
+ */
+type ProvenanceSource = 'witnessed' | 'memo' | 'chain' | 'inferred';
+/**
+ * What kind of public key `peer.pk` is.
+ *
+ * Orbinum stamps ONE-TIME stealth keys in memos on purpose — a stable
+ * identifier in the recipient's note would link every payment from the same
+ * sender forever. The UI needs to know which it holds: a global pk is an
+ * address a user can act on, a stealth pk is a per-transfer artifact that
+ * happens to look identical in hex.
+ */
+type PkScope = 'global' | 'stealth' | 'none';
+/** The other party to a transfer, with the nature of the key made explicit. */
+type ProvenancePeer = {
+    /** BabyJubJub Ax coordinate. */
+    pk: bigint;
+    scope: PkScope;
+};
+/**
+ * The amount moved, and whether that figure is exact.
+ *
+ * `exact` is a property of the FIGURE, not of the source: an `inferred` record
+ * whose fee resolved is exact too. Keeping them separate is what lets the UI
+ * mark an approximation without pretending to know where it came from.
+ */
+type ProvenanceAmount = {
+    /** Amount in planck. */
+    value: bigint;
+    /** False when the figure was derived and something in the derivation was unknown. */
+    exact: boolean;
+};
+/**
+ * One entry in the wallet's private history. Subsumes what used to be three
+ * separate shapes: the app's `LocalTxRecord`, the scanner's
+ * `ReconstructedTxRecord`, and the per-note facts a lookup returns.
+ */
+type NoteProvenanceRecord = {
+    /** Primary key — the tx hash, or `{block}-{index}` when it was not decoded. */
+    id: string;
+    /** 0x-prefixed extrinsic hash. Empty when the extrinsic could not be resolved. */
+    hash: string;
+    blockNumber: number;
+    /** Unix ms. On-chain block time where known, local wall-clock otherwise. */
+    timestampMs: number;
+    /** Explicit direction — replaces `isIncoming`, `outgoing/incoming` and the rest. */
+    direction: 'in' | 'out';
+    kind: 'private_transfer' | 'unshield' | 'shield' | 'fee_claim';
+    origin: NoteOrigin;
+    source: ProvenanceSource;
+    /** The other party, or null when this operation has none (shield, fee claim)
+     *  or when no one-time key was available to record. */
+    peer: ProvenancePeer | null;
+    amount: ProvenanceAmount;
+    assetId: bigint;
+    status: 'success' | 'failed';
+    /** Relay fee actually paid, when it could be read from the extrinsic. */
+    feePlanck?: bigint;
+    /** SS58 address that received the funds — unshield only. */
+    publicRecipient?: string;
+    /** The `orbslip1:` payment slip, when one was sealed or regenerated. */
+    slip?: {
+        encoded: string;
+    };
+    /** The recovered note itself, when a decryption path produced one. */
+    note?: NoteFacts;
+};
+
+/**
+ * Which of an extrinsic's notes describes the transfer.
+ *
+ * One extrinsic can insert more than one note we own — a self-transfer produces
+ * both the recipient note and the change. Taking whichever comes first would
+ * report the change amount as the transfer amount, and an arbitrary one at
+ * that, since vault order is insertion order.
+ *
+ * The rule: a note carrying a stamped `sourcePk` names the other party, so that
+ * is the one that describes the transfer. In a self-transfer either note
+ * qualifies, since both identify us.
+ *
+ * This was implemented twice — `findChangeNote` in the scanner and
+ * `resolveIncomingTransferMeta` in the app, whose comment already admitted it
+ * was copying the SDK. One rule, one place.
+ */
+
+/**
+ * True when the note carries a `sourcePk` — i.e. it is not a shield/unshield
+ * output, and not a transfer whose spent note had no one-time key to stamp.
+ *
+ * The type is checked, not just the value. Notes come back from encrypted
+ * storage, and `normalizeNote` is what turns their scalars into bigints — but
+ * this is public API and takes any object with the field, so a record that
+ * skipped normalisation arrives with a string. `'0' != null && '0' !== 0n` is
+ * true, so an unnormalised zero would read as a stamped key and pick the wrong
+ * note: the CHANGE reported as the transfer amount, silently.
+ */
+declare function hasSourcePk(note: Pick<ZkNote, 'sourcePk'>): boolean;
+/**
+ * Pick the note that describes the transfer, from the notes of ONE extrinsic
+ * that this wallet owns. Returns undefined when it owns none of them.
+ */
+declare function selectDescribingNote<T extends Pick<ZkNote, 'sourcePk'>>(candidates: T[]): T | undefined;
+/**
+ * Same rule, resolving commitment hexes against a lookup first — the shape the
+ * scanner has on hand. Commitments we do not own are skipped.
+ */
+declare function selectDescribingNoteByCommitment<T extends Pick<ZkNote, 'sourcePk'>>(commitments: string[], noteByCommitment: Map<string, T>): T | undefined;
+
+/**
+ * Merging what a rescan learned into what the wallet already knew.
+ *
+ * The hazard this exists to remove: reconstruction runs after every scan, over
+ * records the wallet may have written itself at submit time. Those local
+ * records hold what a recovery path cannot: the amount and the recipient, which
+ * live inside a memo sealed toward someone else. Overwriting one loses them.
+ *
+ * The payment slip itself is not at risk — it can be re-issued from public
+ * fields — but a thin `chain` record must never replace a rich local one.
+ *
+ * Before this, the protection was a single spread expression in the
+ * reconstruction loop. The rule is now explicit and testable on its own.
+ */
+
+declare function outranks(a: ProvenanceSource, b: ProvenanceSource): boolean;
+/**
+ * Merge an incoming record into an existing one.
+ *
+ * Two rules, in order:
+ *
+ *  1. **A weaker source never overwrites a stronger one's facts.** An
+ *     `inferred` backfill cannot replace the amount a `witnessed` record
+ *     recorded at submit time.
+ *  2. **Absence never overwrites presence.** Whatever the incoming record does
+ *     not carry — a slip, a fee, a public recipient — is kept from the
+ *     existing one regardless of rank, because "not recovered" is not "not
+ *     there".
+ *
+ * Absence is not only `undefined`. Several fields spell "not known yet" with a
+ * value: block and timestamp use `0`, `hash` and a slip's `encoded` use the
+ * empty string, and a peer uses `scope: 'none'`. Those are gaps too, and
+ * treating them as data let a placeholder win by rank — which is how a record
+ * written before the chain confirmed could erase a block number already
+ * resolved.
+ *
+ * Two fields sit outside the ranking entirely, because rank is the wrong
+ * question for them: `status` is the chain's own outcome, and `amount.exact`
+ * describes the figure rather than its source.
+ */
+declare function mergeProvenance(existing: NoteProvenanceRecord, incoming: NoteProvenanceRecord): NoteProvenanceRecord;
+
+/**
+ * Seal a fresh `orbslip1:` slip for a transfer recovered from history.
+ *
+ * ## Why the facts are checked here
+ *
+ * They were looked up by commitment, so they crossed a trust boundary, and
+ * sealing them produces an AUTHENTICATED envelope. A valid MAC proves the
+ * sender knew the recipient's viewing key — not that they are honest, and not
+ * that whatever server answered the lookup was. The recipient's wallet then
+ * renders those fields with the authority of a decrypted slip, on a device
+ * where nothing explains which server supplied them.
+ *
+ * So the check belongs on THIS side of the wire: a value that slipped through
+ * would fail on the recipient's device, or worse, not fail at all.
+ *
+ * Throws on a malformed commitment, memo or leaf index — those are the note's
+ * identity, and a slip carrying a wrong one is not a degraded slip but a broken
+ * one. `txHash` is informational, so it is DROPPED rather than fatal.
+ *
+ * @param facts               public facts of the sent note, looked up by commitment
+ * @param recipientIvkPacked  32-byte packed viewing key from the recipient's privacy address
+ * @param txHash              the transfer's hash, when known — informational, shown as proof of payment
+ */
+declare function regeneratePaymentSlip(facts: NoteFacts, recipientIvkPacked: Uint8Array, txHash?: string): string;
+
 /**
  * `OrbinumWallet` — the assembled wallet: keys, vault, scanner, note building.
  *
@@ -5695,4 +5989,4 @@ declare class OrbinumWallet {
     private requireKey;
 }
 
-export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteInput, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, OVK_BLOB_SIZE, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, type OutgoingHint, OutgoingNoteRecord, PAGE_SIZE, PAYMENT_SLIP_SCHEME, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PaymentSlipFields, type PersistParams, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, type SlipImportKeys, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferResult, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePaymentSlip, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOutgoingCipherKey, deriveOutgoingViewingKey, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encodePaymentSlip, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, importPaymentSlip, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, openOutgoingBlob, openPaymentSlip, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, randomOutgoingBlob, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, sealOutgoingBlob, sealPaymentSlip, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, tryRecoverOutgoing, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };
+export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteFacts, NoteInput, type NoteOrigin, type NoteProvenanceRecord, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, OVK_BLOB_SIZE, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, type OutgoingHint, OutgoingNoteRecord, PAGE_SIZE, PAYMENT_SLIP_SCHEME, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PaymentSlipFields, type PersistParams, type PkScope, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProvenanceAmount, type ProvenancePeer, type ProvenanceSource, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, type SlipImportKeys, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferResult, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectOutgoingFacts, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePaymentSlip, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOutgoingCipherKey, deriveOutgoingViewingKey, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encodePaymentSlip, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hasSourcePk, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, importPaymentSlip, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isHexOfLength, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, mergeProvenance, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, openOutgoingBlob, openPaymentSlip, outranks, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, randomOutgoingBlob, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, regeneratePaymentSlip, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, sealOutgoingBlob, sealPaymentSlip, selectDescribingNote, selectDescribingNoteByCommitment, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, tryRecoverOutgoing, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };