@orbinum/sdk 2.0.0 → 3.0.0

package/dist/{chunk-VYKKBXOE.mjs → chunk-54HFH63J.mjs}

@@ -4,7 +4,7 @@ var CURRENT_CIRCUIT_VERSION = 1;
 // src/protocol/memo/EncryptedMemo.ts
 import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
 import { randomBytes } from "@noble/ciphers/utils.js";
-import { packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+import { packPoint } from "@zk-kit/baby-jubjub";
 
 // src/foundation/crypto/bjj-fast.ts
 import { edwards } from "@noble/curves/abstract/edwards.js";
@@ -32,6 +32,84 @@ function fastMulPoint(point, scalar) {
   return [x, y];
 }
 
+// src/foundation/crypto/bjj.ts
+import { mulPointEscalar, unpackPoint } from "@zk-kit/baby-jubjub";
+
+// src/foundation/crypto/constants.ts
+var BN254_R = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var BABYJUB_SUBORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+
+// src/foundation/crypto/bjj.ts
+var BJJ_A = 168700n;
+var BJJ_D = 168696n;
+var BJJ_COFACTOR = 8n;
+function _modpow(base, exp, mod) {
+  let result = 1n;
+  base = base % mod;
+  while (exp > 0n) {
+    if (exp & 1n) result = result * base % mod;
+    exp >>= 1n;
+    base = base * base % mod;
+  }
+  return result;
+}
+function _sqrtModP(y2) {
+  if (y2 === 0n) return 0n;
+  if (_modpow(y2, (BN254_R - 1n) / 2n, BN254_R) !== 1n) return null;
+  let s = 0n;
+  let q = BN254_R - 1n;
+  while ((q & 1n) === 0n) {
+    q >>= 1n;
+    s++;
+  }
+  if (s === 1n) return _modpow(y2, (BN254_R + 1n) / 4n, BN254_R);
+  let z = 2n;
+  while (_modpow(z, (BN254_R - 1n) / 2n, BN254_R) === 1n) z++;
+  let m = s;
+  let c = _modpow(z, q, BN254_R);
+  let t = _modpow(y2, q, BN254_R);
+  let r = _modpow(y2, (q + 1n) / 2n, BN254_R);
+  for (; ; ) {
+    if (t === 1n) return r;
+    let i = 1n;
+    let tmp = t * t % BN254_R;
+    while (tmp !== 1n) {
+      tmp = tmp * tmp % BN254_R;
+      i++;
+    }
+    const b = _modpow(c, 1n << m - i - 1n, BN254_R);
+    m = i;
+    c = b * b % BN254_R;
+    t = t * c % BN254_R;
+    r = r * b % BN254_R;
+  }
+}
+function recoverOwnerPkPoint(ax) {
+  const x2 = ax * ax % BN254_R;
+  const num = ((1n - BJJ_A * x2) % BN254_R + BN254_R) % BN254_R;
+  const den = ((1n - BJJ_D * x2) % BN254_R + BN254_R) % BN254_R;
+  if (den === 0n) return null;
+  const denInv = _modpow(den, BN254_R - 2n, BN254_R);
+  const y2 = num * denInv % BN254_R;
+  const y = _sqrtModP(y2);
+  if (y === null) return null;
+  const yAlt = BN254_R - y;
+  try {
+    const check = mulPointEscalar([ax, y], BABYJUB_SUBORDER);
+    return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
+  } catch {
+    return [ax, yAlt];
+  }
+}
+function unpackUsableViewingKey(packed) {
+  const point = unpackPoint(packed);
+  if (!point) return null;
+  if (point[0] === 0n && point[1] === 1n) return null;
+  const cleared = mulPointEscalar(point, BJJ_COFACTOR);
+  if (cleared[0] === 0n && cleared[1] === 1n) return null;
+  return point;
+}
+
 // src/foundation/encoding/hex.ts
 function isHexOfLength(value, byteLen) {
   return typeof value === "string" && new RegExp(`^0x[0-9a-fA-F]{${byteLen * 2}}$`).test(value);
@@ -57,12 +135,23 @@ function ensureHexPrefix(hex) {
   return hex.startsWith("0x") ? hex : `0x${hex}`;
 }
 function hexToNumber(hex) {
-  return parseInt(hex, 16);
+  const clean = /^0x/i.test(hex) ? hex.slice(2) : hex;
+  if (!/^[0-9a-fA-F]+$/.test(clean)) {
+    throw new Error(`Invalid hex quantity: "${hex}"`);
+  }
+  const value = Number(BigInt("0x" + clean));
+  if (!Number.isSafeInteger(value)) {
+    throw new Error(`Hex quantity exceeds safe integer range: "${hex}"`);
+  }
+  return value;
 }
 function hexToBigint(hex) {
   return BigInt(hex);
 }
 function scalarToHex(value) {
+  if (value < 0n || value >> 256n !== 0n) {
+    throw new Error(`scalarToHex: value must fit in 32 unsigned bytes, got ${value}`);
+  }
   return "0x" + value.toString(16).padStart(64, "0");
 }
 
@@ -122,16 +211,21 @@ function leHexToBigint(hex) {
   return bytesToBigintLE(fromHex(hex));
 }
 
-// src/foundation/crypto/constants.ts
-var BN254_R = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
-var BABYJUB_SUBORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
-
 // src/protocol/memo/plaintext.ts
 import { sha256 } from "@noble/hashes/sha2.js";
 var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
 var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
 var MEMO_PLAINTEXT_SIZE = 120;
 function serializeMemo(value, ownerPk, blinding, assetId, sourcePk, circuitVersion) {
+  if (value < 0n || value >> 128n !== 0n) {
+    throw new Error(`serializeMemo: value must fit in 128 unsigned bits, got ${value}`);
+  }
+  if (!Number.isInteger(assetId) || assetId < 0 || assetId > 4294967295) {
+    throw new Error(`serializeMemo: assetId must be a u32, got ${assetId}`);
+  }
+  if (!Number.isInteger(circuitVersion) || circuitVersion < 0 || circuitVersion > 4294967295) {
+    throw new Error(`serializeMemo: circuitVersion must be a u32, got ${circuitVersion}`);
+  }
   const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
   const view = new DataView(buf.buffer);
   view.setBigUint64(0, value & 0xffffffffffffffffn, true);
@@ -163,6 +257,9 @@ var CIPHERTEXT_SIZE = 136;
 var EPH_PK_SIZE = 32;
 var ENCRYPTED_MEMO_SIZE = NONCE_SIZE + CIPHERTEXT_SIZE + EPH_PK_SIZE;
 function bytesToBjjScalar(bytes) {
+  if (bytes.length !== 32) {
+    throw new Error(`bytesToBjjScalar: expected 32 bytes, got ${bytes.length}`);
+  }
   const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
   return BigInt("0x" + hex) % BABYJUB_SUBORDER || 1n;
 }
@@ -186,7 +283,7 @@ function parsePlaintext(nonce, ciphertextWithMac, encKey) {
 }
 var EncryptedMemo = {
   /**
-   * Build and encrypt a memo for a note using ECDH (v2, 180 bytes).
+   * Build and encrypt a memo for a note using ECDH (180 bytes).
    *
    * @param value              Note value in planck.
    * @param ownerPk            32-byte owner public key (LE).
@@ -226,7 +323,7 @@ var EncryptedMemo = {
       const ephPkPoint = fastMulBase(ephSkScalar);
       ephPkPackedBytes = bigintTo32Le(packPoint(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
-      const ivkPoint = unpackPoint(ivkPackedBigint);
+      const ivkPoint = unpackUsableViewingKey(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
       const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
@@ -316,7 +413,7 @@ var EncryptedMemo = {
     if (ephPkPackedBigint === 0n) {
       return new Uint8Array(32);
     }
-    const ephPkPoint = unpackPoint(ephPkPackedBigint);
+    const ephPkPoint = unpackUsableViewingKey(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
     const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
@@ -326,9 +423,9 @@ var EncryptedMemo = {
    * Cheap view-tag check: does memo nonce[0] match the tag derived from
    * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
    *
-   * Only meaningful for memos built with view tags (commitments at/after
-   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
-   * there and would false-negative 255/256 of the time.
+   * Only meaningful for memos that carry a tag — at or after
+   * `ScanKeys.viewTagActivationLeaf`. An older memo has a random byte there
+   * and would false-negative 255/256 of the time.
    */
   checkViewTag(memoBytes, sharedSecret) {
     if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
@@ -354,80 +451,19 @@ var EncryptedMemo = {
   }
 };
 
-// src/protocol/memo/OutgoingBlob.ts
-import { chacha20poly1305 as chacha20poly13052 } from "@noble/ciphers/chacha.js";
-import { randomBytes as randomBytes2 } from "@noble/ciphers/utils.js";
-import { hkdf } from "@noble/hashes/hkdf.js";
-import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
-var OCK_DOMAIN = new TextEncoder().encode("orbinum-outgoing-cipher-v1");
-var NONCE_PREFIX = new TextEncoder().encode("OVK1");
-var NONCE_SUFFIX_SIZE = 8;
-var SHARED_SECRET_SIZE = 32;
-var MAC_SIZE = 16;
-var OVK_BLOB_SIZE = NONCE_SUFFIX_SIZE + SHARED_SECRET_SIZE + MAC_SIZE;
-function deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes) {
-  if (commitmentBytes.length !== 32) {
-    throw new Error(
-      `OutgoingBlob: commitmentBytes must be 32 bytes, got ${commitmentBytes.length}`
-    );
-  }
-  if (ephPkBytes.length !== 32) {
-    throw new Error(`OutgoingBlob: ephPkBytes must be 32 bytes, got ${ephPkBytes.length}`);
-  }
-  const salt = new Uint8Array(64);
-  salt.set(commitmentBytes, 0);
-  salt.set(ephPkBytes, 32);
-  return hkdf(sha2562, ovk, salt, OCK_DOMAIN, 32);
-}
-function buildNonce(suffix) {
-  const nonce = new Uint8Array(12);
-  nonce.set(NONCE_PREFIX, 0);
-  nonce.set(suffix, 4);
-  return nonce;
-}
-function sealOutgoingBlob(ovk, sharedSecret, commitmentBytes, ephPkBytes) {
-  if (sharedSecret.length !== SHARED_SECRET_SIZE) {
-    throw new Error(`OutgoingBlob: sharedSecret must be 32 bytes, got ${sharedSecret.length}`);
-  }
-  const ock = deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes);
-  const suffix = randomBytes2(NONCE_SUFFIX_SIZE);
-  const cipher = chacha20poly13052(ock, buildNonce(suffix));
-  const sealed = cipher.encrypt(sharedSecret);
-  const blob = new Uint8Array(OVK_BLOB_SIZE);
-  blob.set(suffix, 0);
-  blob.set(sealed, NONCE_SUFFIX_SIZE);
-  return blob;
-}
-function openOutgoingBlob(ovk, blob, commitmentBytes, ephPkBytes) {
-  if (blob.length !== OVK_BLOB_SIZE) return null;
-  if (commitmentBytes.length !== 32 || ephPkBytes.length !== 32) return null;
-  try {
-    const ock = deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes);
-    const suffix = blob.subarray(0, NONCE_SUFFIX_SIZE);
-    const sealed = blob.subarray(NONCE_SUFFIX_SIZE);
-    const cipher = chacha20poly13052(ock, buildNonce(suffix));
-    return cipher.decrypt(sealed);
-  } catch {
-    return null;
-  }
-}
-function randomOutgoingBlob() {
-  return randomBytes2(OVK_BLOB_SIZE);
-}
-
 // src/foundation/crypto/stealth.ts
-import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
-import { hkdf as hkdf2 } from "@noble/hashes/hkdf.js";
-import { mulPointEscalar, Base8, addPoint } from "@zk-kit/baby-jubjub";
+import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { mulPointEscalar as mulPointEscalar2, Base8, addPoint } from "@zk-kit/baby-jubjub";
 var STEALTH_INFO = new TextEncoder().encode("orbinum-stealth-v1");
 function deriveStealthScalar(sharedSecret, ownerPkBigint) {
   const salt = bigintTo32Le(ownerPkBigint);
-  const stealthBytes = hkdf2(sha2563, sharedSecret, salt, STEALTH_INFO, 32);
+  const stealthBytes = hkdf(sha2562, sharedSecret, salt, STEALTH_INFO, 32);
   return bytesToBigintLE(stealthBytes) % BABYJUB_SUBORDER || 1n;
 }
 function deriveStealthOwnerPk(sharedSecret, ownerPkBigint, ownerPkPoint) {
   const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
-  const stealthPt = addPoint(mulPointEscalar(Base8, stealthScalar), ownerPkPoint);
+  const stealthPt = addPoint(mulPointEscalar2(Base8, stealthScalar), ownerPkPoint);
   return stealthPt[0];
 }
 function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
@@ -435,73 +471,20 @@ function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
   return (stealthScalar + spendingKey) % BABYJUB_SUBORDER || 1n;
 }
 
-// src/foundation/crypto/bjj.ts
-import { mulPointEscalar as mulPointEscalar2 } from "@zk-kit/baby-jubjub";
-var BJJ_A = 168700n;
-var BJJ_D = 168696n;
-function _modpow(base, exp, mod) {
-  let result = 1n;
-  base = base % mod;
-  while (exp > 0n) {
-    if (exp & 1n) result = result * base % mod;
-    exp >>= 1n;
-    base = base * base % mod;
-  }
-  return result;
-}
-function _sqrtModP(y2) {
-  if (y2 === 0n) return 0n;
-  if (_modpow(y2, (BN254_R - 1n) / 2n, BN254_R) !== 1n) return null;
-  let s = 0n;
-  let q = BN254_R - 1n;
-  while ((q & 1n) === 0n) {
-    q >>= 1n;
-    s++;
-  }
-  if (s === 1n) return _modpow(y2, (BN254_R + 1n) / 4n, BN254_R);
-  let z = 2n;
-  while (_modpow(z, (BN254_R - 1n) / 2n, BN254_R) === 1n) z++;
-  let m = s;
-  let c = _modpow(z, q, BN254_R);
-  let t = _modpow(y2, q, BN254_R);
-  let r = _modpow(y2, (q + 1n) / 2n, BN254_R);
-  for (; ; ) {
-    if (t === 1n) return r;
-    let i = 1n;
-    let tmp = t * t % BN254_R;
-    while (tmp !== 1n) {
-      tmp = tmp * tmp % BN254_R;
-      i++;
-    }
-    const b = _modpow(c, 1n << m - i - 1n, BN254_R);
-    m = i;
-    c = b * b % BN254_R;
-    t = t * c % BN254_R;
-    r = r * b % BN254_R;
-  }
-}
-function recoverOwnerPkPoint(ax) {
-  const x2 = ax * ax % BN254_R;
-  const num = ((1n - BJJ_A * x2) % BN254_R + BN254_R) % BN254_R;
-  const den = ((1n - BJJ_D * x2) % BN254_R + BN254_R) % BN254_R;
-  if (den === 0n) return null;
-  const denInv = _modpow(den, BN254_R - 2n, BN254_R);
-  const y2 = num * denInv % BN254_R;
-  const y = _sqrtModP(y2);
-  if (y === null) return null;
-  const yAlt = BN254_R - y;
-  try {
-    const check = mulPointEscalar2([ax, y], BABYJUB_SUBORDER);
-    return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
-  } catch {
-    return [ax, yAlt];
-  }
+// src/protocol/note/NoteBuilder.ts
+import { mulPointEscalar as mulPointEscalar3 } from "@zk-kit/baby-jubjub";
+import { randomBytes as randomBytes2 } from "@noble/ciphers/utils.js";
+import { poseidon2, poseidon4 } from "poseidon-lite";
+
+// src/foundation/crypto/blinding.ts
+function randomBlinding() {
+  const buf = new Uint8Array(32);
+  crypto.getRandomValues(buf);
+  const reduced = bytesToBigintLE(buf) % BN254_R;
+  return reduced === 0n ? 1n : reduced;
 }
 
 // src/protocol/note/NoteBuilder.ts
-import { mulPointEscalar as mulPointEscalar3, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
-import { randomBytes as randomBytes3 } from "@noble/ciphers/utils.js";
-import { poseidon2, poseidon4 } from "poseidon-lite";
 var NoteBuilder = class {
   /**
    * Build a ZkNote from the given inputs.
@@ -509,7 +492,7 @@ var NoteBuilder = class {
    * @param input.value            Amount in planck (required).
    * @param input.assetId          Asset ID — default 0n (native ORB-Privacy).
    * @param input.ownerPk          Sender's or recipient's global BabyJubJub Ax — default 0n.
-   * @param input.blinding         Random scalar — defaults to BigInt(Date.now()).
+   * @param input.blinding         Random scalar — defaults to a CSPRNG draw.
    * @param input.spendingKey      Secret key for nullifier — default 0n.
    * @param input.viewingPublicKey Recipient's 32-byte LE packed BJJ ivk. Triggers memo encryption.
    * @param input.recipientOwnerPk Recipient's global ownerPk. Required with viewingPublicKey
@@ -520,7 +503,7 @@ var NoteBuilder = class {
     const value = input.value;
     const assetId = input.assetId ?? 0n;
     const ownerPk = input.ownerPk ?? 0n;
-    const blinding = input.blinding ?? BigInt(Date.now());
+    const blinding = input.blinding ?? randomBlinding();
     const spendingKey = input.spendingKey ?? 0n;
     const sourcePk = input.sourcePk ?? 0n;
     const circuitVersion = input.circuitVersion ?? CURRENT_CIRCUIT_VERSION;
@@ -529,9 +512,9 @@ var NoteBuilder = class {
     if (useStealth) {
       const recipientOwnerPk = input.recipientOwnerPk;
       const recipientIvkPacked = input.viewingPublicKey;
-      const ephSk = input.ephSkOverride ?? randomBytes3(32);
+      const ephSk = input.ephSkOverride ?? randomBytes2(32);
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
-      const ivkPoint = unpackPoint2(ivkPackedBigint);
+      const ivkPoint = unpackUsableViewingKey(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("NoteBuilder.build: invalid recipient viewing public key");
       const ephSkScalar = BigInt(toHex(ephSk)) % BABYJUB_SUBORDER || 1n;
@@ -570,21 +553,6 @@ var NoteBuilder = class {
         throw new Error(
           `NoteBuilder.build: invariant violated \u2014 memo must be ${ENCRYPTED_MEMO_SIZE} bytes, got ${memo.length}`
         );
-      let ovkBlob;
-      if (input.outgoingViewingKey !== void 0) {
-        const ephPkBytes = Uint8Array.from(memo.slice(148, 180));
-        const sealed = sealOutgoingBlob(
-          input.outgoingViewingKey,
-          sharedSecret,
-          stealthCommitmentBytes,
-          ephPkBytes
-        );
-        if (sealed.length !== OVK_BLOB_SIZE)
-          throw new Error(
-            `NoteBuilder.build: invariant violated \u2014 ovkBlob must be ${OVK_BLOB_SIZE} bytes, got ${sealed.length}`
-          );
-        ovkBlob = Array.from(sealed);
-      }
       return {
         value,
         assetId,
@@ -599,8 +567,7 @@ var NoteBuilder = class {
         commitmentHex: toHex(commitmentBytes2),
         nullifierHex: toHex(nullifierBytes2),
         memo,
-        sourcePk,
-        ...ovkBlob ? { ovkBlob } : {}
+        sourcePk
       };
     }
     const commitment = poseidon4([value, assetId, ownerPk, blinding]);
@@ -650,7 +617,7 @@ var NoteBuilder = class {
    * @param note                    The ZkNote whose fields populate the plaintext.
    * @param recipientIvkPacked      32-byte LE packed BJJ viewing public key of the recipient.
    *                                Pass `new Uint8Array(32)` (default) for a public/dummy memo.
-   * @param sourcePk          32-byte counterparty BabyJubJub Ax.
+   * @param sourcePk                32-byte counterparty BabyJubJub Ax.
    *                                Pass `new Uint8Array(32)` (default) for no counterparty.
    */
   static buildMemo(note, recipientIvkPacked, sourcePk) {
@@ -730,18 +697,6 @@ function buildDummyTransferInput(assetId) {
 }
 
 // src/protocol/note/NoteDecryptor.ts
-function decryptAndVerifyPlaintext(memoBytes, commitmentBytes, sharedSecret, effectiveOwnerPk) {
-  const plaintext = EncryptedMemo.decryptWithSharedSecret(
-    memoBytes,
-    commitmentBytes,
-    sharedSecret
-  );
-  if (!plaintext) return null;
-  const ownerPk = effectiveOwnerPk ?? plaintext.ownerPk;
-  const recomputed = poseidon42([plaintext.value, plaintext.assetId, ownerPk, plaintext.blinding]);
-  if (recomputed !== bytesToBigintLE(commitmentBytes)) return null;
-  return plaintext;
-}
 function computeNullifier(commitment, spendingKey) {
   return poseidon22([commitment, spendingKey]);
 }
@@ -824,40 +779,6 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
     }
   };
 }
-function tryRecoverOutgoing(hint, ovk, opts) {
-  if (!hint.ovkBlob || !hint.encryptedMemo) return null;
-  let commitmentBytes;
-  let memoBytes;
-  let blobBytes;
-  try {
-    commitmentBytes = fromHex(hint.commitmentHex);
-    memoBytes = fromHex(hint.encryptedMemo);
-    blobBytes = fromHex(hint.ovkBlob);
-  } catch {
-    return null;
-  }
-  if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
-  if (blobBytes.length !== OVK_BLOB_SIZE) return null;
-  const ephPkBytes = memoBytes.subarray(148, 180);
-  const sharedSecret = openOutgoingBlob(ovk, blobBytes, commitmentBytes, ephPkBytes);
-  if (!sharedSecret) return null;
-  const activation = opts?.viewTagActivationLeaf;
-  if (activation !== void 0 && isValidLeafIndex(hint.leafIndex) && hint.leafIndex >= activation && !EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
-    return null;
-  }
-  const plaintext = decryptAndVerifyPlaintext(memoBytes, commitmentBytes, sharedSecret, null);
-  if (!plaintext) return null;
-  return {
-    commitmentHex: hint.commitmentHex,
-    ...isValidLeafIndex(hint.leafIndex) ? { leafIndex: hint.leafIndex } : {},
-    value: plaintext.value,
-    assetId: plaintext.assetId,
-    recipientStealthPk: plaintext.ownerPk,
-    blinding: plaintext.blinding,
-    sourcePk: plaintext.sourcePk,
-    circuitVersion: plaintext.circuitVersion
-  };
-}
 function collectOutgoingFacts(hint) {
   if (!isHexOfLength(hint.commitmentHex, 32)) return null;
   if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
@@ -868,6 +789,160 @@ function collectOutgoingFacts(hint) {
   };
 }
 
+// src/protocol/eph/outgoingEph.ts
+import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
+
+// src/protocol/eph/windowBounds.ts
+var MAX_EPH_WINDOW = 1 << 20;
+
+// src/foundation/crypto/keyGuards.ts
+var SECRET_KEY_SIZE = 32;
+function isUsableSecretKey(key) {
+  return key !== void 0 && key !== null && key.length === SECRET_KEY_SIZE && !key.every((b) => b === 0);
+}
+function assertSecretKeyBytes(key, label) {
+  if (key.length !== SECRET_KEY_SIZE) {
+    throw new Error(`${label} must be ${SECRET_KEY_SIZE} bytes, got ${key.length}`);
+  }
+  if (key.every((b) => b === 0)) {
+    throw new Error(`${label} is all zeros \u2014 that is not key material`);
+  }
+}
+
+// src/protocol/eph/outgoingEph.ts
+import { packPoint as packPoint2, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
+var OUTGOING_EPH_DOMAIN = new TextEncoder().encode("orbinum-outgoing-eph-v3");
+function deriveOutgoingEphSk(outgoingViewingKey, index) {
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`deriveOutgoingEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(outgoingViewingKey, "deriveOutgoingEphSk: outgoingViewingKey");
+  const h = sha2563.create();
+  h.update(OUTGOING_EPH_DOMAIN);
+  h.update(outgoingViewingKey);
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function deriveOutgoingEphPk(outgoingViewingKey, index) {
+  const scalar = bytesToBjjScalar(deriveOutgoingEphSk(outgoingViewingKey, index));
+  return toHex(bigintTo32Le(packPoint2(fastMulBase(scalar)))).toLowerCase();
+}
+function outgoingEphWindow(outgoingViewingKey, from, count) {
+  const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`outgoingEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `outgoingEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
+  for (let i = from; i < from + count; i++) {
+    entries.push({ index: i, ephPkHex: deriveOutgoingEphPk(outgoingViewingKey, i) });
+  }
+  return entries;
+}
+function deriveOutgoingSharedSecret(outgoingViewingKey, index, recipientIvkPacked) {
+  const ivkPoint = unpackPoint2(bytesToBigintLE(recipientIvkPacked));
+  if (!ivkPoint) throw new Error("deriveOutgoingSharedSecret: invalid viewing public key");
+  const scalar = bytesToBjjScalar(deriveOutgoingEphSk(outgoingViewingKey, index));
+  return bigintTo32Le(fastMulPoint(ivkPoint, scalar)[0]);
+}
+function reconstructOutgoingIndex(outgoingViewingKey, publishedEphPks, window) {
+  const published = /* @__PURE__ */ new Set();
+  for (const hex of publishedEphPks) published.add(hex.toLowerCase());
+  let highest = -1;
+  for (let i = 0; i < window; i++) {
+    if (published.has(deriveOutgoingEphPk(outgoingViewingKey, i))) highest = i;
+  }
+  return highest + 1;
+}
+
+// src/protocol/note/recoverSent.ts
+function recoverSentFromSharedSecret(hint, outgoingSharedSecret, ephIndex) {
+  if (!isHexOfLength(hint.commitmentHex, 32)) return null;
+  if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
+  try {
+    const plaintext = EncryptedMemo.decryptWithSharedSecret(
+      fromHex(hint.encryptedMemo),
+      fromHex(hint.commitmentHex),
+      outgoingSharedSecret
+    );
+    if (!plaintext) return null;
+    return {
+      commitmentHex: hint.commitmentHex,
+      ...isValidLeafIndex(hint.leafIndex) ? { leafIndex: hint.leafIndex } : {},
+      value: plaintext.value,
+      assetId: plaintext.assetId,
+      // On an outgoing note the memo's ownerPk IS the recipient's stealth
+      // owner — the builder wrote it that way.
+      recipientStealthPk: plaintext.ownerPk,
+      blinding: plaintext.blinding,
+      sourcePk: plaintext.sourcePk,
+      circuitVersion: plaintext.circuitVersion,
+      ephIndex
+    };
+  } catch {
+    return null;
+  }
+}
+function recoverSentNote(params) {
+  const { hint, outgoingViewingKey, ephIndex, recipientCandidates } = params;
+  if (!isHexOfLength(hint.commitmentHex, 32)) return null;
+  if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
+  for (const candidate of recipientCandidates) {
+    let sharedSecret;
+    try {
+      sharedSecret = deriveOutgoingSharedSecret(outgoingViewingKey, ephIndex, candidate);
+    } catch {
+      continue;
+    }
+    const facts = recoverSentFromSharedSecret(hint, sharedSecret, ephIndex);
+    if (facts) return { ...facts, recipientIvk: candidate };
+  }
+  return null;
+}
+
+// src/protocol/note/recipientBook.ts
+import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+var RECIPIENT_BOOK_DOMAIN = new TextEncoder().encode("orbinum-recipient-book-v3");
+var IVK_SIZE = 32;
+function bookKeystream(outgoingViewingKey, paymentCommitmentHex) {
+  if (outgoingViewingKey.length !== 32) {
+    throw new Error(
+      `recipientBook: outgoingViewingKey must be 32 bytes, got ${outgoingViewingKey.length}`
+    );
+  }
+  if (outgoingViewingKey.every((b) => b === 0)) {
+    throw new Error(
+      "recipientBook: outgoingViewingKey is all zeros \u2014 the book would be public"
+    );
+  }
+  const normalised = paymentCommitmentHex.toLowerCase().replace(/^0x/, "");
+  const h = sha2564.create();
+  h.update(RECIPIENT_BOOK_DOMAIN);
+  h.update(outgoingViewingKey);
+  h.update(new TextEncoder().encode(normalised));
+  return h.digest();
+}
+function sealRecipientBookEntry(ivkPacked, outgoingViewingKey, paymentCommitmentHex) {
+  if (ivkPacked.length !== IVK_SIZE) return ivkPacked;
+  const keystream = bookKeystream(outgoingViewingKey, paymentCommitmentHex);
+  const out = new Uint8Array(IVK_SIZE);
+  for (let i = 0; i < IVK_SIZE; i++) out[i] = ivkPacked[i] ^ keystream[i];
+  return out;
+}
+function openRecipientBookEntry(sealedSourcePk, outgoingViewingKey, paymentCommitmentHex) {
+  if (sealedSourcePk < 0n || sealedSourcePk >> 256n !== 0n) return new Uint8Array(IVK_SIZE);
+  return sealRecipientBookEntry(
+    bigintTo32Le(sealedSourcePk),
+    outgoingViewingKey,
+    paymentCommitmentHex
+  );
+}
+
 // src/protocol/note/NoteDisclosure.ts
 import { poseidon4 as poseidon43 } from "poseidon-lite";
 
@@ -953,29 +1028,41 @@ function decodeNoteDisclosureKey(key) {
 }
 
 // src/protocol/eph/selfEph.ts
-import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
-import { packPoint as packPoint2, unpackPoint as unpackPoint3 } from "@zk-kit/baby-jubjub";
-var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
-function deriveSelfEphSk(spendingKey, index) {
-  const h = sha2564.create();
+import { sha256 as sha2565 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint3, unpackPoint as unpackPoint3 } from "@zk-kit/baby-jubjub";
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v3");
+function deriveSelfEphSk(viewingSecretKey, index) {
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`deriveSelfEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(viewingSecretKey, "deriveSelfEphSk: viewingSecretKey");
+  const h = sha2565.create();
   h.update(SELF_EPH_DOMAIN);
-  h.update(bigintTo32Le(spendingKey));
+  h.update(viewingSecretKey);
   const idx = new Uint8Array(4);
   new DataView(idx.buffer).setUint32(0, index >>> 0, true);
   h.update(idx);
   return h.digest();
 }
-function selfEphWindow(spendingKey, ivkPacked, from, count) {
+function selfEphWindow(viewingSecretKey, ivkPacked, from, count) {
   const ivkPoint = unpackPoint3(bytesToBigintLE(ivkPacked));
   if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
   const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`selfEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `selfEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
   for (let i = from; i < from + count; i++) {
-    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(viewingSecretKey, i));
     const ephPk = fastMulBase(scalar);
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
       index: i,
-      ephPkHex: toHex(bigintTo32Le(packPoint2(ephPk))),
+      ephPkHex: toHex(bigintTo32Le(packPoint3(ephPk))),
       sharedSecret: bigintTo32Le(sharedPoint[0])
     });
   }
@@ -983,17 +1070,22 @@ function selfEphWindow(spendingKey, ivkPacked, from, count) {
 }
 
 // src/protocol/eph/pairwiseEph.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha2.js";
-import { packPoint as packPoint3, unpackPoint as unpackPoint4 } from "@zk-kit/baby-jubjub";
+import { sha256 as sha2566 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint4, unpackPoint as unpackPoint4 } from "@zk-kit/baby-jubjub";
 var PAIRWISE_EPH_DOMAIN = new TextEncoder().encode("orbinum-pairwise-eph-v1");
 function derivePairwiseSharedSecret(myViewingSk, theirIvkPacked) {
-  const theirPoint = unpackPoint4(bytesToBigintLE(theirIvkPacked));
+  const theirPoint = unpackUsableViewingKey(bytesToBigintLE(theirIvkPacked));
   if (!theirPoint) throw new Error("derivePairwiseSharedSecret: invalid viewing public key");
+  assertSecretKeyBytes(myViewingSk, "derivePairwiseSharedSecret: myViewingSk");
   const shared = fastMulPoint(theirPoint, bytesToBjjScalar(myViewingSk));
   return bigintTo32Le(shared[0]);
 }
 function derivePairwiseEphSk(pairSecret, index) {
-  const h = sha2565.create();
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`derivePairwiseEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(pairSecret, "derivePairwiseEphSk: pairSecret");
+  const h = sha2566.create();
   h.update(PAIRWISE_EPH_DOMAIN);
   h.update(pairSecret);
   const idx = new Uint8Array(4);
@@ -1005,13 +1097,21 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
   const ivkPoint = unpackPoint4(bytesToBigintLE(receiverIvkPacked));
   if (!ivkPoint) throw new Error("pairwiseEphWindow: invalid viewing public key");
   const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`pairwiseEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `pairwiseEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
   for (let i = from; i < from + count; i++) {
     const scalar = bytesToBjjScalar(derivePairwiseEphSk(pairSecret, i));
     const ephPk = fastMulBase(scalar);
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
       index: i,
-      ephPkHex: toHex(bigintTo32Le(packPoint3(ephPk))),
+      ephPkHex: toHex(bigintTo32Le(packPoint4(ephPk))),
       sharedSecret: bigintTo32Le(sharedPoint[0])
     });
   }
@@ -1019,11 +1119,10 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
 }
 
 // src/protocol/keys/PrivacyKeys.ts
-import { hkdf as hkdf3 } from "@noble/hashes/hkdf.js";
-import { sha256 as sha2566 } from "@noble/hashes/sha2.js";
-import { packPoint as packPoint4 } from "@zk-kit/baby-jubjub";
+import { hkdf as hkdf2 } from "@noble/hashes/hkdf.js";
+import { sha256 as sha2567 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint5 } from "@zk-kit/baby-jubjub";
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
-var OVK_DOMAIN = new TextEncoder().encode("orbinum-ovk-v1");
 var KEY_VERSION = "v2";
 function deriveSpendingKeyFromMaster(masterBytes) {
   const skBigint = BigInt(toHex(masterBytes)) % BABYJUB_SUBORDER;
@@ -1031,12 +1130,26 @@ function deriveSpendingKeyFromMaster(masterBytes) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return hkdf3(sha2566, ikm, void 0, IVK_DOMAIN, 32);
+  return hkdf2(sha2567, ikm, void 0, IVK_DOMAIN, 32);
+}
+var SPEND_V3_DOMAIN = new TextEncoder().encode("orbinum-spend-v3");
+var IVK_V3_DOMAIN = new TextEncoder().encode("orbinum-ivk-v3");
+var OVK_V3_DOMAIN = new TextEncoder().encode("orbinum-ovk-v3");
+var deriveBranch = (rootSecret, domain) => hkdf2(sha2567, rootSecret, void 0, domain, 32);
+function deriveSpendingKeyV3(rootSecret) {
+  const scalar = BigInt(toHex(deriveBranch(rootSecret, SPEND_V3_DOMAIN))) % BABYJUB_SUBORDER;
+  return scalar === 0n ? 1n : scalar;
+}
+function deriveViewingSecretKeyV3(rootSecret) {
+  return deriveBranch(rootSecret, IVK_V3_DOMAIN);
+}
+function deriveOutgoingViewingKeyV3(rootSecret) {
+  return deriveBranch(rootSecret, OVK_V3_DOMAIN);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
   const ivkPoint = fastMulBase(ivskScalar);
-  const packed = packPoint4(ivkPoint);
+  const packed = packPoint5(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
@@ -1047,19 +1160,22 @@ function deriveOwnerPk(spendingKey) {
     return 0n;
   }
 }
-function deriveOutgoingViewingKey(masterBytes) {
-  return hkdf3(sha2566, masterBytes, void 0, OVK_DOMAIN, 32);
-}
 
 // src/wallet/worker/kernel/types.ts
 var SELF_EPH_WINDOW = 1024;
 var PAIRWISE_EPH_WINDOW = 64;
+var OUTGOING_EPH_WINDOW = 64;
 var EMPTY_BATCH_RESULT = {
   notes: [],
   tagFiltered: 0,
   selfMatched: 0,
   pairwiseMatched: 0,
-  maxSelfEphIndex: null
+  maxSelfEphIndex: null,
+  maxOutgoingEphIndex: null,
+  sentNotes: [],
+  learnedRecipients: [],
+  unmatchedSent: [],
+  sealedBookEntries: []
 };
 
 // src/wallet/worker/kernel/ephWindow.ts
@@ -1067,23 +1183,21 @@ var cachedWindow = null;
 function clearKnownEphWindow() {
   cachedWindow = null;
 }
-function bytesKey(bytes) {
-  let out = "";
-  for (const b of bytes) out += b.toString(16).padStart(2, "0");
-  return out;
-}
 function getKnownEphWindow(keys) {
   const selfSize = keys.selfEphWindowSize ?? SELF_EPH_WINDOW;
   const pairSize = keys.pairwiseWindowSize ?? PAIRWISE_EPH_WINDOW;
+  const outSize = keys.outgoingEphWindowSize ?? OUTGOING_EPH_WINDOW;
   const counterparties = keys.pairwiseCounterparties ?? [];
-  if (!keys.selfEph && counterparties.length === 0) return null;
-  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:` + counterparties.map((c) => bytesKey(c)).join(",");
+  const canScanOutgoing = keys.outgoingEph === true && isUsableSecretKey(keys.outgoingViewingKey);
+  if (!keys.selfEph && !canScanOutgoing && counterparties.length === 0) return null;
+  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:${canScanOutgoing ? outSize : 0}:` + counterparties.map((c) => toHex(c)).join(",");
   if (cachedWindow?.cacheKey === cacheKey) return cachedWindow.window;
   try {
     const ivkPacked = deriveViewingPublicKey(keys.viewingKey);
     const byEphPk = /* @__PURE__ */ new Map();
+    const outgoingByEphPk = /* @__PURE__ */ new Map();
     if (keys.selfEph) {
-      for (const e of selfEphWindow(keys.spendingKey, ivkPacked, 0, selfSize)) {
+      for (const e of selfEphWindow(keys.viewingKey, ivkPacked, 0, selfSize)) {
         byEphPk.set(e.ephPkHex.toLowerCase(), {
           sharedSecret: e.sharedSecret,
           index: e.index,
@@ -1104,7 +1218,12 @@ function getKnownEphWindow(keys) {
         }
       }
     }
-    cachedWindow = { cacheKey, window: { byEphPk } };
+    if (canScanOutgoing) {
+      for (const e of outgoingEphWindow(keys.outgoingViewingKey, 0, outSize)) {
+        outgoingByEphPk.set(e.ephPkHex.toLowerCase(), e.index);
+      }
+    }
+    cachedWindow = { cacheKey, window: { byEphPk, outgoingByEphPk } };
     return cachedWindow.window;
   } catch {
     return null;
@@ -1113,21 +1232,32 @@ function getKnownEphWindow(keys) {
 
 // src/wallet/worker/kernel/decryptBatch.ts
 function hintEphPkHex(hint) {
-  if (hint.ephPkHex) return hint.ephPkHex.toLowerCase();
   const memo = hint.encryptedMemo;
   if (!memo || memo.length < 66) return null;
   return ("0x" + memo.slice(-64)).toLowerCase();
 }
+function sealedBookEntry(note) {
+  if (note.sourcePk === void 0 || note.sourcePk === 0n) return null;
+  return note.sourcePk;
+}
 function decryptHintBatch(hints, keys) {
   const activation = keys.viewTagActivationLeaf ?? null;
   const knownWindow = getKnownEphWindow(keys);
+  const sentNotes = [];
+  const learnedRecipients = /* @__PURE__ */ new Set();
   let tagFiltered = 0;
   let selfMatched = 0;
   let pairwiseMatched = 0;
   let maxSelfEphIndex = null;
+  let maxOutgoingEphIndex = null;
+  const sealedEntries = [];
+  const pendingSent = [];
+  const seenSent = /* @__PURE__ */ new Set();
+  const unmatchedSent = [];
   const notes = hints.map((hint) => {
     try {
-      const known = knownWindow?.byEphPk.get(hintEphPkHex(hint) ?? "");
+      const ephPkHex = hintEphPkHex(hint) ?? "";
+      const known = knownWindow?.byEphPk.get(ephPkHex);
       if (known) {
         const result2 = tryDecryptNoteVerbose(
           hint,
@@ -1142,12 +1272,26 @@ function decryptHintBatch(hints, keys) {
             if (maxSelfEphIndex === null || known.index > maxSelfEphIndex) {
               maxSelfEphIndex = known.index;
             }
+            const sealed = sealedBookEntry(result2.note);
+            if (sealed !== null) sealedEntries.push(sealed);
           } else {
             pairwiseMatched++;
           }
           return result2.note;
         }
       }
+      const outgoingIndex = knownWindow?.outgoingByEphPk.get(ephPkHex);
+      if (outgoingIndex !== void 0) {
+        if (maxOutgoingEphIndex === null || outgoingIndex > maxOutgoingEphIndex) {
+          maxOutgoingEphIndex = outgoingIndex;
+        }
+        const key = hint.commitmentHex.toLowerCase();
+        if (!seenSent.has(key)) {
+          seenSent.add(key);
+          pendingSent.push({ hint, ephIndex: outgoingIndex });
+        }
+        return null;
+      }
       const viewTag = activation !== null && hint.leafIndex >= activation;
       const result = tryDecryptNoteVerbose(
         hint,
@@ -1162,7 +1306,44 @@ function decryptHintBatch(hints, keys) {
       return null;
     }
   });
-  return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+  const carried = keys.recipientCandidates ?? [];
+  for (const { hint, ephIndex } of pendingSent) {
+    const candidates = [
+      ...sealedEntries.map(
+        (e) => openRecipientBookEntry(e, keys.outgoingViewingKey, hint.commitmentHex)
+      ),
+      ...carried
+    ];
+    const sent = recoverSentNote({
+      hint,
+      outgoingViewingKey: keys.outgoingViewingKey,
+      ephIndex,
+      recipientCandidates: candidates
+    });
+    if (!sent) {
+      unmatchedSent.push({ hint, ephIndex });
+      continue;
+    }
+    const { recipientIvk, ...facts } = sent;
+    learnedRecipients.add(toHex(recipientIvk));
+    sentNotes.push({
+      ...facts,
+      counterpartyIvkHex: toHex(recipientIvk),
+      encryptedMemo: hint.encryptedMemo ?? ""
+    });
+  }
+  return {
+    notes,
+    tagFiltered,
+    selfMatched,
+    pairwiseMatched,
+    maxSelfEphIndex,
+    maxOutgoingEphIndex,
+    sentNotes,
+    learnedRecipients: [...learnedRecipients],
+    unmatchedSent,
+    sealedBookEntries: sealedEntries.map((e) => e.toString())
+  };
 }
 
 // src/foundation/errors/abort.ts
@@ -1197,21 +1378,52 @@ function createMainThreadPool() {
       let selfMatched = 0;
       let pairwiseMatched = 0;
       let maxSelfEphIndex = null;
+      let maxOutgoingEphIndex = null;
+      const sentNotes = [];
+      const unmatchedSent = [];
+      const sealedBookEntries = /* @__PURE__ */ new Set();
+      const learnedRecipients = new Set(
+        (keys.recipientCandidates ?? []).map((c) => toHex(c))
+      );
       for (let i = 0; i < hints.length; i += DECRYPT_YIELD_EVERY) {
         if (i > 0) {
           await yieldToBrowser();
           if (signal?.aborted) throw scanAbortError();
         }
-        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), keys);
+        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), {
+          ...keys,
+          recipientCandidates: [...learnedRecipients].map((h) => fromHex(h))
+        });
         notes.push(...burst.notes);
         tagFiltered += burst.tagFiltered;
         selfMatched += burst.selfMatched;
         pairwiseMatched += burst.pairwiseMatched;
+        sentNotes.push(...burst.sentNotes ?? []);
+        unmatchedSent.push(...burst.unmatchedSent ?? []);
+        for (const e of burst.sealedBookEntries ?? []) sealedBookEntries.add(e);
+        for (const r of burst.learnedRecipients ?? []) learnedRecipients.add(r);
         if (burst.maxSelfEphIndex !== null) {
           maxSelfEphIndex = Math.max(maxSelfEphIndex ?? -1, burst.maxSelfEphIndex);
         }
+        if (burst.maxOutgoingEphIndex != null) {
+          maxOutgoingEphIndex = Math.max(
+            maxOutgoingEphIndex ?? -1,
+            burst.maxOutgoingEphIndex
+          );
+        }
       }
-      return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+      return {
+        notes,
+        tagFiltered,
+        selfMatched,
+        pairwiseMatched,
+        maxSelfEphIndex,
+        maxOutgoingEphIndex,
+        sentNotes,
+        learnedRecipients: [...learnedRecipients],
+        unmatchedSent,
+        sealedBookEntries: [...sealedBookEntries]
+      };
     },
     terminate() {
       clearKnownEphWindow();
@@ -1243,7 +1455,12 @@ function runOnWorker(worker, payload, signal) {
         tagFiltered: data.tagFiltered ?? 0,
         selfMatched: data.selfMatched ?? 0,
         pairwiseMatched: data.pairwiseMatched ?? 0,
-        maxSelfEphIndex: data.maxSelfEphIndex ?? null
+        maxSelfEphIndex: data.maxSelfEphIndex ?? null,
+        maxOutgoingEphIndex: data.maxOutgoingEphIndex ?? null,
+        sentNotes: data.sentNotes ?? [],
+        learnedRecipients: data.learnedRecipients ?? [],
+        unmatchedSent: data.unmatchedSent ?? [],
+        sealedBookEntries: data.sealedBookEntries ?? []
       });
     };
     worker.onerror = () => {
@@ -1270,9 +1487,19 @@ function mergeResults(results) {
     tagFiltered: results.reduce((sum, r) => sum + r.tagFiltered, 0),
     selfMatched: results.reduce((sum, r) => sum + r.selfMatched, 0),
     pairwiseMatched: results.reduce((sum, r) => sum + r.pairwiseMatched, 0),
+    sentNotes: results.flatMap((r) => r.sentNotes ?? []),
+    // Deduped: slices run in parallel, so the same change note cannot be
+    // seen twice, but two different ones may name the same recipient.
+    learnedRecipients: [...new Set(results.flatMap((r) => r.learnedRecipients ?? []))],
+    unmatchedSent: results.flatMap((r) => r.unmatchedSent ?? []),
+    sealedBookEntries: [...new Set(results.flatMap((r) => r.sealedBookEntries ?? []))],
     maxSelfEphIndex: results.reduce(
       (max, r) => r.maxSelfEphIndex === null ? max : Math.max(max ?? -1, r.maxSelfEphIndex),
       null
+    ),
+    maxOutgoingEphIndex: results.reduce(
+      (max, r) => r.maxOutgoingEphIndex == null ? max : Math.max(max ?? -1, r.maxOutgoingEphIndex),
+      null
     )
   };
 }
@@ -1339,10 +1566,14 @@ export {
   BN254_R,
   BABYJUB_SUBORDER,
   recoverOwnerPkPoint,
+  unpackUsableViewingKey,
+  isUsableSecretKey,
+  assertSecretKeyBytes,
   fastMulBase,
   fastMulPoint,
   deriveStealthOwnerPk,
   deriveStealthSk,
+  randomBlinding,
   scanAbortError,
   isAbortError,
   serializeMemo,
@@ -1350,11 +1581,6 @@ export {
   ENCRYPTED_MEMO_SIZE,
   bytesToBjjScalar,
   EncryptedMemo,
-  OVK_BLOB_SIZE,
-  deriveOutgoingCipherKey,
-  sealOutgoingBlob,
-  openOutgoingBlob,
-  randomOutgoingBlob,
   LEAVES_PER_TREE,
   isValidLeafIndex,
   treeIdOf,
@@ -1367,6 +1593,11 @@ export {
   derivePairwiseSharedSecret,
   derivePairwiseEphSk,
   pairwiseEphWindow,
+  deriveOutgoingEphSk,
+  deriveOutgoingEphPk,
+  outgoingEphWindow,
+  deriveOutgoingSharedSecret,
+  reconstructOutgoingIndex,
   CURRENT_CIRCUIT_VERSION,
   NoteBuilder,
   computeNullifier,
@@ -1374,18 +1605,24 @@ export {
   computeNoteCommitment,
   tryDecryptNote,
   tryDecryptNoteVerbose,
-  tryRecoverOutgoing,
   collectOutgoingFacts,
+  recoverSentFromSharedSecret,
+  recoverSentNote,
+  sealRecipientBookEntry,
+  openRecipientBookEntry,
   createNoteDisclosureKey,
   decodeNoteDisclosureKey,
   KEY_VERSION,
   deriveSpendingKeyFromMaster,
   deriveViewingSecretKey,
+  deriveSpendingKeyV3,
+  deriveViewingSecretKeyV3,
+  deriveOutgoingViewingKeyV3,
   deriveViewingPublicKey,
   deriveOwnerPk,
-  deriveOutgoingViewingKey,
   SELF_EPH_WINDOW,
   PAIRWISE_EPH_WINDOW,
+  OUTGOING_EPH_WINDOW,
   EMPTY_BATCH_RESULT,
   clearKnownEphWindow,
   getKnownEphWindow,