@orbinum/sdk 2.1.0 → 3.0.0

package/dist/wallet/worker/index.js

@@ -23,6 +23,7 @@ __export(worker_exports, {
   DECRYPT_YIELD_EVERY: () => DECRYPT_YIELD_EVERY,
   EMPTY_BATCH_RESULT: () => EMPTY_BATCH_RESULT,
   MAX_WORKERS: () => MAX_WORKERS,
+  OUTGOING_EPH_WINDOW: () => OUTGOING_EPH_WINDOW,
   PAIRWISE_EPH_WINDOW: () => PAIRWISE_EPH_WINDOW,
   SELF_EPH_WINDOW: () => SELF_EPH_WINDOW,
   WORKER_CRASHED: () => WORKER_CRASHED,
@@ -38,7 +39,7 @@ module.exports = __toCommonJS(worker_exports);
 // src/protocol/memo/EncryptedMemo.ts
 var import_chacha = require("@noble/ciphers/chacha.js");
 var import_utils = require("@noble/ciphers/utils.js");
-var import_baby_jubjub = require("@zk-kit/baby-jubjub");
+var import_baby_jubjub2 = require("@zk-kit/baby-jubjub");
 
 // src/foundation/crypto/bjj-fast.ts
 var import_edwards = require("@noble/curves/abstract/edwards.js");
@@ -66,7 +67,88 @@ function fastMulPoint(point, scalar) {
   return [x, y];
 }
 
+// src/foundation/crypto/bjj.ts
+var import_baby_jubjub = require("@zk-kit/baby-jubjub");
+
+// src/foundation/crypto/constants.ts
+var BN254_R = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var BABYJUB_SUBORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+
+// src/foundation/crypto/bjj.ts
+var BJJ_A = 168700n;
+var BJJ_D = 168696n;
+var BJJ_COFACTOR = 8n;
+function _modpow(base, exp, mod) {
+  let result = 1n;
+  base = base % mod;
+  while (exp > 0n) {
+    if (exp & 1n) result = result * base % mod;
+    exp >>= 1n;
+    base = base * base % mod;
+  }
+  return result;
+}
+function _sqrtModP(y2) {
+  if (y2 === 0n) return 0n;
+  if (_modpow(y2, (BN254_R - 1n) / 2n, BN254_R) !== 1n) return null;
+  let s = 0n;
+  let q = BN254_R - 1n;
+  while ((q & 1n) === 0n) {
+    q >>= 1n;
+    s++;
+  }
+  if (s === 1n) return _modpow(y2, (BN254_R + 1n) / 4n, BN254_R);
+  let z = 2n;
+  while (_modpow(z, (BN254_R - 1n) / 2n, BN254_R) === 1n) z++;
+  let m = s;
+  let c = _modpow(z, q, BN254_R);
+  let t = _modpow(y2, q, BN254_R);
+  let r = _modpow(y2, (q + 1n) / 2n, BN254_R);
+  for (; ; ) {
+    if (t === 1n) return r;
+    let i = 1n;
+    let tmp = t * t % BN254_R;
+    while (tmp !== 1n) {
+      tmp = tmp * tmp % BN254_R;
+      i++;
+    }
+    const b = _modpow(c, 1n << m - i - 1n, BN254_R);
+    m = i;
+    c = b * b % BN254_R;
+    t = t * c % BN254_R;
+    r = r * b % BN254_R;
+  }
+}
+function recoverOwnerPkPoint(ax) {
+  const x2 = ax * ax % BN254_R;
+  const num = ((1n - BJJ_A * x2) % BN254_R + BN254_R) % BN254_R;
+  const den = ((1n - BJJ_D * x2) % BN254_R + BN254_R) % BN254_R;
+  if (den === 0n) return null;
+  const denInv = _modpow(den, BN254_R - 2n, BN254_R);
+  const y2 = num * denInv % BN254_R;
+  const y = _sqrtModP(y2);
+  if (y === null) return null;
+  const yAlt = BN254_R - y;
+  try {
+    const check = (0, import_baby_jubjub.mulPointEscalar)([ax, y], BABYJUB_SUBORDER);
+    return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
+  } catch {
+    return [ax, yAlt];
+  }
+}
+function unpackUsableViewingKey(packed) {
+  const point = (0, import_baby_jubjub.unpackPoint)(packed);
+  if (!point) return null;
+  if (point[0] === 0n && point[1] === 1n) return null;
+  const cleared = (0, import_baby_jubjub.mulPointEscalar)(point, BJJ_COFACTOR);
+  if (cleared[0] === 0n && cleared[1] === 1n) return null;
+  return point;
+}
+
 // src/foundation/encoding/hex.ts
+function isHexOfLength(value, byteLen) {
+  return typeof value === "string" && new RegExp(`^0x[0-9a-fA-F]{${byteLen * 2}}$`).test(value);
+}
 function toHex(bytes) {
   return "0x" + Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -109,16 +191,21 @@ function bytesToBigintLE(bytes) {
   return result;
 }
 
-// src/foundation/crypto/constants.ts
-var BN254_R = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
-var BABYJUB_SUBORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
-
 // src/protocol/memo/plaintext.ts
 var import_sha2 = require("@noble/hashes/sha2.js");
 var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
 var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
 var MEMO_PLAINTEXT_SIZE = 120;
 function serializeMemo(value, ownerPk, blinding, assetId, sourcePk, circuitVersion) {
+  if (value < 0n || value >> 128n !== 0n) {
+    throw new Error(`serializeMemo: value must fit in 128 unsigned bits, got ${value}`);
+  }
+  if (!Number.isInteger(assetId) || assetId < 0 || assetId > 4294967295) {
+    throw new Error(`serializeMemo: assetId must be a u32, got ${assetId}`);
+  }
+  if (!Number.isInteger(circuitVersion) || circuitVersion < 0 || circuitVersion > 4294967295) {
+    throw new Error(`serializeMemo: circuitVersion must be a u32, got ${circuitVersion}`);
+  }
   const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
   const view = new DataView(buf.buffer);
   view.setBigUint64(0, value & 0xffffffffffffffffn, true);
@@ -150,6 +237,9 @@ var CIPHERTEXT_SIZE = 136;
 var EPH_PK_SIZE = 32;
 var ENCRYPTED_MEMO_SIZE = NONCE_SIZE + CIPHERTEXT_SIZE + EPH_PK_SIZE;
 function bytesToBjjScalar(bytes) {
+  if (bytes.length !== 32) {
+    throw new Error(`bytesToBjjScalar: expected 32 bytes, got ${bytes.length}`);
+  }
   const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
   return BigInt("0x" + hex) % BABYJUB_SUBORDER || 1n;
 }
@@ -173,7 +263,7 @@ function parsePlaintext(nonce, ciphertextWithMac, encKey) {
 }
 var EncryptedMemo = {
   /**
-   * Build and encrypt a memo for a note using ECDH (v2, 180 bytes).
+   * Build and encrypt a memo for a note using ECDH (180 bytes).
    *
    * @param value              Note value in planck.
    * @param ownerPk            32-byte owner public key (LE).
@@ -211,9 +301,9 @@ var EncryptedMemo = {
         throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
       const ephSkScalar = bytesToBjjScalar(ephSkBytes);
       const ephPkPoint = fastMulBase(ephSkScalar);
-      ephPkPackedBytes = bigintTo32Le((0, import_baby_jubjub.packPoint)(ephPkPoint));
+      ephPkPackedBytes = bigintTo32Le((0, import_baby_jubjub2.packPoint)(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
-      const ivkPoint = (0, import_baby_jubjub.unpackPoint)(ivkPackedBigint);
+      const ivkPoint = unpackUsableViewingKey(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
       const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
@@ -303,7 +393,7 @@ var EncryptedMemo = {
     if (ephPkPackedBigint === 0n) {
       return new Uint8Array(32);
     }
-    const ephPkPoint = (0, import_baby_jubjub.unpackPoint)(ephPkPackedBigint);
+    const ephPkPoint = unpackUsableViewingKey(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
     const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
@@ -313,9 +403,9 @@ var EncryptedMemo = {
    * Cheap view-tag check: does memo nonce[0] match the tag derived from
    * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
    *
-   * Only meaningful for memos built with view tags (commitments at/after
-   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
-   * there and would false-negative 255/256 of the time.
+   * Only meaningful for memos that carry a tag — at or after
+   * `ScanKeys.viewTagActivationLeaf`. An older memo has a random byte there
+   * and would false-negative 255/256 of the time.
    */
   checkViewTag(memoBytes, sharedSecret) {
     if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
@@ -344,7 +434,7 @@ var EncryptedMemo = {
 // src/foundation/crypto/stealth.ts
 var import_sha22 = require("@noble/hashes/sha2.js");
 var import_hkdf = require("@noble/hashes/hkdf.js");
-var import_baby_jubjub2 = require("@zk-kit/baby-jubjub");
+var import_baby_jubjub3 = require("@zk-kit/baby-jubjub");
 var STEALTH_INFO = new TextEncoder().encode("orbinum-stealth-v1");
 function deriveStealthScalar(sharedSecret, ownerPkBigint) {
   const salt = bigintTo32Le(ownerPkBigint);
@@ -353,7 +443,7 @@ function deriveStealthScalar(sharedSecret, ownerPkBigint) {
 }
 function deriveStealthOwnerPk(sharedSecret, ownerPkBigint, ownerPkPoint) {
   const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
-  const stealthPt = (0, import_baby_jubjub2.addPoint)((0, import_baby_jubjub2.mulPointEscalar)(import_baby_jubjub2.Base8, stealthScalar), ownerPkPoint);
+  const stealthPt = (0, import_baby_jubjub3.addPoint)((0, import_baby_jubjub3.mulPointEscalar)(import_baby_jubjub3.Base8, stealthScalar), ownerPkPoint);
   return stealthPt[0];
 }
 function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
@@ -361,69 +451,6 @@ function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
   return (stealthScalar + spendingKey) % BABYJUB_SUBORDER || 1n;
 }
 
-// src/foundation/crypto/bjj.ts
-var import_baby_jubjub3 = require("@zk-kit/baby-jubjub");
-var BJJ_A = 168700n;
-var BJJ_D = 168696n;
-function _modpow(base, exp, mod) {
-  let result = 1n;
-  base = base % mod;
-  while (exp > 0n) {
-    if (exp & 1n) result = result * base % mod;
-    exp >>= 1n;
-    base = base * base % mod;
-  }
-  return result;
-}
-function _sqrtModP(y2) {
-  if (y2 === 0n) return 0n;
-  if (_modpow(y2, (BN254_R - 1n) / 2n, BN254_R) !== 1n) return null;
-  let s = 0n;
-  let q = BN254_R - 1n;
-  while ((q & 1n) === 0n) {
-    q >>= 1n;
-    s++;
-  }
-  if (s === 1n) return _modpow(y2, (BN254_R + 1n) / 4n, BN254_R);
-  let z = 2n;
-  while (_modpow(z, (BN254_R - 1n) / 2n, BN254_R) === 1n) z++;
-  let m = s;
-  let c = _modpow(z, q, BN254_R);
-  let t = _modpow(y2, q, BN254_R);
-  let r = _modpow(y2, (q + 1n) / 2n, BN254_R);
-  for (; ; ) {
-    if (t === 1n) return r;
-    let i = 1n;
-    let tmp = t * t % BN254_R;
-    while (tmp !== 1n) {
-      tmp = tmp * tmp % BN254_R;
-      i++;
-    }
-    const b = _modpow(c, 1n << m - i - 1n, BN254_R);
-    m = i;
-    c = b * b % BN254_R;
-    t = t * c % BN254_R;
-    r = r * b % BN254_R;
-  }
-}
-function recoverOwnerPkPoint(ax) {
-  const x2 = ax * ax % BN254_R;
-  const num = ((1n - BJJ_A * x2) % BN254_R + BN254_R) % BN254_R;
-  const den = ((1n - BJJ_D * x2) % BN254_R + BN254_R) % BN254_R;
-  if (den === 0n) return null;
-  const denInv = _modpow(den, BN254_R - 2n, BN254_R);
-  const y2 = num * denInv % BN254_R;
-  const y = _sqrtModP(y2);
-  if (y === null) return null;
-  const yAlt = BN254_R - y;
-  try {
-    const check = (0, import_baby_jubjub3.mulPointEscalar)([ax, y], BABYJUB_SUBORDER);
-    return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
-  } catch {
-    return [ax, yAlt];
-  }
-}
-
 // src/protocol/note/NoteDecryptor.ts
 var import_poseidon_lite = require("poseidon-lite");
 
@@ -506,30 +533,187 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
   };
 }
 
-// src/protocol/eph/selfEph.ts
+// src/protocol/eph/outgoingEph.ts
 var import_sha23 = require("@noble/hashes/sha2.js");
+
+// src/protocol/eph/windowBounds.ts
+var MAX_EPH_WINDOW = 1 << 20;
+
+// src/foundation/crypto/keyGuards.ts
+var SECRET_KEY_SIZE = 32;
+function isUsableSecretKey(key) {
+  return key !== void 0 && key !== null && key.length === SECRET_KEY_SIZE && !key.every((b) => b === 0);
+}
+function assertSecretKeyBytes(key, label) {
+  if (key.length !== SECRET_KEY_SIZE) {
+    throw new Error(`${label} must be ${SECRET_KEY_SIZE} bytes, got ${key.length}`);
+  }
+  if (key.every((b) => b === 0)) {
+    throw new Error(`${label} is all zeros \u2014 that is not key material`);
+  }
+}
+
+// src/protocol/eph/outgoingEph.ts
 var import_baby_jubjub4 = require("@zk-kit/baby-jubjub");
-var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
-function deriveSelfEphSk(spendingKey, index) {
+var OUTGOING_EPH_DOMAIN = new TextEncoder().encode("orbinum-outgoing-eph-v3");
+function deriveOutgoingEphSk(outgoingViewingKey, index) {
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`deriveOutgoingEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(outgoingViewingKey, "deriveOutgoingEphSk: outgoingViewingKey");
   const h = import_sha23.sha256.create();
+  h.update(OUTGOING_EPH_DOMAIN);
+  h.update(outgoingViewingKey);
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function deriveOutgoingEphPk(outgoingViewingKey, index) {
+  const scalar = bytesToBjjScalar(deriveOutgoingEphSk(outgoingViewingKey, index));
+  return toHex(bigintTo32Le((0, import_baby_jubjub4.packPoint)(fastMulBase(scalar)))).toLowerCase();
+}
+function outgoingEphWindow(outgoingViewingKey, from, count) {
+  const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`outgoingEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `outgoingEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
+  for (let i = from; i < from + count; i++) {
+    entries.push({ index: i, ephPkHex: deriveOutgoingEphPk(outgoingViewingKey, i) });
+  }
+  return entries;
+}
+function deriveOutgoingSharedSecret(outgoingViewingKey, index, recipientIvkPacked) {
+  const ivkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(recipientIvkPacked));
+  if (!ivkPoint) throw new Error("deriveOutgoingSharedSecret: invalid viewing public key");
+  const scalar = bytesToBjjScalar(deriveOutgoingEphSk(outgoingViewingKey, index));
+  return bigintTo32Le(fastMulPoint(ivkPoint, scalar)[0]);
+}
+
+// src/protocol/note/recoverSent.ts
+function recoverSentFromSharedSecret(hint, outgoingSharedSecret, ephIndex) {
+  if (!isHexOfLength(hint.commitmentHex, 32)) return null;
+  if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
+  try {
+    const plaintext = EncryptedMemo.decryptWithSharedSecret(
+      fromHex(hint.encryptedMemo),
+      fromHex(hint.commitmentHex),
+      outgoingSharedSecret
+    );
+    if (!plaintext) return null;
+    return {
+      commitmentHex: hint.commitmentHex,
+      ...isValidLeafIndex(hint.leafIndex) ? { leafIndex: hint.leafIndex } : {},
+      value: plaintext.value,
+      assetId: plaintext.assetId,
+      // On an outgoing note the memo's ownerPk IS the recipient's stealth
+      // owner — the builder wrote it that way.
+      recipientStealthPk: plaintext.ownerPk,
+      blinding: plaintext.blinding,
+      sourcePk: plaintext.sourcePk,
+      circuitVersion: plaintext.circuitVersion,
+      ephIndex
+    };
+  } catch {
+    return null;
+  }
+}
+function recoverSentNote(params) {
+  const { hint, outgoingViewingKey, ephIndex, recipientCandidates } = params;
+  if (!isHexOfLength(hint.commitmentHex, 32)) return null;
+  if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
+  for (const candidate of recipientCandidates) {
+    let sharedSecret;
+    try {
+      sharedSecret = deriveOutgoingSharedSecret(outgoingViewingKey, ephIndex, candidate);
+    } catch {
+      continue;
+    }
+    const facts = recoverSentFromSharedSecret(hint, sharedSecret, ephIndex);
+    if (facts) return { ...facts, recipientIvk: candidate };
+  }
+  return null;
+}
+
+// src/protocol/note/recipientBook.ts
+var import_sha24 = require("@noble/hashes/sha2.js");
+var RECIPIENT_BOOK_DOMAIN = new TextEncoder().encode("orbinum-recipient-book-v3");
+var IVK_SIZE = 32;
+function bookKeystream(outgoingViewingKey, paymentCommitmentHex) {
+  if (outgoingViewingKey.length !== 32) {
+    throw new Error(
+      `recipientBook: outgoingViewingKey must be 32 bytes, got ${outgoingViewingKey.length}`
+    );
+  }
+  if (outgoingViewingKey.every((b) => b === 0)) {
+    throw new Error(
+      "recipientBook: outgoingViewingKey is all zeros \u2014 the book would be public"
+    );
+  }
+  const normalised = paymentCommitmentHex.toLowerCase().replace(/^0x/, "");
+  const h = import_sha24.sha256.create();
+  h.update(RECIPIENT_BOOK_DOMAIN);
+  h.update(outgoingViewingKey);
+  h.update(new TextEncoder().encode(normalised));
+  return h.digest();
+}
+function sealRecipientBookEntry(ivkPacked, outgoingViewingKey, paymentCommitmentHex) {
+  if (ivkPacked.length !== IVK_SIZE) return ivkPacked;
+  const keystream = bookKeystream(outgoingViewingKey, paymentCommitmentHex);
+  const out = new Uint8Array(IVK_SIZE);
+  for (let i = 0; i < IVK_SIZE; i++) out[i] = ivkPacked[i] ^ keystream[i];
+  return out;
+}
+function openRecipientBookEntry(sealedSourcePk, outgoingViewingKey, paymentCommitmentHex) {
+  if (sealedSourcePk < 0n || sealedSourcePk >> 256n !== 0n) return new Uint8Array(IVK_SIZE);
+  return sealRecipientBookEntry(
+    bigintTo32Le(sealedSourcePk),
+    outgoingViewingKey,
+    paymentCommitmentHex
+  );
+}
+
+// src/protocol/eph/selfEph.ts
+var import_sha25 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v3");
+function deriveSelfEphSk(viewingSecretKey, index) {
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`deriveSelfEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(viewingSecretKey, "deriveSelfEphSk: viewingSecretKey");
+  const h = import_sha25.sha256.create();
   h.update(SELF_EPH_DOMAIN);
-  h.update(bigintTo32Le(spendingKey));
+  h.update(viewingSecretKey);
   const idx = new Uint8Array(4);
   new DataView(idx.buffer).setUint32(0, index >>> 0, true);
   h.update(idx);
   return h.digest();
 }
-function selfEphWindow(spendingKey, ivkPacked, from, count) {
-  const ivkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(ivkPacked));
+function selfEphWindow(viewingSecretKey, ivkPacked, from, count) {
+  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(ivkPacked));
   if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
   const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`selfEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `selfEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
   for (let i = from; i < from + count; i++) {
-    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(viewingSecretKey, i));
     const ephPk = fastMulBase(scalar);
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
       index: i,
-      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub4.packPoint)(ephPk))),
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
       sharedSecret: bigintTo32Le(sharedPoint[0])
     });
   }
@@ -537,17 +721,22 @@ function selfEphWindow(spendingKey, ivkPacked, from, count) {
 }
 
 // src/protocol/eph/pairwiseEph.ts
-var import_sha24 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var import_sha26 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
 var PAIRWISE_EPH_DOMAIN = new TextEncoder().encode("orbinum-pairwise-eph-v1");
 function derivePairwiseSharedSecret(myViewingSk, theirIvkPacked) {
-  const theirPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(theirIvkPacked));
+  const theirPoint = unpackUsableViewingKey(bytesToBigintLE(theirIvkPacked));
   if (!theirPoint) throw new Error("derivePairwiseSharedSecret: invalid viewing public key");
+  assertSecretKeyBytes(myViewingSk, "derivePairwiseSharedSecret: myViewingSk");
   const shared = fastMulPoint(theirPoint, bytesToBjjScalar(myViewingSk));
   return bigintTo32Le(shared[0]);
 }
 function derivePairwiseEphSk(pairSecret, index) {
-  const h = import_sha24.sha256.create();
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`derivePairwiseEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(pairSecret, "derivePairwiseEphSk: pairSecret");
+  const h = import_sha26.sha256.create();
   h.update(PAIRWISE_EPH_DOMAIN);
   h.update(pairSecret);
   const idx = new Uint8Array(4);
@@ -556,16 +745,24 @@ function derivePairwiseEphSk(pairSecret, index) {
   return h.digest();
 }
 function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
-  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(receiverIvkPacked));
+  const ivkPoint = (0, import_baby_jubjub6.unpackPoint)(bytesToBigintLE(receiverIvkPacked));
   if (!ivkPoint) throw new Error("pairwiseEphWindow: invalid viewing public key");
   const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`pairwiseEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `pairwiseEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
   for (let i = from; i < from + count; i++) {
     const scalar = bytesToBjjScalar(derivePairwiseEphSk(pairSecret, i));
     const ephPk = fastMulBase(scalar);
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
       index: i,
-      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub6.packPoint)(ephPk))),
       sharedSecret: bigintTo32Le(sharedPoint[0])
     });
   }
@@ -574,26 +771,34 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
 
 // src/protocol/keys/PrivacyKeys.ts
 var import_hkdf2 = require("@noble/hashes/hkdf.js");
-var import_sha25 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
+var import_sha27 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
-var OVK_DOMAIN = new TextEncoder().encode("orbinum-ovk-v1");
+var SPEND_V3_DOMAIN = new TextEncoder().encode("orbinum-spend-v3");
+var IVK_V3_DOMAIN = new TextEncoder().encode("orbinum-ivk-v3");
+var OVK_V3_DOMAIN = new TextEncoder().encode("orbinum-ovk-v3");
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
   const ivkPoint = fastMulBase(ivskScalar);
-  const packed = (0, import_baby_jubjub6.packPoint)(ivkPoint);
+  const packed = (0, import_baby_jubjub7.packPoint)(ivkPoint);
   return bigintTo32Le(packed);
 }
 
 // src/wallet/worker/kernel/types.ts
 var SELF_EPH_WINDOW = 1024;
 var PAIRWISE_EPH_WINDOW = 64;
+var OUTGOING_EPH_WINDOW = 64;
 var EMPTY_BATCH_RESULT = {
   notes: [],
   tagFiltered: 0,
   selfMatched: 0,
   pairwiseMatched: 0,
-  maxSelfEphIndex: null
+  maxSelfEphIndex: null,
+  maxOutgoingEphIndex: null,
+  sentNotes: [],
+  learnedRecipients: [],
+  unmatchedSent: [],
+  sealedBookEntries: []
 };
 
 // src/wallet/worker/kernel/ephWindow.ts
@@ -601,23 +806,21 @@ var cachedWindow = null;
 function clearKnownEphWindow() {
   cachedWindow = null;
 }
-function bytesKey(bytes) {
-  let out = "";
-  for (const b of bytes) out += b.toString(16).padStart(2, "0");
-  return out;
-}
 function getKnownEphWindow(keys) {
   const selfSize = keys.selfEphWindowSize ?? SELF_EPH_WINDOW;
   const pairSize = keys.pairwiseWindowSize ?? PAIRWISE_EPH_WINDOW;
+  const outSize = keys.outgoingEphWindowSize ?? OUTGOING_EPH_WINDOW;
   const counterparties = keys.pairwiseCounterparties ?? [];
-  if (!keys.selfEph && counterparties.length === 0) return null;
-  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:` + counterparties.map((c) => bytesKey(c)).join(",");
+  const canScanOutgoing = keys.outgoingEph === true && isUsableSecretKey(keys.outgoingViewingKey);
+  if (!keys.selfEph && !canScanOutgoing && counterparties.length === 0) return null;
+  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:${canScanOutgoing ? outSize : 0}:` + counterparties.map((c) => toHex(c)).join(",");
   if (cachedWindow?.cacheKey === cacheKey) return cachedWindow.window;
   try {
     const ivkPacked = deriveViewingPublicKey(keys.viewingKey);
     const byEphPk = /* @__PURE__ */ new Map();
+    const outgoingByEphPk = /* @__PURE__ */ new Map();
     if (keys.selfEph) {
-      for (const e of selfEphWindow(keys.spendingKey, ivkPacked, 0, selfSize)) {
+      for (const e of selfEphWindow(keys.viewingKey, ivkPacked, 0, selfSize)) {
         byEphPk.set(e.ephPkHex.toLowerCase(), {
           sharedSecret: e.sharedSecret,
           index: e.index,
@@ -638,7 +841,12 @@ function getKnownEphWindow(keys) {
         }
       }
     }
-    cachedWindow = { cacheKey, window: { byEphPk } };
+    if (canScanOutgoing) {
+      for (const e of outgoingEphWindow(keys.outgoingViewingKey, 0, outSize)) {
+        outgoingByEphPk.set(e.ephPkHex.toLowerCase(), e.index);
+      }
+    }
+    cachedWindow = { cacheKey, window: { byEphPk, outgoingByEphPk } };
     return cachedWindow.window;
   } catch {
     return null;
@@ -647,21 +855,32 @@ function getKnownEphWindow(keys) {
 
 // src/wallet/worker/kernel/decryptBatch.ts
 function hintEphPkHex(hint) {
-  if (hint.ephPkHex) return hint.ephPkHex.toLowerCase();
   const memo = hint.encryptedMemo;
   if (!memo || memo.length < 66) return null;
   return ("0x" + memo.slice(-64)).toLowerCase();
 }
+function sealedBookEntry(note) {
+  if (note.sourcePk === void 0 || note.sourcePk === 0n) return null;
+  return note.sourcePk;
+}
 function decryptHintBatch(hints, keys) {
   const activation = keys.viewTagActivationLeaf ?? null;
   const knownWindow = getKnownEphWindow(keys);
+  const sentNotes = [];
+  const learnedRecipients = /* @__PURE__ */ new Set();
   let tagFiltered = 0;
   let selfMatched = 0;
   let pairwiseMatched = 0;
   let maxSelfEphIndex = null;
+  let maxOutgoingEphIndex = null;
+  const sealedEntries = [];
+  const pendingSent = [];
+  const seenSent = /* @__PURE__ */ new Set();
+  const unmatchedSent = [];
   const notes = hints.map((hint) => {
     try {
-      const known = knownWindow?.byEphPk.get(hintEphPkHex(hint) ?? "");
+      const ephPkHex = hintEphPkHex(hint) ?? "";
+      const known = knownWindow?.byEphPk.get(ephPkHex);
       if (known) {
         const result2 = tryDecryptNoteVerbose(
           hint,
@@ -676,12 +895,26 @@ function decryptHintBatch(hints, keys) {
             if (maxSelfEphIndex === null || known.index > maxSelfEphIndex) {
               maxSelfEphIndex = known.index;
             }
+            const sealed = sealedBookEntry(result2.note);
+            if (sealed !== null) sealedEntries.push(sealed);
           } else {
             pairwiseMatched++;
           }
           return result2.note;
         }
       }
+      const outgoingIndex = knownWindow?.outgoingByEphPk.get(ephPkHex);
+      if (outgoingIndex !== void 0) {
+        if (maxOutgoingEphIndex === null || outgoingIndex > maxOutgoingEphIndex) {
+          maxOutgoingEphIndex = outgoingIndex;
+        }
+        const key = hint.commitmentHex.toLowerCase();
+        if (!seenSent.has(key)) {
+          seenSent.add(key);
+          pendingSent.push({ hint, ephIndex: outgoingIndex });
+        }
+        return null;
+      }
       const viewTag = activation !== null && hint.leafIndex >= activation;
       const result = tryDecryptNoteVerbose(
         hint,
@@ -696,7 +929,44 @@ function decryptHintBatch(hints, keys) {
       return null;
     }
   });
-  return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+  const carried = keys.recipientCandidates ?? [];
+  for (const { hint, ephIndex } of pendingSent) {
+    const candidates = [
+      ...sealedEntries.map(
+        (e) => openRecipientBookEntry(e, keys.outgoingViewingKey, hint.commitmentHex)
+      ),
+      ...carried
+    ];
+    const sent = recoverSentNote({
+      hint,
+      outgoingViewingKey: keys.outgoingViewingKey,
+      ephIndex,
+      recipientCandidates: candidates
+    });
+    if (!sent) {
+      unmatchedSent.push({ hint, ephIndex });
+      continue;
+    }
+    const { recipientIvk, ...facts } = sent;
+    learnedRecipients.add(toHex(recipientIvk));
+    sentNotes.push({
+      ...facts,
+      counterpartyIvkHex: toHex(recipientIvk),
+      encryptedMemo: hint.encryptedMemo ?? ""
+    });
+  }
+  return {
+    notes,
+    tagFiltered,
+    selfMatched,
+    pairwiseMatched,
+    maxSelfEphIndex,
+    maxOutgoingEphIndex,
+    sentNotes,
+    learnedRecipients: [...learnedRecipients],
+    unmatchedSent,
+    sealedBookEntries: sealedEntries.map((e) => e.toString())
+  };
 }
 
 // src/foundation/errors/abort.ts
@@ -728,21 +998,52 @@ function createMainThreadPool() {
       let selfMatched = 0;
       let pairwiseMatched = 0;
       let maxSelfEphIndex = null;
+      let maxOutgoingEphIndex = null;
+      const sentNotes = [];
+      const unmatchedSent = [];
+      const sealedBookEntries = /* @__PURE__ */ new Set();
+      const learnedRecipients = new Set(
+        (keys.recipientCandidates ?? []).map((c) => toHex(c))
+      );
       for (let i = 0; i < hints.length; i += DECRYPT_YIELD_EVERY) {
         if (i > 0) {
           await yieldToBrowser();
           if (signal?.aborted) throw scanAbortError();
         }
-        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), keys);
+        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), {
+          ...keys,
+          recipientCandidates: [...learnedRecipients].map((h) => fromHex(h))
+        });
         notes.push(...burst.notes);
         tagFiltered += burst.tagFiltered;
         selfMatched += burst.selfMatched;
         pairwiseMatched += burst.pairwiseMatched;
+        sentNotes.push(...burst.sentNotes ?? []);
+        unmatchedSent.push(...burst.unmatchedSent ?? []);
+        for (const e of burst.sealedBookEntries ?? []) sealedBookEntries.add(e);
+        for (const r of burst.learnedRecipients ?? []) learnedRecipients.add(r);
         if (burst.maxSelfEphIndex !== null) {
           maxSelfEphIndex = Math.max(maxSelfEphIndex ?? -1, burst.maxSelfEphIndex);
         }
+        if (burst.maxOutgoingEphIndex != null) {
+          maxOutgoingEphIndex = Math.max(
+            maxOutgoingEphIndex ?? -1,
+            burst.maxOutgoingEphIndex
+          );
+        }
       }
-      return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+      return {
+        notes,
+        tagFiltered,
+        selfMatched,
+        pairwiseMatched,
+        maxSelfEphIndex,
+        maxOutgoingEphIndex,
+        sentNotes,
+        learnedRecipients: [...learnedRecipients],
+        unmatchedSent,
+        sealedBookEntries: [...sealedBookEntries]
+      };
     },
     terminate() {
       clearKnownEphWindow();
@@ -774,7 +1075,12 @@ function runOnWorker(worker, payload, signal) {
         tagFiltered: data.tagFiltered ?? 0,
         selfMatched: data.selfMatched ?? 0,
         pairwiseMatched: data.pairwiseMatched ?? 0,
-        maxSelfEphIndex: data.maxSelfEphIndex ?? null
+        maxSelfEphIndex: data.maxSelfEphIndex ?? null,
+        maxOutgoingEphIndex: data.maxOutgoingEphIndex ?? null,
+        sentNotes: data.sentNotes ?? [],
+        learnedRecipients: data.learnedRecipients ?? [],
+        unmatchedSent: data.unmatchedSent ?? [],
+        sealedBookEntries: data.sealedBookEntries ?? []
       });
     };
     worker.onerror = () => {
@@ -801,9 +1107,19 @@ function mergeResults(results) {
     tagFiltered: results.reduce((sum, r) => sum + r.tagFiltered, 0),
     selfMatched: results.reduce((sum, r) => sum + r.selfMatched, 0),
     pairwiseMatched: results.reduce((sum, r) => sum + r.pairwiseMatched, 0),
+    sentNotes: results.flatMap((r) => r.sentNotes ?? []),
+    // Deduped: slices run in parallel, so the same change note cannot be
+    // seen twice, but two different ones may name the same recipient.
+    learnedRecipients: [...new Set(results.flatMap((r) => r.learnedRecipients ?? []))],
+    unmatchedSent: results.flatMap((r) => r.unmatchedSent ?? []),
+    sealedBookEntries: [...new Set(results.flatMap((r) => r.sealedBookEntries ?? []))],
     maxSelfEphIndex: results.reduce(
       (max, r) => r.maxSelfEphIndex === null ? max : Math.max(max ?? -1, r.maxSelfEphIndex),
       null
+    ),
+    maxOutgoingEphIndex: results.reduce(
+      (max, r) => r.maxOutgoingEphIndex == null ? max : Math.max(max ?? -1, r.maxOutgoingEphIndex),
+      null
     )
   };
 }
@@ -855,6 +1171,7 @@ function createDecryptPool(options) {
   DECRYPT_YIELD_EVERY,
   EMPTY_BATCH_RESULT,
   MAX_WORKERS,
+  OUTGOING_EPH_WINDOW,
   PAIRWISE_EPH_WINDOW,
   SELF_EPH_WINDOW,
   WORKER_CRASHED,