@orbinum/sdk 2.1.0 → 3.0.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, a as NoteFacts, O as OutgoingNoteRecord, b as DecryptPool, c as ScanKeys } from './index-CLpM1984.js';
-export { C as CURRENT_CIRCUIT_VERSION, d as DECRYPT_YIELD_EVERY, e as DecryptBatchResult, f as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, g as KnownEphWindow, M as MAX_WORKERS, h as MatchSource, i as MerkleTreeInfo, P as PAIRWISE_EPH_WINDOW, j as SELF_EPH_WINDOW, W as WORKER_CRASHED, k as WorkerFactory, l as WorkerLike, m as WorkerMessage, n as clearKnownEphWindow, o as createDecryptPool, p as createMainThreadPool, q as createWorkerPool, r as decryptHintBatch, s as getKnownEphWindow } from './index-CLpM1984.js';
+import { Z as ZkNote, D as DecryptedMemo, N as NoteInput, S as ScanCommitment, a as NoteFacts, b as SentNoteMatch, c as DecryptPool, d as ScanKeys, U as UnmatchedSentHint } from './index-B-dbSIPN.js';
+export { C as CURRENT_CIRCUIT_VERSION, e as DECRYPT_YIELD_EVERY, f as DecryptBatchResult, g as DecryptRequest, E as EMPTY_BATCH_RESULT, K as KnownEphEntry, h as KnownEphWindow, M as MAX_WORKERS, i as MerkleTreeInfo, O as OUTGOING_EPH_WINDOW, P as PAIRWISE_EPH_WINDOW, j as SELF_EPH_WINDOW, k as SentNoteFacts, W as WORKER_CRASHED, l as WorkerFactory, m as WorkerLike, n as WorkerMessage, o as clearKnownEphWindow, p as createDecryptPool, q as createMainThreadPool, r as createWorkerPool, s as decryptHintBatch, t as getKnownEphWindow, u as recoverSentFromSharedSecret, v as recoverSentNote } from './index-B-dbSIPN.js';
 import { ArtifactProvider, ProofResult, CircuitType } from '@orbinum/proof-generator';
 export { ArtifactProvider, CircuitType, ProofResult, WebArtifactProvider, shouldProveSingleThreaded } from '@orbinum/proof-generator';
 import * as polkadot_api from 'polkadot-api';
@@ -12,8 +12,8 @@ export { base58 } from '@scure/base';
 export { getPolkadotSigner as getSubstrateSigner } from 'polkadot-api/signer';
 import { InjectedExtension } from 'polkadot-api/pjs-signer';
 export { SignPayload, SignRaw, getPolkadotSignerFromPjs as getSubstrateSignerFromExtension } from 'polkadot-api/pjs-signer';
-import { V as VaultStorage, a as VaultConfigRecord, E as EncryptedNoteRecord, C as CachedNullifier, N as NullifierSyncMeta, S as SpendDetails, b as EncryptedTxRecord, d as NoteStorage, e as NoteStatusUpdate, T as TxHistoryStore, f as NullifierCache, c as SecretStore } from './secretStore-CF6Nse__.js';
-export { D as DeviceKeyStore, g as createDeviceKeyProvider, h as createMemorySecretStore, i as generateDeviceKey, j as importDeviceKey } from './secretStore-CF6Nse__.js';
+import { V as VaultStorage, a as VaultConfigRecord, E as EncryptedNoteRecord, C as CachedNullifier, N as NullifierSyncMeta, S as SpendDetails, b as EncryptedTxRecord, d as NoteStorage, e as NoteStatusUpdate, T as TxHistoryStore, f as NullifierCache, c as SecretStore } from './secretStore-CCYo4hna.js';
+export { D as DeviceKeyStore, g as createDeviceKeyProvider, h as createMemorySecretStore, i as generateDeviceKey, j as importDeviceKey } from './secretStore-CCYo4hna.js';
 
 /**
  * The two keys a vault runs on, and the AES-GCM envelope they protect.
@@ -210,7 +210,7 @@ declare const VAULT_SCHEMA_VERSION = 5;
  */
 declare function normalizeChainFingerprint(chainFingerprint?: string | null): string | undefined;
 /** The counters a config write must never drop. */
-type EphemeralCounters = Pick<VaultConfigRecord, 'createdAt' | 'selfEphCounter' | 'pairwiseCounterparties'>;
+type EphemeralCounters = Pick<VaultConfigRecord, 'createdAt' | 'selfEphCounter' | 'outgoingEphCounter' | 'pairwiseCounterparties'>;
 /**
  * Builds a config record ready to persist.
  *
@@ -250,31 +250,43 @@ declare function buildConfig(existing: EphemeralCounters | null, chainFingerprin
  */
 declare function reserveSelfEphIndex(storage: NoteStorage): Promise<number>;
 /**
- * Reserves the next pairwise index for a counterparty, keyed by their packed
- * viewing public key. Registering the counterparty is a side effect worth
- * having: it makes the REVERSE direction cheap too, since their future payments
- * to this wallet become hash lookups instead of one trial ECDH per note.
+ * Reserves the next OUTGOING index — the ephemeral published on a note this
+ * wallet sends.
  *
- * Returns `null` when this vault holds no history for that counterparty, and
- * the caller must then use a random ephemeral. The reason is that "no history"
- * has two causes this function cannot tell apart:
+ * "No history" is unambiguous here, unlike the pairwise counter: a sender can
+ * predict every ephPk they published, so a restored wallet recovers the counter
+ * by sweeping the chain. That is why this may start at 0 instead of degrading
+ * to a random ephemeral.
  *
- *   - a genuine first payment, where index 0 is correct;
- *   - a counter that was LOST — a restored seed, a cleared IndexedDB, a wipe
- *     and rescan — where index 0 was already published and re-deriving it
- *     republishes that ephPk, linking the two notes in public.
+ * THE COUNTER ONLY MOVES FORWARD. `fromChain` comes from a feed, and a feed
+ * that HID the highest published index would report a counter already used —
+ * handing it out again republishes that ephPk and links the two notes in
+ * public. So it is a floor, never the truth: a stored counter always wins.
  *
- * Unlike `selfEphCounter`, this one cannot be recovered: the index was
- * published on a note encrypted toward someone else, so it never appears in
- * this wallet's own scan, and asking a server whether a given ephPk exists
- * would reveal which notes are ours. So the ambiguity is resolved the safe way
- * — the caller degrades to random, costing the recipient one trial scan, and
- * every later payment to the same counterparty takes the fast path again.
+ * The restore itself is the one exposure, having no stored counter to defend
+ * with. `RESTORE_SAFETY_GAP` covers it by resuming past a run of unused
+ * indexes, so hiding one top index is not enough — a feed would have to hide
+ * the whole run. Skipped indexes are free and only widen a window.
  *
- * The entry is still created: the NEXT payment has a counter, and registering
- * the counterparty is what makes the reverse direction cheap.
+ * @param fromChain Next index per `reconstructOutgoingIndex`, or undefined on
+ *                  the normal path where the stored counter stands alone.
  */
-declare function reservePairwiseIndex(storage: NoteStorage, ivkHex: string): Promise<number | null>;
+declare function reserveOutgoingIndex(storage: NoteStorage, fromChain?: number): Promise<number>;
+/**
+ * Records a counterparty this wallet has paid, keyed by their packed viewing
+ * public key.
+ *
+ * Purely an optimisation for the REVERSE direction: once they are known, their
+ * future payments to this wallet are found by hash lookup against a precomputed
+ * window instead of one trial ECDH per note in the pool. Nothing this wallet
+ * publishes depends on it, so a failure here costs scan speed and nothing else.
+ *
+ * The stored `nextIndex` is legacy — outgoing ephemerals now come from the
+ * wallet-wide sequence in `outgoingEphCounter`, which is recoverable where a
+ * per-counterparty one was not. It is preserved rather than dropped so that a
+ * vault written by an older version still reads back cleanly.
+ */
+declare function registerPairwiseCounterparty(storage: NoteStorage, ivkHex: string): Promise<void>;
 
 /**
  * Turning a note into a stored record and back.
@@ -290,7 +302,7 @@ declare function reservePairwiseIndex(storage: NoteStorage, ivkHex: string): Pro
  */
 declare function applyNoteStatus(note: ZkNote, status?: NoteStatusUpdate): ZkNote;
 /**
- * Encrypts a ZkNote into a v2 EncryptedNoteRecord.
+ * Encrypts a ZkNote into an `EncryptedNoteRecord`.
  *
  * The full note (values, secrets) is AES-GCM encrypted under `key`; the note
  * identifiers (commitment, nullifier, asset) are stored as BLIND TAGS under
@@ -664,6 +676,11 @@ declare function fromHex(hex: string): Uint8Array;
 declare function ensureHexPrefix(hex: string): string;
 /**
  * Converts a 0x-prefixed hex string (as returned by JSON-RPC) to a number.
+ *
+ * Throws rather than returning `NaN`. A bare `parseInt` accepts a valid prefix
+ * and drops the rest, so `"0x12zz"` used to yield `18` — a plausible block
+ * number that is simply wrong. It also has no upper bound: a quantity past
+ * 2^53 loses precision silently, and these values come from a server.
  */
 declare function hexToNumber(hex: string): number;
 /**
@@ -673,11 +690,10 @@ declare function hexToBigint(hex: string): bigint;
 /**
  * A field scalar as canonical 32-byte hex: `0x` + 64 zero-padded chars.
  *
- * Big-endian and fixed-width on purpose. These strings are compared as strings
- * — a wallet finds its own note by matching an `ownerPk`, and the note-transfer
- * format is a cross-client contract — so one scalar must produce exactly one
- * spelling. Letting `toString(16)` emit its natural width would make `0x1` and
- * `0x0…01` two different keys for one value.
+ * Big-endian and fixed-width on purpose. These are compared AS STRINGS — a
+ * wallet finds its own note by matching an `ownerPk` that way — so one scalar
+ * must have exactly one spelling. `toString(16)` at its natural width would
+ * make `0x1` and `0x0…01` two different keys for the same value.
  *
  * Not for commitments or nullifiers: those travel LITTLE-endian and go through
  * `toHex(bigintTo32Le(...))`.
@@ -755,6 +771,78 @@ declare const BABYJUB_SUBORDER = 27360303589799094027808007181571593860768139721
  * Returns the point with the canonical (smaller) y, or null if Ax is not on the curve.
  */
 declare function recoverOwnerPkPoint(ax: bigint): [bigint, bigint] | null;
+/**
+ * Unpack a recipient's packed viewing key, refusing keys that would make the
+ * ECDH secret guessable.
+ *
+ * Unpacking alone is not validation. BabyJubJub has a cofactor of 8, so the
+ * curve contains a small subgroup, and a point from it has order 1, 2, 4 or 8.
+ * `[ephSk]·P` then takes at most 8 values no matter how random `ephSk` is, and
+ * an interceptor simply tries them all: a memo sealed toward such a key yields
+ * its value, blinding and sourcePk, and a payment slip decrypts, without any
+ * secret at all. The all-zero packed value is one of them — an order-4 point.
+ *
+ * The all-zero byte check that guards privacy addresses does not catch this:
+ * the packed value `0` is not the neutral element, it is a legitimate point
+ * with y=0 that happens to have order 4. Nor is a low-order key necessarily
+ * hostile — it is also what a truncated or half-initialised buffer decodes to.
+ * Either way the note is world-readable, so both are refused here.
+ *
+ * Multiplying by the cofactor is the standard test: `[8]·P` is the identity for
+ * every point of the small subgroup and for no other point.
+ *
+ * @returns the point, or null when it is unusable as a recipient key
+ */
+declare function unpackUsableViewingKey(packed: bigint): [bigint, bigint] | null;
+
+/**
+ * Guards for SECRET key material.
+ *
+ * `unpackUsableViewingKey` covers the public side — a point someone else chose,
+ * where the risk is a low-order key that collapses the ECDH. This covers the
+ * other side: the 32-byte secrets a caller passes in, where the risk is that
+ * nothing checks them at all.
+ *
+ * ## Why a degenerate secret is not merely weak
+ *
+ * `bytesToBjjScalar` reduces whatever it gets modulo the suborder and clamps a
+ * zero result to `1n`. So an all-zero key, or a 16-byte one, does not fail —
+ * it becomes a VALID scalar that some other wallet could also arrive at. An
+ * empty array is worse: `BigInt('0x')` throws, which surfaces as an exception
+ * from whichever primitive happened to touch it first.
+ *
+ * The same shapes are what a missing field, a truncated buffer, or an
+ * uninitialised `new Uint8Array(32)` decode to, so this is the failure a
+ * mis-wired caller actually hits.
+ *
+ * ## Why these THROW
+ *
+ * A bad secret key is a programming error, not untrusted input. Returning null
+ * would fold it into "this note is not mine" / "this slip is not for me", which
+ * is indistinguishable from the ordinary case — the wallet would report an
+ * empty scan and look perfectly healthy.
+ *
+ * Data from the network is the opposite and must NOT use this: a malformed
+ * backup entry or scan hint is dropped, never thrown, so one bad record cannot
+ * take down the batch. `isUsableSecretKey` exists for the paths that have to
+ * make that decision without unwinding.
+ */
+/**
+ * True when `key` can be used as secret key material.
+ *
+ * For callers that must not throw — a scan loop, a window builder — where the
+ * answer is "turn this capability off", not "abort".
+ */
+declare function isUsableSecretKey(key: Uint8Array | undefined | null): key is Uint8Array;
+/**
+ * Throws unless `key` is usable secret key material.
+ *
+ * @param key   the secret to check
+ * @param label what it is, named in the error — a caller that wired two keys
+ *              the wrong way round needs to know WHICH one is wrong, and every
+ *              secret here is 32 opaque bytes that look alike in a debugger.
+ */
+declare function assertSecretKeyBytes(key: Uint8Array, label: string): void;
 
 /** Affine point as zk-kit represents it. */
 type AffinePoint = [bigint, bigint];
@@ -820,6 +908,19 @@ interface CryptoKey$1 {
     readonly usages: string[];
 }
 
+/**
+ * Rendering on-chain amounts for people.
+ *
+ * Chain amounts are integers in the smallest unit — 18 decimals for ORB — and
+ * every one of these keeps them that way internally: BigInt arithmetic only, no
+ * float ever touches a balance. A `number` intermediate would silently lose
+ * precision past 2^53, which for 18 decimals starts at about 0.009 ORB.
+ *
+ * Malformed input yields ZERO rather than a guess. Grouped digits, scientific
+ * notation and a leading `+` are all rejected: coercing them would render an
+ * amount that is not the one on chain, and a balance nobody can explain is
+ * worse than a visible zero.
+ */
 /**
  * Options for {@link formatBalance}.
  */
@@ -831,6 +932,7 @@ interface FormatOptions {
     /** Whether to append the symbol. Defaults to `true`. */
     showSymbol?: boolean;
     /** Maximum number of decimal digits shown in output. Defaults to `6`. */
+    /** MAXIMUM decimal digits shown. Trailing zeros are trimmed, never padded. */
     precision?: number;
 }
 /**
@@ -851,7 +953,7 @@ interface FormatOptions {
  *
  * @example
  * formatBalance('1000000000000000000') // '1 ORB'
- * formatBalance(500000000000000000n, { precision: 2 }) // '0.50 ORB'
+ * formatBalance(500000000000000000n, { precision: 2 }) // '0.5 ORB'  (max, not pad)
  * formatBalance('0x0de0b6b3a7640000', { showSymbol: false }) // '1'
  * formatBalance(null) // '0 ORB'
  */
@@ -931,18 +1033,19 @@ declare function normalizeEvmAddress(addr: string): string;
  * a UI renders, not an exception.
  */
 declare function parseEvmAddress(addr: string): string | null;
-/**
- * Returns true if the string looks like an SS58 encoded address
- * (not a 0x-prefixed hex).
- */
-declare function isSs58(addr: string): boolean;
 /**
  * Returns true if the string looks like a 20-byte EVM address.
  */
 declare function isEvmAddress(addr: string): boolean;
 /**
- * Pads a 20-byte EVM address to a 32-byte account ID (H256)
- * by prepending 12 zero bytes (Ethereum-compatible mapping).
+ * Pads a 20-byte EVM address to 32 bytes by PREPENDING 12 zero bytes.
+ *
+ * The Ethereum convention, NOT Orbinum's. This chain maps an H160 to an account
+ * by appending — `evmToImplicitSubstrate` is the one that matches the runtime,
+ * and the two produce different accounts for the same address.
+ *
+ * Kept for callers that need the Ethereum-shaped padding (an H256 topic, an ABI
+ * word). Anything that has to name an Orbinum account wants the other one.
  */
 declare function evmAddressToAccountId(evmAddr: string): Uint8Array;
 /**
@@ -1035,10 +1138,10 @@ declare function addressToFieldElement(address: string): bigint;
  * Layout (180 bytes, ECDH):
  *   nonce(12) || ciphertext+MAC(136) || ephPk_packed(32) = 180
  *
- * View tag (memos built by SDK ≥ 0.15): nonce[0] = deriveViewTag(sharedSecret)
- * — see memo.ts. Layout and size are unchanged; legacy memos carry a random
- * byte there instead, so the filter is only sound at/after the wallet's
- * tagActivationLeaf.
+ * View tag: nonce[0] = deriveViewTag(sharedSecret). Layout and size unchanged.
+ * Memos written before tags carry a RANDOM byte there, so the filter is only
+ * sound at or after the leaf where they were switched on — the scanner passes
+ * that boundary as `ScanKeys.viewTagActivationLeaf`.
  *
  * Plaintext layout (120 bytes):
  *   value_lo(8 LE) || value_hi(8 LE) || owner_pk(32) || blinding(32) || asset_id(4 LE) || source_pk(32) || circuit_version(4 LE)
@@ -1046,7 +1149,9 @@ declare function addressToFieldElement(address: string): bigint;
  * value is stored as a 128-bit LE unsigned integer (two uint64 words), supporting
  * amounts up to ~3.4 × 10^38 planck — well above any realistic token supply.
  *
- * v2 key derivation (ECDH):
+ * Key derivation (ECDH). The "v2" in the memo's own wire format names THIS
+ * layout, and is unrelated to the identity version — the v3 identity work
+ * changed which branches derive a wallet's keys, not how a memo is sealed:
  *   ephSk        = random scalar in [1, BABYJUB_SUBORDER)
  *   ephPk        = mulPointEscalar(Base8, ephSk)
  *   sharedPoint  = mulPointEscalar(recipientIvk, ephSk)  ← or mulPointEscalar(ephPk, ivsk)
@@ -1063,7 +1168,7 @@ declare const ENCRYPTED_MEMO_SIZE: number;
 declare function bytesToBjjScalar(bytes: Uint8Array): bigint;
 declare const EncryptedMemo: {
     /**
-     * Build and encrypt a memo for a note using ECDH (v2, 180 bytes).
+     * Build and encrypt a memo for a note using ECDH (180 bytes).
      *
      * @param value              Note value in planck.
      * @param ownerPk            32-byte owner public key (LE).
@@ -1129,9 +1234,9 @@ declare const EncryptedMemo: {
      * Cheap view-tag check: does memo nonce[0] match the tag derived from
      * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
      *
-     * Only meaningful for memos built with view tags (commitments at/after
-     * the wallet's tagActivationLeaf): a legacy memo carries a random byte
-     * there and would false-negative 255/256 of the time.
+     * Only meaningful for memos that carry a tag — at or after
+     * `ScanKeys.viewTagActivationLeaf`. An older memo has a random byte there
+     * and would false-negative 255/256 of the time.
      */
     checkViewTag(memoBytes: Uint8Array, sharedSecret: Uint8Array): boolean;
     /**
@@ -1171,76 +1276,6 @@ declare function serializeMemo(value: bigint, ownerPk: Uint8Array, blinding: Uin
  */
 declare function deriveViewTag(sharedSecret: Uint8Array): number;
 
-/**
- * OutgoingBlob — the OVK "wrap-the-key" primitive.
- *
- * When a wallet sends a private_transfer, the recipient's memo is encrypted ECDH
- * toward the RECIPIENT's ivk; the sender cannot reopen it, so a cold restore
- * loses the outgoing history (who/how much). This blob fixes that: it wraps the
- * memo's 32-byte `sharedSecret` under a key derived from the SENDER's ovk. On
- * restore the sender unwraps the sharedSecret and feeds it to the SAME memo
- * decryption path the recipient uses — one decryption routine in the whole
- * system (OVK plan requirement #7).
- *
- * This is Zcash Sapling's `outCiphertext` / Penumbra's `OvkWrappedKey`, adapted
- * to a shared secret that is a field element (32 bytes), not a group point — so
- * the blob contains no group element to decode, sidestepping Zcash's canonical-
- * encoding class of bugs.
- *
- * Layout (56 bytes): nonce_suffix(8) || ciphertext(32) || MAC(16).
- * Cipher: ChaCha20-Poly1305 (IETF), same primitive as EncryptedMemo.
- *
- * The outgoing cipher key binds every unique-per-output public value:
- *   ock = HKDF(ikm=ovk, salt=commitment_bytes||ephPk_bytes, info=OCK_DOMAIN)
- * so each ock encrypts exactly one message. Uniqueness comes from the COMMITMENT
- * (Poseidon4 with random blinding, consensus rejects duplicates); the ephPk adds
- * the on-chain binding, not the uniqueness — two self-notes can share an ephPk
- * but never a commitment, so their ock still differs.
- *
- * SALT IS RAW ON-CHAIN BYTES. `commitment_bytes` and `ephPk_bytes` must be the
- * exact bytes that are/go on chain, never a re-serialization of a decoded point:
- * two encodings of "the same point" produce different ock and the AEAD fails —
- * no ambiguity to exploit.
- */
-/** Total on-chain blob size: nonce_suffix(8) || ciphertext(32) || MAC(16). */
-declare const OVK_BLOB_SIZE: number;
-/**
- * Derive the 32-byte outgoing cipher key.
- *   ock = HKDF-SHA256(ikm=ovk, salt=commitmentBytes||ephPkBytes, info=OCK_DOMAIN)
- *
- * Both salt parts must be the raw 32-byte on-chain values (see file header).
- * Throws if either is not exactly 32 bytes — a wrong length here would silently
- * change the key and make recovery fail far from the cause.
- */
-declare function deriveOutgoingCipherKey(ovk: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array;
-/**
- * Seal a sharedSecret into a 56-byte outgoing blob under the sender's ovk.
- *
- * @param ovk             sender's 32-byte outgoing viewing key
- * @param sharedSecret    the memo's 32-byte ECDH shared secret (what we wrap)
- * @param commitmentBytes raw 32-byte on-chain commitment of the recipient output
- * @param ephPkBytes      raw 32-byte ephemeral public key (from the memo, not recomputed)
- * @returns 56 bytes: nonce_suffix(8) || ciphertext(32) || MAC(16)
- */
-declare function sealOutgoingBlob(ovk: Uint8Array, sharedSecret: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array;
-/**
- * Open an outgoing blob, returning the wrapped sharedSecret or null.
- *
- * Never throws — this runs in recovery loops over hints that may be foreign,
- * pre-OVK, or ovk=⊥ random. A wrong ovk, wrong commitment, wrong ephPk, or any
- * corrupted byte fails the MAC and returns null.
- */
-declare function openOutgoingBlob(ovk: Uint8Array, blob: Uint8Array, commitmentBytes: Uint8Array, ephPkBytes: Uint8Array): Uint8Array | null;
-/**
- * A 56-byte random blob for the ovk=⊥ case (sender opts out of recoverability).
- *
- * Indistinguishable on-chain from a real blob: a real one is a random 8-byte
- * suffix plus ChaCha20/Poly1305 output, both uniform without the key. This is
- * the ONLY path for ⊥ — never zeros (distinguishable), never omission (a length
- * or SCALE-tag difference is a permanent, retroactive privacy label).
- */
-declare function randomOutgoingBlob(): Uint8Array;
-
 /** The fields a payment slip carries — all public on-chain. */
 interface PaymentSlipFields {
     /** 0x-prefixed 32-byte LE commitment hex of the recipient output. */
@@ -1292,7 +1327,7 @@ declare function decodePaymentSlip(text: string): Uint8Array | null;
  * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
  * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
  */
-declare function deriveSelfEphSk(spendingKey: bigint, index: number): Uint8Array;
+declare function deriveSelfEphSk(viewingSecretKey: Uint8Array, index: number): Uint8Array;
 /** One precomputed self-note window entry. */
 interface SelfEphWindowEntry {
     index: number;
@@ -1307,11 +1342,11 @@ interface SelfEphWindowEntry {
  * needed to decrypt the memo. One EC pass up front; scanning then matches
  * hints by ephPk hex equality with no per-hint EC work.
  *
- * @param spendingKey Wallet spending key (the seed of the derivation).
+ * @param viewingSecretKey Wallet incoming viewing key (the seed of the derivation).
  * @param ivkPacked   The wallet's OWN 32-byte LE packed viewing public key —
  *                    self memos are encrypted to it.
  */
-declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from: number, count: number): SelfEphWindowEntry[];
+declare function selfEphWindow(viewingSecretKey: Uint8Array, ivkPacked: Uint8Array, from: number, count: number): SelfEphWindowEntry[];
 
 /**
  * The secret shared by a sender/receiver pair: ECDH between one side's viewing
@@ -1353,6 +1388,83 @@ interface PairwiseEphWindowEntry {
  */
 declare function pairwiseEphWindow(pairSecret: Uint8Array, receiverIvkPacked: Uint8Array, from: number, count: number): PairwiseEphWindowEntry[];
 
+/**
+ * The ephemeral secret for the `index`-th note this wallet sends. Feed it to
+ * `NoteBuilder.build` as `ephSkOverride`.
+ */
+declare function deriveOutgoingEphSk(outgoingViewingKey: Uint8Array, index: number): Uint8Array;
+/** The ephPk this wallet publishes at `index` — the memo's last 32 bytes. */
+declare function deriveOutgoingEphPk(outgoingViewingKey: Uint8Array, index: number): string;
+/** One precomputed outgoing window entry. */
+interface OutgoingEphWindowEntry {
+    index: number;
+    /** 0x-prefixed LE-packed ephPk — byte-identical to the memo's last 32 bytes. */
+    ephPkHex: string;
+}
+/**
+ * Precompute [from, from+count) of the outgoing sequence.
+ *
+ * Only the ephPk, never a shared secret: unlike the self and pairwise windows,
+ * the secret that opens an outgoing memo depends on the RECIPIENT's viewing
+ * key, which is not known until the note is matched. Recovery derives it then,
+ * per candidate, with `deriveOutgoingSharedSecret`.
+ */
+declare function outgoingEphWindow(outgoingViewingKey: Uint8Array, from: number, count: number): OutgoingEphWindowEntry[];
+/**
+ * The secret that opens the memo of the payment this wallet sent at `index`.
+ *
+ * The same value the recipient computes from their viewing secret key and the
+ * published ephPk — reached from the other side, which is what lets the sender
+ * read back a memo sealed toward someone else.
+ *
+ * Throws on a viewing key that is not a curve point; callers sweeping
+ * candidates should treat that as "not this one".
+ */
+declare function deriveOutgoingSharedSecret(outgoingViewingKey: Uint8Array, index: number, recipientIvkPacked: Uint8Array): Uint8Array;
+/**
+ * The next unused outgoing index, read off the chain.
+ *
+ * The sender can predict every ephPk they would publish, so the highest one
+ * that actually appears on chain names the last index used. This is what the
+ * pairwise counter cannot do — its ephemerals depend on a counterparty the
+ * restored wallet no longer knows — and it is why an outgoing sequence may
+ * start at 0 instead of degrading to a random ephemeral.
+ *
+ * ## This result must never be trusted on its own
+ *
+ * Omission is a WRITE attack: a feed that hides the highest index makes this
+ * return a value already published, and using it republishes that ephPk. Two
+ * rules follow, both enforced by the caller in `reserveOutgoingIndex`:
+ *
+ *   - never move a counter BACKWARDS — a local counter always wins;
+ *   - after a restore, where there is no local counter to compare against,
+ *     leave a gap so a feed would have to hide a whole run of consecutive
+ *     top indexes rather than a single one.
+ *
+ * @param window How many indexes to consider — must cover the highest ever
+ *               used, or a high index stays invisible and gets handed out
+ *               again. Grow it with the counter, as `selfEphGap` does.
+ */
+declare function reconstructOutgoingIndex(outgoingViewingKey: Uint8Array, publishedEphPks: Iterable<string>, window: number): number;
+
+/**
+ * Building a note: its commitment, its nullifier, and the memo that recovers it.
+ *
+ * Everything is local — no chain access — and every note leaves here in one of
+ * two shapes:
+ *
+ *   - STEALTH, when the caller supplies both halves of a privacy address. The
+ *     commitment covers a one-time owner key, so two payments to one address
+ *     cannot be linked, and the memo carries what the recipient needs to
+ *     rederive the matching spending key.
+ *   - PLAIN, for a wallet's own notes (a shield, a change note), where the
+ *     commitment covers the wallet's global owner key because it has to find
+ *     the note again with its own keys.
+ *
+ * The blinding is the note's only real secret once an amount is guessed, so an
+ * absent one is drawn from a CSPRNG and never from anything predictable.
+ */
+
 /**
  * Builds ZK notes (commitment + nullifier) and encrypted memos locally.
  *
@@ -1380,7 +1492,7 @@ declare class NoteBuilder {
      * @param input.value            Amount in planck (required).
      * @param input.assetId          Asset ID — default 0n (native ORB-Privacy).
      * @param input.ownerPk          Sender's or recipient's global BabyJubJub Ax — default 0n.
-     * @param input.blinding         Random scalar — defaults to BigInt(Date.now()).
+     * @param input.blinding         Random scalar — defaults to a CSPRNG draw.
      * @param input.spendingKey      Secret key for nullifier — default 0n.
      * @param input.viewingPublicKey Recipient's 32-byte LE packed BJJ ivk. Triggers memo encryption.
      * @param input.recipientOwnerPk Recipient's global ownerPk. Required with viewingPublicKey
@@ -1397,7 +1509,7 @@ declare class NoteBuilder {
      * @param note                    The ZkNote whose fields populate the plaintext.
      * @param recipientIvkPacked      32-byte LE packed BJJ viewing public key of the recipient.
      *                                Pass `new Uint8Array(32)` (default) for a public/dummy memo.
-     * @param sourcePk          32-byte counterparty BabyJubJub Ax.
+     * @param sourcePk                32-byte counterparty BabyJubJub Ax.
      *                                Pass `new Uint8Array(32)` (default) for no counterparty.
      */
     static buildMemo(note: ZkNote, recipientIvkPacked?: Uint8Array, sourcePk?: Uint8Array): Uint8Array;
@@ -1453,8 +1565,9 @@ interface TryDecryptOptions {
      * 1-byte tag in memo nonce[0], and skip the AEAD decrypt on mismatch
      * (255/256 of foreign notes; `reason: 'view_tag_mismatch'`).
      *
-     * Only enable for commitments at/after the wallet's tagActivationLeaf —
-     * legacy memos carry a random byte there and would be silently dropped.
+     * Enable only for commitments at or after the leaf where tags were switched
+     * on — the scanner tracks it as `ScanKeys.viewTagActivationLeaf`. Older
+     * memos carry a random byte there and would be dropped in silence.
      */
     viewTag?: boolean;
     /**
@@ -1489,41 +1602,6 @@ declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecret
     note: ZkNote | null;
     reason?: string;
 };
-/** A scan hint plus the per-transaction OVK blob the indexer serves alongside it. */
-type OutgoingHint = ScanCommitment & {
-    ovkBlob?: string | null;
-};
-/**
- * Recover a note the caller SENT, using their outgoing viewing key (ovk).
- *
- * The sender's memo was encrypted toward the RECIPIENT, so they cannot reopen it
- * directly. Instead the ovk blob wraps the memo's shared secret; unwrapping it
- * gives the same secret the recipient gets via ECDH, and feeding it to the shared
- * decrypt-and-verify step rebuilds the sent note's public facts.
- *
- * Returns an OutgoingNoteRecord (value, recipient stealth pk, counterparty,
- * circuit version) — NEVER a spendable note: no spendingKey, no nullifier. The
- * sender does not own this note. Never throws (runs in recovery loops).
- *
- * Security (OVK plan §3.4), in three non-algebraic but sound layers:
- *  1. The blob MAC (openOutgoingBlob) proves whoever wrote it knew the ovk, and
- *     the ock binds it to THIS (commitment, ephPk) — blobs are not transplantable.
- *  2. The memo MAC (inside decryptAndVerifyPlaintext) proves this shared secret
- *     is the one that encrypted this memo — the same secret the recipient derives.
- *  3. The commitment check ties the recovered fields to the note in the tree.
- * Not verifiable by the sender: that `sharedSecret` corresponds to `ephPk` — that
- * needs the recipient's ivsk. Residual: a leaked ovk lets an attacker fabricate a
- * self-consistent (commitment, memo, blob) and plant false outgoing history. It
- * moves no funds; Zcash accepts the same residual. Mitigated in the app by only
- * running this over commitments from extrinsics that spent our own nullifiers.
- *
- * @param hint  scan hint with commitmentHex, encryptedMemo, and ovkBlob.
- * @param ovk   the sender's 32-byte outgoing viewing key.
- * @param opts  viewTagActivationLeaf gates the view-tag check for legacy memos.
- */
-declare function tryRecoverOutgoing(hint: OutgoingHint, ovk: Uint8Array, opts?: {
-    viewTagActivationLeaf?: number;
-}): OutgoingNoteRecord | null;
 /**
  * Collect what a sender can still say about a note they sent.
  *
@@ -1543,6 +1621,43 @@ declare function tryRecoverOutgoing(hint: OutgoingHint, ovk: Uint8Array, opts?:
  */
 declare function collectOutgoingFacts(hint: ScanCommitment): NoteFacts | null;
 
+/**
+ * Seal (or open — XOR is its own inverse) a recipient's packed viewing key for
+ * carriage in a change note's `sourcePk`.
+ *
+ * Returns the input unchanged when it is not 32 bytes: a caller with a
+ * malformed key must not silently ship a truncated one, and every consumer
+ * here already treats an unusable book entry as "no recipient known".
+ *
+ * @param ivkPacked            32-byte packed viewing key, sealed or plain
+ * @param outgoingViewingKey   this wallet's OUTGOING viewing key (ovk) — the
+ *                             capability "see what I sent", delegable on its own
+ * @param paymentCommitmentHex  the PAYMENT's commitment — NOT the change note's.
+ *                               It is the one value both sides hold: the sender
+ *                               has it while building, and a restored wallet has
+ *                               it the moment the outgoing window matches that
+ *                               payment, which is the only time the entry is
+ *                               needed.
+ */
+declare function sealRecipientBookEntry(ivkPacked: Uint8Array, outgoingViewingKey: Uint8Array, paymentCommitmentHex: string): Uint8Array;
+/**
+ * Recover a recipient's packed viewing key from a change note's `sourcePk`.
+ *
+ * The value is transported as a raw 32-byte little-endian integer with no field
+ * reduction, so a ciphertext above the BN254 modulus survives intact — which
+ * matters, because most of them are.
+ *
+ * The result is unverified by construction: whether it is really a viewing key
+ * is settled by trying to open the payment memo with it.
+ *
+ * Returns 32 zero bytes for anything that cannot be a `sourcePk` — negative, or
+ * wider than the 32 bytes the field is carved from. A memo can never yield one
+ * (the slice is 32 bytes), but this is public API taking a bigint, and every
+ * neighbour here answers an impossible input with a value no memo will open
+ * rather than an exception a caller has to catch mid-scan.
+ */
+declare function openRecipientBookEntry(sealedSourcePk: bigint, outgoingViewingKey: Uint8Array, paymentCommitmentHex: string): Uint8Array;
+
 /**
  * Proving what ONE note holds, without granting any power to spend it.
  *
@@ -1631,12 +1746,24 @@ interface ProofOptions {
      * `Data cannot be cloned, out of memory`.
      *
      * Pass it only when the host knows better than the heuristic — a desktop
-     * app certain of its environment, or a benchmark pinning one mode. The
-     * proof is byte-identical either way; only the wall-clock changes.
+     * app certain of its environment, or a benchmark pinning one mode. Either
+     * mode yields a proof the chain verifies; only the wall-clock changes.
      */
     singleThread?: boolean;
 }
 
+/**
+ * Witness assembly for the 2-in/2-out private-transfer circuit.
+ *
+ * Pure marshalling: bigints and hex in, decimal strings the prover accepts out.
+ * Nothing here VALIDATES the witness — the circuit is what enforces every
+ * constraint, and a caller that assembles an inconsistent one gets a proof
+ * failure rather than a wrong proof.
+ *
+ * Always two inputs and two outputs. A single-note spend pads slot B with a
+ * dummy (see `buildDummyTransferInput`), because the circuit's shape is fixed.
+ */
+
 /** A single input note for a private transfer. */
 interface TransferInputNote {
     nullifier: bigint;
@@ -1668,20 +1795,49 @@ interface PrivateTransferProofInputs {
     merkleRoot: string;
     inputs: [TransferInputNote, TransferInputNote];
     outputs: [TransferOutputNote, TransferOutputNote];
-    /** Gasless fee in planck (default 0n). Must satisfy: input_sum == output_sum + fee */
+    /**
+     * Gasless fee in planck (default 0n).
+     *
+     * The circuit constrains `input_sum == output_sum + fee`. Nothing here
+     * checks it — the caller balances the amounts (`transferNotes` does, before
+     * proving) and an unbalanced witness fails at proof time.
+     */
     fee?: bigint;
 }
 /**
  * Generate a Groth16 proof for a PrivateTransfer operation.
+ *
+ * The merkle root arrives LITTLE-ENDIAN hex and is converted here; passing it
+ * big-endian yields a root the circuit cannot match against the paths.
  */
 declare function generateTransferProof(params: PrivateTransferProofInputs, options?: ProofOptions): Promise<ProofResult>;
 
 /**
- * Leaves one forest tree holds. Pinned to the runtime's `MaxLeavesPerTree`
- * (2^20), guarded on-chain by the pallet's `integrity_test` — it can never
- * change on a live chain, so deriving tree membership locally is safe.
+ * Which notes pay an amount, and what the forest allows.
+ *
+ * The circuit is 2-in/2-out, so a spend draws on at most TWO notes and the
+ * selection is a search over pairs rather than a greedy sum. A pair must agree
+ * on two things beyond covering the amount: the same CIRCUIT VERSION, since one
+ * proof is verified against one VK, and the same FOREST TREE, since both paths
+ * resolve under one root and a cross-tree pair can never converge.
+ *
+ * Pure arithmetic over notes: nothing here reserves anything or touches the
+ * chain, and every guard it applies is one the circuit would apply anyway,
+ * seconds later and without naming the note.
+ */
+
+/**
+ * Leaves one forest tree holds — the value this SDK assumes for the chain's
+ * `MaxLeavesPerTree`.
+ *
+ * The pallet's `integrity_test` requires that constant to be a power of two no
+ * greater than `2^MAX_TREE_DEPTH`, and forbids changing it on a live chain,
+ * precisely because clients derive `tree_id` from a global leaf index with it.
+ * It does NOT pin it to 2^20: a chain configured lower still passes, and this
+ * constant would then place notes in the wrong tree.
  *
- * Exported so a host can reason about tree boundaries.
+ * Exported so a host can reason about tree boundaries — and so a deployment on
+ * a differently-configured chain has one place to look.
  */
 declare const LEAVES_PER_TREE: number;
 /**
@@ -1922,6 +2078,18 @@ declare function deriveSpendingKeyMessageV2(chainId: number, address: string): s
  */
 declare function canonicalAccountId(address: string): string;
 
+/**
+ * The derivation scheme an identity was built under.
+ *
+ * Only `v3` exists. It lives here, beside the derivations themselves, rather
+ * than in the wallet: the vault name and the address scheme both hang off it,
+ * and having `protocol` reach up into `wallet` for the type would invert the
+ * layering for a single string union.
+ *
+ * Kept as a named union rather than dropped: the next scheme gets added here,
+ * and a bare string would let a typo pick a vault nobody ever wrote to.
+ */
+type IdentityVersion = 'v3';
 /**
  * Reduces master key bytes to the circuit's spending-key scalar.
  *
@@ -1934,17 +2102,46 @@ declare function canonicalAccountId(address: string): string;
  */
 declare function deriveSpendingKeyFromMaster(masterBytes: Uint8Array): bigint;
 /**
- * Derive a 32-byte viewing secret key (ivsk) from the spending key.
+ * The v2 viewing secret key, chained off the SPENDING key.
  *   ivsk = HKDF-SHA256(ikm=bigintTo32Le(spendingKey), info="orbinum-ivk-v1")
  *
- * The ivsk is intentionally derived from the already-reduced spending key scalar
- * (not from masterBytes) so that it stays bound to the specific key identity
- * loaded in this session. The spendingKey must already be in [1, BABYJUB_SUBORDER).
+ * NOT what a v3 wallet uses. `deriveViewingSecretKeyV3(masterBytes)` is the
+ * live branch, and the two produce DIFFERENT keys from one signature: deriving
+ * this one beside a v3 identity yields a second wallet whose notes the first
+ * cannot see. `PrivacyKeyManager` only ever calls the v3 branch.
+ *
+ * Chaining off the spending key is exactly what v3 removed — it made a viewing
+ * key impossible to delegate, since anything that revealed it revealed the key
+ * that spends. Kept for reading material derived under the older scheme.
  *
- * SECURITY: This is a symmetric secret — never embed it in a shareable address.
- * Use deriveViewingPublicKey() to obtain the public component for sharing.
+ * SECURITY: a symmetric secret — never embed it in a shareable address. Use
+ * `deriveViewingPublicKey()` for the public half.
  */
 declare function deriveViewingSecretKey(spendingKey: bigint): Uint8Array;
+/**
+ * The v3 spending scalar — the authority to move funds, and nothing else.
+ *
+ * Reduced into the curve's scalar field like its v2 counterpart, so the circuit
+ * accepts it unchanged. Unlike v2 it is a LEAF: no other key hangs off it.
+ */
+declare function deriveSpendingKeyV3(rootSecret: Uint8Array): bigint;
+/**
+ * The v3 incoming viewing key — read what arrives, spend nothing.
+ *
+ * This is the branch that makes a watch-only wallet possible: it is a sibling of
+ * the spending key, so holding it proves nothing about the spending key and
+ * gives no path to it.
+ */
+declare function deriveViewingSecretKeyV3(rootSecret: Uint8Array): Uint8Array;
+/**
+ * The v3 outgoing viewing key — read what this wallet SENT.
+ *
+ * Seeds the outgoing ephemerals and the recipient book, so a holder can
+ * enumerate every payment the wallet made and name who received it. That is the
+ * capability, not a leak — but it makes this strictly more sensitive than the
+ * incoming viewing key, which only reveals what arrived.
+ */
+declare function deriveOutgoingViewingKeyV3(rootSecret: Uint8Array): Uint8Array;
 /**
  * Derive the packed BabyJubJub viewing public key (ivk) from ivsk bytes.
  *
@@ -1955,7 +2152,7 @@ declare function deriveViewingSecretKey(spendingKey: bigint): Uint8Array;
  * The packed bigint is stored in little-endian so it is consistent with the
  * rest of the SDK's 32-byte scalar encoding (bigintTo32Le / bytesToBigintLE).
  *
- * @param ivsk 32-byte HKDF output from deriveViewingSecretKey().
+ * @param ivsk 32-byte viewing secret key — `deriveViewingSecretKeyV3` on v3.
  * @returns 32-byte LE-encoded packed BJJ point (goes in the privacy address).
  */
 declare function deriveViewingPublicKey(ivsk: Uint8Array): Uint8Array;
@@ -1966,20 +2163,6 @@ declare function deriveViewingPublicKey(ivsk: Uint8Array): Uint8Array;
  * Returns 0n if BabyJubJub computation fails (e.g. invalid scalar).
  */
 declare function deriveOwnerPk(spendingKey: bigint): bigint;
-/**
- * Derive the 32-byte outgoing viewing key (ovk) from master bytes.
- *   ovk = HKDF-SHA256(ikm=masterBytes, info="orbinum-ovk-v1")
- *
- * Mirror of the vault-key derivation: rooted at masterBytes, not the spendingKey
- * scalar (see the derivation chain above for why). The ovk lets the SENDER of a
- * private transfer recover what they sent — it wraps the memo's shared secret so
- * a cold restore rebuilds the outgoing history. Sibling of the ivsk, delegable
- * independently.
- *
- * SECRET. Never embed it in a shareable address — it stays out of
- * encodePrivacyAddress by construction (there is no public component to derive).
- */
-declare function deriveOutgoingViewingKey(masterBytes: Uint8Array): Uint8Array;
 
 /**
  * PrivacyKeyManager
@@ -1994,17 +2177,31 @@ declare function deriveOutgoingViewingKey(masterBytes: Uint8Array): Uint8Array;
  * The caller (application layer) is responsible for key persistence and session
  * caching. Each instance holds independent state — safe for multi-wallet use.
  *
- * Derivation scheme (from wallet signature):
+ * Derivation scheme (from wallet signature) — every branch hangs off the root:
  *   sig → HKDF → masterBytes (32 bytes, stable root for all derived keys)
- *     ├── spendingKey       = BigInt(masterBytes) % BABYJUB_SUBORDER  (circuit scalar)
- *     ├── viewingSecretKey  = HKDF(bigintTo32Le(spendingKey), info="orbinum-ivk-v1")  ← NEVER shared
- *     ├── viewingPublicKey  = packPoint(BJJ_mul(Base8, ivsk_scalar))  ← embedded in privacy address
+ *     ├── spendingKey       = HKDF(masterBytes, info="orbinum-spend-v3")  (circuit scalar)
+ *     ├── viewingSecretKey  = HKDF(masterBytes, info="orbinum-ivk-v3")  ← delegable
+ *     ├── outgoingViewingKey= HKDF(masterBytes, info="orbinum-ovk-v3")  ← own-payment recovery
+ *     ├── viewingPublicKey  = packPoint(BJJ_mul(Base8, ivsk_scalar))  ← in the privacy address
  *     ├── ownerPk           = BabyJubJub Ax from (spendingKey × Base8)
  *     └── vaultKey          = HKDF(masterBytes, info="orbinum-vault-key-v1")  ← stable
  *
+ * The branches are DISJOINT: knowing one reveals nothing about the others, so a
+ * viewing key can be handed out without handing out the ability to spend.
+ *
  * Cache format: "mk:0x{masterBytes_hex}" — storing masterBytes (not the sk scalar)
  * ensures the vault key remains stable if the circuit modulus ever changes.
  */
+
+/**
+ * Every address scheme this decoder still READS.
+ *
+ * Reading an old address is not the same as supporting the old identity: an
+ * address is just an owner key plus a viewing key, and paying one works no
+ * matter which scheme derived it. Only `orbpriv3` is ever EMITTED — see
+ * `encodePrivacyAddress`.
+ */
+type PrivacyAddressScheme = 'orbpriv1' | 'orbpriv2' | 'orbpriv3';
 declare class PrivacyKeyManager {
     private _state;
     /**
@@ -2012,11 +2209,12 @@ declare class PrivacyKeyManager {
      * Derives viewingSecretKey, viewingPublicKeyPacked, and ownerPk immediately.
      * Replaces any previously loaded key.
      *
-     * @param spendingKey  Circuit scalar: BigInt(masterBytes) % BABYJUB_SUBORDER, clamped to [1, ∞).
-     * @param masterBytes  Raw 32-byte HKDF output before modular reduction. Used to derive
-     *                     the stable vault key (HKDF(masterBytes, info="orbinum-vault-key-v1")).
+     * @param _legacySpendingKey  IGNORED. Kept so v2-era callers still compile;
+     *                             the scalar is re-derived from `masterBytes`.
+     * @param masterBytes  Raw 32-byte HKDF output. The root every v3 branch and
+     *                     the stable vault key hang off.
      */
-    load(spendingKey: bigint, masterBytes: Uint8Array): Promise<void>;
+    load(_legacySpendingKey: bigint, masterBytes: Uint8Array): Promise<void>;
     /** Clear all key material from memory. Call on vault lock / sign-out. */
     clear(): void;
     /** Returns true if a spending key has been loaded. */
@@ -2037,13 +2235,24 @@ declare class PrivacyKeyManager {
      * Throws if not loaded.
      */
     getViewingPublicKeyPacked(): Uint8Array;
-    /** Returns the BabyJubJub owner public key (x-coordinate). Throws if not loaded. */
-    getOwnerPk(): bigint;
     /**
-     * Returns the 32-byte outgoing viewing key (ovk). Throws if not loaded.
-     * Used to seal/open the outgoing blob that lets the sender recover a transfer.
+     * The OUTGOING viewing key (ovk) — reads what this wallet SENT.
+     *
+     * Seeds the outgoing ephemeral sequence and opens the recipient book, so a
+     * holder can enumerate every payment the wallet made and name who received
+     * it. That makes it strictly more sensitive than the incoming viewing key,
+     * which yields amounts and no counterparties: hand it out only where the
+     * payment graph is meant to travel with it.
+     *
+     * A scan without it still finds every note the wallet OWNS and simply
+     * reconstructs no sent history — the watch-only case.
+     *
+     * SECURITY: never expose this in an address or a network request.
+     * Throws if not loaded.
      */
     getOutgoingViewingKey(): Uint8Array;
+    /** Returns the BabyJubJub owner public key (x-coordinate). Throws if not loaded. */
+    getOwnerPk(): bigint;
     /** Returns the spending key as a 32-byte little-endian Uint8Array. Throws if not loaded. */
     getSpendingKeyBytes(): Uint8Array;
     /**
@@ -2062,7 +2271,7 @@ declare class PrivacyKeyManager {
      * Exports a shareable privacy address encoding the owner public key and
      * viewing PUBLIC key of the currently loaded identity.
      *
-     * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
+     * Format: `orbpriv3:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
      *
      * The recipient uses this address so the sender can:
      *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
@@ -2077,24 +2286,35 @@ declare class PrivacyKeyManager {
      *
      * Throws if no key is loaded.
      */
-    encodePrivacyAddress(): string;
+    encodePrivacyAddress(version?: IdentityVersion): string;
     /**
      * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
      * `null` if it does not parse.
      *
-     * Accepts both:
-     *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
-     *    (corrupted paste) returns null.
-     *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
-     *    shared before v2 keep resolving; only v2 is emitted.
+     * Reads every scheme ever emitted; only `orbpriv3` is written.
+     *
+     *  - `orbpriv3` / `orbpriv2` — checksum verified; a mismatch (corrupted
+     *    paste, or a relabelled prefix) returns null.
+     *  - `orbpriv1` — legacy, predates the checksum entirely. The FIELDS are
+     *    validated exactly as above, since this branch has no integrity check
+     *    of its own.
+     *
+     * Reading an old address is not the same as supporting an old identity. An
+     * address is an owner key and a viewing key; paying one works whatever
+     * scheme derived it, and whoever shares it may not have upgraded yet.
+     * Refusing them here would break incoming payments for no gain.
      */
     static decodePrivacyAddress(address: string): {
         ownerPkHex: string;
         viewingPublicKeyHex: string;
+        scheme: PrivacyAddressScheme;
     } | null;
     /**
      * Load keys from a cached "mk:0x{masterBytes_hex}" string produced by exportHex().
-     * Throws if the format is invalid or masterBytes length is not 32 bytes.
+     *
+     * Throws on a bad prefix, on non-hex content, and on a master that is not
+     * 32 usable bytes — an all-zero one included, since every wallet would
+     * derive the same identity from it.
      */
     importFromHex(hex: string): Promise<void>;
 }
@@ -2110,14 +2330,19 @@ declare const MIN_SIGNATURE_BYTES = 32;
  *
  * masterBytes = HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-v2:{chainId}:{address}")
  *
- * These bytes are the stable root for ALL derived keys:
- *   - spendingKey (circuit scalar) = BigInt(masterBytes) % BABYJUB_SUBORDER
- *   - viewingSecretKey              = HKDF(bigintTo32Le(spendingKey), info="orbinum-ivk-v1")
+ * These bytes are the stable root for ALL derived keys, each its own HKDF
+ * branch of the SAME root — none derived from another:
+ *   - spendingKey (circuit scalar) = HKDF(masterBytes, info="orbinum-spend-v3")
+ *   - viewingSecretKey             = HKDF(masterBytes, info="orbinum-ivk-v3")
+ *   - outgoingViewingKey           = HKDF(masterBytes, info="orbinum-ovk-v3")
  *   - vaultKey                     = HKDF(masterBytes, info="orbinum-vault-key-v1")
  *
- * Separating masterBytes from the circuit scalar means the viewingSecretKey and
- * vault key are STABLE across any future change to the modulus — they never
- * depend on which prime field the circuit uses.
+ * Disjoint branches are what make a viewing key delegable: handing one out
+ * grants sight and never the ability to spend.
+ *
+ * Separating masterBytes from the circuit scalar also keeps the viewing and
+ * vault keys STABLE across any future change to the modulus — they never depend
+ * on which prime field the circuit uses.
  *
  * @throws If the signature is not valid hex, or carries less entropy than the
  *         shortest real signing scheme (see {@link MIN_SIGNATURE_BYTES}).
@@ -2126,12 +2351,13 @@ declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, add
 /**
  * Derives an Orbinum spending key from a wallet signature.
  *
- * Uses HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-v2:{chainId}:{address}")
- * and reduces the resulting 32-byte value modulo BABYJUB_SUBORDER.
+ * Reduces the master bytes modulo BABYJUB_SUBORDER directly. NOT the v3
+ * branch — a v3 wallet derives its spending key with
+ * `deriveSpendingKeyV3(masterBytes)`, through HKDF under `orbinum-spend-v3`,
+ * and the two produce different scalars from the same signature.
  *
- * IMPORTANT: viewingSecretKey and vaultKey must be derived from masterBytes (via
- * deriveMasterKeyBytes), NOT from this spending key scalar. This ensures those
- * keys remain stable if the circuit's modulus ever changes again.
+ * Kept for reading material derived under the older scheme. Every other key
+ * comes from `masterBytes` and never from this scalar, so it is not a root.
  *
  * @param signatureHex  0x-prefixed or bare hex of the wallet signature.
  * @param chainId       Chain ID used when building the signing message.
@@ -2142,6 +2368,21 @@ declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, add
  */
 declare function deriveSpendingKeyFromSignature(signatureHex: string, chainId: number, address: string): Promise<bigint>;
 
+/**
+ * Witness assembly for the unshield circuit — one note in, a public payout and
+ * an optional change note out.
+ *
+ * The only entry point here that BUILDS anything rather than marshalling it:
+ * a partial unshield needs a change note, and its blinding and commitment are
+ * computed here when the caller does not supply them. The blinding comes from
+ * a CSPRNG — it is the only unknown in `Poseidon4(value, assetId, ownerPk,
+ * blinding)` once an observer guesses the amount, so a predictable one makes
+ * the commitment brute-forceable.
+ *
+ * A total unshield has no change, and the circuit constrains its commitment to
+ * be exactly zero — not a commitment to a zero-value note.
+ */
+
 /**
  * Inputs required to generate an Unshield proof.
  *
@@ -2698,7 +2939,10 @@ declare class EvmClient {
     request<T>(method: string, params?: unknown[]): Promise<T>;
     /**
      * Performs multiple JSON-RPC calls in a single HTTP request (batch).
-     * Results are returned in the same order as `calls`, as a typed tuple.
+     *
+     * Results come back in the order of `calls`, as a typed tuple. A call the
+     * server answered with an error, or did not answer at all, lands as `null`
+     * in its own slot — never shifting the ones after it.
      */
     batchRequest<T extends unknown[]>(calls: Array<{
         method: string;
@@ -2726,7 +2970,10 @@ declare class EvmClient {
     sendRawTransaction(signedHex: string): Promise<string>;
     /** Executes a read-only call without creating a transaction. Returns the raw ABI-encoded response. */
     call(to: string, data: string, from?: string): Promise<string>;
-    /** Estimates the gas required for a transaction. Returns the estimate in wei as a `bigint`. */
+    /**
+     * Estimates a transaction's gas, in GAS UNITS — not wei. Multiply by
+     * `getGasPrice()` for a cost.
+     */
     estimateGas(params: {
         from?: string;
         to: string;
@@ -2787,7 +3034,11 @@ interface EvmTransaction {
     nonce: number;
     /** ABI-encoded call data (0x-prefixed hex). `'0x'` for plain transfers. */
     input: string;
-    /** `1` for success, `0` for revert. */
+    /**
+     * `1` for success, `0` for revert — and `0` ALSO when no receipt could be
+     * read, which is what a pending transaction or a failed receipt call looks
+     * like. Not proof of a revert on its own.
+     */
     status: number;
     /** Deployed contract address for contract-creation transactions; `null` otherwise. */
     contractAddress: string | null;
@@ -2823,7 +3074,12 @@ interface EvmAddressInfo {
     codeSize: number;
     /** Deployed bytecode (truncated to 100 bytes + ellipsis for display). `'0x'` for EOAs. */
     code: string;
-    /** Up to 50 most recent logs emitted by or received by this address. */
+    /**
+     * Up to 50 recent logs EMITTED BY this address — `eth_getLogs` filters on
+     * the emitting contract, so nothing where the address merely appears as an
+     * indexed topic is here. A plain EOA emits nothing and gets an empty list;
+     * `getTokenTransfers` is the call that finds received activity.
+     */
     recentLogs: EvmLog[];
 }
 /** EVM block header with transaction hashes (not full tx objects). */
@@ -2865,7 +3121,12 @@ interface EvmTxSummary {
     gasUsed: number;
     /** Gas price in wei, as a 0x-prefixed hex string. */
     gasPrice: string;
-    /** `true` when the transaction succeeded (receipt status `0x1`). */
+    /**
+     * `true` on receipt status `0x1` — and ALSO when no receipt could be read,
+     * since a transaction still in the pool has not failed. Optimistic by
+     * design, and the opposite default from `EvmTransaction.status`: read it as
+     * "not known to have failed", never as confirmed success.
+     */
     status: boolean;
     /** `true` when the transaction created a new contract (`to` is `null`). */
     isContractCreation: boolean;
@@ -2926,7 +3187,7 @@ declare class EvmExplorer {
     getTransactionsByAddress(address: string, maxBlocks?: number): Promise<EvmTxSummary[]>;
     /**
      * Returns aggregated on-chain data for an EVM address: balance, nonce,
-     * bytecode (truncated), and up to 50 recent logs from the last 1 000 blocks.
+     * bytecode (truncated), and up to 50 logs it EMITTED in the last 1 001 blocks.
      */
     getAddressInfo(address: string): Promise<EvmAddressInfo>;
     /** Returns the native token balance of `address`, formatted as a decimal string (no symbol). */
@@ -2941,7 +3202,7 @@ declare class EvmExplorer {
      */
     getTokenInfo(address: string): Promise<TokenInfo | null>;
     /**
-     * Returns ERC-20 `Transfer` events for `address` from the last 1 000 blocks.
+     * Returns ERC-20 `Transfer` events for `address` from the last 1 001 blocks.
      * When `holderAddress` is provided, restricts results to transfers sent or received by that address.
      */
     getTokenTransfers(address: string, holderAddress?: string): Promise<TokenTransfer[]>;
@@ -3316,8 +3577,14 @@ declare class PrivacyModule {
     constructor(substrate: SubstrateClient);
     /** Returns the current Merkle tree root. */
     getMerkleRoot(): Promise<string>;
-    /** Returns the Merkle proof for the given leaf index or commitment hex. */
-    getMerkleProof(leafIndex: number | string): Promise<RpcV2MerkleProof>;
+    /**
+     * Returns the Merkle proof for a LEAF INDEX.
+     *
+     * The node declares this parameter `u32`, so a commitment hex is rejected
+     * by deserialisation before any lookup runs — `getMerkleProofByCommitment`
+     * is the one that takes a string.
+     */
+    getMerkleProof(leafIndex: number): Promise<RpcV2MerkleProof>;
     /**
      * Returns the Merkle inclusion proof for a given commitment hex,
      * bundled with the Merkle root.
@@ -3572,9 +3839,17 @@ declare class CryptoPrecompiles {
  * const stats = await client.privacy.getPoolStats();
  * console.log('root:', stats.merkleRoot, 'leaves:', stats.commitmentCount);
  *
- * // Shield tokens (with a SubstrateSigner)
+ * // Shield tokens (with a SubstrateSigner). `NoteBuilder.build` produces the
+ * // commitment and the 180-byte memo together — both are required, and a note
+ * // shielded without a valid memo is unrecoverable.
+ * const note = await NoteBuilder.build({ value: 1000n, assetId: 1n, ownerPk });
  * const result = await client.shieldedPool.shield(
- *   { assetId: 1, amount: 1000n, commitment: '0xabc...' },
+ *   {
+ *     assetId: 1,
+ *     amount: note.value,
+ *     commitment: note.commitmentHex,
+ *     encryptedMemo: Uint8Array.from(note.memo),
+ *   },
  *   signer,
  * );
  * console.log('tx ok:', result.ok, 'block:', result.blockHash);
@@ -3797,9 +4072,13 @@ declare class OrbinumClientProvider {
     private stopStableTimer;
     /**
      * Schedules the next connection attempt using exponential backoff
-     * (capped at `reconnectMaxMs`) with full jitter, then transitions to
-     * `'reconnecting'`. Jitter (a random fraction of the delay) spreads out
-     * reconnects so many clients don't retry in lockstep after a shared outage.
+     * (capped at `reconnectMaxMs`) with EQUAL jitter, then transitions to
+     * `'reconnecting'`.
+     *
+     * The delay lands in `[capped/2, capped]` — half fixed, half random. That
+     * spreads a shared outage's reconnects over a `capped/2` window instead of
+     * having every client retry in lockstep, while keeping a floor so the first
+     * attempts do not all pile up near zero the way full jitter allows.
      */
     private scheduleReconnect;
     private cancelReconnect;
@@ -3832,11 +4111,19 @@ declare class OrbinumClientProvider {
 }
 
 /**
- * Utilities for decoding on-chain extrinsic arguments and event data.
+ * Naming the positional fields of a decoded extrinsic or event.
+ *
+ * A Substrate/PAPI node returns `arg0`, `arg1`, … when metadata-based decoding
+ * is unavailable. These two tables map those positions onto the field names the
+ * pallets declare, so a caller reads `nullifier` instead of `arg2`.
+ *
+ * BEST EFFORT, BY METHOD NAME ONLY. Neither helper is given the pallet section,
+ * so two pallets that declare the same method name are indistinguishable here —
+ * see the `Executed` note below. A consumer that needs certainty decodes
+ * against metadata instead.
  *
- * Substrate/PAPI nodes return positional arg keys (`arg0`, `arg1`, …) when
- * metadata-based decoding is unavailable. These helpers map those positions
- * to human-readable semantic names for all Orbinum pallets.
+ * `events.ts` is the canonical model of the shielded-pool events; this file is
+ * a display convenience and does not replace it.
  */
 /**
  * Maps raw extrinsic args (which may use positional keys like `arg0`, `arg1`)
@@ -3872,16 +4159,14 @@ declare class RpcV2Module {
 /**
  * Classification of shielded-pool failures out of raw chain errors.
  *
- * These are pallet vocabulary, not app policy: the strings come from the
- * runtime's error variants, and what each one MEANS for a wallet — resync the
- * vault, purge a note — is protocol knowledge. A consumer without these treats
- * a ghost note as a generic failure and leaves the unspendable note in place.
+ * Pallet vocabulary, not app policy. The strings are the runtime's error
+ * variants, and what each MEANS for a wallet — resync, purge a note, retry — is
+ * protocol knowledge: without it a ghost note reads as a generic failure and
+ * the unspendable note stays in the vault.
  *
- * The split with a host is deliberate. This module answers "what kind of
- * failure is this, and what should a wallet DO about it"; the words shown to a
- * person, in whatever language, belong to the host. Two wallets should agree
- * that `UnknownMerkleRoot` means "rescan and retry" while phrasing it however
- * they like.
+ * This module answers "what kind of failure, and what should a wallet DO"; the
+ * words a person reads belong to the host. Two wallets should agree that
+ * `UnknownMerkleRoot` means "rescan and retry" while phrasing it differently.
  */
 /**
  * The pallet error name inside a raw chain error, or null.
@@ -4022,7 +4307,7 @@ type ShieldedEvent = {
     amount: bigint;
     /** 0x-prefixed 32-byte Poseidon commitment (LE). */
     commitment: string;
-    /** 0x-prefixed encrypted memo bytes (104 bytes). */
+    /** 0x-prefixed encrypted memo (180 bytes — see `ENCRYPTED_MEMO_SIZE`). */
     encryptedMemo: string;
     /** Leaf index assigned in the Merkle tree. */
     leafIndex: number;
@@ -4051,7 +4336,11 @@ type CommitmentsInsertedEvent = {
 };
 /**
  * Emitted by `unshield()` when a note is withdrawn to the public chain.
- * Rust variant: `Unshielded { nullifier, amount, recipient, change_commitment }`
+ *
+ * Rust variant: `Unshielded { nullifier, amount, recipient, change_commitment,
+ * change_encrypted_memo, change_leaf_index }`. The last two are NOT modelled
+ * here — a consumer that needs the change note's memo or its leaf position
+ * reads the raw event, or finds the note by scanning.
  */
 type UnshieldedEvent = {
     /** 0x-prefixed 32-byte Poseidon nullifier (LE). */
@@ -4074,7 +4363,11 @@ type MerkleRootUpdatedEvent = {
     oldRoot: string;
     /** 0x-prefixed new Merkle root (32 bytes, LE). */
     newRoot: string;
-    /** Total number of leaves after the update. */
+    /**
+     * Total leaves ever inserted, GLOBAL across the whole forest — never the
+     * current tree's size. Dense and monotonic, which is what indexer chunking
+     * and scan cursors rely on; per-tree size is `treeSize % LEAVES_PER_TREE`.
+     */
     treeSize: number;
 };
 /**
@@ -4098,7 +4391,13 @@ type AssetVerifiedEvent = {
 type AssetUnverifiedEvent = {
     assetId: number;
 };
-/** All events emitted by pallet-shielded-pool as a discriminated union. */
+/**
+ * The pallet events this SDK models, as a discriminated union.
+ *
+ * NOT every variant: `TreeSealed` (forest rotation) and `ValidatorFeesClaimed`
+ * are emitted by the pallet and absent here. A consumer that acts on a tree
+ * rotation has to read the raw event.
+ */
 type ShieldedPoolEvent = {
     type: 'Shielded';
     data: ShieldedEvent;
@@ -4557,6 +4856,20 @@ interface TransferFactsSource {
     byCommitments(commitments: string[]): Promise<TransferFactsRow[]>;
 }
 
+/**
+ * What a scan reports: progress while it runs, and its outcome when it ends.
+ *
+ * A host renders both, so these are the scanner's public vocabulary. The
+ * counters are DIAGNOSTICS, not results — the notes themselves land in the
+ * vault, and every field here exists so a host can tell a scan that found
+ * nothing from a scan that failed to look.
+ *
+ * That distinction is the reason the discovery counters are surfaced at all:
+ * the fast paths fail silently by design (a window that never matches costs
+ * only speed), so without them "the fast path is off" and "the fast path ran
+ * and matched nothing" are indistinguishable.
+ */
+
 /** Live progress, reported after each scanned page or chunk. */
 interface ScanProgress {
     scanned: number;
@@ -4573,12 +4886,48 @@ interface ScanResult {
     purged: number;
     /** Whether this was a full scan (from leafIndex 0) or an incremental one. */
     incremental: boolean;
+    /**
+     * Notes this wallet SENT, recovered during the same sweep.
+     *
+     * Free of extra requests — the outgoing ephPk window recognises our own
+     * payments, and the change notes in the same feed carry the recipient keys
+     * that open them. Feed them to `reconstructOutgoingTxRecords` to turn a
+     * derived history row into the exact amount, plus a re-issued payment slip.
+     */
+    sentNotes: SentNoteMatch[];
+    /**
+     * How the scan found what it found — diagnostics, not results.
+     *
+     * The two fast routes recognise a note by hash lookup against a precomputed
+     * window instead of a trial ECDH per hint, and they are the difference
+     * between a scan that takes seconds and one that takes minutes. Both fail
+     * SILENTLY: a window that never matches costs only speed, so the notes
+     * quietly take the expensive path and nothing reports it.
+     *
+     * Surfaced here so a host can tell "the fast path is off" from "the fast
+     * path ran". The counters existed before this and were accumulated where
+     * nothing could read them.
+     */
+    discovery: {
+        /** Own notes matched via the self-eph window (shields, change). */
+        self: number;
+        /** Notes from registered counterparties matched via their pairwise window. */
+        pairwise: number;
+        /** Hints rejected by the 1-byte view-tag filter, before any AEAD work. */
+        tagFiltered: number;
+    };
 }
 
 interface WalletScanKeys {
     viewingKey: Uint8Array;
     spendingKey: bigint;
     ownerPk: bigint;
+    /**
+     * Outgoing viewing key (ovk). Omit to scan WITHOUT payment history: every
+     * note the wallet owns is still found, and the sender-side record of what
+     * it paid simply is not reconstructed. That is the watch-only case.
+     */
+    outgoingViewingKey?: Uint8Array;
 }
 interface RunScanParams {
     vault: VaultStore;
@@ -4620,7 +4969,6 @@ declare function gapMargin(windowSize: number): number;
 declare function resolveSelfEphCeiling(params: {
     /** The wallet's notes AFTER persist — self notes carry their ephPk in the memo. */
     notes: ZkNote[];
-    spendingKey: bigint;
     viewingKey: Uint8Array;
     /** Highest window-matched index reported by the scan. */
     scanMaxIndex: number | null;
@@ -4632,10 +4980,11 @@ declare function resolveSelfEphCeiling(params: {
  * the gap margin) falls inside the fast path, and never past `MAX_EPH_WINDOW`.
  *
  * The counter is read from a config that survives restores and hand-editing, so
- * a non-finite value is treated as "no history" rather than propagated: `NaN`
- * would make the builder's `i < from + count` false immediately and return an
- * EMPTY window, silently disabling the fast path, while `Infinity` would make
- * that same loop never terminate.
+ * a non-finite value is treated as "no history" rather than propagated. The
+ * window builders reject a non-integer `count` outright, so passing one through
+ * would abort the scan with a throw — turning a corrupt stored counter into a
+ * wallet that cannot scan at all, where falling back to the default size costs
+ * only the fast path for indexes past it.
  */
 declare function windowSizeForCounter(counter: number): number;
 
@@ -4719,8 +5068,41 @@ interface ScanOutcome {
      * path fired rather than the notes quietly taking the expensive route.
      */
     pairwiseDiscovered: number;
+    /**
+     * Notes this wallet SENT, recovered in the same sweep.
+     *
+     * Free of extra requests: the outgoing ephPk window recognises our own
+     * payments, and the change notes in the same feed carry the recipient keys
+     * that open them. Kept out of `scanEntries` — the sender does not own them.
+     */
+    sentNotes: SentNoteMatch[];
+    /**
+     * Recipient viewing keys learned while opening payments, as lowercase hex.
+     *
+     * Accumulated across the whole scan and fed forward, so a second payment to
+     * the same person opens from the first one's key.
+     */
+    learnedRecipients: Set<string>;
+    /**
+     * Payments recognised as ours that no batch managed to open.
+     *
+     * Their book entry sits in a change note that landed in a different page.
+     * Kept so the caller can retry them once the whole feed has been read —
+     * dropping one costs a history row and a re-issuable slip for good.
+     */
+    unmatchedSent: UnmatchedSentHint[];
+    /**
+     * Every sealed book entry the scan saw, as decimal `sourcePk` strings.
+     *
+     * A payment and its change can land in different pages, and then neither
+     * half is usable alone. Accumulating both across the whole scan is what lets
+     * the final retry pair them up.
+     */
+    sealedBookEntries: Set<string>;
     /** Highest self-eph index seen — the caller bumps the vault counter past it. */
     maxSelfEphIndex: number | null;
+    /** Highest outgoing index seen — same repair, for the payment sequence. */
+    maxOutgoingEphIndex: number | null;
 }
 interface CollectScanEntriesParams {
     source: ScanHintSource;
@@ -4760,7 +5142,7 @@ interface CollectScanEntriesParams {
      * discoveries into the set; harmless, since the ghost purge filters them.
      */
     vaultHexes?: Set<string> | undefined;
-    /** Sink for the two non-fatal warnings this phase can emit. */
+    /** Sink for the one non-fatal warning this phase emits: the chunk fallback. */
     onWarning?: ((message: string, cause?: unknown) => void) | undefined;
 }
 /**
@@ -4804,31 +5186,21 @@ declare function resolveSpentStatus(params: {
 }): Promise<Map<string, SpendDetails>>;
 
 /**
- * Spent-status resolution — decides which of the wallet's own nullifiers are
- * spent WITHOUT ever asking the server about a specific nullifier.
+ * Spent-status resolution — which of the wallet's own nullifiers are spent,
+ * WITHOUT ever asking the server about a specific one.
  *
- * This is the most important privacy property in the scanner. The obvious
- * implementation — ask the indexer "is nullifier X spent?" — tells the server
- * exactly which notes the caller owns, and it is what a re-implementation
- * reaches for by default. Instead the whole set is downloaded and intersected
- * locally, so every request the server sees is identical for every caller.
+ * The most important privacy property in the scanner, and the one a
+ * re-implementation gets wrong by default: asking "is nullifier X spent?" tells
+ * the server exactly which notes the caller owns. Instead the whole set is
+ * downloaded and intersected locally, so every request looks identical for
+ * every caller.
  *
- * Sealed chunks make that affordable: the manifest is universal, only missing
- * chunks are fetched, and the set persists in the injected cache. Per scan this
- * transfers roughly one chunk plus the tail rather than the entire set.
+ * Sealed chunks make that affordable — universal manifest, only missing chunks
+ * fetched, the set persisted in the injected cache — so a scan transfers about
+ * one chunk plus the tail rather than the entire set.
  *
  * On any hard failure the caller degrades: notes stay unspent and are
- * re-verified on the next pass.
- *
- * ## Hex casing
- *
- * The intersection is an exact string match, so both sides must agree on
- * casing. The wallet lowercases its own nullifiers before asking; the feed's
- * are lowercased HERE, on the way in. Skipping that makes an uppercase-serving
- * indexer report every spent note as unspent — the wallet then offers notes it
- * cannot spend, and each attempt dies on a duplicate nullifier. Normalising at
- * ingestion means the cache only ever holds one form, so a feed that changes
- * casing between runs cannot split one nullifier into two entries.
+ * re-verified next pass.
  */
 
 interface OpenSpentSetParams {
@@ -4881,26 +5253,19 @@ interface PersistParams {
 }
 /**
  * The notes to purge as ghosts: unspent, absent from the on-chain set, and
- * already in the vault when the scan began.
+ * already in the vault when the scan BEGAN.
  *
- * That last condition is what protects a note the user just created.
- * `onChainHexes` is a snapshot frozen as the scan paged the feed, so a
- * shield/transfer that lands mid-scan is legitimately missing from it — the feed
- * had not served it yet, or its leaf sat behind the paging cursor. Purging on
- * absence alone deleted that note from memory AND storage seconds after the user
- * saw it, and only a later rescan brought it back.
+ * That last condition protects a note the user just created. `onChainHexes` is
+ * frozen as the scan pages the feed, so a shield or transfer landing mid-scan is
+ * legitimately missing from it — purging on absence alone deleted such a note
+ * from memory and storage seconds after the user saw it.
  *
- * A note born mid-scan is simply not this scan's business; the next pass, run
- * against a feed that has caught up, reconciles it.
+ * A note born mid-scan is not this scan's business; the next pass reconciles it.
  */
 declare function selectGhosts(notes: ZkNote[], onChainHexes: Set<string>, preScanHexes?: Set<string>): string[];
 /**
- * Phase 3: builds the batched save-entry list, writes it in one transaction,
- * then purges ghost notes (full scan only). Returns the number of ghosts purged.
- *
- * Both the scanned notes and the memo-failed reconciliation feed a SINGLE
- * saveMany → one storage transaction and one cache write, so subscribers
- * re-render once per call instead of once per note.
+ * Phase 3: build the batched save-entry list, write it in one transaction, then
+ * purge ghost notes (full scan only). Returns how many ghosts were purged.
  */
 declare function persistScanResults(params: PersistParams): Promise<number>;
 /**
@@ -4928,6 +5293,12 @@ interface ReconstructedTxRecord {
     /** Set when the fee was unreadable — the amount overstates by exactly it. */
     amountApproximate?: true;
     timestampMs: number;
+    /**
+     * A freshly sealed `orbslip1:` slip, when this row was recovered from the
+     * memo. RE-ISSUED, not remembered: a slip is sealed toward the recipient,
+     * so the sender never held a readable copy. It carries only public facts.
+     */
+    paymentSlip?: string;
 }
 interface ReconstructDeps {
     vault: Pick<VaultStore, 'getAll' | 'getTxRecords' | 'saveTxRecord'>;
@@ -4935,6 +5306,13 @@ interface ReconstructDeps {
     txFacts: TxFactsSource;
     /** Injectable clock — reconstruction stamps rows whose block time is unknown. */
     now?: () => number;
+    /**
+     * Notes this wallet sent, as the scan recovered them.
+     *
+     * Comes from `ScanOutcome.sentNotes` — the sweep already recognises them by
+     * their outgoing ephPk. Omit to keep the arithmetic-only behaviour.
+     */
+    sentNotes?: SentNoteMatch[];
 }
 declare function reconstructOutgoingTxRecords(deps: ReconstructDeps): Promise<void>;
 
@@ -4981,6 +5359,12 @@ interface NoteBuildKeys {
     viewingPublicKey: Uint8Array;
     /** Needed only for pairwise derivation; omit to disable that path. */
     viewingSecretKey?: Uint8Array | undefined;
+    /**
+     * Outgoing viewing key (ovk). Omit and a payment falls back to a random
+     * ephemeral: still spendable by the recipient, but the sender loses the
+     * ability to read it back later.
+     */
+    outgoingViewingKey?: Uint8Array | undefined;
 }
 interface BuildNoteParams {
     /** Note value in the asset's indivisible units. Must be greater than zero. */
@@ -4997,6 +5381,11 @@ interface BuildNoteParams {
     sourcePk?: bigint | undefined;
     /** Recipient's global ownerPk. With `viewingPublicKey`, enables stealth. */
     recipientOwnerPk?: bigint | undefined;
+    /**
+     * Next outgoing index as reconstructed from chain data, for the first
+     * payment after a restore. Taken as a floor only — see `reserveOutgoingIndex`.
+     */
+    outgoingIndexFromChain?: number | undefined;
     /**
      * Circuit version to stamp. A fresh note carries no proof, so this only
      * matters when it is later spent — pass the version the chain reports as
@@ -5012,6 +5401,21 @@ interface BuildNoteDeps {
      */
     storage?: NoteStorage | undefined;
 }
+/** A built note, plus the outgoing index it published when it is a payment. */
+interface BuiltNote {
+    note: ZkNote;
+    /**
+     * Which index of the outgoing sequence this note used, when it is a payment
+     * to a privacy address. Absent for self notes and for a payment that fell
+     * back to a random ephemeral.
+     *
+     * The transfer reads it as a flag: an index present means this payment can
+     * be recovered later, so its change note is worth giving a recipient book
+     * entry. The entry is keyed on the payment's commitment, not on this index.
+     */
+    outgoingIndex?: number;
+}
+declare function buildZkNoteWithIndex(params: BuildNoteParams, deps: BuildNoteDeps): Promise<BuiltNote>;
 declare function buildZkNote(params: BuildNoteParams, deps: BuildNoteDeps): Promise<ZkNote>;
 
 interface SelfStealthKeys {
@@ -5032,104 +5436,29 @@ interface SelfStealthKeys {
  */
 declare function recoverSelfStealthNote(note: ZkNote, keys: SelfStealthKeys): ZkNote | null;
 
-/** URI namespace. The version is in the path, so a v2 scanner can refuse a v1. */
-declare const NOTE_TRANSFER_URI_SCHEME = "orbinum://notes/v1/";
-/**
- * Max characters per page. Chosen for QR error-correction level M, which stays
- * scannable from a phone at arm's length.
- */
-declare const QR_PAGE_MAX_CHARS = 1800;
-/**
- * One note on the wire. Field names are abbreviated because every byte costs
- * QR density — and they are FROZEN: renaming one breaks every deployed scanner.
- */
-interface NoteTransferEntry {
-    /** commitmentHex */
-    c: string;
-    /** nullifierHex */
-    n: string;
-    /** value, decimal string */
-    val: string;
-    /** assetId, decimal string */
-    aid: string;
-    /** ownerPk, 0x-prefixed 64-char hex */
-    opk: string;
-    /** blinding, 0x-prefixed 64-char hex */
-    bld: string;
-    /** spendingKey, 0x-prefixed 64-char hex */
-    sk: string;
-}
-interface NoteTransferPayload {
-    v: 1;
-    /** Encode time (ms). Informational — a scanner may warn on a stale batch. */
-    ts: number;
-    /** Page index, 0-based. */
-    p: number;
-    /** Total pages in this batch. */
-    pt: number;
-    notes: NoteTransferEntry[];
-}
-declare function noteToTransferEntry(note: ZkNote): NoteTransferEntry;
 /**
- * Encodes notes into scannable page URIs.
+ * CLOSED JSON backup: notes moved between a user's devices as a plain file,
+ * WITHOUT exposing any spending key.
  *
- * `now` is injectable so a caller can produce a deterministic batch (tests, or
- * a reproducible export).
- */
-declare function encodeNoteTransferPages(notes: ZkNote[], options?: {
-    now?: () => number;
-    maxChars?: number;
-}): string[];
-/**
- * Decodes one scanned page, or throws with a reason a scanner can show.
- *
- * Strict on purpose: a partially-understood payload would import notes with
- * missing fields, and an unspendable note in a vault is worse than a failed
- * scan the user can retry.
- */
-declare function decodeNoteTransferPage(uri: string): NoteTransferPayload;
-/**
- * Reassembles a scanned batch into notes.
- *
- * Rejects an incomplete or mixed batch rather than importing what it has: a
- * partial import looks like a successful one, and the user would never learn
- * which notes never made it.
- */
-declare function assembleNoteTransfer(pages: NoteTransferPayload[]): NoteTransferEntry[];
-
-/**
- * CLOSED JSON backup of notes — the same notes moved between a user's devices as
- * a plain file, WITHOUT exposing any spending key.
- *
- * ## The idea
- *
- * A backup entry carries only what is already PUBLIC on chain: the commitment and
- * the encrypted memo. It contains no spending key, so the file is safe to hold
- * and even share — it grants nothing on its own.
+ * An entry carries only what is already PUBLIC on chain — the commitment and
+ * the encrypted memo — so the file grants nothing on its own.
  *
- * On import, the recipient DECRYPTS each memo with their own viewing key
- * (`importNotesFromBackup`). Decryption is the proof of ownership:
- *   - the memo decrypts → the note is theirs → a full spendable `ZkNote` is
- *     reconstructed, spending key and stealth key derived from their identity;
- *   - the memo does not decrypt → the note is someone else's → it is dropped.
+ * DECRYPTION IS THE PROOF OF OWNERSHIP. On import each memo is opened with the
+ * importer's viewing key: one that opens rebuilds a full spendable `ZkNote`
+ * (spending and stealth keys derived from their identity); one that does not is
+ * someone else's note and is dropped.
  *
- * This is NOT a chain scan: only the N memos in the backup are tried, not the
- * whole pool. It moves notes between devices without re-scanning, and a note that
- * is not yours simply fails to import.
+ * Not a chain scan — only the N memos in the file are tried, which is what lets
+ * a device restore without re-scanning the pool.
  *
- * ## What travels vs what does not
- *
- * Travels: `commitmentHex`, `encryptedMemo`, and `leafIndex` (informational).
- * Does NOT travel: value, ownerPk, blinding, spendingKey — all recovered by
- * decrypting the memo. The Merkle proof is re-fetched at spend time.
+ * Travels: `commitmentHex`, `encryptedMemo`, `leafIndex` (informational).
+ * Recovered from the memo: value, ownerPk, blinding, spendingKey. The Merkle
+ * proof is re-fetched at spend time.
  */
 
 /** Current backup format version. Bumped only if the entry shape changes. */
 declare const NOTE_BACKUP_VERSION: 1;
-/**
- * One note in a closed backup — public data only. Field names are short but not
- * cryptic; readability matters more than density in a file (unlike the QR path).
- */
+/** One note in a closed backup — public data only. */
 interface NoteBackupEntry {
     /** 0x-prefixed 32-byte LE commitment hex. */
     commitmentHex: string;
@@ -5189,15 +5518,12 @@ declare function decodeNoteBackup(json: string | object): NoteBackupEntry[];
 declare function importNotesFromBackup(entries: NoteBackupEntry[], keys: BackupImportKeys): ZkNote[];
 
 /**
- * Reconstruct a note from a payment slip.
+ * Reconstruct a note from a payment slip, without scanning the pool.
  *
- * The recipient of a private transfer receives an `orbslip1:` string (or the raw
- * envelope) that the sender produced. Opening it yields the note's public
- * locators — commitment, encrypted memo, leaf index — which are fed to the SAME
- * decryption path a scan uses (`tryDecryptNote`): it decrypts the memo with the
- * recipient's viewing key, derives the stealth spending key, and verifies the
- * commitment. The result is a fully spendable `ZkNote`, obtained without scanning
- * the pool.
+ * An `orbslip1:` string carries the note's public locators — commitment,
+ * encrypted memo, leaf index. Those feed the SAME path a scan uses
+ * (`tryDecryptNote`), which opens the memo, derives the stealth spending key
+ * and verifies the commitment. Out comes a fully spendable `ZkNote`.
  */
 
 /** Keys the recipient needs to open a slip and reconstruct the note. */
@@ -5306,16 +5632,28 @@ interface TransferSubmitRequest {
 interface TransferDeps {
     privacy: SpendPrivacyReads;
     resolver: Pick<CircuitVersionResolver, 'resolve'>;
-    /** Builds the two output notes. Owns keys and the ephemeral reservations. */
+    /**
+     * Builds the two output notes. Owns keys and the ephemeral reservations.
+     *
+     * Returns the outgoing index alongside the note, used only as a signal that
+     * this payment published a DERIVED ephemeral and is therefore recoverable —
+     * which is what decides whether the change note carries a book entry at all.
+     * The entry itself is keyed on the payment's commitment, never on this
+     * index; see `recipientBook`.
+     */
     buildNote: (params: {
         value: bigint;
         assetId: bigint;
-        ownerPk: bigint;
+        /** Omit for a note owned by the wallet itself — the builder fills its own. */
+        ownerPk?: bigint;
         spendingKey?: bigint;
         sourcePk: bigint;
         viewingPublicKey?: Uint8Array;
         recipientOwnerPk?: bigint;
-    }) => Promise<ZkNote>;
+    }) => Promise<{
+        note: ZkNote;
+        outgoingIndex?: number;
+    }>;
     vault: SpendVault;
     /** Spendable form of a self-addressed stealth note, or null (see selfStealthNote). */
     recoverStealth: (note: ZkNote) => ZkNote | null;
@@ -5327,6 +5665,14 @@ interface TransferDeps {
      * immediately instead of waiting for a rescan.
      */
     selfOwnerPk: bigint | null;
+    /**
+     * The wallet's outgoing viewing key (ovk), when it has one.
+     *
+     * Seals the recipient book into the change note. Absent — a watch-only or
+     * legacy identity — the change keeps the older meaning and the transfer is
+     * simply not recoverable from the seed later.
+     */
+    outgoingViewingKey?: Uint8Array;
     /** Route stamped on persisted notes (explorer link kind). */
     txKind?: TxKind;
 }
@@ -5336,6 +5682,19 @@ interface TransferParams {
     recipientPk: bigint;
     /** Packed viewing key from the recipient's privacy address. Omitted → dummy memo, they must scan. */
     recipientViewingPublicKey?: Uint8Array | undefined;
+    /**
+     * What the recipient sees as `sourcePk` — who paid them.
+     *
+     * PASS IT EXPLICITLY. The default is the spent note's owner, so what gets
+     * disclosed depends on coin selection: spending a received note discloses a
+     * one-time key that names nobody, spending a shield or change note
+     * discloses the wallet's GLOBAL identity, linkable across every payment
+     * made from one. Naming the counterparty is the field's purpose, so neither
+     * is a leak — but the choice should not be made by the coin selector.
+     *
+     * A stable pseudonym for a merchant tracking repeat payments, a
+     * per-recipient value to stay unlinkable, or `0n` to say nothing.
+     */
     senderPk?: bigint | undefined;
     fee?: bigint | undefined;
 }
@@ -5367,7 +5726,18 @@ interface UnshieldSubmitRequest {
 interface UnshieldDeps {
     privacy: SpendPrivacyReads;
     resolver: Pick<CircuitVersionResolver, 'resolve'>;
-    /** Builds the stealth change note. Owns keys and the ephemeral reservation. */
+    /**
+     * Builds the stealth change note. Owns the keys it is built under.
+     *
+     * No ephemeral is reserved: passing `recipientOwnerPk` without a
+     * `viewingPublicKey` takes neither the self nor the outgoing branch in
+     * `buildZkNoteWithIndex`, so the note publishes a RANDOM ephemeral and a rescan
+     * finds it by trial decryption rather than by index lookup.
+     *
+     * Shares its shape with the transfer's builder so one bound function serves
+     * both; the outgoing index it may return is unused here, since an unshield
+     * has no recipient to record.
+     */
     buildNote: (params: {
         value: bigint;
         assetId: bigint;
@@ -5375,7 +5745,9 @@ interface UnshieldDeps {
         blinding: bigint;
         spendingKey: bigint;
         recipientOwnerPk: bigint;
-    }) => Promise<ZkNote>;
+    }) => Promise<{
+        note: ZkNote;
+    }>;
     vault: SpendVault;
     /**
      * The spendable form of a stealth note this wallet authored, or null. Null
@@ -5441,12 +5813,12 @@ declare function claimFees(deps: FeeClaimDeps, { assetId, amount, signer }: FeeC
 /**
  * Whether a note still matches the commitment stored on chain.
  *
- * The circuit ignores the ownerPk it is passed and rebuilds each input
- * commitment from BabyPbk(spending_key).Ax. If a note's stored spendingKey,
- * value, assetId or blinding drift from what was committed, the recomputed root
- * differs and witness generation dies on the Merkle constraint. Checking here
- * costs one EC multiplication plus a Poseidon hash — around 0.13 ms — against
- * seconds of proving that would fail anyway, and it names the real problem.
+ * The circuit ignores the `ownerPk` it is handed and rebuilds each input
+ * commitment from `BabyPbk(spending_key).Ax`, so a drifted spendingKey, value,
+ * assetId or blinding kills witness generation on the Merkle constraint.
+ *
+ * ~0.13 ms here — one EC mul plus a Poseidon hash — against seconds of proving
+ * that fails anyway, and this one names the note.
  */
 declare function noteMatchesCommitment(note: ZkNote): boolean;
 /**
@@ -5547,12 +5919,11 @@ declare function chainActiveCircuitVersion(zkVerifier: Pick<ZkVerifierModule, 'g
  * A WebSocket drop between submit and finalization surfaces as an error for a
  * tx that may have landed anyway. Reporting that as "failed" is the dangerous
  * outcome: the user retries, and the retry double-spends (shield) or dies on a
- * duplicate nullifier (transfer/unshield). Every wallet has this bug until it
- * explicitly does not.
+ * duplicate nullifier (transfer/unshield).
  *
- * The fix is to distinguish "the chain rejected it" from "we lost the line":
- * only the second is worth polling, and the poll asks an on-chain predicate the
- * caller supplies — a nullifier turned spent, a commitment now in the tree.
+ * So "the chain rejected it" and "we lost the line" are told apart, and only
+ * the second is polled — against an on-chain predicate the caller supplies: a
+ * nullifier turned spent, a commitment now in the tree.
  */
 
 /** Whether an error leaves the submit outcome unknown rather than rejected. */
@@ -5582,20 +5953,26 @@ declare function txLandedAfterError(err: unknown, landed: () => Promise<boolean>
 declare const RECOVERED_TX_RESULT: TxResult;
 
 /**
- * Storage key for one cached identity.
+ * Storage name for one account's vault on one chain.
  *
- * Scoped by chainId because the chain is PART of the identity: the spending key
- * is derived with `info = "orbinum-sk-v2:{chainId}:{account}"`, so one wallet
- * yields a different key per network. A key shared across networks would restore
- * one network's identity into another and show an empty vault with nothing to
- * explain it.
+ * `chainFingerprint` is the genesis hash, optional because a host may not know
+ * it during connect: the name then scopes by account alone and is promoted once
+ * it arrives. Opening under the short name and later the long one is safe —
+ * `unlock` detects the change and resets rather than mixing two chains' notes.
+ */
+declare function vaultStorageName(address: string, chainFingerprint?: string, version?: IdentityVersion): string;
+
+/**
+ * Storage key for one cached identity — same three parts as the vault name, for
+ * the same reason (see `vaultName`).
  *
- * The account half goes through `canonicalAccountId` for the same reason: it has
- * to match what the derivation keys by, or one identity ends up filed under two
- * names. An SS58 address re-listed under another network prefix is the common
- * way that happens — same key, different vault, orphaned notes.
+ * The chain is PART of the identity: the derivation's `info` carries the chain
+ * id, so one wallet yields a different key per network. The account goes through
+ * `canonicalAccountId` so this matches what the derivation keys by — an address
+ * re-listed under another SS58 prefix would otherwise file one identity under
+ * two names.
  */
-declare function sessionCacheKey(address: string, chainId: number): string;
+declare function sessionCacheKey(address: string, chainId: number, version?: IdentityVersion): string;
 interface SessionCacheDeps {
     store: SecretStore;
     /**
@@ -5635,61 +6012,87 @@ declare function restoreSession(deps: SessionCacheDeps, address: string, chainId
  */
 declare function clearSession(store: SecretStore, address: string, chainId?: number): Promise<void>;
 
+interface WalletIdentity {
+    version: IdentityVersion;
+    spendingKey: bigint;
+    ownerPk: bigint;
+    viewingSecretKey: Uint8Array;
+    viewingPublicKey: Uint8Array;
+    /** Absent on a watch-only identity, which is handed everything except this. */
+    outgoingViewingKey?: Uint8Array;
+}
 /**
- * Storage name for one account's vault on one chain.
+ * Assemble the identity. v3 is the only scheme.
+ *
+ * Throws on a root that is not 32 bytes or is all zeros. Neither is an error the
+ * derivation itself would raise: the branches are pure HKDF, so they answer for
+ * ANY input — an empty one included — with a complete, deterministic and
+ * publicly derivable identity. This is the only place that catches a caller who
+ * wired the root from something that was not there.
  *
- * `chainFingerprint` is the chain's genesis hash. It is optional because a host
- * may not know it yet during connect; the name then scopes by account alone and
- * is promoted once the fingerprint arrives. Opening a vault under the short name
- * and later under the long one is safe — `VaultStore.unlock` detects the
- * fingerprint change and resets rather than mixing two chains' notes.
+ * Nothing migrates from an older scheme: a note is committed on chain under the
+ * `ownerPk` inside the Merkle tree, so re-deriving an identity does not move it,
+ * it orphans it. Holders unshield first.
+ *
+ * @param rootSecret 32 bytes — the master key material. Not retained.
  */
-declare function vaultStorageName(address: string, chainFingerprint?: string): string;
-
+declare function deriveIdentity(rootSecret: Uint8Array, version: IdentityVersion): WalletIdentity;
 /**
- * Whether browser wallet extensions can be discovered at all.
+ * What a watch-only holder is given: read access, no spend authority.
  *
- * False in React Native, Node, a Cloudflare Worker and an extension service
- * worker. A host that gets false must sign some other way — there is no
- * fallback to arrange here, only a fact to report.
+ * The spending key is absent by TYPE, not by a runtime check — a credential
+ * cannot be passed where a spend needs one.
+ *
+ * `includeOutgoing` is opt-in and stays that way: the incoming key reveals what
+ * arrived, the outgoing one reveals who was PAID. Bundling them by default would
+ * hand the payment graph to anyone granted a look at the balance.
+ */
+interface ViewingCredential {
+    version: IdentityVersion;
+    ownerPk: bigint;
+    viewingSecretKey: Uint8Array;
+    viewingPublicKey: Uint8Array;
+    outgoingViewingKey?: Uint8Array;
+}
+declare function exportViewingCredential(identity: WalletIdentity, options?: {
+    includeOutgoing?: boolean;
+}): ViewingCredential;
+
+/**
+ * Whether browser wallet extensions can be discovered at all. A host that gets
+ * false must sign some other way — there is no fallback to arrange here.
  */
 declare function hasInjectedExtensions(): boolean;
 /**
  * Installed extension ids, or an empty list where none can exist.
  *
- * Returns empty rather than throwing: "which extensions are present" has an
- * honest answer off-page, and it is "none". A caller enumerating wallets to
- * render a picker wants a list, not an exception.
+ * Empty rather than a throw: off-page, "which extensions are present" has an
+ * honest answer, and it is "none". A caller rendering a picker wants a list.
  */
 declare function getInjectedExtensions(): string[];
 /**
- * Connects to one extension by id.
- *
- * Throws off-page, unlike the enumerator above: the caller asked for a specific
- * extension, so an empty result would misreport "not installed" for what is
- * really "this host cannot reach extensions at all".
+ * Connects to one extension by id. Throws off-page, unlike the enumerator: the
+ * caller named an extension, so silence would misreport "not installed" for
+ * "this host cannot reach extensions at all".
  */
 declare function connectInjectedExtension(name: string, origin?: string): Promise<InjectedExtension>;
 
 /**
- * NoteProvenance — the single vocabulary for "where did this note come from,
- * and where did it go".
+ * NoteProvenance — one vocabulary for "where did this note come from, and where
+ * did it go".
  *
- * Several mechanisms answer that question, and before this module they had
- * separate vocabularies and no contract between them:
+ * Two mechanisms answer that, and they are PROVIDERS of the same fact rather
+ * than competing designs; `ProvenanceSource` records which one spoke:
  *
- *   - the memo's `sourcePk` field, readable by whoever can decrypt the note
- *     (the recipient always; the sender only for the change note they kept);
- *   - a lookup by commitment, which returns only what is already public — no
- *     amount, no recipient, but enough to re-issue a payment slip.
+ *   - the memo's `sourcePk`, readable by whoever can decrypt the note — the
+ *     recipient always, the sender only for the change note they kept;
+ *   - a lookup by commitment, returning only what is already public: no amount,
+ *     no recipient, but enough to re-issue a payment slip.
  *
- * They are not competing designs. They are providers of the same fact, and
- * `ProvenanceSource` records which one spoke. Nothing here derives a key: this
- * layer only holds data already recovered.
- *
- * A sender cannot reopen a memo sealed toward someone else, so the amount and
- * recipient of an outgoing transfer are NOT recoverable from a seed alone. What
- * survives is the ability to hand the recipient a working slip again.
+ * Nothing here derives a key — this layer only holds what was already
+ * recovered. And a sender cannot reopen a memo sealed toward someone else, so
+ * the amount and recipient of an outgoing transfer are NOT recoverable from a
+ * seed. What survives is the ability to hand over a working slip again.
  */
 
 /**
@@ -5819,16 +6222,12 @@ declare function selectDescribingNoteByCommitment<T extends Pick<ZkNote, 'source
 /**
  * Merging what a rescan learned into what the wallet already knew.
  *
- * The hazard this exists to remove: reconstruction runs after every scan, over
- * records the wallet may have written itself at submit time. Those local
- * records hold what a recovery path cannot: the amount and the recipient, which
- * live inside a memo sealed toward someone else. Overwriting one loses them.
- *
- * The payment slip itself is not at risk — it can be re-issued from public
- * fields — but a thin `chain` record must never replace a rich local one.
+ * Reconstruction runs after every scan, over records the wallet may have
+ * written ITSELF at submit time — and those hold what no recovery path can
+ * reach: the amount and the recipient, which live inside a memo sealed toward
+ * someone else. A thin `chain` record must never replace a rich local one.
  *
- * Before this, the protection was a single spread expression in the
- * reconstruction loop. The rule is now explicit and testable on its own.
+ * The slip is the exception: it can always be re-issued from public fields.
  */
 
 declare function outranks(a: ProvenanceSource, b: ProvenanceSource): boolean;
@@ -5861,25 +6260,20 @@ declare function mergeProvenance(existing: NoteProvenanceRecord, incoming: NoteP
 /**
  * Seal a fresh `orbslip1:` slip for a transfer recovered from history.
  *
- * ## Why the facts are checked here
- *
- * They were looked up by commitment, so they crossed a trust boundary, and
- * sealing them produces an AUTHENTICATED envelope. A valid MAC proves the
- * sender knew the recipient's viewing key — not that they are honest, and not
- * that whatever server answered the lookup was. The recipient's wallet then
- * renders those fields with the authority of a decrypted slip, on a device
- * where nothing explains which server supplied them.
- *
- * So the check belongs on THIS side of the wire: a value that slipped through
- * would fail on the recipient's device, or worse, not fail at all.
+ * VALIDATES ON THIS SIDE OF THE WIRE. The facts crossed a trust boundary (they
+ * were looked up by commitment) and sealing them produces an AUTHENTICATED
+ * envelope: a valid MAC proves the sender knew the recipient's viewing key, not
+ * that the server which answered was honest. The recipient's wallet then renders
+ * those fields with the authority of a decrypted slip, on a device that cannot
+ * tell where they came from.
  *
- * Throws on a malformed commitment, memo or leaf index — those are the note's
- * identity, and a slip carrying a wrong one is not a degraded slip but a broken
- * one. `txHash` is informational, so it is DROPPED rather than fatal.
+ * Throws on a malformed commitment, memo or leaf index — they are the note's
+ * identity, and a slip carrying a wrong one is broken, not degraded. `txHash` is
+ * informational, so it is DROPPED instead.
  *
  * @param facts               public facts of the sent note, looked up by commitment
  * @param recipientIvkPacked  32-byte packed viewing key from the recipient's privacy address
- * @param txHash              the transfer's hash, when known — informational, shown as proof of payment
+ * @param txHash              the transfer's hash, when known — informational
  */
 declare function regeneratePaymentSlip(facts: NoteFacts, recipientIvkPacked: Uint8Array, txHash?: string): string;
 
@@ -5931,6 +6325,16 @@ interface OrbinumWalletConfig {
      * that already resolved it — a wrong value yields unspendable notes.
      */
     circuitVersion?: number | undefined;
+    /**
+     * Which derivation scheme this wallet's keys come from.
+     *
+     * Only `v3` exists, so this is here for the NEXT scheme rather than for a
+     * choice available today — passing it changes nothing. v2 was removed, not
+     * deprecated: it chained the viewing key off the spending key, which made a
+     * watch-only wallet impossible and left no branch to hang the outgoing
+     * viewing key on.
+     */
+    identityVersion?: IdentityVersion | undefined;
 }
 interface ScanOptions {
     /**
@@ -5947,8 +6351,16 @@ declare class OrbinumWallet {
     private readonly session;
     private readonly notes;
     private readonly vaultStore;
-    /** Set at unlock; every key below is derived from it. */
-    private spendingKey;
+    /**
+     * The identity this wallet is unlocked as, or null.
+     *
+     * Held as a bundle rather than a single scalar because v3 keys are SIBLINGS:
+     * the spending key no longer produces the viewing key, so there is nothing
+     * left to derive the others from once unlock returns. Keeping the root out
+     * of this object is deliberate — the branches are what the wallet needs, and
+     * the root is the thing worth not retaining.
+     */
+    private identity;
     constructor(config: OrbinumWalletConfig);
     /** The underlying store, for operations the facade does not cover. */
     get vault(): VaultStore;
@@ -5958,11 +6370,14 @@ declare class OrbinumWallet {
      * signature produces — the same value `PrivacyKeyManager.getMasterBytes()`
      * returns.
      *
-     * Master bytes rather than the spending-key scalar, deliberately: the scalar
-     * is the master reduced modulo the curve order, so deriving the vault key
-     * from it would tie the encrypted vault to the CURRENT modulus. The master
-     * is pre-reduction, which keeps a stored vault readable across a modulus
-     * change. Everything else — viewing keys, ownerPk — comes from the scalar.
+     * Master bytes rather than the spending-key scalar, deliberately: the master
+     * is the root EVERY branch hangs off — spending key, viewing key, outgoing
+     * viewing key and vault key are each their own HKDF of it, none derived
+     * from another. Only `ownerPk` comes from the spending scalar, because the
+     * circuit defines it that way.
+     *
+     * It is also what keeps a stored vault readable across a modulus change:
+     * the vault key is derived pre-reduction.
      *
      * Reports whether the stored vault was RESET: a different chain, a different
      * key, or notes the chain no longer recognises. When it was, the wallet
@@ -6027,6 +6442,7 @@ declare class OrbinumWallet {
         spendingKey: bigint;
         viewingSecretKey: Uint8Array;
         ownerPk: bigint;
+        outgoingViewingKey?: Uint8Array;
     };
     /**
      * `recoverStealth` for the spend ops, bound to this wallet's keys.
@@ -6043,10 +6459,13 @@ declare class OrbinumWallet {
      * guessed version produces a note the chain refuses to spend after a
      * verifying-key rotation, and the failure surfaces much later.
      */
-    buildOutputNote: (params: Omit<BuildNoteParams, "circuitVersion">) => Promise<ZkNote>;
+    buildOutputNote: (params: Omit<BuildNoteParams, "circuitVersion">) => Promise<{
+        note: ZkNote;
+        outgoingIndex?: number;
+    }>;
     /** The circuit version a new note should carry. */
     circuitVersion(): Promise<number>;
-    private requireKey;
+    private requireIdentity;
 }
 
-export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, NOTE_TRANSFER_URI_SCHEME, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteFacts, NoteInput, type NoteOrigin, type NoteProvenanceRecord, NoteStatusUpdate, NoteStorage, type NoteTransferEntry, type NoteTransferPayload, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, OVK_BLOB_SIZE, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, type OutgoingHint, OutgoingNoteRecord, PAGE_SIZE, PAYMENT_SLIP_SCHEME, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PaymentSlipFields, type PersistParams, type PkScope, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProvenanceAmount, type ProvenancePeer, type ProvenanceSource, type ProviderFactory, QR_PAGE_MAX_CHARS, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, type SlipImportKeys, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferResult, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assembleNoteTransfer, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectOutgoingFacts, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodeNoteTransferPage, decodePaymentSlip, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOutgoingCipherKey, deriveOutgoingViewingKey, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, detectCommitmentMismatch, encodeNoteBackup, encodeNoteTransferPages, encodePaymentSlip, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hasSourcePk, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, importPaymentSlip, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isHexOfLength, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSs58, isSubstrateAddress, isUnifiedAddress, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, mergeProvenance, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteToTransferEntry, noteTxKind, openOutgoingBlob, openPaymentSlip, outranks, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, randomOutgoingBlob, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, regeneratePaymentSlip, removeByCommitment, requireSessionKeys, reservePairwiseIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, sealOutgoingBlob, sealPaymentSlip, selectDescribingNote, selectDescribingNoteByCommitment, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, tryRecoverOutgoing, txLandedAfterError, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };
+export { type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BackupImportKeys, type BlockInfo, type BuildNoteDeps, type BuildNoteParams, type Bytes32, CachedNullifier, type ChainInfo, ChainModule, type ChunkInfo, CircuitId, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CoinSelection, type CollectScanEntriesParams, type CommitmentsInsertedEvent, type ConnectionStatus, type CryptoKey$1 as CryptoKey, CryptoPrecompiles, type DecodedPrecompile, DecryptPool, DecryptedMemo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, EncryptedNoteRecord, EncryptedTxRecord, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFacts, type ExtrinsicRecord, type FeeClaimDeps, type FeeClaimParams, type FeeClaimProofInputs, type FeeClaimProofOutput, type FeeClaimStep, type FormatOptions, type IdentityVersion, KNOWN_PALLET_ERRORS, KNOWN_PRECOMPILES, type KnownPrecompileInfo, LEAVES_PER_TREE, MIN_GASLESS_FEE, MIN_SIGNATURE_BYTES, MemoryVaultStorage, type MerkleRootUpdatedEvent, type MutableWalletSession, NATIVE_ASSET_ID, NOTE_BACKUP_VERSION, NOTE_BIGINT_FIELDS, type NoteBackup, type NoteBackupEntry, type NoteBuildKeys, NoteBuilder, type NoteDisclosure, NoteFacts, NoteInput, type NoteOrigin, type NoteProvenanceRecord, NoteStatusUpdate, NoteStorage, type NoteWithMeta, type NotesCache, NullifierCache, type NullifierChunkBody, type NullifierManifest, type NullifierSource, NullifierSyncMeta, type NullifierTail, type NullifiersSpentEvent, type ObservableNotesCache, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, OrbinumWallet, type OrbinumWalletConfig, type OutgoingEphWindowEntry, PAGE_SIZE, PAYMENT_SLIP_SCHEME, PRECOMPILE_ADDR, type PairwiseEphWindowEntry, type PalletErrorKind, type PaymentSlipFields, type PersistParams, type PkScope, type PrecompileMethod, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofOptions, type ProvenanceAmount, type ProvenancePeer, type ProvenanceSource, type ProviderFactory, RECOVERED_TX_RESULT, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type ReconstructDeps, type ReconstructedTxRecord, type RegisterAssetArgs, type RelayerInfo, RelayerStatusModule, type ResolveSpentSetParams, type ResolvedProverVersion, type ResolvedSpendVersion, type RpcV2MerkleProof, RpcV2Module, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, type RunScanParams, SPENDING_KEY_CANONICAL_ORIGIN, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanChunkManifest, ScanCommitment, type ScanHint, type ScanHintPage, type ScanHintSource, ScanKeys, type ScanOptions, type ScanOutcome, type ScanProgress, type ScanResult, SecretStore, type SelfEphWindowEntry, type SelfStealthKeys, SentNoteMatch, type SessionCacheDeps, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, type SlipImportKeys, SpendDetails, type SpendPlanProblem, type SpendPrivacyReads, type SpendVault, type SpendableInputsCheck, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SystemHealth, TRANSFER_INPUTS, TRANSFER_OUTPUTS, type TokenInfo, type TokenTransfer, type TransferDeps, type TransferFactsRow, type TransferFactsSource, type TransferInputNote, type TransferOutputNote, type TransferParams, type TransferPlan, type TransferResult, type TransferStep, type TransferSubmitRequest, type TxFactsSource, TxHistoryStore, type TxKind, type TxLandingPollOptions, type TxResult, UnmatchedSentHint, type UnsafeTxOptions, type UnshieldArgs, type UnshieldDeps, type UnshieldNoteParams, type UnshieldParams, type UnshieldPlan, type UnshieldProofInputs, type UnshieldProofResult, type UnshieldStep, type UnshieldSubmitRequest, type UnshieldedEvent, type UnverifyAssetArgs, VAULT_SCHEMA_VERSION, VaultConfigRecord, VaultLockedError, VaultStorage, VaultStore, type VaultStoreDeps, type VaultUnlockOptions, type VerifyAssetArgs, type VersionedArtifactProvider, type ViewingCredential, type WalletIdentity, type WalletScanKeys, type WalletSession, ZkNote, type ZkVerifierCircuitVersionInfo, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, addressToFieldElement, applyBatch, applyNoteStatus, assertSecretKeyBytes, base64UrlDecode, base64UrlEncode, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildConfig, buildDummyTransferInput, buildShieldBatchOperations, buildShieldParams, buildZkNote, buildZkNoteWithIndex, bytesToBigintLE, bytesToBjjScalar, cacheSession, canPairWith, canonicalAccountId, chainActiveCircuitVersion, checkSpendableInputs, claimFees, classifyChainError, clearSession, collectNullifiersToQuery, collectOutgoingFacts, collectScanEntries, commitmentHexOf, computeNoteCommitment, computeNullifier, computePathIndices, connectInjectedExtension, createNoteDisclosureKey, createNotesCache, createWalletSession, decodeNoteBackup, decodeNoteDisclosureKey, decodePaymentSlip, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveIdentity, deriveMasterKeyBytes, deriveOutgoingEphPk, deriveOutgoingEphSk, deriveOutgoingSharedSecret, deriveOutgoingViewingKeyV3, deriveOwnerPk, derivePairwiseEphSk, derivePairwiseSharedSecret, deriveSelfEphSk, deriveSpendingKeyFromMaster, deriveSpendingKeyFromSignature, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveSpendingKeyV3, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, deriveViewingSecretKeyV3, detectCommitmentMismatch, encodeNoteBackup, encodePaymentSlip, encryptJson, encryptNote, ensureCreatedAt, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, exportViewingCredential, extractPalletError, failed, fastMulBase, fastMulPoint, fetchExtrinsicFacts, formatAmountPlain, formatBalance, formatORB, fromBase64, fromHex, gapMargin, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getInjectedExtensions, getPrecompileLabel, hasCachedSession, hasInjectedExtensions, hasSourcePk, hexToBigint, hexToNumber, implicitSubstrateToEvm, importNotesFromBackup, importPaymentSlip, isAbortError, isAlreadySpentError, isConnectionLossError, isEvmAddress, isGhostNoteError, isHexOfLength, isImplicitEvmAccount, isNativeAsset, isNoteSelfConsistent, isSpendable, isSubstrateAddress, isUnifiedAddress, isUsableSecretKey, isValidLeafIndex, leHexToBigint, mapExtrinsicArgs, mapZkEventData, markInputsSpent, mergeProvenance, normalizeChainFingerprint, normalizeEvmAddress, normalizeNote, normalizeNotes, noteBlindTag, noteCreatedAt, noteCreatedTxHash, noteMatchesCommitment, noteOrigin, noteSpentTxHash, noteTxKind, openPaymentSlip, openRecipientBookEntry, outgoingEphWindow, outranks, pairwiseEphWindow, palletErrorKind, parseAmount, parseEvmAddress, persistCursor, persistScanResults, planTransfer, planUnshield, randomBlinding, reconstructOutgoingIndex, reconstructOutgoingTxRecords, recoverOwnerPkPoint, recoverSelfStealthNote, refuseIfAlreadySpent, regeneratePaymentSlip, registerPairwiseCounterparty, removeByCommitment, requireSessionKeys, reserveOutgoingIndex, reserveSelfEphIndex, resolveSelfEphCeiling, resolveSpentSet, resolveSpentStatus, restoreSession, runScan, scalarToHex, scanAbortError, sealPaymentSlip, sealRecipientBookEntry, selectDescribingNote, selectDescribingNoteByCommitment, selectGhosts, selectNotes, selfEphWindow, serializeMemo, sessionCacheKey, shortHash, signAndSubmitTx, spendableBalance, stampCreatedAt, stampCreatedTxHash, stampSpentTxHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, transferNotes, treeIdOf, treeOf, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, txLandedAfterError, unpackUsableViewingKey, unshieldNote, upsertNote, vaultReplacer, vaultReviver, vaultStorageName, windowSizeForCounter };