@orbinum/sdk 2.1.0 → 3.0.0

package/dist/index.js

@@ -47,9 +47,8 @@ __export(index_exports, {
   NATIVE_ASSET_ID: () => NATIVE_ASSET_ID,
   NOTE_BACKUP_VERSION: () => NOTE_BACKUP_VERSION,
   NOTE_BIGINT_FIELDS: () => NOTE_BIGINT_FIELDS,
-  NOTE_TRANSFER_URI_SCHEME: () => NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder: () => NoteBuilder,
-  OVK_BLOB_SIZE: () => OVK_BLOB_SIZE,
+  OUTGOING_EPH_WINDOW: () => OUTGOING_EPH_WINDOW,
   OrbinumClient: () => OrbinumClient,
   OrbinumClientProvider: () => OrbinumClientProvider,
   OrbinumWallet: () => OrbinumWallet,
@@ -59,7 +58,6 @@ __export(index_exports, {
   PRECOMPILE_ADDR: () => PRECOMPILE_ADDR,
   PrivacyKeyManager: () => PrivacyKeyManager,
   PrivacyModule: () => PrivacyModule,
-  QR_PAGE_MAX_CHARS: () => QR_PAGE_MAX_CHARS,
   RECOVERED_TX_RESULT: () => RECOVERED_TX_RESULT,
   RelayerStatusModule: () => RelayerStatusModule,
   RpcV2Module: () => RpcV2Module,
@@ -84,7 +82,7 @@ __export(index_exports, {
   addressToFieldElement: () => addressToFieldElement,
   applyBatch: () => applyBatch,
   applyNoteStatus: () => applyNoteStatus,
-  assembleNoteTransfer: () => assembleNoteTransfer,
+  assertSecretKeyBytes: () => assertSecretKeyBytes,
   base58: () => import_base.base58,
   base64UrlDecode: () => base64UrlDecode,
   base64UrlEncode: () => base64UrlEncode,
@@ -97,6 +95,7 @@ __export(index_exports, {
   buildShieldBatchOperations: () => buildShieldBatchOperations,
   buildShieldParams: () => buildShieldParams,
   buildZkNote: () => buildZkNote,
+  buildZkNoteWithIndex: () => buildZkNoteWithIndex,
   bytesToBigintLE: () => bytesToBigintLE,
   bytesToBjjScalar: () => bytesToBjjScalar,
   cacheSession: () => cacheSession,
@@ -126,15 +125,17 @@ __export(index_exports, {
   createWorkerPool: () => createWorkerPool,
   decodeNoteBackup: () => decodeNoteBackup,
   decodeNoteDisclosureKey: () => decodeNoteDisclosureKey,
-  decodeNoteTransferPage: () => decodeNoteTransferPage,
   decodePaymentSlip: () => decodePaymentSlip,
   decodePrecompileCalldata: () => decodePrecompileCalldata,
   decryptHintBatch: () => decryptHintBatch,
   decryptJson: () => decryptJson,
   decryptNoteRecord: () => decryptNoteRecord,
+  deriveIdentity: () => deriveIdentity,
   deriveMasterKeyBytes: () => deriveMasterKeyBytes,
-  deriveOutgoingCipherKey: () => deriveOutgoingCipherKey,
-  deriveOutgoingViewingKey: () => deriveOutgoingViewingKey,
+  deriveOutgoingEphPk: () => deriveOutgoingEphPk,
+  deriveOutgoingEphSk: () => deriveOutgoingEphSk,
+  deriveOutgoingSharedSecret: () => deriveOutgoingSharedSecret,
+  deriveOutgoingViewingKeyV3: () => deriveOutgoingViewingKeyV3,
   deriveOwnerPk: () => deriveOwnerPk,
   derivePairwiseEphSk: () => derivePairwiseEphSk,
   derivePairwiseSharedSecret: () => derivePairwiseSharedSecret,
@@ -143,6 +144,7 @@ __export(index_exports, {
   deriveSpendingKeyFromSignature: () => deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessageV2: () => deriveSpendingKeyMessageV2,
   deriveSpendingKeyTypedData: () => deriveSpendingKeyTypedData,
+  deriveSpendingKeyV3: () => deriveSpendingKeyV3,
   deriveStealthOwnerPk: () => deriveStealthOwnerPk,
   deriveStealthSk: () => deriveStealthSk,
   deriveVaultBlindKey: () => deriveVaultBlindKey,
@@ -150,9 +152,9 @@ __export(index_exports, {
   deriveViewTag: () => deriveViewTag,
   deriveViewingPublicKey: () => deriveViewingPublicKey,
   deriveViewingSecretKey: () => deriveViewingSecretKey,
+  deriveViewingSecretKeyV3: () => deriveViewingSecretKeyV3,
   detectCommitmentMismatch: () => detectCommitmentMismatch,
   encodeNoteBackup: () => encodeNoteBackup,
-  encodeNoteTransferPages: () => encodeNoteTransferPages,
   encodePaymentSlip: () => encodePaymentSlip,
   encryptJson: () => encryptJson,
   encryptNote: () => encryptNote,
@@ -162,6 +164,7 @@ __export(index_exports, {
   evmToImplicitSubstrate: () => evmToImplicitSubstrate,
   evmToMappedAccountHex: () => evmToMappedAccountHex,
   evmToSubstrate: () => evmToSubstrate,
+  exportViewingCredential: () => exportViewingCredential,
   extractPalletError: () => extractPalletError,
   failed: () => failed,
   fastMulBase: () => fastMulBase,
@@ -202,9 +205,9 @@ __export(index_exports, {
   isNativeAsset: () => isNativeAsset,
   isNoteSelfConsistent: () => isNoteSelfConsistent,
   isSpendable: () => isSpendable,
-  isSs58: () => isSs58,
   isSubstrateAddress: () => isSubstrateAddress,
   isUnifiedAddress: () => isUnifiedAddress,
+  isUsableSecretKey: () => isUsableSecretKey,
   isValidLeafIndex: () => isValidLeafIndex,
   leHexToBigint: () => leHexToBigint,
   mapExtrinsicArgs: () => mapExtrinsicArgs,
@@ -221,10 +224,10 @@ __export(index_exports, {
   noteMatchesCommitment: () => noteMatchesCommitment,
   noteOrigin: () => noteOrigin,
   noteSpentTxHash: () => noteSpentTxHash,
-  noteToTransferEntry: () => noteToTransferEntry,
   noteTxKind: () => noteTxKind,
-  openOutgoingBlob: () => openOutgoingBlob,
   openPaymentSlip: () => openPaymentSlip,
+  openRecipientBookEntry: () => openRecipientBookEntry,
+  outgoingEphWindow: () => outgoingEphWindow,
   outranks: () => outranks,
   pairwiseEphWindow: () => pairwiseEphWindow,
   palletErrorKind: () => palletErrorKind,
@@ -235,15 +238,18 @@ __export(index_exports, {
   planTransfer: () => planTransfer,
   planUnshield: () => planUnshield,
   randomBlinding: () => randomBlinding,
-  randomOutgoingBlob: () => randomOutgoingBlob,
+  reconstructOutgoingIndex: () => reconstructOutgoingIndex,
   reconstructOutgoingTxRecords: () => reconstructOutgoingTxRecords,
   recoverOwnerPkPoint: () => recoverOwnerPkPoint,
   recoverSelfStealthNote: () => recoverSelfStealthNote,
+  recoverSentFromSharedSecret: () => recoverSentFromSharedSecret,
+  recoverSentNote: () => recoverSentNote,
   refuseIfAlreadySpent: () => refuseIfAlreadySpent,
   regeneratePaymentSlip: () => regeneratePaymentSlip,
+  registerPairwiseCounterparty: () => registerPairwiseCounterparty,
   removeByCommitment: () => removeByCommitment,
   requireSessionKeys: () => requireSessionKeys,
-  reservePairwiseIndex: () => reservePairwiseIndex,
+  reserveOutgoingIndex: () => reserveOutgoingIndex,
   reserveSelfEphIndex: () => reserveSelfEphIndex,
   resolveSelfEphCeiling: () => resolveSelfEphCeiling,
   resolveSpentSet: () => resolveSpentSet,
@@ -252,8 +258,8 @@ __export(index_exports, {
   runScan: () => runScan,
   scalarToHex: () => scalarToHex,
   scanAbortError: () => scanAbortError,
-  sealOutgoingBlob: () => sealOutgoingBlob,
   sealPaymentSlip: () => sealPaymentSlip,
+  sealRecipientBookEntry: () => sealRecipientBookEntry,
   selectDescribingNote: () => selectDescribingNote,
   selectDescribingNoteByCommitment: () => selectDescribingNoteByCommitment,
   selectGhosts: () => selectGhosts,
@@ -279,10 +285,10 @@ __export(index_exports, {
   truncateMiddle: () => truncateMiddle,
   tryDecryptNote: () => tryDecryptNote,
   tryDecryptNoteVerbose: () => tryDecryptNoteVerbose,
-  tryRecoverOutgoing: () => tryRecoverOutgoing,
   txLandedAfterError: () => txLandedAfterError,
   u128: () => import_substrate_bindings3.u128,
   u64: () => import_substrate_bindings3.u64,
+  unpackUsableViewingKey: () => unpackUsableViewingKey,
   unshieldNote: () => unshieldNote,
   upsertNote: () => upsertNote,
   vaultReplacer: () => vaultReplacer,
@@ -317,12 +323,23 @@ function ensureHexPrefix(hex) {
   return hex.startsWith("0x") ? hex : `0x${hex}`;
 }
 function hexToNumber(hex) {
-  return parseInt(hex, 16);
+  const clean = /^0x/i.test(hex) ? hex.slice(2) : hex;
+  if (!/^[0-9a-fA-F]+$/.test(clean)) {
+    throw new Error(`Invalid hex quantity: "${hex}"`);
+  }
+  const value = Number(BigInt("0x" + clean));
+  if (!Number.isSafeInteger(value)) {
+    throw new Error(`Hex quantity exceeds safe integer range: "${hex}"`);
+  }
+  return value;
 }
 function hexToBigint(hex) {
   return BigInt(hex);
 }
 function scalarToHex(value) {
+  if (value < 0n || value >> 256n !== 0n) {
+    throw new Error(`scalarToHex: value must fit in 32 unsigned bytes, got ${value}`);
+  }
   return "0x" + value.toString(16).padStart(64, "0");
 }
 
@@ -464,6 +481,7 @@ var BABYJUB_SUBORDER = 273603035897990940278080071815715938607681397215856725920
 var import_baby_jubjub = require("@zk-kit/baby-jubjub");
 var BJJ_A = 168700n;
 var BJJ_D = 168696n;
+var BJJ_COFACTOR = 8n;
 function _modpow(base, exp, mod) {
   let result = 1n;
   base = base % mod;
@@ -522,6 +540,28 @@ function recoverOwnerPkPoint(ax) {
     return [ax, yAlt];
   }
 }
+function unpackUsableViewingKey(packed) {
+  const point = (0, import_baby_jubjub.unpackPoint)(packed);
+  if (!point) return null;
+  if (point[0] === 0n && point[1] === 1n) return null;
+  const cleared = (0, import_baby_jubjub.mulPointEscalar)(point, BJJ_COFACTOR);
+  if (cleared[0] === 0n && cleared[1] === 1n) return null;
+  return point;
+}
+
+// src/foundation/crypto/keyGuards.ts
+var SECRET_KEY_SIZE = 32;
+function isUsableSecretKey(key) {
+  return key !== void 0 && key !== null && key.length === SECRET_KEY_SIZE && !key.every((b) => b === 0);
+}
+function assertSecretKeyBytes(key, label) {
+  if (key.length !== SECRET_KEY_SIZE) {
+    throw new Error(`${label} must be ${SECRET_KEY_SIZE} bytes, got ${key.length}`);
+  }
+  if (key.every((b) => b === 0)) {
+    throw new Error(`${label} is all zeros \u2014 that is not key material`);
+  }
+}
 
 // src/foundation/crypto/bjj-fast.ts
 var import_edwards = require("@noble/curves/abstract/edwards.js");
@@ -697,9 +737,6 @@ function parseEvmAddress(addr) {
   const withPrefix = addr.startsWith("0x") ? addr : `0x${addr}`;
   return isEvmAddress(withPrefix) ? withPrefix.toLowerCase() : null;
 }
-function isSs58(addr) {
-  return !addr.startsWith("0x") && addr.length >= 46 && addr.length <= 50;
-}
 function isEvmAddress(addr) {
   return /^0x[0-9a-fA-F]{40}$/.test(addr);
 }
@@ -829,11 +866,10 @@ function addressToAccountIdHex(addr) {
 function addressToFieldElement(address) {
   const accountIdHex = addressToAccountIdHex(address);
   if (!accountIdHex) throw new Error(`Cannot resolve address to AccountId32: ${address}`);
-  const hex = accountIdHex.slice(2);
-  const bytes = new Uint8Array(32);
-  for (let i = 0; i < 32; i++) {
-    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  if (!isHexOfLength(accountIdHex, 32)) {
+    throw new Error(`AccountId32 must be 32 bytes of hex: ${accountIdHex}`);
   }
+  const bytes = fromHex(accountIdHex);
   return bytesToBigintLE(bytes) % BN254_R;
 }
 
@@ -848,6 +884,15 @@ var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
 var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
 var MEMO_PLAINTEXT_SIZE = 120;
 function serializeMemo(value, ownerPk, blinding, assetId, sourcePk, circuitVersion) {
+  if (value < 0n || value >> 128n !== 0n) {
+    throw new Error(`serializeMemo: value must fit in 128 unsigned bits, got ${value}`);
+  }
+  if (!Number.isInteger(assetId) || assetId < 0 || assetId > 4294967295) {
+    throw new Error(`serializeMemo: assetId must be a u32, got ${assetId}`);
+  }
+  if (!Number.isInteger(circuitVersion) || circuitVersion < 0 || circuitVersion > 4294967295) {
+    throw new Error(`serializeMemo: circuitVersion must be a u32, got ${circuitVersion}`);
+  }
   const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
   const view = new DataView(buf.buffer);
   view.setBigUint64(0, value & 0xffffffffffffffffn, true);
@@ -879,6 +924,9 @@ var CIPHERTEXT_SIZE = 136;
 var EPH_PK_SIZE = 32;
 var ENCRYPTED_MEMO_SIZE = NONCE_SIZE + CIPHERTEXT_SIZE + EPH_PK_SIZE;
 function bytesToBjjScalar(bytes) {
+  if (bytes.length !== 32) {
+    throw new Error(`bytesToBjjScalar: expected 32 bytes, got ${bytes.length}`);
+  }
   const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
   return BigInt("0x" + hex) % BABYJUB_SUBORDER || 1n;
 }
@@ -902,7 +950,7 @@ function parsePlaintext(nonce, ciphertextWithMac, encKey) {
 }
 var EncryptedMemo = {
   /**
-   * Build and encrypt a memo for a note using ECDH (v2, 180 bytes).
+   * Build and encrypt a memo for a note using ECDH (180 bytes).
    *
    * @param value              Note value in planck.
    * @param ownerPk            32-byte owner public key (LE).
@@ -942,7 +990,7 @@ var EncryptedMemo = {
       const ephPkPoint = fastMulBase(ephSkScalar);
       ephPkPackedBytes = bigintTo32Le((0, import_baby_jubjub3.packPoint)(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
-      const ivkPoint = (0, import_baby_jubjub3.unpackPoint)(ivkPackedBigint);
+      const ivkPoint = unpackUsableViewingKey(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
       const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
@@ -1032,7 +1080,7 @@ var EncryptedMemo = {
     if (ephPkPackedBigint === 0n) {
       return new Uint8Array(32);
     }
-    const ephPkPoint = (0, import_baby_jubjub3.unpackPoint)(ephPkPackedBigint);
+    const ephPkPoint = unpackUsableViewingKey(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
     const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
@@ -1042,9 +1090,9 @@ var EncryptedMemo = {
    * Cheap view-tag check: does memo nonce[0] match the tag derived from
    * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
    *
-   * Only meaningful for memos built with view tags (commitments at/after
-   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
-   * there and would false-negative 255/256 of the time.
+   * Only meaningful for memos that carry a tag — at or after
+   * `ScanKeys.viewTagActivationLeaf`. An older memo has a random byte there
+   * and would false-negative 255/256 of the time.
    */
   checkViewTag(memoBytes, sharedSecret) {
     if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
@@ -1070,72 +1118,11 @@ var EncryptedMemo = {
   }
 };
 
-// src/protocol/memo/OutgoingBlob.ts
+// src/protocol/memo/PaymentSlip.ts
 var import_chacha2 = require("@noble/ciphers/chacha.js");
 var import_utils2 = require("@noble/ciphers/utils.js");
 var import_hkdf2 = require("@noble/hashes/hkdf.js");
 var import_sha23 = require("@noble/hashes/sha2.js");
-var OCK_DOMAIN = new TextEncoder().encode("orbinum-outgoing-cipher-v1");
-var NONCE_PREFIX = new TextEncoder().encode("OVK1");
-var NONCE_SUFFIX_SIZE = 8;
-var SHARED_SECRET_SIZE = 32;
-var MAC_SIZE = 16;
-var OVK_BLOB_SIZE = NONCE_SUFFIX_SIZE + SHARED_SECRET_SIZE + MAC_SIZE;
-function deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes) {
-  if (commitmentBytes.length !== 32) {
-    throw new Error(
-      `OutgoingBlob: commitmentBytes must be 32 bytes, got ${commitmentBytes.length}`
-    );
-  }
-  if (ephPkBytes.length !== 32) {
-    throw new Error(`OutgoingBlob: ephPkBytes must be 32 bytes, got ${ephPkBytes.length}`);
-  }
-  const salt = new Uint8Array(64);
-  salt.set(commitmentBytes, 0);
-  salt.set(ephPkBytes, 32);
-  return (0, import_hkdf2.hkdf)(import_sha23.sha256, ovk, salt, OCK_DOMAIN, 32);
-}
-function buildNonce(suffix) {
-  const nonce = new Uint8Array(12);
-  nonce.set(NONCE_PREFIX, 0);
-  nonce.set(suffix, 4);
-  return nonce;
-}
-function sealOutgoingBlob(ovk, sharedSecret, commitmentBytes, ephPkBytes) {
-  if (sharedSecret.length !== SHARED_SECRET_SIZE) {
-    throw new Error(`OutgoingBlob: sharedSecret must be 32 bytes, got ${sharedSecret.length}`);
-  }
-  const ock = deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes);
-  const suffix = (0, import_utils2.randomBytes)(NONCE_SUFFIX_SIZE);
-  const cipher = (0, import_chacha2.chacha20poly1305)(ock, buildNonce(suffix));
-  const sealed = cipher.encrypt(sharedSecret);
-  const blob = new Uint8Array(OVK_BLOB_SIZE);
-  blob.set(suffix, 0);
-  blob.set(sealed, NONCE_SUFFIX_SIZE);
-  return blob;
-}
-function openOutgoingBlob(ovk, blob, commitmentBytes, ephPkBytes) {
-  if (blob.length !== OVK_BLOB_SIZE) return null;
-  if (commitmentBytes.length !== 32 || ephPkBytes.length !== 32) return null;
-  try {
-    const ock = deriveOutgoingCipherKey(ovk, commitmentBytes, ephPkBytes);
-    const suffix = blob.subarray(0, NONCE_SUFFIX_SIZE);
-    const sealed = blob.subarray(NONCE_SUFFIX_SIZE);
-    const cipher = (0, import_chacha2.chacha20poly1305)(ock, buildNonce(suffix));
-    return cipher.decrypt(sealed);
-  } catch {
-    return null;
-  }
-}
-function randomOutgoingBlob() {
-  return (0, import_utils2.randomBytes)(OVK_BLOB_SIZE);
-}
-
-// src/protocol/memo/PaymentSlip.ts
-var import_chacha3 = require("@noble/ciphers/chacha.js");
-var import_utils3 = require("@noble/ciphers/utils.js");
-var import_hkdf3 = require("@noble/hashes/hkdf.js");
-var import_sha24 = require("@noble/hashes/sha2.js");
 var import_baby_jubjub4 = require("@zk-kit/baby-jubjub");
 
 // src/protocol/spend/coinSelection.ts
@@ -1199,16 +1186,16 @@ function buildDummyTransferInput(assetId) {
 
 // src/protocol/memo/PaymentSlip.ts
 var SLIP_DOMAIN = new TextEncoder().encode("orbinum-payment-slip-v1");
-var NONCE_PREFIX2 = new TextEncoder().encode("SLP1");
+var NONCE_PREFIX = new TextEncoder().encode("SLP1");
 var EPH_PK_SIZE2 = 32;
-var NONCE_SUFFIX_SIZE2 = 8;
+var NONCE_SUFFIX_SIZE = 8;
 var MAX_SLIP_ENVELOPE_SIZE = 4096;
 function deriveSlipKey(sharedSecret) {
-  return (0, import_hkdf3.hkdf)(import_sha24.sha256, sharedSecret, void 0, SLIP_DOMAIN, 32);
+  return (0, import_hkdf2.hkdf)(import_sha23.sha256, sharedSecret, void 0, SLIP_DOMAIN, 32);
 }
-function buildNonce2(suffix) {
+function buildNonce(suffix) {
   const nonce = new Uint8Array(12);
-  nonce.set(NONCE_PREFIX2, 0);
+  nonce.set(NONCE_PREFIX, 0);
   nonce.set(suffix, 4);
   return nonce;
 }
@@ -1218,36 +1205,36 @@ function sealPaymentSlip(recipientIvkPacked, fields) {
       `PaymentSlip: recipientIvk must be 32 bytes, got ${recipientIvkPacked.length}`
     );
   }
-  const ivkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(recipientIvkPacked));
+  const ivkPoint = unpackUsableViewingKey(bytesToBigintLE(recipientIvkPacked));
   if (!ivkPoint) throw new Error("PaymentSlip: invalid recipient viewing public key");
-  const ephSkScalar = bytesToBjjScalar((0, import_utils3.randomBytes)(32));
+  const ephSkScalar = bytesToBjjScalar((0, import_utils2.randomBytes)(32));
   const ephPkPacked = bigintTo32Le((0, import_baby_jubjub4.packPoint)(fastMulBase(ephSkScalar)));
   const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
   const sharedSecret = bigintTo32Le(sharedPoint[0]);
   const slipKey = deriveSlipKey(sharedSecret);
-  const suffix = (0, import_utils3.randomBytes)(NONCE_SUFFIX_SIZE2);
-  const cipher = (0, import_chacha3.chacha20poly1305)(slipKey, buildNonce2(suffix));
+  const suffix = (0, import_utils2.randomBytes)(NONCE_SUFFIX_SIZE);
+  const cipher = (0, import_chacha2.chacha20poly1305)(slipKey, buildNonce(suffix));
   const plaintext = new TextEncoder().encode(JSON.stringify(fields));
   const sealed = cipher.encrypt(plaintext);
-  const envelope = new Uint8Array(EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2 + sealed.length);
+  const envelope = new Uint8Array(EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE + sealed.length);
   envelope.set(ephPkPacked, 0);
   envelope.set(suffix, EPH_PK_SIZE2);
-  envelope.set(sealed, EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2);
+  envelope.set(sealed, EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE);
   return envelope;
 }
 function openPaymentSlip(recipientIvsk, envelope) {
-  if (envelope.length < EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2 + 16) return null;
+  if (envelope.length < EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE + 16) return null;
   if (envelope.length > MAX_SLIP_ENVELOPE_SIZE) return null;
   try {
     const ephPkPacked = envelope.subarray(0, EPH_PK_SIZE2);
-    const ephPkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(ephPkPacked));
+    const ephPkPoint = unpackUsableViewingKey(bytesToBigintLE(ephPkPacked));
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(recipientIvsk);
     const sharedSecret = bigintTo32Le(fastMulPoint(ephPkPoint, ivskScalar)[0]);
     const slipKey = deriveSlipKey(sharedSecret);
-    const suffix = envelope.subarray(EPH_PK_SIZE2, EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2);
-    const sealed = envelope.subarray(EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE2);
-    const cipher = (0, import_chacha3.chacha20poly1305)(slipKey, buildNonce2(suffix));
+    const suffix = envelope.subarray(EPH_PK_SIZE2, EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE);
+    const sealed = envelope.subarray(EPH_PK_SIZE2 + NONCE_SUFFIX_SIZE);
+    const cipher = (0, import_chacha2.chacha20poly1305)(slipKey, buildNonce(suffix));
     const plaintext = cipher.decrypt(sealed);
     const parsed = JSON.parse(new TextDecoder().decode(plaintext));
     if (!isHexOfLength(parsed["commitmentHex"], 32)) return null;
@@ -1268,7 +1255,7 @@ function openPaymentSlip(recipientIvsk, envelope) {
 }
 var PAYMENT_SLIP_SCHEME = "orbslip1:";
 function slipChecksum(payload) {
-  const digest = (0, import_sha24.sha256)(new TextEncoder().encode(PAYMENT_SLIP_SCHEME + payload));
+  const digest = (0, import_sha23.sha256)(new TextEncoder().encode(PAYMENT_SLIP_SCHEME + payload));
   return toHex(digest.slice(0, 4)).slice(2);
 }
 function encodePaymentSlip(envelope) {
@@ -1284,38 +1271,48 @@ function decodePaymentSlip(text) {
   const checksum = rest.slice(sep + 1);
   if (slipChecksum(payload) !== checksum) return null;
   try {
-    const hex = base64UrlDecode(payload);
-    const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
-    if (clean.length % 2 !== 0) return null;
-    const bytes = new Uint8Array(clean.length / 2);
-    for (let i = 0; i < bytes.length; i++) {
-      bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-    }
-    return bytes;
+    return fromHex(base64UrlDecode(payload));
   } catch {
     return null;
   }
 }
 
 // src/protocol/eph/selfEph.ts
-var import_sha25 = require("@noble/hashes/sha2.js");
+var import_sha24 = require("@noble/hashes/sha2.js");
+
+// src/protocol/eph/windowBounds.ts
+var MAX_EPH_WINDOW = 1 << 20;
+
+// src/protocol/eph/selfEph.ts
 var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
-var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
-function deriveSelfEphSk(spendingKey, index) {
-  const h = import_sha25.sha256.create();
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v3");
+function deriveSelfEphSk(viewingSecretKey, index) {
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`deriveSelfEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(viewingSecretKey, "deriveSelfEphSk: viewingSecretKey");
+  const h = import_sha24.sha256.create();
   h.update(SELF_EPH_DOMAIN);
-  h.update(bigintTo32Le(spendingKey));
+  h.update(viewingSecretKey);
   const idx = new Uint8Array(4);
   new DataView(idx.buffer).setUint32(0, index >>> 0, true);
   h.update(idx);
   return h.digest();
 }
-function selfEphWindow(spendingKey, ivkPacked, from, count) {
+function selfEphWindow(viewingSecretKey, ivkPacked, from, count) {
   const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(ivkPacked));
   if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
   const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`selfEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `selfEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
   for (let i = from; i < from + count; i++) {
-    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(viewingSecretKey, i));
     const ephPk = fastMulBase(scalar);
     const sharedPoint = fastMulPoint(ivkPoint, scalar);
     entries.push({
@@ -1328,17 +1325,22 @@ function selfEphWindow(spendingKey, ivkPacked, from, count) {
 }
 
 // src/protocol/eph/pairwiseEph.ts
-var import_sha26 = require("@noble/hashes/sha2.js");
+var import_sha25 = require("@noble/hashes/sha2.js");
 var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
 var PAIRWISE_EPH_DOMAIN = new TextEncoder().encode("orbinum-pairwise-eph-v1");
 function derivePairwiseSharedSecret(myViewingSk, theirIvkPacked) {
-  const theirPoint = (0, import_baby_jubjub6.unpackPoint)(bytesToBigintLE(theirIvkPacked));
+  const theirPoint = unpackUsableViewingKey(bytesToBigintLE(theirIvkPacked));
   if (!theirPoint) throw new Error("derivePairwiseSharedSecret: invalid viewing public key");
+  assertSecretKeyBytes(myViewingSk, "derivePairwiseSharedSecret: myViewingSk");
   const shared = fastMulPoint(theirPoint, bytesToBjjScalar(myViewingSk));
   return bigintTo32Le(shared[0]);
 }
 function derivePairwiseEphSk(pairSecret, index) {
-  const h = import_sha26.sha256.create();
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`derivePairwiseEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(pairSecret, "derivePairwiseEphSk: pairSecret");
+  const h = import_sha25.sha256.create();
   h.update(PAIRWISE_EPH_DOMAIN);
   h.update(pairSecret);
   const idx = new Uint8Array(4);
@@ -1350,6 +1352,14 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
   const ivkPoint = (0, import_baby_jubjub6.unpackPoint)(bytesToBigintLE(receiverIvkPacked));
   if (!ivkPoint) throw new Error("pairwiseEphWindow: invalid viewing public key");
   const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`pairwiseEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `pairwiseEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
   for (let i = from; i < from + count; i++) {
     const scalar = bytesToBjjScalar(derivePairwiseEphSk(pairSecret, i));
     const ephPk = fastMulBase(scalar);
@@ -1363,12 +1373,64 @@ function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
   return entries;
 }
 
+// src/protocol/eph/outgoingEph.ts
+var import_sha26 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
+var OUTGOING_EPH_DOMAIN = new TextEncoder().encode("orbinum-outgoing-eph-v3");
+function deriveOutgoingEphSk(outgoingViewingKey, index) {
+  if (!Number.isInteger(index) || index < 0 || index > 4294967295) {
+    throw new Error(`deriveOutgoingEphSk: index must be a u32, got ${index}`);
+  }
+  assertSecretKeyBytes(outgoingViewingKey, "deriveOutgoingEphSk: outgoingViewingKey");
+  const h = import_sha26.sha256.create();
+  h.update(OUTGOING_EPH_DOMAIN);
+  h.update(outgoingViewingKey);
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function deriveOutgoingEphPk(outgoingViewingKey, index) {
+  const scalar = bytesToBjjScalar(deriveOutgoingEphSk(outgoingViewingKey, index));
+  return toHex(bigintTo32Le((0, import_baby_jubjub7.packPoint)(fastMulBase(scalar)))).toLowerCase();
+}
+function outgoingEphWindow(outgoingViewingKey, from, count) {
+  const entries = [];
+  if (!Number.isInteger(from) || from < 0) {
+    throw new Error(`outgoingEphWindow: from must be a non-negative integer, got ${from}`);
+  }
+  if (!Number.isInteger(count) || count > MAX_EPH_WINDOW) {
+    throw new Error(
+      `outgoingEphWindow: count must be an integer <= ${MAX_EPH_WINDOW}, got ${count}`
+    );
+  }
+  for (let i = from; i < from + count; i++) {
+    entries.push({ index: i, ephPkHex: deriveOutgoingEphPk(outgoingViewingKey, i) });
+  }
+  return entries;
+}
+function deriveOutgoingSharedSecret(outgoingViewingKey, index, recipientIvkPacked) {
+  const ivkPoint = (0, import_baby_jubjub7.unpackPoint)(bytesToBigintLE(recipientIvkPacked));
+  if (!ivkPoint) throw new Error("deriveOutgoingSharedSecret: invalid viewing public key");
+  const scalar = bytesToBjjScalar(deriveOutgoingEphSk(outgoingViewingKey, index));
+  return bigintTo32Le(fastMulPoint(ivkPoint, scalar)[0]);
+}
+function reconstructOutgoingIndex(outgoingViewingKey, publishedEphPks, window) {
+  const published = /* @__PURE__ */ new Set();
+  for (const hex of publishedEphPks) published.add(hex.toLowerCase());
+  let highest = -1;
+  for (let i = 0; i < window; i++) {
+    if (published.has(deriveOutgoingEphPk(outgoingViewingKey, i))) highest = i;
+  }
+  return highest + 1;
+}
+
 // src/protocol/types.ts
 var CURRENT_CIRCUIT_VERSION = 1;
 
 // src/protocol/note/NoteBuilder.ts
-var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
-var import_utils4 = require("@noble/ciphers/utils.js");
+var import_baby_jubjub8 = require("@zk-kit/baby-jubjub");
+var import_utils3 = require("@noble/ciphers/utils.js");
 var import_poseidon_lite = require("poseidon-lite");
 var NoteBuilder = class {
   /**
@@ -1377,7 +1439,7 @@ var NoteBuilder = class {
    * @param input.value            Amount in planck (required).
    * @param input.assetId          Asset ID — default 0n (native ORB-Privacy).
    * @param input.ownerPk          Sender's or recipient's global BabyJubJub Ax — default 0n.
-   * @param input.blinding         Random scalar — defaults to BigInt(Date.now()).
+   * @param input.blinding         Random scalar — defaults to a CSPRNG draw.
    * @param input.spendingKey      Secret key for nullifier — default 0n.
    * @param input.viewingPublicKey Recipient's 32-byte LE packed BJJ ivk. Triggers memo encryption.
    * @param input.recipientOwnerPk Recipient's global ownerPk. Required with viewingPublicKey
@@ -1388,7 +1450,7 @@ var NoteBuilder = class {
     const value = input.value;
     const assetId = input.assetId ?? 0n;
     const ownerPk = input.ownerPk ?? 0n;
-    const blinding = input.blinding ?? BigInt(Date.now());
+    const blinding = input.blinding ?? randomBlinding();
     const spendingKey = input.spendingKey ?? 0n;
     const sourcePk = input.sourcePk ?? 0n;
     const circuitVersion = input.circuitVersion ?? CURRENT_CIRCUIT_VERSION;
@@ -1397,13 +1459,13 @@ var NoteBuilder = class {
     if (useStealth) {
       const recipientOwnerPk = input.recipientOwnerPk;
       const recipientIvkPacked = input.viewingPublicKey;
-      const ephSk = input.ephSkOverride ?? (0, import_utils4.randomBytes)(32);
+      const ephSk = input.ephSkOverride ?? (0, import_utils3.randomBytes)(32);
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
-      const ivkPoint = (0, import_baby_jubjub7.unpackPoint)(ivkPackedBigint);
+      const ivkPoint = unpackUsableViewingKey(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("NoteBuilder.build: invalid recipient viewing public key");
       const ephSkScalar = BigInt(toHex(ephSk)) % BABYJUB_SUBORDER || 1n;
-      const sharedPoint = (0, import_baby_jubjub7.mulPointEscalar)(ivkPoint, ephSkScalar);
+      const sharedPoint = (0, import_baby_jubjub8.mulPointEscalar)(ivkPoint, ephSkScalar);
       const sharedSecret = bigintTo32Le(sharedPoint[0]);
       const recipientPkPoint = recoverOwnerPkPoint(recipientOwnerPk);
       if (!recipientPkPoint)
@@ -1438,21 +1500,6 @@ var NoteBuilder = class {
         throw new Error(
           `NoteBuilder.build: invariant violated \u2014 memo must be ${ENCRYPTED_MEMO_SIZE} bytes, got ${memo.length}`
         );
-      let ovkBlob;
-      if (input.outgoingViewingKey !== void 0) {
-        const ephPkBytes = Uint8Array.from(memo.slice(148, 180));
-        const sealed = sealOutgoingBlob(
-          input.outgoingViewingKey,
-          sharedSecret,
-          stealthCommitmentBytes,
-          ephPkBytes
-        );
-        if (sealed.length !== OVK_BLOB_SIZE)
-          throw new Error(
-            `NoteBuilder.build: invariant violated \u2014 ovkBlob must be ${OVK_BLOB_SIZE} bytes, got ${sealed.length}`
-          );
-        ovkBlob = Array.from(sealed);
-      }
       return {
         value,
         assetId,
@@ -1467,8 +1514,7 @@ var NoteBuilder = class {
         commitmentHex: toHex(commitmentBytes2),
         nullifierHex: toHex(nullifierBytes2),
         memo,
-        sourcePk,
-        ...ovkBlob ? { ovkBlob } : {}
+        sourcePk
       };
     }
     const commitment = (0, import_poseidon_lite.poseidon4)([value, assetId, ownerPk, blinding]);
@@ -1518,7 +1564,7 @@ var NoteBuilder = class {
    * @param note                    The ZkNote whose fields populate the plaintext.
    * @param recipientIvkPacked      32-byte LE packed BJJ viewing public key of the recipient.
    *                                Pass `new Uint8Array(32)` (default) for a public/dummy memo.
-   * @param sourcePk          32-byte counterparty BabyJubJub Ax.
+   * @param sourcePk                32-byte counterparty BabyJubJub Ax.
    *                                Pass `new Uint8Array(32)` (default) for no counterparty.
    */
   static buildMemo(note, recipientIvkPacked, sourcePk) {
@@ -1537,18 +1583,6 @@ var NoteBuilder = class {
 
 // src/protocol/note/NoteDecryptor.ts
 var import_poseidon_lite2 = require("poseidon-lite");
-function decryptAndVerifyPlaintext(memoBytes, commitmentBytes, sharedSecret, effectiveOwnerPk) {
-  const plaintext = EncryptedMemo.decryptWithSharedSecret(
-    memoBytes,
-    commitmentBytes,
-    sharedSecret
-  );
-  if (!plaintext) return null;
-  const ownerPk = effectiveOwnerPk ?? plaintext.ownerPk;
-  const recomputed = (0, import_poseidon_lite2.poseidon4)([plaintext.value, plaintext.assetId, ownerPk, plaintext.blinding]);
-  if (recomputed !== bytesToBigintLE(commitmentBytes)) return null;
-  return plaintext;
-}
 function computeNullifier(commitment, spendingKey) {
   return (0, import_poseidon_lite2.poseidon2)([commitment, spendingKey]);
 }
@@ -1631,40 +1665,6 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
     }
   };
 }
-function tryRecoverOutgoing(hint, ovk, opts) {
-  if (!hint.ovkBlob || !hint.encryptedMemo) return null;
-  let commitmentBytes;
-  let memoBytes;
-  let blobBytes;
-  try {
-    commitmentBytes = fromHex(hint.commitmentHex);
-    memoBytes = fromHex(hint.encryptedMemo);
-    blobBytes = fromHex(hint.ovkBlob);
-  } catch {
-    return null;
-  }
-  if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
-  if (blobBytes.length !== OVK_BLOB_SIZE) return null;
-  const ephPkBytes = memoBytes.subarray(148, 180);
-  const sharedSecret = openOutgoingBlob(ovk, blobBytes, commitmentBytes, ephPkBytes);
-  if (!sharedSecret) return null;
-  const activation = opts?.viewTagActivationLeaf;
-  if (activation !== void 0 && isValidLeafIndex(hint.leafIndex) && hint.leafIndex >= activation && !EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
-    return null;
-  }
-  const plaintext = decryptAndVerifyPlaintext(memoBytes, commitmentBytes, sharedSecret, null);
-  if (!plaintext) return null;
-  return {
-    commitmentHex: hint.commitmentHex,
-    ...isValidLeafIndex(hint.leafIndex) ? { leafIndex: hint.leafIndex } : {},
-    value: plaintext.value,
-    assetId: plaintext.assetId,
-    recipientStealthPk: plaintext.ownerPk,
-    blinding: plaintext.blinding,
-    sourcePk: plaintext.sourcePk,
-    circuitVersion: plaintext.circuitVersion
-  };
-}
 function collectOutgoingFacts(hint) {
   if (!isHexOfLength(hint.commitmentHex, 32)) return null;
   if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
@@ -1675,6 +1675,89 @@ function collectOutgoingFacts(hint) {
   };
 }
 
+// src/protocol/note/recoverSent.ts
+function recoverSentFromSharedSecret(hint, outgoingSharedSecret, ephIndex) {
+  if (!isHexOfLength(hint.commitmentHex, 32)) return null;
+  if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
+  try {
+    const plaintext = EncryptedMemo.decryptWithSharedSecret(
+      fromHex(hint.encryptedMemo),
+      fromHex(hint.commitmentHex),
+      outgoingSharedSecret
+    );
+    if (!plaintext) return null;
+    return {
+      commitmentHex: hint.commitmentHex,
+      ...isValidLeafIndex(hint.leafIndex) ? { leafIndex: hint.leafIndex } : {},
+      value: plaintext.value,
+      assetId: plaintext.assetId,
+      // On an outgoing note the memo's ownerPk IS the recipient's stealth
+      // owner — the builder wrote it that way.
+      recipientStealthPk: plaintext.ownerPk,
+      blinding: plaintext.blinding,
+      sourcePk: plaintext.sourcePk,
+      circuitVersion: plaintext.circuitVersion,
+      ephIndex
+    };
+  } catch {
+    return null;
+  }
+}
+function recoverSentNote(params) {
+  const { hint, outgoingViewingKey, ephIndex, recipientCandidates } = params;
+  if (!isHexOfLength(hint.commitmentHex, 32)) return null;
+  if (!isHexOfLength(hint.encryptedMemo, ENCRYPTED_MEMO_SIZE)) return null;
+  for (const candidate of recipientCandidates) {
+    let sharedSecret;
+    try {
+      sharedSecret = deriveOutgoingSharedSecret(outgoingViewingKey, ephIndex, candidate);
+    } catch {
+      continue;
+    }
+    const facts = recoverSentFromSharedSecret(hint, sharedSecret, ephIndex);
+    if (facts) return { ...facts, recipientIvk: candidate };
+  }
+  return null;
+}
+
+// src/protocol/note/recipientBook.ts
+var import_sha27 = require("@noble/hashes/sha2.js");
+var RECIPIENT_BOOK_DOMAIN = new TextEncoder().encode("orbinum-recipient-book-v3");
+var IVK_SIZE = 32;
+function bookKeystream(outgoingViewingKey, paymentCommitmentHex) {
+  if (outgoingViewingKey.length !== 32) {
+    throw new Error(
+      `recipientBook: outgoingViewingKey must be 32 bytes, got ${outgoingViewingKey.length}`
+    );
+  }
+  if (outgoingViewingKey.every((b) => b === 0)) {
+    throw new Error(
+      "recipientBook: outgoingViewingKey is all zeros \u2014 the book would be public"
+    );
+  }
+  const normalised = paymentCommitmentHex.toLowerCase().replace(/^0x/, "");
+  const h = import_sha27.sha256.create();
+  h.update(RECIPIENT_BOOK_DOMAIN);
+  h.update(outgoingViewingKey);
+  h.update(new TextEncoder().encode(normalised));
+  return h.digest();
+}
+function sealRecipientBookEntry(ivkPacked, outgoingViewingKey, paymentCommitmentHex) {
+  if (ivkPacked.length !== IVK_SIZE) return ivkPacked;
+  const keystream = bookKeystream(outgoingViewingKey, paymentCommitmentHex);
+  const out = new Uint8Array(IVK_SIZE);
+  for (let i = 0; i < IVK_SIZE; i++) out[i] = ivkPacked[i] ^ keystream[i];
+  return out;
+}
+function openRecipientBookEntry(sealedSourcePk, outgoingViewingKey, paymentCommitmentHex) {
+  if (sealedSourcePk < 0n || sealedSourcePk >> 256n !== 0n) return new Uint8Array(IVK_SIZE);
+  return sealRecipientBookEntry(
+    bigintTo32Le(sealedSourcePk),
+    outgoingViewingKey,
+    paymentCommitmentHex
+  );
+}
+
 // src/protocol/note/NoteDisclosure.ts
 var import_poseidon_lite3 = require("poseidon-lite");
 var PREFIX = "orbdisc:";
@@ -1819,11 +1902,10 @@ ${canonicalAccountId(address)}`;
 }
 
 // src/protocol/keys/PrivacyKeys.ts
-var import_hkdf4 = require("@noble/hashes/hkdf.js");
-var import_sha27 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub8 = require("@zk-kit/baby-jubjub");
+var import_hkdf3 = require("@noble/hashes/hkdf.js");
+var import_sha28 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub9 = require("@zk-kit/baby-jubjub");
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
-var OVK_DOMAIN = new TextEncoder().encode("orbinum-ovk-v1");
 var KEY_VERSION = "v2";
 function deriveSpendingKeyFromMaster(masterBytes) {
   const skBigint = BigInt(toHex(masterBytes)) % BABYJUB_SUBORDER;
@@ -1831,12 +1913,26 @@ function deriveSpendingKeyFromMaster(masterBytes) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return (0, import_hkdf4.hkdf)(import_sha27.sha256, ikm, void 0, IVK_DOMAIN, 32);
+  return (0, import_hkdf3.hkdf)(import_sha28.sha256, ikm, void 0, IVK_DOMAIN, 32);
+}
+var SPEND_V3_DOMAIN = new TextEncoder().encode("orbinum-spend-v3");
+var IVK_V3_DOMAIN = new TextEncoder().encode("orbinum-ivk-v3");
+var OVK_V3_DOMAIN = new TextEncoder().encode("orbinum-ovk-v3");
+var deriveBranch = (rootSecret, domain) => (0, import_hkdf3.hkdf)(import_sha28.sha256, rootSecret, void 0, domain, 32);
+function deriveSpendingKeyV3(rootSecret) {
+  const scalar = BigInt(toHex(deriveBranch(rootSecret, SPEND_V3_DOMAIN))) % BABYJUB_SUBORDER;
+  return scalar === 0n ? 1n : scalar;
+}
+function deriveViewingSecretKeyV3(rootSecret) {
+  return deriveBranch(rootSecret, IVK_V3_DOMAIN);
+}
+function deriveOutgoingViewingKeyV3(rootSecret) {
+  return deriveBranch(rootSecret, OVK_V3_DOMAIN);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
   const ivkPoint = fastMulBase(ivskScalar);
-  const packed = (0, import_baby_jubjub8.packPoint)(ivkPoint);
+  const packed = (0, import_baby_jubjub9.packPoint)(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
@@ -1847,15 +1943,21 @@ function deriveOwnerPk(spendingKey) {
     return 0n;
   }
 }
-function deriveOutgoingViewingKey(masterBytes) {
-  return (0, import_hkdf4.hkdf)(import_sha27.sha256, masterBytes, void 0, OVK_DOMAIN, 32);
-}
 
 // src/protocol/keys/PrivacyKeyManager.ts
-var import_sha28 = require("@noble/hashes/sha2.js");
-function privacyAddressChecksum(ownerPkHex, ivkHex) {
-  const body = `orbpriv2:${ownerPkHex}:${ivkHex}`;
-  const digest = (0, import_sha28.sha256)(new TextEncoder().encode(body));
+var import_sha29 = require("@noble/hashes/sha2.js");
+var SCHEME_BY_VERSION = { v2: "orbpriv2", v3: "orbpriv3" };
+function usableAddressFields(ownerPkHex, ivkHex) {
+  const ownerPk = ownerPkHex.toLowerCase();
+  const ivk = ivkHex.toLowerCase();
+  if (!isHexOfLength(ownerPk, 32) || !isHexOfLength(ivk, 32)) return null;
+  if (/^0x0+$/.test(ownerPk) || /^0x0+$/.test(ivk)) return null;
+  if (!unpackUsableViewingKey(bytesToBigintLE(fromHex(ivk)))) return null;
+  return { ownerPkHex: ownerPk, viewingPublicKeyHex: ivk };
+}
+function privacyAddressChecksum(scheme, ownerPkHex, ivkHex) {
+  const body = `${scheme}:${ownerPkHex}:${ivkHex}`;
+  const digest = (0, import_sha29.sha256)(new TextEncoder().encode(body));
   return toHex(digest.slice(0, 4)).slice(2);
 }
 var PrivacyKeyManager = class {
@@ -1864,30 +1966,29 @@ var PrivacyKeyManager = class {
     masterBytes: null,
     viewingSecretKey: null,
     viewingPublicKeyPacked: null,
-    ownerPk: null,
-    outgoingViewingKey: null
+    ownerPk: null
   };
   /**
    * Load a spending key and its corresponding master bytes into the in-memory session.
    * Derives viewingSecretKey, viewingPublicKeyPacked, and ownerPk immediately.
    * Replaces any previously loaded key.
    *
-   * @param spendingKey  Circuit scalar: BigInt(masterBytes) % BABYJUB_SUBORDER, clamped to [1, ∞).
-   * @param masterBytes  Raw 32-byte HKDF output before modular reduction. Used to derive
-   *                     the stable vault key (HKDF(masterBytes, info="orbinum-vault-key-v1")).
+   * @param _legacySpendingKey  IGNORED. Kept so v2-era callers still compile;
+   *                             the scalar is re-derived from `masterBytes`.
+   * @param masterBytes  Raw 32-byte HKDF output. The root every v3 branch and
+   *                     the stable vault key hang off.
    */
-  async load(spendingKey, masterBytes) {
-    const viewingSecretKey = deriveViewingSecretKey(spendingKey);
+  async load(_legacySpendingKey, masterBytes) {
+    const spendingKey = deriveSpendingKeyV3(masterBytes);
+    const viewingSecretKey = deriveViewingSecretKeyV3(masterBytes);
     const viewingPublicKeyPacked = deriveViewingPublicKey(viewingSecretKey);
     const ownerPk = deriveOwnerPk(spendingKey);
-    const outgoingViewingKey = deriveOutgoingViewingKey(masterBytes);
     this._state = {
       spendingKey,
       masterBytes,
       viewingSecretKey,
       viewingPublicKeyPacked,
-      ownerPk,
-      outgoingViewingKey
+      ownerPk
     };
   }
   /** Clear all key material from memory. Call on vault lock / sign-out. */
@@ -1897,8 +1998,7 @@ var PrivacyKeyManager = class {
       masterBytes: null,
       viewingSecretKey: null,
       viewingPublicKeyPacked: null,
-      ownerPk: null,
-      outgoingViewingKey: null
+      ownerPk: null
     };
   }
   /** Returns true if a spending key has been loaded. */
@@ -1936,6 +2036,24 @@ var PrivacyKeyManager = class {
     }
     return this._state.viewingPublicKeyPacked;
   }
+  /**
+   * The OUTGOING viewing key (ovk) — reads what this wallet SENT.
+   *
+   * Seeds the outgoing ephemeral sequence and opens the recipient book, so a
+   * holder can enumerate every payment the wallet made and name who received
+   * it. That makes it strictly more sensitive than the incoming viewing key,
+   * which yields amounts and no counterparties: hand it out only where the
+   * payment graph is meant to travel with it.
+   *
+   * A scan without it still finds every note the wallet OWNS and simply
+   * reconstructs no sent history — the watch-only case.
+   *
+   * SECURITY: never expose this in an address or a network request.
+   * Throws if not loaded.
+   */
+  getOutgoingViewingKey() {
+    return deriveOutgoingViewingKeyV3(this.getMasterBytes());
+  }
   /** Returns the BabyJubJub owner public key (x-coordinate). Throws if not loaded. */
   getOwnerPk() {
     if (this._state.ownerPk === null) {
@@ -1943,16 +2061,6 @@ var PrivacyKeyManager = class {
     }
     return this._state.ownerPk;
   }
-  /**
-   * Returns the 32-byte outgoing viewing key (ovk). Throws if not loaded.
-   * Used to seal/open the outgoing blob that lets the sender recover a transfer.
-   */
-  getOutgoingViewingKey() {
-    if (this._state.outgoingViewingKey === null) {
-      throw new Error("PrivacyKeyManager: no key loaded. Call load() first.");
-    }
-    return this._state.outgoingViewingKey;
-  }
   /** Returns the spending key as a 32-byte little-endian Uint8Array. Throws if not loaded. */
   getSpendingKeyBytes() {
     return bigintTo32Le(this.getSpendingKey());
@@ -1981,7 +2089,7 @@ var PrivacyKeyManager = class {
    * Exports a shareable privacy address encoding the owner public key and
    * viewing PUBLIC key of the currently loaded identity.
    *
-   * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
+   * Format: `orbpriv3:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
    *
    * The recipient uses this address so the sender can:
    *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
@@ -1996,44 +2104,64 @@ var PrivacyKeyManager = class {
    *
    * Throws if no key is loaded.
    */
-  encodePrivacyAddress() {
+  encodePrivacyAddress(version = "v3") {
     const ownerPk = this.getOwnerPk();
     const ivkPacked = this.getViewingPublicKeyPacked();
     const ownerPkHex = scalarToHex(ownerPk);
     const ivkHex = toHex(ivkPacked);
-    const checksum = privacyAddressChecksum(ownerPkHex, ivkHex);
-    return `orbpriv2:${ownerPkHex}:${ivkHex}:${checksum}`;
+    const scheme = SCHEME_BY_VERSION[version];
+    const checksum = privacyAddressChecksum(scheme, ownerPkHex, ivkHex);
+    return `${scheme}:${ownerPkHex}:${ivkHex}:${checksum}`;
   }
   /**
    * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
    * `null` if it does not parse.
    *
-   * Accepts both:
-   *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
-   *    (corrupted paste) returns null.
-   *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
-   *    shared before v2 keep resolving; only v2 is emitted.
+   * Reads every scheme ever emitted; only `orbpriv3` is written.
+   *
+   *  - `orbpriv3` / `orbpriv2` — checksum verified; a mismatch (corrupted
+   *    paste, or a relabelled prefix) returns null.
+   *  - `orbpriv1` — legacy, predates the checksum entirely. The FIELDS are
+   *    validated exactly as above, since this branch has no integrity check
+   *    of its own.
+   *
+   * Reading an old address is not the same as supporting an old identity. An
+   * address is an owner key and a viewing key; paying one works whatever
+   * scheme derived it, and whoever shares it may not have upgraded yet.
+   * Refusing them here would break incoming payments for no gain.
    */
   static decodePrivacyAddress(address) {
     const parts = address.split(":");
-    if (parts[0] === "orbpriv2") {
+    for (const version of ["v2", "v3"]) {
+      if (parts[0] !== SCHEME_BY_VERSION[version]) continue;
       if (parts.length !== 4) return null;
       const [, ownerPkHex, viewingPublicKeyHex, checksum] = parts;
       if (!ownerPkHex || !viewingPublicKeyHex || !checksum) return null;
-      if (privacyAddressChecksum(ownerPkHex, viewingPublicKeyHex) !== checksum) return null;
-      return { ownerPkHex, viewingPublicKeyHex };
+      if (privacyAddressChecksum(
+        SCHEME_BY_VERSION[version],
+        ownerPkHex,
+        viewingPublicKeyHex
+      ) !== checksum) {
+        return null;
+      }
+      const fields = usableAddressFields(ownerPkHex, viewingPublicKeyHex);
+      return fields ? { ...fields, scheme: SCHEME_BY_VERSION[version] } : null;
     }
     if (parts[0] === "orbpriv1") {
       if (parts.length !== 3) return null;
       const [, ownerPkHex, viewingPublicKeyHex] = parts;
       if (!ownerPkHex || !viewingPublicKeyHex) return null;
-      return { ownerPkHex, viewingPublicKeyHex };
+      const fields = usableAddressFields(ownerPkHex, viewingPublicKeyHex);
+      return fields ? { ...fields, scheme: "orbpriv1" } : null;
     }
     return null;
   }
   /**
    * Load keys from a cached "mk:0x{masterBytes_hex}" string produced by exportHex().
-   * Throws if the format is invalid or masterBytes length is not 32 bytes.
+   *
+   * Throws on a bad prefix, on non-hex content, and on a master that is not
+   * 32 usable bytes — an all-zero one included, since every wallet would
+   * derive the same identity from it.
    */
   async importFromHex(hex) {
     if (!hex.startsWith("mk:")) {
@@ -2041,21 +2169,15 @@ var PrivacyKeyManager = class {
         'PrivacyKeyManager: invalid cache format. Expected "mk:0x{masterBytes_hex}".'
       );
     }
-    const raw = hex.slice(3);
-    const h = raw.startsWith("0x") ? raw.slice(2) : raw;
-    const masterBytes = new Uint8Array((h.match(/.{2}/g) ?? []).map((b) => parseInt(b, 16)));
-    if (masterBytes.length !== 32) {
-      throw new Error("PrivacyKeyManager: invalid master bytes \u2014 expected 32 bytes.");
-    }
-    const masterBigint = BigInt("0x" + h);
-    const sk = masterBigint % BABYJUB_SUBORDER || 1n;
-    await this.load(sk, masterBytes);
+    const masterBytes = fromHex(hex.slice(3));
+    assertSecretKeyBytes(masterBytes, "PrivacyKeyManager: master");
+    await this.load(0n, masterBytes);
   }
 };
 
 // src/protocol/keys/spendingKeyDerivation.ts
-var import_hkdf5 = require("@noble/hashes/hkdf.js");
-var import_sha29 = require("@noble/hashes/sha2.js");
+var import_hkdf4 = require("@noble/hashes/hkdf.js");
+var import_sha210 = require("@noble/hashes/sha2.js");
 var MIN_SIGNATURE_BYTES = 32;
 var MIN_DISTINCT_BYTES = 8;
 function assertUsableSignature(sigBytes) {
@@ -2077,7 +2199,7 @@ async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const info = new TextEncoder().encode(
     `orbinum-sk-${KEY_VERSION}:${chainId}:${canonicalAccountId(address)}`
   );
-  return (0, import_hkdf5.hkdf)(import_sha29.sha256, sigBytes, new Uint8Array(0), info, 32);
+  return (0, import_hkdf4.hkdf)(import_sha210.sha256, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   return deriveSpendingKeyFromMaster(await deriveMasterKeyBytes(signatureHex, chainId, address));
@@ -2085,8 +2207,8 @@ async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
 
 // src/protocol/proving/unshield.ts
 var import_proof_generator = require("@orbinum/proof-generator");
-var import_utils5 = require("@noble/ciphers/utils.js");
-var import_baby_jubjub9 = require("@zk-kit/baby-jubjub");
+var import_utils4 = require("@noble/ciphers/utils.js");
+var import_baby_jubjub10 = require("@zk-kit/baby-jubjub");
 var import_poseidon_lite4 = require("poseidon-lite");
 
 // src/protocol/proving/merkle.ts
@@ -2118,8 +2240,8 @@ async function generateUnshieldProof(inputs, options = {}) {
   if (changeValue < 0n) {
     throw new Error("changeValue must be >= 0.");
   }
-  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub9.mulPointEscalar)(import_baby_jubjub9.Base8, inputs.spendingKey)[0];
-  const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE((0, import_utils5.randomBytes)(32)) : 0n);
+  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub10.mulPointEscalar)(import_baby_jubjub10.Base8, inputs.spendingKey)[0];
+  const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE((0, import_utils4.randomBytes)(32)) : 0n);
   const changeCommitment = changeValue > 0n ? (0, import_poseidon_lite4.poseidon4)([changeValue, inputs.assetId, changeOwnerPubkey, changeBlinding]) : 0n;
   const circuitInputs = {
     merkle_root: leHexToBigint(inputs.merkleRoot).toString(),
@@ -2355,6 +2477,25 @@ function wsUrlToHttp(wsUrl) {
 }
 
 // src/chain/substrate/SubstrateClient.ts
+var TIMESTAMP_PALLET = 1;
+function decodeCompact(bytes, offset) {
+  const first = bytes[offset];
+  if (first === void 0) return null;
+  const mode = first & 3;
+  if (mode === 0) return first >>> 2;
+  if (mode === 1) {
+    const b1 = bytes[offset + 1];
+    return b1 === void 0 ? null : (first >>> 2 | b1 << 6) >>> 0;
+  }
+  const width = mode === 2 ? 4 : (first >>> 2) + 5;
+  if (offset + width > bytes.length) return null;
+  let value = 0n;
+  const start = mode === 2 ? offset : offset + 1;
+  const end = mode === 2 ? offset + 4 : offset + width;
+  for (let i = end - 1; i >= start; i--) value = value << 8n | BigInt(bytes[i]);
+  if (mode === 2) value >>= 2n;
+  return value > BigInt(Number.MAX_SAFE_INTEGER) ? null : Number(value);
+}
 var SubstrateClient = class _SubstrateClient {
   constructor(_papi, _httpUrl, _owned) {
     this._papi = _papi;
@@ -2552,25 +2693,17 @@ var SubstrateClient = class _SubstrateClient {
         }
       }
       if (!timestampMs) {
-        const tsHex = extrinsics.find((hex) => {
+        const ts = extrinsics.reduce((found, hex) => {
+          if (found !== null) return found;
           try {
             const b = fromHex(hex);
-            return b.length > 6 && b[4] === 3 && b[5] === 0;
+            if (b.length < 5 || b[2] !== TIMESTAMP_PALLET || b[3] !== 0) return null;
+            return decodeCompact(b, 4);
           } catch {
-            return false;
+            return null;
           }
-        });
-        if (tsHex) {
-          try {
-            const b = fromHex(tsHex);
-            const view = new DataView(b.buffer, b.byteOffset + 6, 8);
-            const lo = view.getUint32(0, true);
-            const hi = view.getUint32(4, true);
-            const ms = lo + hi * 4294967296;
-            if (ms > 0) timestampMs = ms;
-          } catch {
-          }
-        }
+        }, null);
+        if (ts !== null && ts > 0) timestampMs = ts;
       }
       const author = _SubstrateClient.extractAuthorFromLogs(header.digest.logs, ss58Prefix);
       return { header, extrinsics, timestampMs, author };
@@ -2840,7 +2973,10 @@ var EvmClient = class {
   }
   /**
    * Performs multiple JSON-RPC calls in a single HTTP request (batch).
-   * Results are returned in the same order as `calls`, as a typed tuple.
+   *
+   * Results come back in the order of `calls`, as a typed tuple. A call the
+   * server answered with an error, or did not answer at all, lands as `null`
+   * in its own slot — never shifting the ones after it.
    */
   async batchRequest(calls) {
     const body = calls.map((c, i) => ({
@@ -2852,8 +2988,8 @@ var EvmClient = class {
     const res = await postJsonWithRetry(this.rpcUrl, JSON.stringify(body));
     if (!res.ok) throw new Error(`EVM HTTP ${res.status}: ${res.statusText}`);
     const arr = await res.json();
-    arr.sort((a, b) => (a.id ?? 0) - (b.id ?? 0));
-    return arr.map((r) => r.result ?? null);
+    const byId = new Map(arr.map((r) => [r.id, r]));
+    return calls.map((_, i) => byId.get(i + 1)?.result ?? null);
   }
   // ─── Convenience wrappers ─────────────────────────────────────────────────
   /** Returns the native token balance (in wei) for an EVM address. */
@@ -2899,7 +3035,10 @@ var EvmClient = class {
     if (from) txObj["from"] = from;
     return this.request("eth_call", [txObj, "latest"]);
   }
-  /** Estimates the gas required for a transaction. Returns the estimate in wei as a `bigint`. */
+  /**
+   * Estimates a transaction's gas, in GAS UNITS — not wei. Multiply by
+   * `getGasPrice()` for a cost.
+   */
   async estimateGas(params) {
     const hex = await this.request("eth_estimateGas", [params]);
     return hexToBigint(hex);
@@ -3150,7 +3289,7 @@ var EvmExplorer = class _EvmExplorer {
   // --- Address ---
   /**
    * Returns aggregated on-chain data for an EVM address: balance, nonce,
-   * bytecode (truncated), and up to 50 recent logs from the last 1 000 blocks.
+   * bytecode (truncated), and up to 50 logs it EMITTED in the last 1 001 blocks.
    */
   async getAddressInfo(address) {
     const latest = await this.evm.getBlockNumber().catch(() => 0);
@@ -3233,7 +3372,7 @@ var EvmExplorer = class _EvmExplorer {
     };
   }
   /**
-   * Returns ERC-20 `Transfer` events for `address` from the last 1 000 blocks.
+   * Returns ERC-20 `Transfer` events for `address` from the last 1 001 blocks.
    * When `holderAddress` is provided, restricts results to transfers sent or received by that address.
    */
   async getTokenTransfers(address, holderAddress) {
@@ -3606,7 +3745,13 @@ var PrivacyModule = class {
   async getMerkleRoot() {
     return this.substrate.request("privacy_getMerkleRoot", []);
   }
-  /** Returns the Merkle proof for the given leaf index or commitment hex. */
+  /**
+   * Returns the Merkle proof for a LEAF INDEX.
+   *
+   * The node declares this parameter `u32`, so a commitment hex is rejected
+   * by deserialisation before any lookup runs — `getMerkleProofByCommitment`
+   * is the one that takes a string.
+   */
   async getMerkleProof(leafIndex) {
     const raw = await this.substrate.request("privacy_getMerkleProof", [
       leafIndex
@@ -4556,9 +4701,13 @@ var OrbinumClientProvider = class _OrbinumClientProvider {
   // ─── Reconnection ───────────────────────────────────────────────────────
   /**
    * Schedules the next connection attempt using exponential backoff
-   * (capped at `reconnectMaxMs`) with full jitter, then transitions to
-   * `'reconnecting'`. Jitter (a random fraction of the delay) spreads out
-   * reconnects so many clients don't retry in lockstep after a shared outage.
+   * (capped at `reconnectMaxMs`) with EQUAL jitter, then transitions to
+   * `'reconnecting'`.
+   *
+   * The delay lands in `[capped/2, capped]` — half fixed, half random. That
+   * spreads a shared outage's reconnects over a `capped/2` window instead of
+   * having every client retry in lockstep, while keeping a floor so the first
+   * attempts do not all pile up near zero the way full jitter allows.
    */
   scheduleReconnect() {
     if (this._reconnectTimer) clearTimeout(this._reconnectTimer);
@@ -4950,6 +5099,16 @@ function mapZkEventData(method, data) {
       index: get(4, "leaf_index") || get(4, "index")
     };
   }
+  if (m === "nullifiersspent") {
+    return { nullifiers: get(0, "nullifiers") };
+  }
+  if (m === "commitmentsinserted") {
+    return {
+      commitments: get(0, "commitments"),
+      memos: get(1, "encrypted_memos") || get(1, "memos"),
+      indices: get(2, "leaf_indices") || get(2, "indices")
+    };
+  }
   if (m === "privatetransfer") {
     return {
       nullifiers: get(0, "nullifiers"),
@@ -4991,12 +5150,12 @@ function mapZkEventData(method, data) {
   if (m_norm === "log") {
     return { log: get(0, "log") };
   }
-  if (m_norm === "created" || m_norm === "createdfailed" || m_norm === "executed" || m_norm === "executedfailed") {
+  if (m_norm === "created" || m_norm === "createdfailed" || m_norm === "executedfailed") {
     return { address: get(0, "address") };
   }
   if (m_norm === "executed") {
     return {
-      from: get(0, "from"),
+      from: get(0, "from") ?? get(0, "address"),
       to: get(1, "to"),
       transaction_hash: get(2, "transaction_hash"),
       exit_reason: get(3, "exit_reason")
@@ -5136,10 +5295,10 @@ var ERROR_KINDS = {
   CommitmentAlreadyExists: "shape",
   UnknownMerkleRoot: "stale-proof",
   // Amounts and fees
-  AmountTooSmall: "amount",
   InvalidAmount: "amount",
   InsufficientPoolBalance: "amount",
   FeeTooLow: "amount",
+  InsufficientPendingFees: "amount",
   // Proofs
   InvalidProof: "proof",
   ProofVerificationFailed: "proof",
@@ -5148,12 +5307,14 @@ var ERROR_KINDS = {
   InvalidAssetId: "asset",
   AssetNotVerified: "asset",
   AssetIdMismatch: "asset",
+  AssetIdAlreadyExists: "asset",
   // Request shape
   InvalidMemoSize: "shape",
   MemoCommitmentMismatch: "shape",
   TooManyInputsOrOutputs: "shape",
   InvalidRecipient: "shape",
   EmptyBatch: "shape",
+  FeeRecipientUnavailable: "shape",
   // Capacity
   MerkleTreeFull: "capacity",
   // Balances pallet, reached through the same path
@@ -5512,6 +5673,7 @@ function buildConfig(existing, chainFingerprint) {
     updatedAt: now,
     ...chainFingerprint ? { chainFingerprint } : {},
     ...existing?.selfEphCounter !== void 0 ? { selfEphCounter: existing.selfEphCounter } : {},
+    ...existing?.outgoingEphCounter !== void 0 ? { outgoingEphCounter: existing.outgoingEphCounter } : {},
     ...existing?.pairwiseCounterparties !== void 0 ? { pairwiseCounterparties: existing.pairwiseCounterparties } : {}
   };
 }
@@ -5523,6 +5685,7 @@ async function writeConfig(storage, fallback, chainFingerprint) {
 }
 function mergeCounters(current, fallback) {
   const selfEphCounter = higher(current.selfEphCounter, fallback?.selfEphCounter);
+  const outgoingEphCounter = higher(current.outgoingEphCounter, fallback?.outgoingEphCounter);
   const parties = mergePairwise(current.pairwiseCounterparties, fallback?.pairwiseCounterparties);
   return {
     createdAt: current.createdAt ?? fallback?.createdAt,
@@ -5530,6 +5693,7 @@ function mergeCounters(current, fallback) {
     // is exactOptionalPropertyTypes, so an explicit undefined is a type
     // error AND would round-trip through structured clone as a present key.
     ...selfEphCounter !== void 0 ? { selfEphCounter } : {},
+    ...outgoingEphCounter !== void 0 ? { outgoingEphCounter } : {},
     ...parties !== void 0 ? { pairwiseCounterparties: parties } : {}
   };
 }
@@ -5567,6 +5731,7 @@ function mergePairwise(current, fallback) {
 
 // src/wallet/vault/storage/ephemeralIndex.ts
 var MAX_EPH_INDEX = 4294967294;
+var RESTORE_SAFETY_GAP = 8;
 function usableCounter(value) {
   if (typeof value !== "number" || !Number.isInteger(value)) return null;
   if (value < 0 || value > MAX_EPH_INDEX) return null;
@@ -5581,27 +5746,51 @@ async function reserveSelfEphIndex(storage) {
   if (!updated) throw new Error("vault not initialized");
   return (usableCounter(updated.selfEphCounter) ?? 1) - 1;
 }
-async function reservePairwiseIndex(storage, ivkHex) {
+async function reserveOutgoingIndex(storage, fromChain) {
+  const recovered = usableCounter(fromChain);
+  let exhausted = false;
+  const updated = await storage.updateConfig((config) => {
+    const raw = config.outgoingEphCounter;
+    if (typeof raw === "number" && Number.isSafeInteger(raw) && raw > MAX_EPH_INDEX) {
+      exhausted = true;
+      return config;
+    }
+    exhausted = false;
+    const stored = usableCounter(raw) ?? 0;
+    const floor = recovered !== null && recovered > stored ? Math.min(recovered + RESTORE_SAFETY_GAP, MAX_EPH_INDEX) : stored;
+    return {
+      ...config,
+      outgoingEphCounter: floor + 1,
+      updatedAt: Date.now()
+    };
+  });
+  if (!updated) throw new Error("vault not initialized");
+  if (exhausted || typeof updated.outgoingEphCounter === "number" && Number.isSafeInteger(updated.outgoingEphCounter) && updated.outgoingEphCounter > MAX_EPH_INDEX) {
+    throw new Error("outgoing ephemeral sequence exhausted");
+  }
+  const committed = usableCounter(updated.outgoingEphCounter);
+  if (committed === null || committed - 1 >= MAX_EPH_INDEX) {
+    throw new Error("outgoing ephemeral sequence exhausted");
+  }
+  return committed - 1;
+}
+async function registerPairwiseCounterparty(storage, ivkHex) {
   const key = ivkHex.toLowerCase();
   const updated = await storage.updateConfig((config) => {
-    const stored = usableCounter(config.pairwiseCounterparties?.[key]?.nextIndex);
-    const addedAt = config.pairwiseCounterparties?.[key]?.addedAt;
+    const existing = config.pairwiseCounterparties?.[key];
     return {
       ...config,
       pairwiseCounterparties: {
         ...config.pairwiseCounterparties,
         [key]: {
-          nextIndex: (stored ?? 0) + 1,
-          addedAt: typeof addedAt === "number" ? addedAt : Date.now()
+          nextIndex: usableCounter(existing?.nextIndex) ?? 0,
+          addedAt: typeof existing?.addedAt === "number" ? existing.addedAt : Date.now()
         }
       },
       updatedAt: Date.now()
     };
   });
   if (!updated) throw new Error("vault not initialized");
-  const nextIndex = usableCounter(updated.pairwiseCounterparties?.[key]?.nextIndex);
-  if (nextIndex === null || nextIndex <= 1) return null;
-  return nextIndex - 1;
 }
 
 // src/wallet/vault/notes/record.ts
@@ -6036,19 +6225,44 @@ async function processHints(ctx, hints, total) {
       }
     }
     outcome.scanned++;
-    if (!hint.encryptedMemo || !hint.ephPkHex) {
+    if (!hint.encryptedMemo) {
       outcome.noMemo++;
       continue;
     }
     toDecrypt.push(hint);
   }
-  const { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex } = await ctx.pool.decryptBatch(toDecrypt, ctx.keys, ctx.signal);
+  const {
+    notes,
+    tagFiltered,
+    selfMatched,
+    pairwiseMatched,
+    maxSelfEphIndex,
+    maxOutgoingEphIndex,
+    sentNotes,
+    learnedRecipients,
+    unmatchedSent,
+    sealedBookEntries
+  } = await ctx.pool.decryptBatch(
+    toDecrypt,
+    { ...ctx.keys, recipientCandidates: [...outcome.learnedRecipients].map(fromHex) },
+    ctx.signal
+  );
   outcome.tagFiltered += tagFiltered;
   outcome.selfDiscovered += selfMatched;
   outcome.pairwiseDiscovered += pairwiseMatched;
+  outcome.sentNotes.push(...sentNotes ?? []);
+  outcome.unmatchedSent.push(...unmatchedSent ?? []);
+  for (const e of sealedBookEntries ?? []) outcome.sealedBookEntries.add(e);
+  for (const r of learnedRecipients ?? []) outcome.learnedRecipients.add(r);
   if (maxSelfEphIndex !== null) {
     outcome.maxSelfEphIndex = Math.max(outcome.maxSelfEphIndex ?? -1, maxSelfEphIndex);
   }
+  if (maxOutgoingEphIndex != null) {
+    outcome.maxOutgoingEphIndex = Math.max(
+      outcome.maxOutgoingEphIndex ?? -1,
+      maxOutgoingEphIndex
+    );
+  }
   const pageEntries = [];
   for (const [i, decrypted] of notes.entries()) {
     const hint = toDecrypt[i];
@@ -6145,7 +6359,12 @@ async function collectScanEntries(params) {
     tagFiltered: 0,
     selfDiscovered: 0,
     pairwiseDiscovered: 0,
-    maxSelfEphIndex: null
+    sentNotes: [],
+    unmatchedSent: [],
+    sealedBookEntries: /* @__PURE__ */ new Set(),
+    learnedRecipients: new Set((params.keys.recipientCandidates ?? []).map((c) => toHex(c))),
+    maxSelfEphIndex: null,
+    maxOutgoingEphIndex: null
   };
   const ctx = {
     outcome,
@@ -6361,12 +6580,18 @@ function createScanCheckpoint(params) {
 // src/wallet/worker/kernel/types.ts
 var SELF_EPH_WINDOW = 1024;
 var PAIRWISE_EPH_WINDOW = 64;
+var OUTGOING_EPH_WINDOW = 64;
 var EMPTY_BATCH_RESULT = {
   notes: [],
   tagFiltered: 0,
   selfMatched: 0,
   pairwiseMatched: 0,
-  maxSelfEphIndex: null
+  maxSelfEphIndex: null,
+  maxOutgoingEphIndex: null,
+  sentNotes: [],
+  learnedRecipients: [],
+  unmatchedSent: [],
+  sealedBookEntries: []
 };
 
 // src/wallet/scanner/selfEphGap.ts
@@ -6378,7 +6603,7 @@ function gapMargin(windowSize) {
   return Math.max(1, Math.floor(windowSize / 16));
 }
 function resolveSelfEphCeiling(params) {
-  const { notes, spendingKey, viewingKey, scanMaxIndex } = params;
+  const { notes, viewingKey, scanMaxIndex } = params;
   const windowSize = params.windowSize !== void 0 && params.windowSize > 0 ? params.windowSize : SELF_EPH_WINDOW;
   if (scanMaxIndex === null) return null;
   if (scanMaxIndex < windowSize - gapMargin(windowSize)) return scanMaxIndex;
@@ -6391,7 +6616,7 @@ function resolveSelfEphCeiling(params) {
   let max = scanMaxIndex;
   let from = windowSize;
   for (; ; ) {
-    const slice = selfEphWindow(spendingKey, ivkPacked, from, windowSize);
+    const slice = selfEphWindow(viewingKey, ivkPacked, from, windowSize);
     let matched = false;
     for (const entry of slice) {
       if (ownEphPks.has(entry.ephPkHex.toLowerCase())) {
@@ -6404,12 +6629,12 @@ function resolveSelfEphCeiling(params) {
   }
   return max;
 }
-var MAX_EPH_WINDOW = SELF_EPH_WINDOW * 64;
+var MAX_EPH_WINDOW2 = SELF_EPH_WINDOW * 64;
 function windowSizeForCounter(counter) {
   const used = Number.isFinite(counter) ? counter : 0;
   const needed = used + gapMargin(SELF_EPH_WINDOW);
   const rounded = Math.ceil(needed / SELF_EPH_WINDOW) * SELF_EPH_WINDOW;
-  return Math.min(MAX_EPH_WINDOW, Math.max(SELF_EPH_WINDOW, rounded));
+  return Math.min(MAX_EPH_WINDOW2, Math.max(SELF_EPH_WINDOW, rounded));
 }
 
 // src/wallet/scanner/phases/spentStatus.ts
@@ -6447,6 +6672,8 @@ async function resolveSpentStatus(params) {
 }
 
 // src/wallet/scanner/pipeline.ts
+var OUTGOING_RESCAN_GAP = 8;
+var RETRY_BOOK_LIMIT = 64;
 async function runScan(params) {
   const { vault, storage, hints, nullifiers, pool, keys, sinceLeafIndex, signal, onWarning } = params;
   const isIncremental = sinceLeafIndex !== void 0;
@@ -6454,6 +6681,7 @@ async function runScan(params) {
   const preScanHexes = new Set(existingHexes);
   const config = await storage.getConfig().catch(() => null);
   const selfEphWindowSize = windowSizeForCounter(config?.selfEphCounter ?? 0);
+  const outgoingEphWindowSize = windowSizeForCounter(config?.outgoingEphCounter ?? 0);
   const pairwiseCounterparties = Object.keys(config?.pairwiseCounterparties ?? {}).flatMap(
     (hex) => {
       try {
@@ -6482,7 +6710,12 @@ async function runScan(params) {
       // worth it on full scans and restores, waste on small incremental ticks.
       selfEph: !isIncremental,
       selfEphWindowSize,
-      pairwiseCounterparties
+      pairwiseCounterparties,
+      // Sent-note discovery rides the same full-scan/restore budget as
+      // self discovery: on an incremental tick the history is already
+      // there, and the window would be paid for nothing.
+      outgoingEph: !isIncremental,
+      outgoingEphWindowSize
     },
     existingHexes,
     sinceLeafIndex,
@@ -6496,6 +6729,49 @@ async function runScan(params) {
     onPage: (entries) => checkpoint.savePageNotes(entries),
     onBatchDone: (maxLeafIndex) => checkpoint.advanceCursor(maxLeafIndex)
   });
+  const ovk = keys.outgoingViewingKey;
+  if (scan.unmatchedSent.length > 0 && ovk) {
+    const proven = [...scan.learnedRecipients].map(fromHex);
+    const keptEntries = [...scan.sealedBookEntries].slice(-RETRY_BOOK_LIMIT);
+    const sealed = [];
+    for (const entry of keptEntries) {
+      try {
+        sealed.push(BigInt(entry));
+      } catch {
+      }
+    }
+    const retries = scan.unmatchedSent.slice(-RETRY_BOOK_LIMIT);
+    if (retries.length < scan.unmatchedSent.length) {
+      onWarning?.(
+        `sent-note retry capped at ${retries.length} of ${scan.unmatchedSent.length}; the rest resolve on the next full scan`
+      );
+    }
+    if (keptEntries.length < scan.sealedBookEntries.size) {
+      onWarning?.(
+        `recipient book capped at ${keptEntries.length} of ${scan.sealedBookEntries.size} entries; older payments resolve on the next full scan`
+      );
+    }
+    for (const { hint, ephIndex } of retries) {
+      if (signal?.aborted) throw scanAbortError();
+      const candidates = [
+        ...sealed.map((e) => openRecipientBookEntry(e, ovk, hint.commitmentHex)),
+        ...proven
+      ];
+      const sent = recoverSentNote({
+        hint,
+        outgoingViewingKey: ovk,
+        ephIndex,
+        recipientCandidates: candidates
+      });
+      if (!sent) continue;
+      const { recipientIvk, ...facts } = sent;
+      scan.sentNotes.push({
+        ...facts,
+        counterpartyIvkHex: toHex(recipientIvk),
+        encryptedMemo: hint.encryptedMemo ?? ""
+      });
+    }
+  }
   const nullifiersToQuery = collectNullifiersToQuery(
     scan.scanEntries,
     scan.onChainHexes,
@@ -6525,7 +6801,6 @@ async function runScan(params) {
     try {
       ceiling = resolveSelfEphCeiling({
         notes: vault.getAll(),
-        spendingKey: keys.spendingKey,
         viewingKey: keys.viewingKey,
         scanMaxIndex: scan.maxSelfEphIndex,
         windowSize: selfEphWindowSize
@@ -6535,6 +6810,13 @@ async function runScan(params) {
     await bumpSelfEphCounterTo(storage, ceiling + 1).catch(() => {
     });
   }
+  if (scan.maxOutgoingEphIndex !== null) {
+    await bumpOutgoingCounterTo(
+      storage,
+      scan.maxOutgoingEphIndex + 1 + OUTGOING_RESCAN_GAP
+    ).catch(() => {
+    });
+  }
   if (scan.decryptFailed > 0 && scan.found === 0 && scan.alreadyPresent === 0) {
     onWarning?.(
       `no notes recovered from ${scan.decryptFailed} hint(s) with memos; if this wallet should hold notes, check the keys it was unlocked with`
@@ -6546,7 +6828,13 @@ async function runScan(params) {
     decryptFailed: scan.decryptFailed,
     alreadyPresent: scan.alreadyPresent,
     purged,
-    incremental: isIncremental
+    incremental: isIncremental,
+    sentNotes: scan.sentNotes,
+    discovery: {
+      self: scan.selfDiscovered,
+      pairwise: scan.pairwiseDiscovered,
+      tagFiltered: scan.tagFiltered
+    }
   };
 }
 async function bumpSelfEphCounterTo(storage, next) {
@@ -6554,6 +6842,11 @@ async function bumpSelfEphCounterTo(storage, next) {
     (config) => (config.selfEphCounter ?? 0) >= next ? config : { ...config, selfEphCounter: next, updatedAt: Date.now() }
   );
 }
+async function bumpOutgoingCounterTo(storage, next) {
+  await storage.updateConfig(
+    (config) => (config.outgoingEphCounter ?? 0) >= next ? config : { ...config, outgoingEphCounter: next, updatedAt: Date.now() }
+  );
+}
 
 // src/wallet/scanner/history/extrinsicFacts.ts
 var UNKNOWN = { fee: null, success: true };
@@ -6692,10 +6985,8 @@ function regeneratePaymentSlip(facts, recipientIvkPacked, txHash) {
     commitmentHex: facts.commitmentHex,
     encryptedMemo: facts.encryptedMemo,
     ...facts.leafIndex !== void 0 ? { leafIndex: facts.leafIndex } : {},
-    // Rendered as an explorer link by the recipient, where an unconstrained
+    // The recipient renders this as an explorer link, so an unconstrained
     // string is a URL injection wearing the authority of a decrypted slip.
-    // Dropped rather than fatal: the slip still rebuilds the note, which is
-    // the part that matters.
     ...isHexOfLength(txHash, 32) ? { txHash } : {}
   });
   return encodePaymentSlip(envelope);
@@ -6720,15 +7011,37 @@ async function loadExistingRecords(vault) {
 function recordKey(transfer) {
   return transfer.hash ?? `${transfer.blockNumber}-${transfer.extrinsicIndex ?? 0}`;
 }
+function sentByCommitment(sentNotes) {
+  return new Map(sentNotes.map((s) => [s.commitmentHex.toLowerCase(), s]));
+}
+function reissuedSlip(sent, hash) {
+  try {
+    const facts = {
+      commitmentHex: sent.commitmentHex,
+      encryptedMemo: sent.encryptedMemo,
+      ...sent.leafIndex !== void 0 ? { leafIndex: sent.leafIndex } : {}
+    };
+    return {
+      paymentSlip: regeneratePaymentSlip(
+        facts,
+        fromHex(sent.counterpartyIvkHex),
+        hash ?? void 0
+      )
+    };
+  } catch {
+    return {};
+  }
+}
 async function reconstructOutgoingTxRecords(deps) {
   const { vault, transfers } = deps;
   const now = deps.now ?? Date.now;
   const allNotes = vault.getAll();
   const spentNotes = allNotes.filter((n) => n.spent);
   if (spentNotes.length === 0) return;
+  const sentCommitments = (deps.sentNotes ?? []).map((s) => s.commitmentHex);
   const [outgoingTransfers, commitmentTransfers] = await Promise.all([
     transfers.byNullifiers(spentNotes.map((n) => n.nullifierHex)),
-    transfers.byCommitments(allNotes.map((n) => n.commitmentHex))
+    transfers.byCommitments([...allNotes.map((n) => n.commitmentHex), ...sentCommitments])
   ]);
   if (outgoingTransfers.length === 0) return;
   const noteByNullifier = new Map(spentNotes.map((n) => [n.nullifierHex, n]));
@@ -6737,64 +7050,85 @@ async function reconstructOutgoingTxRecords(deps) {
     commitmentTransfers.map((ct) => [extrinsicKey(ct), ct.matchedCommitments ?? []])
   );
   const existingByKey = await loadExistingRecords(vault);
+  const sentIndex = sentByCommitment(deps.sentNotes ?? []);
+  const recoveryEnabled = deps.sentNotes !== void 0;
+  const sentFor = (row) => (commitmentsByExtrinsic.get(extrinsicKey(row)) ?? []).map((hex) => sentIndex.get(hex.toLowerCase())).find((s) => s !== void 0);
   for (const transfer of outgoingTransfers) {
     const existing = existingByKey.get(recordKey(transfer));
-    if (existing?.recipientPkHex && existing.recipientPkHex !== ZERO_PK) continue;
+    const known = existing?.recipientPkHex && existing.recipientPkHex !== ZERO_PK;
+    if (known && existing?.paymentSlip) continue;
     const inputNotes = (transfer.matchedNullifiers ?? []).map((h) => noteByNullifier.get(h)).filter((n) => n !== void 0);
     if (inputNotes.length === 0) continue;
     const changeNote = selectDescribingNoteByCommitment(
       commitmentsByExtrinsic.get(extrinsicKey(transfer)) ?? [],
       noteByCommitment
     );
-    const recipientPkHex = toPkHex(changeNote?.sourcePk);
+    const sentForRow = sentFor(transfer);
+    const recipientPkHex = sentForRow ? toPkHex(sentForRow.recipientStealthPk) : recoveryEnabled ? ZERO_PK : toPkHex(changeNote?.sourcePk);
     if (existing) {
-      if (recipientPkHex === ZERO_PK) continue;
-      await vault.saveTxRecord({ ...existing, recipientPkHex });
+      const patch = {
+        // Only when it ADDS something: this runs over the whole
+        // outgoing history on every scan, and rewriting what is already
+        // there would make each one a write.
+        ...!known && recipientPkHex !== ZERO_PK ? { recipientPkHex } : {},
+        ...sentForRow && !existing.paymentSlip ? reissuedSlip(sentForRow, transfer.hash) : {}
+      };
+      if (Object.keys(patch).length > 0) {
+        await vault.saveTxRecord({ ...existing, ...patch });
+      }
       continue;
     }
     const { fee, success } = await fetchExtrinsicFacts(deps.txFacts, transfer.hash);
     const totalInputValue = inputNotes.reduce((sum, n) => sum + n.value, 0n);
-    const transferAmount = totalInputValue - (changeNote?.value ?? 0n) - (fee ?? 0n);
+    const derivedAmount = totalInputValue - (changeNote?.value ?? 0n) - (fee ?? 0n);
+    const transferAmount = sentForRow?.value ?? derivedAmount;
     if (transferAmount <= 0n) continue;
     const record = {
       id: recordKey(transfer),
       type: "private_transfer",
       blockNumber: transfer.blockNumber,
       hash: transfer.hash ?? "",
-      assetId: inputNotes[0].assetId.toString(),
+      assetId: (sentForRow?.assetId ?? inputNotes[0].assetId).toString(),
       amount: transferAmount.toString(),
       recipientPkHex,
       status: success ? "success" : "failed",
-      ...fee !== null ? { feePlanck: fee.toString() } : { amountApproximate: true },
-      timestampMs: transfer.timestampMs ?? now()
+      ...fee !== null ? { feePlanck: fee.toString() } : {},
+      ...fee === null && !sentForRow ? { amountApproximate: true } : {},
+      timestampMs: transfer.timestampMs ?? now(),
+      // Best-effort: a slip that cannot be sealed costs the convenience of
+      // handing it over again, never the history row.
+      ...sentForRow ? reissuedSlip(sentForRow, transfer.hash) : {}
     };
     await vault.saveTxRecord(record);
   }
 }
 
 // src/wallet/ops/notes/buildNote.ts
-async function buildZkNote(params, deps) {
+async function buildZkNoteWithIndex(params, deps) {
   const { keys, storage } = deps;
   const ownerPk = params.ownerPk ?? keys.ownerPk;
   const spendingKey = params.spendingKey ?? keys.spendingKey;
   const viewingPublicKey = params.viewingPublicKey ?? keys.viewingPublicKey;
   const isSelf = params.viewingPublicKey === void 0 && params.recipientOwnerPk === void 0;
   let ephSkOverride;
-  if (isSelf && storage) {
+  let outgoingIndex;
+  if (isSelf && storage && keys.viewingSecretKey) {
     try {
-      ephSkOverride = deriveSelfEphSk(spendingKey, await reserveSelfEphIndex(storage));
+      ephSkOverride = deriveSelfEphSk(
+        keys.viewingSecretKey,
+        await reserveSelfEphIndex(storage)
+      );
     } catch {
     }
-  } else if (params.viewingPublicKey && storage && keys.viewingSecretKey) {
+  } else if (params.viewingPublicKey && storage && keys.outgoingViewingKey) {
     try {
-      const index = await reservePairwiseIndex(storage, toHex(params.viewingPublicKey));
-      if (index !== null) {
-        const pairSecret = derivePairwiseSharedSecret(
-          keys.viewingSecretKey,
-          params.viewingPublicKey
-        );
-        ephSkOverride = derivePairwiseEphSk(pairSecret, index);
-      }
+      const index = await reserveOutgoingIndex(storage, params.outgoingIndexFromChain);
+      ephSkOverride = deriveOutgoingEphSk(keys.outgoingViewingKey, index);
+      outgoingIndex = index;
+    } catch {
+    }
+    try {
+      await registerPairwiseCounterparty(storage, toHex(params.viewingPublicKey));
     } catch {
     }
   }
@@ -6814,7 +7148,13 @@ async function buildZkNote(params, deps) {
     },
     ...ephSkOverride !== void 0 && { ephSkOverride }
   });
-  return stampCreatedAt(note, Date.now());
+  return {
+    note: stampCreatedAt(note, Date.now()),
+    ...outgoingIndex !== void 0 ? { outgoingIndex } : {}
+  };
+}
+async function buildZkNote(params, deps) {
+  return (await buildZkNoteWithIndex(params, deps)).note;
 }
 
 // src/wallet/ops/notes/selfStealthNote.ts
@@ -6833,89 +7173,6 @@ function recoverSelfStealthNote(note, keys) {
   return recovered;
 }
 
-// src/wallet/ops/notes/noteTransfer.ts
-var NOTE_TRANSFER_URI_SCHEME = "orbinum://notes/v1/";
-var QR_PAGE_MAX_CHARS = 1800;
-function noteToTransferEntry(note) {
-  return {
-    c: note.commitmentHex,
-    n: note.nullifierHex,
-    val: note.value.toString(),
-    aid: note.assetId.toString(),
-    opk: scalarToHex(note.ownerPk),
-    bld: scalarToHex(note.blinding),
-    sk: scalarToHex(note.spendingKey)
-  };
-}
-function encodeNoteTransferPages(notes, options = {}) {
-  const now = options.now ?? Date.now;
-  const maxChars = options.maxChars ?? QR_PAGE_MAX_CHARS;
-  const entries = notes.map(noteToTransferEntry);
-  const batches = [];
-  let batch = [];
-  for (const entry of entries) {
-    batch.push(entry);
-    const probe = { v: 1, ts: 0, p: 0, pt: 1, notes: batch };
-    const size = NOTE_TRANSFER_URI_SCHEME.length + base64UrlEncode(JSON.stringify(probe)).length;
-    if (size > maxChars && batch.length > 1) {
-      batch.pop();
-      batches.push(batch);
-      batch = [entry];
-    }
-  }
-  if (batch.length > 0) batches.push(batch);
-  const ts = now();
-  return batches.map((notesInPage, i) => {
-    const payload = {
-      v: 1,
-      ts,
-      p: i,
-      pt: batches.length,
-      notes: notesInPage
-    };
-    return NOTE_TRANSFER_URI_SCHEME + base64UrlEncode(JSON.stringify(payload));
-  });
-}
-function decodeNoteTransferPage(uri) {
-  if (!uri.startsWith(NOTE_TRANSFER_URI_SCHEME)) {
-    throw new Error("Not an Orbinum note-transfer code.");
-  }
-  let payload;
-  try {
-    payload = JSON.parse(base64UrlDecode(uri.slice(NOTE_TRANSFER_URI_SCHEME.length)));
-  } catch {
-    throw new Error("Note-transfer code is corrupt.");
-  }
-  const p = payload;
-  if (p.v !== 1) {
-    throw new Error(`Unsupported note-transfer version: ${String(p.v)}.`);
-  }
-  if (typeof p.p !== "number" || typeof p.pt !== "number" || !Array.isArray(p.notes) || p.notes.some((n) => !isEntry(n))) {
-    throw new Error("Note-transfer code is missing required fields.");
-  }
-  return p;
-}
-function isEntry(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const e = value;
-  return ["c", "n", "val", "aid", "opk", "bld", "sk"].every(
-    (k) => typeof e[k] === "string" && e[k].length > 0
-  );
-}
-function assembleNoteTransfer(pages) {
-  if (pages.length === 0) throw new Error("No pages scanned.");
-  const total = pages[0].pt;
-  if (pages.some((p) => p.pt !== total)) {
-    throw new Error("Pages come from different batches.");
-  }
-  const seen = new Set(pages.map((p) => p.p));
-  if (seen.size !== total) {
-    const missing = [...Array(total).keys()].filter((i) => !seen.has(i));
-    throw new Error(`Missing page(s): ${missing.map((i) => i + 1).join(", ")} of ${total}.`);
-  }
-  return [...pages].sort((a, b) => a.p - b.p).flatMap((p) => p.notes);
-}
-
 // src/wallet/ops/notes/noteBackup.ts
 var NOTE_BACKUP_VERSION = 1;
 function noteToBackupEntry(note) {
@@ -6950,12 +7207,13 @@ function decodeNoteBackup(json) {
   if (p.v !== NOTE_BACKUP_VERSION) {
     throw new Error(`Unsupported note-backup version: ${String(p.v)}.`);
   }
-  if (!Array.isArray(p.notes) || p.notes.some((n) => !isEntry2(n))) {
+  if (!Array.isArray(p.notes) || p.notes.some((n) => !isEntry(n))) {
     throw new Error("Note backup is missing required fields.");
   }
   return p.notes;
 }
 function importNotesFromBackup(entries, keys) {
+  assertSecretKeyBytes(keys.viewingSecretKey, "importNotesFromBackup: viewingSecretKey");
   const out = [];
   for (const entry of entries) {
     const commitment = {
@@ -6979,12 +7237,14 @@ function importNotesFromBackup(entries, keys) {
   }
   return out;
 }
-function isEntry2(value) {
+function isEntry(value) {
   if (typeof value !== "object" || value === null) return false;
   const e = value;
-  if (typeof e["commitmentHex"] !== "string" || e["commitmentHex"].length === 0) return false;
-  if (typeof e["encryptedMemo"] !== "string" || e["encryptedMemo"].length === 0) return false;
-  if ("leafIndex" in e && e["leafIndex"] !== void 0 && typeof e["leafIndex"] !== "number") {
+  if (!isHexOfLength(e["commitmentHex"], 32)) return false;
+  if (!isHexOfLength(e["encryptedMemo"], ENCRYPTED_MEMO_SIZE)) return false;
+  if (e["leafIndex"] !== void 0 && !isValidLeafIndex(e["leafIndex"])) return false;
+  if (e["spent"] !== void 0 && typeof e["spent"] !== "boolean") return false;
+  if (e["spentAt"] !== void 0 && e["spentAt"] !== null && typeof e["spentAt"] !== "number") {
     return false;
   }
   return true;
@@ -6992,6 +7252,7 @@ function isEntry2(value) {
 
 // src/wallet/ops/notes/paymentSlipImport.ts
 function importPaymentSlip(slip, keys) {
+  assertSecretKeyBytes(keys.viewingSecretKey, "importPaymentSlip: viewingSecretKey");
   const envelope = typeof slip === "string" ? decodePaymentSlip(slip) : slip;
   if (!envelope) return null;
   const fields = openPaymentSlip(keys.viewingSecretKey, envelope);
@@ -7120,10 +7381,7 @@ async function transferNotes(deps, params, onProgress) {
   const merkleRoot = merkleA.root;
   onProgress?.("building-output-notes");
   const effectiveSenderPk = senderPk ?? noteA.ownerPk;
-  const senderViewingPublicKey = deriveViewingPublicKey(
-    deriveViewingSecretKey(noteA.spendingKey)
-  );
-  const recipientNote = await deps.buildNote({
+  const { note: recipientNote, outgoingIndex } = await deps.buildNote({
     value: transferAmount,
     assetId: noteA.assetId,
     ownerPk: recipientPk,
@@ -7133,13 +7391,17 @@ async function transferNotes(deps, params, onProgress) {
     // With a viewing key present this activates stealth derivation.
     recipientOwnerPk: recipientPk
   });
-  const changeNote = await deps.buildNote({
+  const changeSourcePk = outgoingIndex !== void 0 && recipientViewingPublicKey !== void 0 && deps.outgoingViewingKey !== void 0 ? bytesToBigintLE(
+    sealRecipientBookEntry(
+      recipientViewingPublicKey,
+      deps.outgoingViewingKey,
+      recipientNote.commitmentHex
+    )
+  ) : recipientNote.ownerPk;
+  const { note: changeNote } = await deps.buildNote({
     value: changeValue,
     assetId: noteA.assetId,
-    ownerPk: effectiveSenderPk,
-    spendingKey: noteA.spendingKey,
-    sourcePk: recipientNote.ownerPk,
-    viewingPublicKey: senderViewingPublicKey
+    sourcePk: changeSourcePk
   });
   onProgress?.("generating-zk");
   const noteToInput = (note, proof) => ({
@@ -7256,7 +7518,7 @@ async function unshieldNote(deps, params, onProgress) {
   if (changeValue > 0n) {
     const { ownerPk, spendingKey } = deps.stealthKeys;
     changeBlinding = randomBlinding();
-    changeNote = await deps.buildNote({
+    changeNote = (await deps.buildNote({
       value: changeValue,
       assetId: note.assetId,
       ownerPk,
@@ -7264,7 +7526,7 @@ async function unshieldNote(deps, params, onProgress) {
       spendingKey,
       // Activates stealth: the commitment covers a one-time ownerPk.
       recipientOwnerPk: ownerPk
-    });
+    })).note;
   }
   const { provider, version: circuitVersion } = await deps.resolver.resolve(
     import_proof_generator7.CircuitType.Unshield,
@@ -7550,8 +7812,9 @@ var KEY_PREFIX = "orbinum_sk_";
 function isEnvelope(value) {
   return typeof value === "object" && value !== null && value.v === 1 && typeof value.iv === "string" && typeof value.ct === "string";
 }
-function sessionCacheKey(address, chainId) {
-  return `${KEY_PREFIX}${chainId}_${canonicalAccountId(address)}`;
+function sessionCacheKey(address, chainId, version = "v3") {
+  const marker = `${version}_`;
+  return `${KEY_PREFIX}${marker}${chainId}_${canonicalAccountId(address)}`;
 }
 async function hasCachedSession(store, address, chainId) {
   return await store.get(sessionCacheKey(address, chainId)) !== null;
@@ -7622,9 +7885,55 @@ function createDeviceKeyProvider(store) {
 
 // src/wallet/identity/vaultName.ts
 var PREFIX2 = "orbinum-vault";
-function vaultStorageName(address, chainFingerprint) {
+var versionMarker = (version) => `${version}-`;
+var VERSION_MARKERS = ["v3-"];
+function assertNoVersionMarker(component, label) {
+  for (const marker of VERSION_MARKERS) {
+    if (component.startsWith(marker)) {
+      throw new Error(
+        `vaultStorageName: ${label} must not start with "${marker}" \u2014 it would collide with another identity version`
+      );
+    }
+  }
+}
+function vaultStorageName(address, chainFingerprint, version = "v3") {
   const account = canonicalAccountId(address);
-  return chainFingerprint ? `${PREFIX2}-${chainFingerprint.toLowerCase()}-${account}` : `${PREFIX2}-${account}`;
+  assertNoVersionMarker(account, "account");
+  const marker = versionMarker(version);
+  if (chainFingerprint) assertNoVersionMarker(chainFingerprint.toLowerCase(), "chainFingerprint");
+  return chainFingerprint ? `${PREFIX2}-${marker}${chainFingerprint.toLowerCase()}-${account}` : `${PREFIX2}-${marker}${account}`;
+}
+
+// src/wallet/identity/walletIdentity.ts
+function deriveIdentity(rootSecret, version) {
+  if (rootSecret.length !== 32) {
+    throw new Error(`deriveIdentity: rootSecret must be 32 bytes, got ${rootSecret.length}`);
+  }
+  if (rootSecret.every((b) => b === 0)) {
+    throw new Error("deriveIdentity: rootSecret is all zeros \u2014 every wallet would share it");
+  }
+  if (version !== "v3") {
+    throw new Error(`deriveIdentity: unknown identity version ${String(version)}`);
+  }
+  const spendingKey = deriveSpendingKeyV3(rootSecret);
+  const viewingSecretKey = deriveViewingSecretKeyV3(rootSecret);
+  return {
+    version,
+    spendingKey,
+    ownerPk: deriveOwnerPk(spendingKey),
+    viewingSecretKey,
+    viewingPublicKey: deriveViewingPublicKey(viewingSecretKey),
+    outgoingViewingKey: deriveOutgoingViewingKeyV3(rootSecret)
+  };
+}
+function exportViewingCredential(identity, options = {}) {
+  return {
+    version: identity.version,
+    ownerPk: identity.ownerPk,
+    viewingSecretKey: Uint8Array.from(identity.viewingSecretKey),
+    viewingPublicKey: Uint8Array.from(identity.viewingPublicKey),
+    ...options.includeOutgoing && identity.outgoingViewingKey ? { outgoingViewingKey: Uint8Array.from(identity.outgoingViewingKey) } : {}
+  };
 }
 
 // src/wallet/identity/injectedExtensions.ts
@@ -7648,23 +7957,21 @@ var cachedWindow = null;
 function clearKnownEphWindow() {
   cachedWindow = null;
 }
-function bytesKey(bytes) {
-  let out = "";
-  for (const b of bytes) out += b.toString(16).padStart(2, "0");
-  return out;
-}
 function getKnownEphWindow(keys) {
   const selfSize = keys.selfEphWindowSize ?? SELF_EPH_WINDOW;
   const pairSize = keys.pairwiseWindowSize ?? PAIRWISE_EPH_WINDOW;
+  const outSize = keys.outgoingEphWindowSize ?? OUTGOING_EPH_WINDOW;
   const counterparties = keys.pairwiseCounterparties ?? [];
-  if (!keys.selfEph && counterparties.length === 0) return null;
-  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:` + counterparties.map((c) => bytesKey(c)).join(",");
+  const canScanOutgoing = keys.outgoingEph === true && isUsableSecretKey(keys.outgoingViewingKey);
+  if (!keys.selfEph && !canScanOutgoing && counterparties.length === 0) return null;
+  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:${canScanOutgoing ? outSize : 0}:` + counterparties.map((c) => toHex(c)).join(",");
   if (cachedWindow?.cacheKey === cacheKey) return cachedWindow.window;
   try {
     const ivkPacked = deriveViewingPublicKey(keys.viewingKey);
     const byEphPk = /* @__PURE__ */ new Map();
+    const outgoingByEphPk = /* @__PURE__ */ new Map();
     if (keys.selfEph) {
-      for (const e of selfEphWindow(keys.spendingKey, ivkPacked, 0, selfSize)) {
+      for (const e of selfEphWindow(keys.viewingKey, ivkPacked, 0, selfSize)) {
         byEphPk.set(e.ephPkHex.toLowerCase(), {
           sharedSecret: e.sharedSecret,
           index: e.index,
@@ -7685,7 +7992,12 @@ function getKnownEphWindow(keys) {
         }
       }
     }
-    cachedWindow = { cacheKey, window: { byEphPk } };
+    if (canScanOutgoing) {
+      for (const e of outgoingEphWindow(keys.outgoingViewingKey, 0, outSize)) {
+        outgoingByEphPk.set(e.ephPkHex.toLowerCase(), e.index);
+      }
+    }
+    cachedWindow = { cacheKey, window: { byEphPk, outgoingByEphPk } };
     return cachedWindow.window;
   } catch {
     return null;
@@ -7694,21 +8006,32 @@ function getKnownEphWindow(keys) {
 
 // src/wallet/worker/kernel/decryptBatch.ts
 function hintEphPkHex(hint) {
-  if (hint.ephPkHex) return hint.ephPkHex.toLowerCase();
   const memo = hint.encryptedMemo;
   if (!memo || memo.length < 66) return null;
   return ("0x" + memo.slice(-64)).toLowerCase();
 }
+function sealedBookEntry(note) {
+  if (note.sourcePk === void 0 || note.sourcePk === 0n) return null;
+  return note.sourcePk;
+}
 function decryptHintBatch(hints, keys) {
   const activation = keys.viewTagActivationLeaf ?? null;
   const knownWindow = getKnownEphWindow(keys);
+  const sentNotes = [];
+  const learnedRecipients = /* @__PURE__ */ new Set();
   let tagFiltered = 0;
   let selfMatched = 0;
   let pairwiseMatched = 0;
   let maxSelfEphIndex = null;
+  let maxOutgoingEphIndex = null;
+  const sealedEntries = [];
+  const pendingSent = [];
+  const seenSent = /* @__PURE__ */ new Set();
+  const unmatchedSent = [];
   const notes = hints.map((hint) => {
     try {
-      const known = knownWindow?.byEphPk.get(hintEphPkHex(hint) ?? "");
+      const ephPkHex = hintEphPkHex(hint) ?? "";
+      const known = knownWindow?.byEphPk.get(ephPkHex);
       if (known) {
         const result2 = tryDecryptNoteVerbose(
           hint,
@@ -7723,12 +8046,26 @@ function decryptHintBatch(hints, keys) {
             if (maxSelfEphIndex === null || known.index > maxSelfEphIndex) {
               maxSelfEphIndex = known.index;
             }
+            const sealed = sealedBookEntry(result2.note);
+            if (sealed !== null) sealedEntries.push(sealed);
           } else {
             pairwiseMatched++;
           }
           return result2.note;
         }
       }
+      const outgoingIndex = knownWindow?.outgoingByEphPk.get(ephPkHex);
+      if (outgoingIndex !== void 0) {
+        if (maxOutgoingEphIndex === null || outgoingIndex > maxOutgoingEphIndex) {
+          maxOutgoingEphIndex = outgoingIndex;
+        }
+        const key = hint.commitmentHex.toLowerCase();
+        if (!seenSent.has(key)) {
+          seenSent.add(key);
+          pendingSent.push({ hint, ephIndex: outgoingIndex });
+        }
+        return null;
+      }
       const viewTag = activation !== null && hint.leafIndex >= activation;
       const result = tryDecryptNoteVerbose(
         hint,
@@ -7743,7 +8080,44 @@ function decryptHintBatch(hints, keys) {
       return null;
     }
   });
-  return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+  const carried = keys.recipientCandidates ?? [];
+  for (const { hint, ephIndex } of pendingSent) {
+    const candidates = [
+      ...sealedEntries.map(
+        (e) => openRecipientBookEntry(e, keys.outgoingViewingKey, hint.commitmentHex)
+      ),
+      ...carried
+    ];
+    const sent = recoverSentNote({
+      hint,
+      outgoingViewingKey: keys.outgoingViewingKey,
+      ephIndex,
+      recipientCandidates: candidates
+    });
+    if (!sent) {
+      unmatchedSent.push({ hint, ephIndex });
+      continue;
+    }
+    const { recipientIvk, ...facts } = sent;
+    learnedRecipients.add(toHex(recipientIvk));
+    sentNotes.push({
+      ...facts,
+      counterpartyIvkHex: toHex(recipientIvk),
+      encryptedMemo: hint.encryptedMemo ?? ""
+    });
+  }
+  return {
+    notes,
+    tagFiltered,
+    selfMatched,
+    pairwiseMatched,
+    maxSelfEphIndex,
+    maxOutgoingEphIndex,
+    sentNotes,
+    learnedRecipients: [...learnedRecipients],
+    unmatchedSent,
+    sealedBookEntries: sealedEntries.map((e) => e.toString())
+  };
 }
 
 // src/wallet/worker/pool/types.ts
@@ -7765,21 +8139,52 @@ function createMainThreadPool() {
       let selfMatched = 0;
       let pairwiseMatched = 0;
       let maxSelfEphIndex = null;
+      let maxOutgoingEphIndex = null;
+      const sentNotes = [];
+      const unmatchedSent = [];
+      const sealedBookEntries = /* @__PURE__ */ new Set();
+      const learnedRecipients = new Set(
+        (keys.recipientCandidates ?? []).map((c) => toHex(c))
+      );
       for (let i = 0; i < hints.length; i += DECRYPT_YIELD_EVERY) {
         if (i > 0) {
           await yieldToBrowser();
           if (signal?.aborted) throw scanAbortError();
         }
-        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), keys);
+        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), {
+          ...keys,
+          recipientCandidates: [...learnedRecipients].map((h) => fromHex(h))
+        });
         notes.push(...burst.notes);
         tagFiltered += burst.tagFiltered;
         selfMatched += burst.selfMatched;
         pairwiseMatched += burst.pairwiseMatched;
+        sentNotes.push(...burst.sentNotes ?? []);
+        unmatchedSent.push(...burst.unmatchedSent ?? []);
+        for (const e of burst.sealedBookEntries ?? []) sealedBookEntries.add(e);
+        for (const r of burst.learnedRecipients ?? []) learnedRecipients.add(r);
         if (burst.maxSelfEphIndex !== null) {
           maxSelfEphIndex = Math.max(maxSelfEphIndex ?? -1, burst.maxSelfEphIndex);
         }
+        if (burst.maxOutgoingEphIndex != null) {
+          maxOutgoingEphIndex = Math.max(
+            maxOutgoingEphIndex ?? -1,
+            burst.maxOutgoingEphIndex
+          );
+        }
       }
-      return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+      return {
+        notes,
+        tagFiltered,
+        selfMatched,
+        pairwiseMatched,
+        maxSelfEphIndex,
+        maxOutgoingEphIndex,
+        sentNotes,
+        learnedRecipients: [...learnedRecipients],
+        unmatchedSent,
+        sealedBookEntries: [...sealedBookEntries]
+      };
     },
     terminate() {
       clearKnownEphWindow();
@@ -7811,7 +8216,12 @@ function runOnWorker(worker, payload, signal) {
         tagFiltered: data.tagFiltered ?? 0,
         selfMatched: data.selfMatched ?? 0,
         pairwiseMatched: data.pairwiseMatched ?? 0,
-        maxSelfEphIndex: data.maxSelfEphIndex ?? null
+        maxSelfEphIndex: data.maxSelfEphIndex ?? null,
+        maxOutgoingEphIndex: data.maxOutgoingEphIndex ?? null,
+        sentNotes: data.sentNotes ?? [],
+        learnedRecipients: data.learnedRecipients ?? [],
+        unmatchedSent: data.unmatchedSent ?? [],
+        sealedBookEntries: data.sealedBookEntries ?? []
       });
     };
     worker.onerror = () => {
@@ -7838,9 +8248,19 @@ function mergeResults(results) {
     tagFiltered: results.reduce((sum, r) => sum + r.tagFiltered, 0),
     selfMatched: results.reduce((sum, r) => sum + r.selfMatched, 0),
     pairwiseMatched: results.reduce((sum, r) => sum + r.pairwiseMatched, 0),
+    sentNotes: results.flatMap((r) => r.sentNotes ?? []),
+    // Deduped: slices run in parallel, so the same change note cannot be
+    // seen twice, but two different ones may name the same recipient.
+    learnedRecipients: [...new Set(results.flatMap((r) => r.learnedRecipients ?? []))],
+    unmatchedSent: results.flatMap((r) => r.unmatchedSent ?? []),
+    sealedBookEntries: [...new Set(results.flatMap((r) => r.sealedBookEntries ?? []))],
     maxSelfEphIndex: results.reduce(
       (max, r) => r.maxSelfEphIndex === null ? max : Math.max(max ?? -1, r.maxSelfEphIndex),
       null
+    ),
+    maxOutgoingEphIndex: results.reduce(
+      (max, r) => r.maxOutgoingEphIndex == null ? max : Math.max(max ?? -1, r.maxOutgoingEphIndex),
+      null
     )
   };
 }
@@ -7904,25 +8324,36 @@ var OrbinumWallet = class {
   session;
   notes;
   vaultStore;
-  /** Set at unlock; every key below is derived from it. */
-  spendingKey = null;
+  /**
+   * The identity this wallet is unlocked as, or null.
+   *
+   * Held as a bundle rather than a single scalar because v3 keys are SIBLINGS:
+   * the spending key no longer produces the viewing key, so there is nothing
+   * left to derive the others from once unlock returns. Keeping the root out
+   * of this object is deliberate — the branches are what the wallet needs, and
+   * the root is the thing worth not retaining.
+   */
+  identity = null;
   /** The underlying store, for operations the facade does not cover. */
   get vault() {
     return this.vaultStore;
   }
   get unlocked() {
-    return this.session.unlocked && this.spendingKey !== null;
+    return this.session.unlocked && this.identity !== null;
   }
   /**
    * Opens the wallet from the master key bytes a `SpendingKeyRequest`
    * signature produces — the same value `PrivacyKeyManager.getMasterBytes()`
    * returns.
    *
-   * Master bytes rather than the spending-key scalar, deliberately: the scalar
-   * is the master reduced modulo the curve order, so deriving the vault key
-   * from it would tie the encrypted vault to the CURRENT modulus. The master
-   * is pre-reduction, which keeps a stored vault readable across a modulus
-   * change. Everything else — viewing keys, ownerPk — comes from the scalar.
+   * Master bytes rather than the spending-key scalar, deliberately: the master
+   * is the root EVERY branch hangs off — spending key, viewing key, outgoing
+   * viewing key and vault key are each their own HKDF of it, none derived
+   * from another. Only `ownerPk` comes from the spending scalar, because the
+   * circuit defines it that way.
+   *
+   * It is also what keeps a stored vault readable across a modulus change:
+   * the vault key is derived pre-reduction.
    *
    * Reports whether the stored vault was RESET: a different chain, a different
    * key, or notes the chain no longer recognises. When it was, the wallet
@@ -7936,14 +8367,12 @@ var OrbinumWallet = class {
    * against a vault that was never read.
    */
   async unlock(masterBytes, options = {}) {
-    if (masterBytes.length !== 32) {
-      throw new Error(`Master key must be 32 bytes, got ${masterBytes.length}.`);
-    }
+    assertSecretKeyBytes(masterBytes, "Master key");
     this.session.open(
       await deriveVaultKey(masterBytes),
       await deriveVaultBlindKey(masterBytes)
     );
-    this.spendingKey = deriveSpendingKeyFromMaster(masterBytes);
+    this.identity = deriveIdentity(masterBytes, this.config.identityVersion ?? "v3");
     try {
       return await this.vaultStore.unlock(this.session.cryptoKey, options);
     } catch (err) {
@@ -7954,8 +8383,12 @@ var OrbinumWallet = class {
   /** Drops the in-memory keys. The stored vault is untouched. */
   lock() {
     this.session.lock();
-    this.spendingKey = null;
+    this.identity = null;
     this.notes.set([]);
+    try {
+      this.config.pool.terminate();
+    } catch {
+    }
   }
   /** The notes currently held. Empty while locked. */
   getNotes() {
@@ -7967,11 +8400,8 @@ var OrbinumWallet = class {
   }
   /** This wallet's privacy identity: the keys a payer needs to address it. */
   privacyKeys() {
-    const spendingKey = this.requireKey();
-    return {
-      ownerPk: deriveOwnerPk(spendingKey),
-      viewingPublicKey: deriveViewingPublicKey(deriveViewingSecretKey(spendingKey))
-    };
+    const { ownerPk, viewingPublicKey } = this.requireIdentity();
+    return { ownerPk, viewingPublicKey };
   }
   /**
    * Walks the feed, recovers this wallet's notes, and persists them with their
@@ -7981,15 +8411,21 @@ var OrbinumWallet = class {
    * `sinceLeafIndex` for a full scan, which is what a restore needs.
    */
   async scan(options = {}) {
-    const spendingKey = this.requireKey();
-    const viewingKey = deriveViewingSecretKey(spendingKey);
+    const identity = this.requireIdentity();
     return runScan({
       vault: this.vaultStore,
       storage: this.config.storage,
       hints: this.config.hints,
       nullifiers: this.config.nullifiers,
       pool: this.config.pool,
-      keys: { viewingKey, spendingKey, ownerPk: deriveOwnerPk(spendingKey) },
+      keys: {
+        viewingKey: identity.viewingSecretKey,
+        spendingKey: identity.spendingKey,
+        ownerPk: identity.ownerPk,
+        // Absent on a watch-only identity: the scan then finds every
+        // note the wallet owns and reconstructs no payment history.
+        ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
+      },
       sinceLeafIndex: options.sinceLeafIndex,
       viewTagActivationLeaf: this.config.viewTagActivationLeaf,
       onProgress: options.onProgress,
@@ -8011,13 +8447,14 @@ var OrbinumWallet = class {
    * reusing an index would republish an ephPk and link the two notes.
    */
   async buildNote(params) {
-    const spendingKey = this.requireKey();
+    const identity = this.requireIdentity();
     return buildZkNote(params, {
       keys: {
-        ownerPk: deriveOwnerPk(spendingKey),
-        spendingKey,
-        viewingPublicKey: deriveViewingPublicKey(deriveViewingSecretKey(spendingKey)),
-        viewingSecretKey: deriveViewingSecretKey(spendingKey)
+        ownerPk: identity.ownerPk,
+        spendingKey: identity.spendingKey,
+        viewingPublicKey: identity.viewingPublicKey,
+        viewingSecretKey: identity.viewingSecretKey,
+        ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
       },
       storage: this.config.storage
     });
@@ -8034,11 +8471,12 @@ var OrbinumWallet = class {
    * Treat the result as secret: it can spend every note this wallet holds.
    */
   spendKeys() {
-    const spendingKey = this.requireKey();
+    const identity = this.requireIdentity();
     return {
-      spendingKey,
-      viewingSecretKey: deriveViewingSecretKey(spendingKey),
-      ownerPk: deriveOwnerPk(spendingKey)
+      spendingKey: identity.spendingKey,
+      viewingSecretKey: identity.viewingSecretKey,
+      ownerPk: identity.ownerPk,
+      ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
     };
   }
   /**
@@ -8060,7 +8498,20 @@ var OrbinumWallet = class {
    * verifying-key rotation, and the failure surfaces much later.
    */
   buildOutputNote = async (params) => {
-    return this.buildNote({ ...params, circuitVersion: await this.circuitVersion() });
+    const identity = this.requireIdentity();
+    return buildZkNoteWithIndex(
+      { ...params, circuitVersion: await this.circuitVersion() },
+      {
+        keys: {
+          ownerPk: identity.ownerPk,
+          spendingKey: identity.spendingKey,
+          viewingPublicKey: identity.viewingPublicKey,
+          viewingSecretKey: identity.viewingSecretKey,
+          ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
+        },
+        storage: this.config.storage
+      }
+    );
   };
   /** The circuit version a new note should carry. */
   async circuitVersion() {
@@ -8072,11 +8523,11 @@ var OrbinumWallet = class {
     }
     return chainActiveCircuitVersion(this.config.zkVerifier);
   }
-  requireKey() {
-    if (this.spendingKey === null) {
+  requireIdentity() {
+    if (this.identity === null) {
       throw new Error("Wallet is locked. Call unlock() before using it.");
     }
-    return this.spendingKey;
+    return this.identity;
   }
 };
 // Annotate the CommonJS export names for ESM import in node:
@@ -8108,9 +8559,8 @@ var OrbinumWallet = class {
   NATIVE_ASSET_ID,
   NOTE_BACKUP_VERSION,
   NOTE_BIGINT_FIELDS,
-  NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder,
-  OVK_BLOB_SIZE,
+  OUTGOING_EPH_WINDOW,
   OrbinumClient,
   OrbinumClientProvider,
   OrbinumWallet,
@@ -8120,7 +8570,6 @@ var OrbinumWallet = class {
   PRECOMPILE_ADDR,
   PrivacyKeyManager,
   PrivacyModule,
-  QR_PAGE_MAX_CHARS,
   RECOVERED_TX_RESULT,
   RelayerStatusModule,
   RpcV2Module,
@@ -8145,7 +8594,7 @@ var OrbinumWallet = class {
   addressToFieldElement,
   applyBatch,
   applyNoteStatus,
-  assembleNoteTransfer,
+  assertSecretKeyBytes,
   base58,
   base64UrlDecode,
   base64UrlEncode,
@@ -8158,6 +8607,7 @@ var OrbinumWallet = class {
   buildShieldBatchOperations,
   buildShieldParams,
   buildZkNote,
+  buildZkNoteWithIndex,
   bytesToBigintLE,
   bytesToBjjScalar,
   cacheSession,
@@ -8187,15 +8637,17 @@ var OrbinumWallet = class {
   createWorkerPool,
   decodeNoteBackup,
   decodeNoteDisclosureKey,
-  decodeNoteTransferPage,
   decodePaymentSlip,
   decodePrecompileCalldata,
   decryptHintBatch,
   decryptJson,
   decryptNoteRecord,
+  deriveIdentity,
   deriveMasterKeyBytes,
-  deriveOutgoingCipherKey,
-  deriveOutgoingViewingKey,
+  deriveOutgoingEphPk,
+  deriveOutgoingEphSk,
+  deriveOutgoingSharedSecret,
+  deriveOutgoingViewingKeyV3,
   deriveOwnerPk,
   derivePairwiseEphSk,
   derivePairwiseSharedSecret,
@@ -8204,6 +8656,7 @@ var OrbinumWallet = class {
   deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessageV2,
   deriveSpendingKeyTypedData,
+  deriveSpendingKeyV3,
   deriveStealthOwnerPk,
   deriveStealthSk,
   deriveVaultBlindKey,
@@ -8211,9 +8664,9 @@ var OrbinumWallet = class {
   deriveViewTag,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
+  deriveViewingSecretKeyV3,
   detectCommitmentMismatch,
   encodeNoteBackup,
-  encodeNoteTransferPages,
   encodePaymentSlip,
   encryptJson,
   encryptNote,
@@ -8223,6 +8676,7 @@ var OrbinumWallet = class {
   evmToImplicitSubstrate,
   evmToMappedAccountHex,
   evmToSubstrate,
+  exportViewingCredential,
   extractPalletError,
   failed,
   fastMulBase,
@@ -8263,9 +8717,9 @@ var OrbinumWallet = class {
   isNativeAsset,
   isNoteSelfConsistent,
   isSpendable,
-  isSs58,
   isSubstrateAddress,
   isUnifiedAddress,
+  isUsableSecretKey,
   isValidLeafIndex,
   leHexToBigint,
   mapExtrinsicArgs,
@@ -8282,10 +8736,10 @@ var OrbinumWallet = class {
   noteMatchesCommitment,
   noteOrigin,
   noteSpentTxHash,
-  noteToTransferEntry,
   noteTxKind,
-  openOutgoingBlob,
   openPaymentSlip,
+  openRecipientBookEntry,
+  outgoingEphWindow,
   outranks,
   pairwiseEphWindow,
   palletErrorKind,
@@ -8296,15 +8750,18 @@ var OrbinumWallet = class {
   planTransfer,
   planUnshield,
   randomBlinding,
-  randomOutgoingBlob,
+  reconstructOutgoingIndex,
   reconstructOutgoingTxRecords,
   recoverOwnerPkPoint,
   recoverSelfStealthNote,
+  recoverSentFromSharedSecret,
+  recoverSentNote,
   refuseIfAlreadySpent,
   regeneratePaymentSlip,
+  registerPairwiseCounterparty,
   removeByCommitment,
   requireSessionKeys,
-  reservePairwiseIndex,
+  reserveOutgoingIndex,
   reserveSelfEphIndex,
   resolveSelfEphCeiling,
   resolveSpentSet,
@@ -8313,8 +8770,8 @@ var OrbinumWallet = class {
   runScan,
   scalarToHex,
   scanAbortError,
-  sealOutgoingBlob,
   sealPaymentSlip,
+  sealRecipientBookEntry,
   selectDescribingNote,
   selectDescribingNoteByCommitment,
   selectGhosts,
@@ -8340,10 +8797,10 @@ var OrbinumWallet = class {
   truncateMiddle,
   tryDecryptNote,
   tryDecryptNoteVerbose,
-  tryRecoverOutgoing,
   txLandedAfterError,
   u128,
   u64,
+  unpackUsableViewingKey,
   unshieldNote,
   upsertNote,
   vaultReplacer,