@orbinum/sdk 2.1.0 → 3.0.0

package/dist/index.mjs

@@ -15,10 +15,11 @@ import {
   LEAVES_PER_TREE,
   MAX_WORKERS,
   NoteBuilder,
-  OVK_BLOB_SIZE,
+  OUTGOING_EPH_WINDOW,
   PAIRWISE_EPH_WINDOW,
   SELF_EPH_WINDOW,
   WORKER_CRASHED,
+  assertSecretKeyBytes,
   base64UrlDecode,
   base64UrlEncode,
   bigintTo32Be,
@@ -40,18 +41,22 @@ import {
   createWorkerPool,
   decodeNoteDisclosureKey,
   decryptHintBatch,
-  deriveOutgoingCipherKey,
-  deriveOutgoingViewingKey,
+  deriveOutgoingEphPk,
+  deriveOutgoingEphSk,
+  deriveOutgoingSharedSecret,
+  deriveOutgoingViewingKeyV3,
   deriveOwnerPk,
   derivePairwiseEphSk,
   derivePairwiseSharedSecret,
   deriveSelfEphSk,
   deriveSpendingKeyFromMaster,
+  deriveSpendingKeyV3,
   deriveStealthOwnerPk,
   deriveStealthSk,
   deriveViewTag,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
+  deriveViewingSecretKeyV3,
   ensureHexPrefix,
   fastMulBase,
   fastMulPoint,
@@ -62,15 +67,20 @@ import {
   isAbortError,
   isHexOfLength,
   isSpendable,
+  isUsableSecretKey,
   isValidLeafIndex,
   leHexToBigint,
-  openOutgoingBlob,
+  openRecipientBookEntry,
+  outgoingEphWindow,
   pairwiseEphWindow,
-  randomOutgoingBlob,
+  randomBlinding,
+  reconstructOutgoingIndex,
   recoverOwnerPkPoint,
+  recoverSentFromSharedSecret,
+  recoverSentNote,
   scalarToHex,
   scanAbortError,
-  sealOutgoingBlob,
+  sealRecipientBookEntry,
   selectNotes,
   selfEphWindow,
   serializeMemo,
@@ -78,8 +88,8 @@ import {
   treeIdOf,
   tryDecryptNote,
   tryDecryptNoteVerbose,
-  tryRecoverOutgoing
-} from "./chunk-VYKKBXOE.mjs";
+  unpackUsableViewingKey
+} from "./chunk-54HFH63J.mjs";
 
 // src/foundation/encoding/base64.ts
 var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
@@ -119,14 +129,6 @@ function fromBase64(b64) {
   return new Uint8Array(bytes);
 }
 
-// src/foundation/crypto/blinding.ts
-function randomBlinding() {
-  const buf = new Uint8Array(32);
-  crypto.getRandomValues(buf);
-  const reduced = bytesToBigintLE(buf) % BN254_R;
-  return reduced === 0n ? 1n : reduced;
-}
-
 // src/foundation/text/format.ts
 var LOCALE_DECIMAL_SEP = new Intl.NumberFormat(void 0).formatToParts(1.1).find((p) => p.type === "decimal")?.value ?? ".";
 function formatIntegerLocale(intPart) {
@@ -234,9 +236,6 @@ function parseEvmAddress(addr) {
   const withPrefix = addr.startsWith("0x") ? addr : `0x${addr}`;
   return isEvmAddress(withPrefix) ? withPrefix.toLowerCase() : null;
 }
-function isSs58(addr) {
-  return !addr.startsWith("0x") && addr.length >= 46 && addr.length <= 50;
-}
 function isEvmAddress(addr) {
   return /^0x[0-9a-fA-F]{40}$/.test(addr);
 }
@@ -366,11 +365,10 @@ function addressToAccountIdHex(addr) {
 function addressToFieldElement(address) {
   const accountIdHex = addressToAccountIdHex(address);
   if (!accountIdHex) throw new Error(`Cannot resolve address to AccountId32: ${address}`);
-  const hex = accountIdHex.slice(2);
-  const bytes = new Uint8Array(32);
-  for (let i = 0; i < 32; i++) {
-    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  if (!isHexOfLength(accountIdHex, 32)) {
+    throw new Error(`AccountId32 must be 32 bytes of hex: ${accountIdHex}`);
   }
+  const bytes = fromHex(accountIdHex);
   return bytesToBigintLE(bytes) % BN254_R;
 }
 
@@ -379,7 +377,7 @@ import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
 import { randomBytes } from "@noble/ciphers/utils.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
 import { sha256 } from "@noble/hashes/sha2.js";
-import { packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+import { packPoint } from "@zk-kit/baby-jubjub";
 var SLIP_DOMAIN = new TextEncoder().encode("orbinum-payment-slip-v1");
 var NONCE_PREFIX = new TextEncoder().encode("SLP1");
 var EPH_PK_SIZE = 32;
@@ -400,7 +398,7 @@ function sealPaymentSlip(recipientIvkPacked, fields) {
       `PaymentSlip: recipientIvk must be 32 bytes, got ${recipientIvkPacked.length}`
     );
   }
-  const ivkPoint = unpackPoint(bytesToBigintLE(recipientIvkPacked));
+  const ivkPoint = unpackUsableViewingKey(bytesToBigintLE(recipientIvkPacked));
   if (!ivkPoint) throw new Error("PaymentSlip: invalid recipient viewing public key");
   const ephSkScalar = bytesToBjjScalar(randomBytes(32));
   const ephPkPacked = bigintTo32Le(packPoint(fastMulBase(ephSkScalar)));
@@ -422,7 +420,7 @@ function openPaymentSlip(recipientIvsk, envelope) {
   if (envelope.length > MAX_SLIP_ENVELOPE_SIZE) return null;
   try {
     const ephPkPacked = envelope.subarray(0, EPH_PK_SIZE);
-    const ephPkPoint = unpackPoint(bytesToBigintLE(ephPkPacked));
+    const ephPkPoint = unpackUsableViewingKey(bytesToBigintLE(ephPkPacked));
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(recipientIvsk);
     const sharedSecret = bigintTo32Le(fastMulPoint(ephPkPoint, ivskScalar)[0]);
@@ -466,14 +464,7 @@ function decodePaymentSlip(text) {
   const checksum = rest.slice(sep + 1);
   if (slipChecksum(payload) !== checksum) return null;
   try {
-    const hex = base64UrlDecode(payload);
-    const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
-    if (clean.length % 2 !== 0) return null;
-    const bytes = new Uint8Array(clean.length / 2);
-    for (let i = 0; i < bytes.length; i++) {
-      bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
-    }
-    return bytes;
+    return fromHex(base64UrlDecode(payload));
   } catch {
     return null;
   }
@@ -578,8 +569,17 @@ ${canonicalAccountId(address)}`;
 
 // src/protocol/keys/PrivacyKeyManager.ts
 import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
-function privacyAddressChecksum(ownerPkHex, ivkHex) {
-  const body = `orbpriv2:${ownerPkHex}:${ivkHex}`;
+var SCHEME_BY_VERSION = { v2: "orbpriv2", v3: "orbpriv3" };
+function usableAddressFields(ownerPkHex, ivkHex) {
+  const ownerPk = ownerPkHex.toLowerCase();
+  const ivk = ivkHex.toLowerCase();
+  if (!isHexOfLength(ownerPk, 32) || !isHexOfLength(ivk, 32)) return null;
+  if (/^0x0+$/.test(ownerPk) || /^0x0+$/.test(ivk)) return null;
+  if (!unpackUsableViewingKey(bytesToBigintLE(fromHex(ivk)))) return null;
+  return { ownerPkHex: ownerPk, viewingPublicKeyHex: ivk };
+}
+function privacyAddressChecksum(scheme, ownerPkHex, ivkHex) {
+  const body = `${scheme}:${ownerPkHex}:${ivkHex}`;
   const digest = sha2562(new TextEncoder().encode(body));
   return toHex(digest.slice(0, 4)).slice(2);
 }
@@ -589,30 +589,29 @@ var PrivacyKeyManager = class {
     masterBytes: null,
     viewingSecretKey: null,
     viewingPublicKeyPacked: null,
-    ownerPk: null,
-    outgoingViewingKey: null
+    ownerPk: null
   };
   /**
    * Load a spending key and its corresponding master bytes into the in-memory session.
    * Derives viewingSecretKey, viewingPublicKeyPacked, and ownerPk immediately.
    * Replaces any previously loaded key.
    *
-   * @param spendingKey  Circuit scalar: BigInt(masterBytes) % BABYJUB_SUBORDER, clamped to [1, ∞).
-   * @param masterBytes  Raw 32-byte HKDF output before modular reduction. Used to derive
-   *                     the stable vault key (HKDF(masterBytes, info="orbinum-vault-key-v1")).
+   * @param _legacySpendingKey  IGNORED. Kept so v2-era callers still compile;
+   *                             the scalar is re-derived from `masterBytes`.
+   * @param masterBytes  Raw 32-byte HKDF output. The root every v3 branch and
+   *                     the stable vault key hang off.
    */
-  async load(spendingKey, masterBytes) {
-    const viewingSecretKey = deriveViewingSecretKey(spendingKey);
+  async load(_legacySpendingKey, masterBytes) {
+    const spendingKey = deriveSpendingKeyV3(masterBytes);
+    const viewingSecretKey = deriveViewingSecretKeyV3(masterBytes);
     const viewingPublicKeyPacked = deriveViewingPublicKey(viewingSecretKey);
     const ownerPk = deriveOwnerPk(spendingKey);
-    const outgoingViewingKey = deriveOutgoingViewingKey(masterBytes);
     this._state = {
       spendingKey,
       masterBytes,
       viewingSecretKey,
       viewingPublicKeyPacked,
-      ownerPk,
-      outgoingViewingKey
+      ownerPk
     };
   }
   /** Clear all key material from memory. Call on vault lock / sign-out. */
@@ -622,8 +621,7 @@ var PrivacyKeyManager = class {
       masterBytes: null,
       viewingSecretKey: null,
       viewingPublicKeyPacked: null,
-      ownerPk: null,
-      outgoingViewingKey: null
+      ownerPk: null
     };
   }
   /** Returns true if a spending key has been loaded. */
@@ -661,6 +659,24 @@ var PrivacyKeyManager = class {
     }
     return this._state.viewingPublicKeyPacked;
   }
+  /**
+   * The OUTGOING viewing key (ovk) — reads what this wallet SENT.
+   *
+   * Seeds the outgoing ephemeral sequence and opens the recipient book, so a
+   * holder can enumerate every payment the wallet made and name who received
+   * it. That makes it strictly more sensitive than the incoming viewing key,
+   * which yields amounts and no counterparties: hand it out only where the
+   * payment graph is meant to travel with it.
+   *
+   * A scan without it still finds every note the wallet OWNS and simply
+   * reconstructs no sent history — the watch-only case.
+   *
+   * SECURITY: never expose this in an address or a network request.
+   * Throws if not loaded.
+   */
+  getOutgoingViewingKey() {
+    return deriveOutgoingViewingKeyV3(this.getMasterBytes());
+  }
   /** Returns the BabyJubJub owner public key (x-coordinate). Throws if not loaded. */
   getOwnerPk() {
     if (this._state.ownerPk === null) {
@@ -668,16 +684,6 @@ var PrivacyKeyManager = class {
     }
     return this._state.ownerPk;
   }
-  /**
-   * Returns the 32-byte outgoing viewing key (ovk). Throws if not loaded.
-   * Used to seal/open the outgoing blob that lets the sender recover a transfer.
-   */
-  getOutgoingViewingKey() {
-    if (this._state.outgoingViewingKey === null) {
-      throw new Error("PrivacyKeyManager: no key loaded. Call load() first.");
-    }
-    return this._state.outgoingViewingKey;
-  }
   /** Returns the spending key as a 32-byte little-endian Uint8Array. Throws if not loaded. */
   getSpendingKeyBytes() {
     return bigintTo32Le(this.getSpendingKey());
@@ -706,7 +712,7 @@ var PrivacyKeyManager = class {
    * Exports a shareable privacy address encoding the owner public key and
    * viewing PUBLIC key of the currently loaded identity.
    *
-   * Format: `orbpriv2:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
+   * Format: `orbpriv3:{ownerPk_hex}:{viewingPublicKey_hex}:{checksum}`
    *
    * The recipient uses this address so the sender can:
    *  1. Embed `ownerPk` in the note commitment (Poseidon4 input).
@@ -721,44 +727,64 @@ var PrivacyKeyManager = class {
    *
    * Throws if no key is loaded.
    */
-  encodePrivacyAddress() {
+  encodePrivacyAddress(version = "v3") {
     const ownerPk = this.getOwnerPk();
     const ivkPacked = this.getViewingPublicKeyPacked();
     const ownerPkHex = scalarToHex(ownerPk);
     const ivkHex = toHex(ivkPacked);
-    const checksum = privacyAddressChecksum(ownerPkHex, ivkHex);
-    return `orbpriv2:${ownerPkHex}:${ivkHex}:${checksum}`;
+    const scheme = SCHEME_BY_VERSION[version];
+    const checksum = privacyAddressChecksum(scheme, ownerPkHex, ivkHex);
+    return `${scheme}:${ownerPkHex}:${ivkHex}:${checksum}`;
   }
   /**
    * Decode a privacy address into `{ ownerPkHex, viewingPublicKeyHex }`, or
    * `null` if it does not parse.
    *
-   * Accepts both:
-   *  - `orbpriv2:{ownerPk}:{ivk}:{checksum}` — checksum verified; a mismatch
-   *    (corrupted paste) returns null.
-   *  - `orbpriv1:{ownerPk}:{ivk}` — legacy, no checksum. Still read so addresses
-   *    shared before v2 keep resolving; only v2 is emitted.
+   * Reads every scheme ever emitted; only `orbpriv3` is written.
+   *
+   *  - `orbpriv3` / `orbpriv2` — checksum verified; a mismatch (corrupted
+   *    paste, or a relabelled prefix) returns null.
+   *  - `orbpriv1` — legacy, predates the checksum entirely. The FIELDS are
+   *    validated exactly as above, since this branch has no integrity check
+   *    of its own.
+   *
+   * Reading an old address is not the same as supporting an old identity. An
+   * address is an owner key and a viewing key; paying one works whatever
+   * scheme derived it, and whoever shares it may not have upgraded yet.
+   * Refusing them here would break incoming payments for no gain.
    */
   static decodePrivacyAddress(address) {
     const parts = address.split(":");
-    if (parts[0] === "orbpriv2") {
+    for (const version of ["v2", "v3"]) {
+      if (parts[0] !== SCHEME_BY_VERSION[version]) continue;
       if (parts.length !== 4) return null;
       const [, ownerPkHex, viewingPublicKeyHex, checksum] = parts;
       if (!ownerPkHex || !viewingPublicKeyHex || !checksum) return null;
-      if (privacyAddressChecksum(ownerPkHex, viewingPublicKeyHex) !== checksum) return null;
-      return { ownerPkHex, viewingPublicKeyHex };
+      if (privacyAddressChecksum(
+        SCHEME_BY_VERSION[version],
+        ownerPkHex,
+        viewingPublicKeyHex
+      ) !== checksum) {
+        return null;
+      }
+      const fields = usableAddressFields(ownerPkHex, viewingPublicKeyHex);
+      return fields ? { ...fields, scheme: SCHEME_BY_VERSION[version] } : null;
     }
     if (parts[0] === "orbpriv1") {
       if (parts.length !== 3) return null;
       const [, ownerPkHex, viewingPublicKeyHex] = parts;
       if (!ownerPkHex || !viewingPublicKeyHex) return null;
-      return { ownerPkHex, viewingPublicKeyHex };
+      const fields = usableAddressFields(ownerPkHex, viewingPublicKeyHex);
+      return fields ? { ...fields, scheme: "orbpriv1" } : null;
     }
     return null;
   }
   /**
    * Load keys from a cached "mk:0x{masterBytes_hex}" string produced by exportHex().
-   * Throws if the format is invalid or masterBytes length is not 32 bytes.
+   *
+   * Throws on a bad prefix, on non-hex content, and on a master that is not
+   * 32 usable bytes — an all-zero one included, since every wallet would
+   * derive the same identity from it.
    */
   async importFromHex(hex) {
     if (!hex.startsWith("mk:")) {
@@ -766,15 +792,9 @@ var PrivacyKeyManager = class {
         'PrivacyKeyManager: invalid cache format. Expected "mk:0x{masterBytes_hex}".'
       );
     }
-    const raw = hex.slice(3);
-    const h = raw.startsWith("0x") ? raw.slice(2) : raw;
-    const masterBytes = new Uint8Array((h.match(/.{2}/g) ?? []).map((b) => parseInt(b, 16)));
-    if (masterBytes.length !== 32) {
-      throw new Error("PrivacyKeyManager: invalid master bytes \u2014 expected 32 bytes.");
-    }
-    const masterBigint = BigInt("0x" + h);
-    const sk = masterBigint % BABYJUB_SUBORDER || 1n;
-    await this.load(sk, masterBytes);
+    const masterBytes = fromHex(hex.slice(3));
+    assertSecretKeyBytes(masterBytes, "PrivacyKeyManager: master");
+    await this.load(0n, masterBytes);
   }
 };
 
@@ -1095,6 +1115,25 @@ function wsUrlToHttp(wsUrl) {
 }
 
 // src/chain/substrate/SubstrateClient.ts
+var TIMESTAMP_PALLET = 1;
+function decodeCompact(bytes, offset) {
+  const first = bytes[offset];
+  if (first === void 0) return null;
+  const mode = first & 3;
+  if (mode === 0) return first >>> 2;
+  if (mode === 1) {
+    const b1 = bytes[offset + 1];
+    return b1 === void 0 ? null : (first >>> 2 | b1 << 6) >>> 0;
+  }
+  const width = mode === 2 ? 4 : (first >>> 2) + 5;
+  if (offset + width > bytes.length) return null;
+  let value = 0n;
+  const start = mode === 2 ? offset : offset + 1;
+  const end = mode === 2 ? offset + 4 : offset + width;
+  for (let i = end - 1; i >= start; i--) value = value << 8n | BigInt(bytes[i]);
+  if (mode === 2) value >>= 2n;
+  return value > BigInt(Number.MAX_SAFE_INTEGER) ? null : Number(value);
+}
 var SubstrateClient = class _SubstrateClient {
   constructor(_papi, _httpUrl, _owned) {
     this._papi = _papi;
@@ -1292,25 +1331,17 @@ var SubstrateClient = class _SubstrateClient {
         }
       }
       if (!timestampMs) {
-        const tsHex = extrinsics.find((hex) => {
+        const ts = extrinsics.reduce((found, hex) => {
+          if (found !== null) return found;
           try {
             const b = fromHex(hex);
-            return b.length > 6 && b[4] === 3 && b[5] === 0;
-          } catch {
-            return false;
-          }
-        });
-        if (tsHex) {
-          try {
-            const b = fromHex(tsHex);
-            const view = new DataView(b.buffer, b.byteOffset + 6, 8);
-            const lo = view.getUint32(0, true);
-            const hi = view.getUint32(4, true);
-            const ms = lo + hi * 4294967296;
-            if (ms > 0) timestampMs = ms;
+            if (b.length < 5 || b[2] !== TIMESTAMP_PALLET || b[3] !== 0) return null;
+            return decodeCompact(b, 4);
           } catch {
+            return null;
           }
-        }
+        }, null);
+        if (ts !== null && ts > 0) timestampMs = ts;
       }
       const author = _SubstrateClient.extractAuthorFromLogs(header.digest.logs, ss58Prefix);
       return { header, extrinsics, timestampMs, author };
@@ -1580,7 +1611,10 @@ var EvmClient = class {
   }
   /**
    * Performs multiple JSON-RPC calls in a single HTTP request (batch).
-   * Results are returned in the same order as `calls`, as a typed tuple.
+   *
+   * Results come back in the order of `calls`, as a typed tuple. A call the
+   * server answered with an error, or did not answer at all, lands as `null`
+   * in its own slot — never shifting the ones after it.
    */
   async batchRequest(calls) {
     const body = calls.map((c, i) => ({
@@ -1592,8 +1626,8 @@ var EvmClient = class {
     const res = await postJsonWithRetry(this.rpcUrl, JSON.stringify(body));
     if (!res.ok) throw new Error(`EVM HTTP ${res.status}: ${res.statusText}`);
     const arr = await res.json();
-    arr.sort((a, b) => (a.id ?? 0) - (b.id ?? 0));
-    return arr.map((r) => r.result ?? null);
+    const byId = new Map(arr.map((r) => [r.id, r]));
+    return calls.map((_, i) => byId.get(i + 1)?.result ?? null);
   }
   // ─── Convenience wrappers ─────────────────────────────────────────────────
   /** Returns the native token balance (in wei) for an EVM address. */
@@ -1639,7 +1673,10 @@ var EvmClient = class {
     if (from) txObj["from"] = from;
     return this.request("eth_call", [txObj, "latest"]);
   }
-  /** Estimates the gas required for a transaction. Returns the estimate in wei as a `bigint`. */
+  /**
+   * Estimates a transaction's gas, in GAS UNITS — not wei. Multiply by
+   * `getGasPrice()` for a cost.
+   */
   async estimateGas(params) {
     const hex = await this.request("eth_estimateGas", [params]);
     return hexToBigint(hex);
@@ -1890,7 +1927,7 @@ var EvmExplorer = class _EvmExplorer {
   // --- Address ---
   /**
    * Returns aggregated on-chain data for an EVM address: balance, nonce,
-   * bytecode (truncated), and up to 50 recent logs from the last 1 000 blocks.
+   * bytecode (truncated), and up to 50 logs it EMITTED in the last 1 001 blocks.
    */
   async getAddressInfo(address) {
     const latest = await this.evm.getBlockNumber().catch(() => 0);
@@ -1973,7 +2010,7 @@ var EvmExplorer = class _EvmExplorer {
     };
   }
   /**
-   * Returns ERC-20 `Transfer` events for `address` from the last 1 000 blocks.
+   * Returns ERC-20 `Transfer` events for `address` from the last 1 001 blocks.
    * When `holderAddress` is provided, restricts results to transfers sent or received by that address.
    */
   async getTokenTransfers(address, holderAddress) {
@@ -2346,7 +2383,13 @@ var PrivacyModule = class {
   async getMerkleRoot() {
     return this.substrate.request("privacy_getMerkleRoot", []);
   }
-  /** Returns the Merkle proof for the given leaf index or commitment hex. */
+  /**
+   * Returns the Merkle proof for a LEAF INDEX.
+   *
+   * The node declares this parameter `u32`, so a commitment hex is rejected
+   * by deserialisation before any lookup runs — `getMerkleProofByCommitment`
+   * is the one that takes a string.
+   */
   async getMerkleProof(leafIndex) {
     const raw = await this.substrate.request("privacy_getMerkleProof", [
       leafIndex
@@ -3296,9 +3339,13 @@ var OrbinumClientProvider = class _OrbinumClientProvider {
   // ─── Reconnection ───────────────────────────────────────────────────────
   /**
    * Schedules the next connection attempt using exponential backoff
-   * (capped at `reconnectMaxMs`) with full jitter, then transitions to
-   * `'reconnecting'`. Jitter (a random fraction of the delay) spreads out
-   * reconnects so many clients don't retry in lockstep after a shared outage.
+   * (capped at `reconnectMaxMs`) with EQUAL jitter, then transitions to
+   * `'reconnecting'`.
+   *
+   * The delay lands in `[capped/2, capped]` — half fixed, half random. That
+   * spreads a shared outage's reconnects over a `capped/2` window instead of
+   * having every client retry in lockstep, while keeping a floor so the first
+   * attempts do not all pile up near zero the way full jitter allows.
    */
   scheduleReconnect() {
     if (this._reconnectTimer) clearTimeout(this._reconnectTimer);
@@ -3690,6 +3737,16 @@ function mapZkEventData(method, data) {
       index: get(4, "leaf_index") || get(4, "index")
     };
   }
+  if (m === "nullifiersspent") {
+    return { nullifiers: get(0, "nullifiers") };
+  }
+  if (m === "commitmentsinserted") {
+    return {
+      commitments: get(0, "commitments"),
+      memos: get(1, "encrypted_memos") || get(1, "memos"),
+      indices: get(2, "leaf_indices") || get(2, "indices")
+    };
+  }
   if (m === "privatetransfer") {
     return {
       nullifiers: get(0, "nullifiers"),
@@ -3731,12 +3788,12 @@ function mapZkEventData(method, data) {
   if (m_norm === "log") {
     return { log: get(0, "log") };
   }
-  if (m_norm === "created" || m_norm === "createdfailed" || m_norm === "executed" || m_norm === "executedfailed") {
+  if (m_norm === "created" || m_norm === "createdfailed" || m_norm === "executedfailed") {
     return { address: get(0, "address") };
   }
   if (m_norm === "executed") {
     return {
-      from: get(0, "from"),
+      from: get(0, "from") ?? get(0, "address"),
       to: get(1, "to"),
       transaction_hash: get(2, "transaction_hash"),
       exit_reason: get(3, "exit_reason")
@@ -3883,10 +3940,10 @@ var ERROR_KINDS = {
   CommitmentAlreadyExists: "shape",
   UnknownMerkleRoot: "stale-proof",
   // Amounts and fees
-  AmountTooSmall: "amount",
   InvalidAmount: "amount",
   InsufficientPoolBalance: "amount",
   FeeTooLow: "amount",
+  InsufficientPendingFees: "amount",
   // Proofs
   InvalidProof: "proof",
   ProofVerificationFailed: "proof",
@@ -3895,12 +3952,14 @@ var ERROR_KINDS = {
   InvalidAssetId: "asset",
   AssetNotVerified: "asset",
   AssetIdMismatch: "asset",
+  AssetIdAlreadyExists: "asset",
   // Request shape
   InvalidMemoSize: "shape",
   MemoCommitmentMismatch: "shape",
   TooManyInputsOrOutputs: "shape",
   InvalidRecipient: "shape",
   EmptyBatch: "shape",
+  FeeRecipientUnavailable: "shape",
   // Capacity
   MerkleTreeFull: "capacity",
   // Balances pallet, reached through the same path
@@ -4259,6 +4318,7 @@ function buildConfig(existing, chainFingerprint) {
     updatedAt: now,
     ...chainFingerprint ? { chainFingerprint } : {},
     ...existing?.selfEphCounter !== void 0 ? { selfEphCounter: existing.selfEphCounter } : {},
+    ...existing?.outgoingEphCounter !== void 0 ? { outgoingEphCounter: existing.outgoingEphCounter } : {},
     ...existing?.pairwiseCounterparties !== void 0 ? { pairwiseCounterparties: existing.pairwiseCounterparties } : {}
   };
 }
@@ -4270,6 +4330,7 @@ async function writeConfig(storage, fallback, chainFingerprint) {
 }
 function mergeCounters(current, fallback) {
   const selfEphCounter = higher(current.selfEphCounter, fallback?.selfEphCounter);
+  const outgoingEphCounter = higher(current.outgoingEphCounter, fallback?.outgoingEphCounter);
   const parties = mergePairwise(current.pairwiseCounterparties, fallback?.pairwiseCounterparties);
   return {
     createdAt: current.createdAt ?? fallback?.createdAt,
@@ -4277,6 +4338,7 @@ function mergeCounters(current, fallback) {
     // is exactOptionalPropertyTypes, so an explicit undefined is a type
     // error AND would round-trip through structured clone as a present key.
     ...selfEphCounter !== void 0 ? { selfEphCounter } : {},
+    ...outgoingEphCounter !== void 0 ? { outgoingEphCounter } : {},
     ...parties !== void 0 ? { pairwiseCounterparties: parties } : {}
   };
 }
@@ -4314,6 +4376,7 @@ function mergePairwise(current, fallback) {
 
 // src/wallet/vault/storage/ephemeralIndex.ts
 var MAX_EPH_INDEX = 4294967294;
+var RESTORE_SAFETY_GAP = 8;
 function usableCounter(value) {
   if (typeof value !== "number" || !Number.isInteger(value)) return null;
   if (value < 0 || value > MAX_EPH_INDEX) return null;
@@ -4328,27 +4391,51 @@ async function reserveSelfEphIndex(storage) {
   if (!updated) throw new Error("vault not initialized");
   return (usableCounter(updated.selfEphCounter) ?? 1) - 1;
 }
-async function reservePairwiseIndex(storage, ivkHex) {
+async function reserveOutgoingIndex(storage, fromChain) {
+  const recovered = usableCounter(fromChain);
+  let exhausted = false;
+  const updated = await storage.updateConfig((config) => {
+    const raw = config.outgoingEphCounter;
+    if (typeof raw === "number" && Number.isSafeInteger(raw) && raw > MAX_EPH_INDEX) {
+      exhausted = true;
+      return config;
+    }
+    exhausted = false;
+    const stored = usableCounter(raw) ?? 0;
+    const floor = recovered !== null && recovered > stored ? Math.min(recovered + RESTORE_SAFETY_GAP, MAX_EPH_INDEX) : stored;
+    return {
+      ...config,
+      outgoingEphCounter: floor + 1,
+      updatedAt: Date.now()
+    };
+  });
+  if (!updated) throw new Error("vault not initialized");
+  if (exhausted || typeof updated.outgoingEphCounter === "number" && Number.isSafeInteger(updated.outgoingEphCounter) && updated.outgoingEphCounter > MAX_EPH_INDEX) {
+    throw new Error("outgoing ephemeral sequence exhausted");
+  }
+  const committed = usableCounter(updated.outgoingEphCounter);
+  if (committed === null || committed - 1 >= MAX_EPH_INDEX) {
+    throw new Error("outgoing ephemeral sequence exhausted");
+  }
+  return committed - 1;
+}
+async function registerPairwiseCounterparty(storage, ivkHex) {
   const key = ivkHex.toLowerCase();
   const updated = await storage.updateConfig((config) => {
-    const stored = usableCounter(config.pairwiseCounterparties?.[key]?.nextIndex);
-    const addedAt = config.pairwiseCounterparties?.[key]?.addedAt;
+    const existing = config.pairwiseCounterparties?.[key];
     return {
       ...config,
       pairwiseCounterparties: {
         ...config.pairwiseCounterparties,
         [key]: {
-          nextIndex: (stored ?? 0) + 1,
-          addedAt: typeof addedAt === "number" ? addedAt : Date.now()
+          nextIndex: usableCounter(existing?.nextIndex) ?? 0,
+          addedAt: typeof existing?.addedAt === "number" ? existing.addedAt : Date.now()
         }
       },
       updatedAt: Date.now()
     };
   });
   if (!updated) throw new Error("vault not initialized");
-  const nextIndex = usableCounter(updated.pairwiseCounterparties?.[key]?.nextIndex);
-  if (nextIndex === null || nextIndex <= 1) return null;
-  return nextIndex - 1;
 }
 
 // src/wallet/vault/notes/record.ts
@@ -4783,19 +4870,44 @@ async function processHints(ctx, hints, total) {
       }
     }
     outcome.scanned++;
-    if (!hint.encryptedMemo || !hint.ephPkHex) {
+    if (!hint.encryptedMemo) {
       outcome.noMemo++;
       continue;
     }
     toDecrypt.push(hint);
   }
-  const { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex } = await ctx.pool.decryptBatch(toDecrypt, ctx.keys, ctx.signal);
+  const {
+    notes,
+    tagFiltered,
+    selfMatched,
+    pairwiseMatched,
+    maxSelfEphIndex,
+    maxOutgoingEphIndex,
+    sentNotes,
+    learnedRecipients,
+    unmatchedSent,
+    sealedBookEntries
+  } = await ctx.pool.decryptBatch(
+    toDecrypt,
+    { ...ctx.keys, recipientCandidates: [...outcome.learnedRecipients].map(fromHex) },
+    ctx.signal
+  );
   outcome.tagFiltered += tagFiltered;
   outcome.selfDiscovered += selfMatched;
   outcome.pairwiseDiscovered += pairwiseMatched;
+  outcome.sentNotes.push(...sentNotes ?? []);
+  outcome.unmatchedSent.push(...unmatchedSent ?? []);
+  for (const e of sealedBookEntries ?? []) outcome.sealedBookEntries.add(e);
+  for (const r of learnedRecipients ?? []) outcome.learnedRecipients.add(r);
   if (maxSelfEphIndex !== null) {
     outcome.maxSelfEphIndex = Math.max(outcome.maxSelfEphIndex ?? -1, maxSelfEphIndex);
   }
+  if (maxOutgoingEphIndex != null) {
+    outcome.maxOutgoingEphIndex = Math.max(
+      outcome.maxOutgoingEphIndex ?? -1,
+      maxOutgoingEphIndex
+    );
+  }
   const pageEntries = [];
   for (const [i, decrypted] of notes.entries()) {
     const hint = toDecrypt[i];
@@ -4892,7 +5004,12 @@ async function collectScanEntries(params) {
     tagFiltered: 0,
     selfDiscovered: 0,
     pairwiseDiscovered: 0,
-    maxSelfEphIndex: null
+    sentNotes: [],
+    unmatchedSent: [],
+    sealedBookEntries: /* @__PURE__ */ new Set(),
+    learnedRecipients: new Set((params.keys.recipientCandidates ?? []).map((c) => toHex(c))),
+    maxSelfEphIndex: null,
+    maxOutgoingEphIndex: null
   };
   const ctx = {
     outcome,
@@ -5114,7 +5231,7 @@ function gapMargin(windowSize) {
   return Math.max(1, Math.floor(windowSize / 16));
 }
 function resolveSelfEphCeiling(params) {
-  const { notes, spendingKey, viewingKey, scanMaxIndex } = params;
+  const { notes, viewingKey, scanMaxIndex } = params;
   const windowSize = params.windowSize !== void 0 && params.windowSize > 0 ? params.windowSize : SELF_EPH_WINDOW;
   if (scanMaxIndex === null) return null;
   if (scanMaxIndex < windowSize - gapMargin(windowSize)) return scanMaxIndex;
@@ -5127,7 +5244,7 @@ function resolveSelfEphCeiling(params) {
   let max = scanMaxIndex;
   let from = windowSize;
   for (; ; ) {
-    const slice = selfEphWindow(spendingKey, ivkPacked, from, windowSize);
+    const slice = selfEphWindow(viewingKey, ivkPacked, from, windowSize);
     let matched = false;
     for (const entry of slice) {
       if (ownEphPks.has(entry.ephPkHex.toLowerCase())) {
@@ -5183,6 +5300,8 @@ async function resolveSpentStatus(params) {
 }
 
 // src/wallet/scanner/pipeline.ts
+var OUTGOING_RESCAN_GAP = 8;
+var RETRY_BOOK_LIMIT = 64;
 async function runScan(params) {
   const { vault, storage, hints, nullifiers, pool, keys, sinceLeafIndex, signal, onWarning } = params;
   const isIncremental = sinceLeafIndex !== void 0;
@@ -5190,6 +5309,7 @@ async function runScan(params) {
   const preScanHexes = new Set(existingHexes);
   const config = await storage.getConfig().catch(() => null);
   const selfEphWindowSize = windowSizeForCounter(config?.selfEphCounter ?? 0);
+  const outgoingEphWindowSize = windowSizeForCounter(config?.outgoingEphCounter ?? 0);
   const pairwiseCounterparties = Object.keys(config?.pairwiseCounterparties ?? {}).flatMap(
     (hex) => {
       try {
@@ -5218,7 +5338,12 @@ async function runScan(params) {
       // worth it on full scans and restores, waste on small incremental ticks.
       selfEph: !isIncremental,
       selfEphWindowSize,
-      pairwiseCounterparties
+      pairwiseCounterparties,
+      // Sent-note discovery rides the same full-scan/restore budget as
+      // self discovery: on an incremental tick the history is already
+      // there, and the window would be paid for nothing.
+      outgoingEph: !isIncremental,
+      outgoingEphWindowSize
     },
     existingHexes,
     sinceLeafIndex,
@@ -5232,6 +5357,49 @@ async function runScan(params) {
     onPage: (entries) => checkpoint.savePageNotes(entries),
     onBatchDone: (maxLeafIndex) => checkpoint.advanceCursor(maxLeafIndex)
   });
+  const ovk = keys.outgoingViewingKey;
+  if (scan.unmatchedSent.length > 0 && ovk) {
+    const proven = [...scan.learnedRecipients].map(fromHex);
+    const keptEntries = [...scan.sealedBookEntries].slice(-RETRY_BOOK_LIMIT);
+    const sealed = [];
+    for (const entry of keptEntries) {
+      try {
+        sealed.push(BigInt(entry));
+      } catch {
+      }
+    }
+    const retries = scan.unmatchedSent.slice(-RETRY_BOOK_LIMIT);
+    if (retries.length < scan.unmatchedSent.length) {
+      onWarning?.(
+        `sent-note retry capped at ${retries.length} of ${scan.unmatchedSent.length}; the rest resolve on the next full scan`
+      );
+    }
+    if (keptEntries.length < scan.sealedBookEntries.size) {
+      onWarning?.(
+        `recipient book capped at ${keptEntries.length} of ${scan.sealedBookEntries.size} entries; older payments resolve on the next full scan`
+      );
+    }
+    for (const { hint, ephIndex } of retries) {
+      if (signal?.aborted) throw scanAbortError();
+      const candidates = [
+        ...sealed.map((e) => openRecipientBookEntry(e, ovk, hint.commitmentHex)),
+        ...proven
+      ];
+      const sent = recoverSentNote({
+        hint,
+        outgoingViewingKey: ovk,
+        ephIndex,
+        recipientCandidates: candidates
+      });
+      if (!sent) continue;
+      const { recipientIvk, ...facts } = sent;
+      scan.sentNotes.push({
+        ...facts,
+        counterpartyIvkHex: toHex(recipientIvk),
+        encryptedMemo: hint.encryptedMemo ?? ""
+      });
+    }
+  }
   const nullifiersToQuery = collectNullifiersToQuery(
     scan.scanEntries,
     scan.onChainHexes,
@@ -5261,7 +5429,6 @@ async function runScan(params) {
     try {
       ceiling = resolveSelfEphCeiling({
         notes: vault.getAll(),
-        spendingKey: keys.spendingKey,
         viewingKey: keys.viewingKey,
         scanMaxIndex: scan.maxSelfEphIndex,
         windowSize: selfEphWindowSize
@@ -5271,6 +5438,13 @@ async function runScan(params) {
     await bumpSelfEphCounterTo(storage, ceiling + 1).catch(() => {
     });
   }
+  if (scan.maxOutgoingEphIndex !== null) {
+    await bumpOutgoingCounterTo(
+      storage,
+      scan.maxOutgoingEphIndex + 1 + OUTGOING_RESCAN_GAP
+    ).catch(() => {
+    });
+  }
   if (scan.decryptFailed > 0 && scan.found === 0 && scan.alreadyPresent === 0) {
     onWarning?.(
       `no notes recovered from ${scan.decryptFailed} hint(s) with memos; if this wallet should hold notes, check the keys it was unlocked with`
@@ -5282,7 +5456,13 @@ async function runScan(params) {
     decryptFailed: scan.decryptFailed,
     alreadyPresent: scan.alreadyPresent,
     purged,
-    incremental: isIncremental
+    incremental: isIncremental,
+    sentNotes: scan.sentNotes,
+    discovery: {
+      self: scan.selfDiscovered,
+      pairwise: scan.pairwiseDiscovered,
+      tagFiltered: scan.tagFiltered
+    }
   };
 }
 async function bumpSelfEphCounterTo(storage, next) {
@@ -5290,6 +5470,11 @@ async function bumpSelfEphCounterTo(storage, next) {
     (config) => (config.selfEphCounter ?? 0) >= next ? config : { ...config, selfEphCounter: next, updatedAt: Date.now() }
   );
 }
+async function bumpOutgoingCounterTo(storage, next) {
+  await storage.updateConfig(
+    (config) => (config.outgoingEphCounter ?? 0) >= next ? config : { ...config, outgoingEphCounter: next, updatedAt: Date.now() }
+  );
+}
 
 // src/wallet/scanner/history/extrinsicFacts.ts
 var UNKNOWN = { fee: null, success: true };
@@ -5428,10 +5613,8 @@ function regeneratePaymentSlip(facts, recipientIvkPacked, txHash) {
     commitmentHex: facts.commitmentHex,
     encryptedMemo: facts.encryptedMemo,
     ...facts.leafIndex !== void 0 ? { leafIndex: facts.leafIndex } : {},
-    // Rendered as an explorer link by the recipient, where an unconstrained
+    // The recipient renders this as an explorer link, so an unconstrained
     // string is a URL injection wearing the authority of a decrypted slip.
-    // Dropped rather than fatal: the slip still rebuilds the note, which is
-    // the part that matters.
     ...isHexOfLength(txHash, 32) ? { txHash } : {}
   });
   return encodePaymentSlip(envelope);
@@ -5456,15 +5639,37 @@ async function loadExistingRecords(vault) {
 function recordKey(transfer) {
   return transfer.hash ?? `${transfer.blockNumber}-${transfer.extrinsicIndex ?? 0}`;
 }
+function sentByCommitment(sentNotes) {
+  return new Map(sentNotes.map((s) => [s.commitmentHex.toLowerCase(), s]));
+}
+function reissuedSlip(sent, hash) {
+  try {
+    const facts = {
+      commitmentHex: sent.commitmentHex,
+      encryptedMemo: sent.encryptedMemo,
+      ...sent.leafIndex !== void 0 ? { leafIndex: sent.leafIndex } : {}
+    };
+    return {
+      paymentSlip: regeneratePaymentSlip(
+        facts,
+        fromHex(sent.counterpartyIvkHex),
+        hash ?? void 0
+      )
+    };
+  } catch {
+    return {};
+  }
+}
 async function reconstructOutgoingTxRecords(deps) {
   const { vault, transfers } = deps;
   const now = deps.now ?? Date.now;
   const allNotes = vault.getAll();
   const spentNotes = allNotes.filter((n) => n.spent);
   if (spentNotes.length === 0) return;
+  const sentCommitments = (deps.sentNotes ?? []).map((s) => s.commitmentHex);
   const [outgoingTransfers, commitmentTransfers] = await Promise.all([
     transfers.byNullifiers(spentNotes.map((n) => n.nullifierHex)),
-    transfers.byCommitments(allNotes.map((n) => n.commitmentHex))
+    transfers.byCommitments([...allNotes.map((n) => n.commitmentHex), ...sentCommitments])
   ]);
   if (outgoingTransfers.length === 0) return;
   const noteByNullifier = new Map(spentNotes.map((n) => [n.nullifierHex, n]));
@@ -5473,64 +5678,85 @@ async function reconstructOutgoingTxRecords(deps) {
     commitmentTransfers.map((ct) => [extrinsicKey(ct), ct.matchedCommitments ?? []])
   );
   const existingByKey = await loadExistingRecords(vault);
+  const sentIndex = sentByCommitment(deps.sentNotes ?? []);
+  const recoveryEnabled = deps.sentNotes !== void 0;
+  const sentFor = (row) => (commitmentsByExtrinsic.get(extrinsicKey(row)) ?? []).map((hex) => sentIndex.get(hex.toLowerCase())).find((s) => s !== void 0);
   for (const transfer of outgoingTransfers) {
     const existing = existingByKey.get(recordKey(transfer));
-    if (existing?.recipientPkHex && existing.recipientPkHex !== ZERO_PK) continue;
+    const known = existing?.recipientPkHex && existing.recipientPkHex !== ZERO_PK;
+    if (known && existing?.paymentSlip) continue;
     const inputNotes = (transfer.matchedNullifiers ?? []).map((h) => noteByNullifier.get(h)).filter((n) => n !== void 0);
     if (inputNotes.length === 0) continue;
     const changeNote = selectDescribingNoteByCommitment(
       commitmentsByExtrinsic.get(extrinsicKey(transfer)) ?? [],
       noteByCommitment
     );
-    const recipientPkHex = toPkHex(changeNote?.sourcePk);
+    const sentForRow = sentFor(transfer);
+    const recipientPkHex = sentForRow ? toPkHex(sentForRow.recipientStealthPk) : recoveryEnabled ? ZERO_PK : toPkHex(changeNote?.sourcePk);
     if (existing) {
-      if (recipientPkHex === ZERO_PK) continue;
-      await vault.saveTxRecord({ ...existing, recipientPkHex });
+      const patch = {
+        // Only when it ADDS something: this runs over the whole
+        // outgoing history on every scan, and rewriting what is already
+        // there would make each one a write.
+        ...!known && recipientPkHex !== ZERO_PK ? { recipientPkHex } : {},
+        ...sentForRow && !existing.paymentSlip ? reissuedSlip(sentForRow, transfer.hash) : {}
+      };
+      if (Object.keys(patch).length > 0) {
+        await vault.saveTxRecord({ ...existing, ...patch });
+      }
       continue;
     }
     const { fee, success } = await fetchExtrinsicFacts(deps.txFacts, transfer.hash);
     const totalInputValue = inputNotes.reduce((sum, n) => sum + n.value, 0n);
-    const transferAmount = totalInputValue - (changeNote?.value ?? 0n) - (fee ?? 0n);
+    const derivedAmount = totalInputValue - (changeNote?.value ?? 0n) - (fee ?? 0n);
+    const transferAmount = sentForRow?.value ?? derivedAmount;
     if (transferAmount <= 0n) continue;
     const record = {
       id: recordKey(transfer),
       type: "private_transfer",
       blockNumber: transfer.blockNumber,
       hash: transfer.hash ?? "",
-      assetId: inputNotes[0].assetId.toString(),
+      assetId: (sentForRow?.assetId ?? inputNotes[0].assetId).toString(),
       amount: transferAmount.toString(),
       recipientPkHex,
       status: success ? "success" : "failed",
-      ...fee !== null ? { feePlanck: fee.toString() } : { amountApproximate: true },
-      timestampMs: transfer.timestampMs ?? now()
+      ...fee !== null ? { feePlanck: fee.toString() } : {},
+      ...fee === null && !sentForRow ? { amountApproximate: true } : {},
+      timestampMs: transfer.timestampMs ?? now(),
+      // Best-effort: a slip that cannot be sealed costs the convenience of
+      // handing it over again, never the history row.
+      ...sentForRow ? reissuedSlip(sentForRow, transfer.hash) : {}
     };
     await vault.saveTxRecord(record);
   }
 }
 
 // src/wallet/ops/notes/buildNote.ts
-async function buildZkNote(params, deps) {
+async function buildZkNoteWithIndex(params, deps) {
   const { keys, storage } = deps;
   const ownerPk = params.ownerPk ?? keys.ownerPk;
   const spendingKey = params.spendingKey ?? keys.spendingKey;
   const viewingPublicKey = params.viewingPublicKey ?? keys.viewingPublicKey;
   const isSelf = params.viewingPublicKey === void 0 && params.recipientOwnerPk === void 0;
   let ephSkOverride;
-  if (isSelf && storage) {
+  let outgoingIndex;
+  if (isSelf && storage && keys.viewingSecretKey) {
     try {
-      ephSkOverride = deriveSelfEphSk(spendingKey, await reserveSelfEphIndex(storage));
+      ephSkOverride = deriveSelfEphSk(
+        keys.viewingSecretKey,
+        await reserveSelfEphIndex(storage)
+      );
     } catch {
     }
-  } else if (params.viewingPublicKey && storage && keys.viewingSecretKey) {
+  } else if (params.viewingPublicKey && storage && keys.outgoingViewingKey) {
     try {
-      const index = await reservePairwiseIndex(storage, toHex(params.viewingPublicKey));
-      if (index !== null) {
-        const pairSecret = derivePairwiseSharedSecret(
-          keys.viewingSecretKey,
-          params.viewingPublicKey
-        );
-        ephSkOverride = derivePairwiseEphSk(pairSecret, index);
-      }
+      const index = await reserveOutgoingIndex(storage, params.outgoingIndexFromChain);
+      ephSkOverride = deriveOutgoingEphSk(keys.outgoingViewingKey, index);
+      outgoingIndex = index;
+    } catch {
+    }
+    try {
+      await registerPairwiseCounterparty(storage, toHex(params.viewingPublicKey));
     } catch {
     }
   }
@@ -5550,7 +5776,13 @@ async function buildZkNote(params, deps) {
     },
     ...ephSkOverride !== void 0 && { ephSkOverride }
   });
-  return stampCreatedAt(note, Date.now());
+  return {
+    note: stampCreatedAt(note, Date.now()),
+    ...outgoingIndex !== void 0 ? { outgoingIndex } : {}
+  };
+}
+async function buildZkNote(params, deps) {
+  return (await buildZkNoteWithIndex(params, deps)).note;
 }
 
 // src/wallet/ops/notes/selfStealthNote.ts
@@ -5569,89 +5801,6 @@ function recoverSelfStealthNote(note, keys) {
   return recovered;
 }
 
-// src/wallet/ops/notes/noteTransfer.ts
-var NOTE_TRANSFER_URI_SCHEME = "orbinum://notes/v1/";
-var QR_PAGE_MAX_CHARS = 1800;
-function noteToTransferEntry(note) {
-  return {
-    c: note.commitmentHex,
-    n: note.nullifierHex,
-    val: note.value.toString(),
-    aid: note.assetId.toString(),
-    opk: scalarToHex(note.ownerPk),
-    bld: scalarToHex(note.blinding),
-    sk: scalarToHex(note.spendingKey)
-  };
-}
-function encodeNoteTransferPages(notes, options = {}) {
-  const now = options.now ?? Date.now;
-  const maxChars = options.maxChars ?? QR_PAGE_MAX_CHARS;
-  const entries = notes.map(noteToTransferEntry);
-  const batches = [];
-  let batch = [];
-  for (const entry of entries) {
-    batch.push(entry);
-    const probe = { v: 1, ts: 0, p: 0, pt: 1, notes: batch };
-    const size = NOTE_TRANSFER_URI_SCHEME.length + base64UrlEncode(JSON.stringify(probe)).length;
-    if (size > maxChars && batch.length > 1) {
-      batch.pop();
-      batches.push(batch);
-      batch = [entry];
-    }
-  }
-  if (batch.length > 0) batches.push(batch);
-  const ts = now();
-  return batches.map((notesInPage, i) => {
-    const payload = {
-      v: 1,
-      ts,
-      p: i,
-      pt: batches.length,
-      notes: notesInPage
-    };
-    return NOTE_TRANSFER_URI_SCHEME + base64UrlEncode(JSON.stringify(payload));
-  });
-}
-function decodeNoteTransferPage(uri) {
-  if (!uri.startsWith(NOTE_TRANSFER_URI_SCHEME)) {
-    throw new Error("Not an Orbinum note-transfer code.");
-  }
-  let payload;
-  try {
-    payload = JSON.parse(base64UrlDecode(uri.slice(NOTE_TRANSFER_URI_SCHEME.length)));
-  } catch {
-    throw new Error("Note-transfer code is corrupt.");
-  }
-  const p = payload;
-  if (p.v !== 1) {
-    throw new Error(`Unsupported note-transfer version: ${String(p.v)}.`);
-  }
-  if (typeof p.p !== "number" || typeof p.pt !== "number" || !Array.isArray(p.notes) || p.notes.some((n) => !isEntry(n))) {
-    throw new Error("Note-transfer code is missing required fields.");
-  }
-  return p;
-}
-function isEntry(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const e = value;
-  return ["c", "n", "val", "aid", "opk", "bld", "sk"].every(
-    (k) => typeof e[k] === "string" && e[k].length > 0
-  );
-}
-function assembleNoteTransfer(pages) {
-  if (pages.length === 0) throw new Error("No pages scanned.");
-  const total = pages[0].pt;
-  if (pages.some((p) => p.pt !== total)) {
-    throw new Error("Pages come from different batches.");
-  }
-  const seen = new Set(pages.map((p) => p.p));
-  if (seen.size !== total) {
-    const missing = [...Array(total).keys()].filter((i) => !seen.has(i));
-    throw new Error(`Missing page(s): ${missing.map((i) => i + 1).join(", ")} of ${total}.`);
-  }
-  return [...pages].sort((a, b) => a.p - b.p).flatMap((p) => p.notes);
-}
-
 // src/wallet/ops/notes/noteBackup.ts
 var NOTE_BACKUP_VERSION = 1;
 function noteToBackupEntry(note) {
@@ -5686,12 +5835,13 @@ function decodeNoteBackup(json) {
   if (p.v !== NOTE_BACKUP_VERSION) {
     throw new Error(`Unsupported note-backup version: ${String(p.v)}.`);
   }
-  if (!Array.isArray(p.notes) || p.notes.some((n) => !isEntry2(n))) {
+  if (!Array.isArray(p.notes) || p.notes.some((n) => !isEntry(n))) {
     throw new Error("Note backup is missing required fields.");
   }
   return p.notes;
 }
 function importNotesFromBackup(entries, keys) {
+  assertSecretKeyBytes(keys.viewingSecretKey, "importNotesFromBackup: viewingSecretKey");
   const out = [];
   for (const entry of entries) {
     const commitment = {
@@ -5715,12 +5865,14 @@ function importNotesFromBackup(entries, keys) {
   }
   return out;
 }
-function isEntry2(value) {
+function isEntry(value) {
   if (typeof value !== "object" || value === null) return false;
   const e = value;
-  if (typeof e["commitmentHex"] !== "string" || e["commitmentHex"].length === 0) return false;
-  if (typeof e["encryptedMemo"] !== "string" || e["encryptedMemo"].length === 0) return false;
-  if ("leafIndex" in e && e["leafIndex"] !== void 0 && typeof e["leafIndex"] !== "number") {
+  if (!isHexOfLength(e["commitmentHex"], 32)) return false;
+  if (!isHexOfLength(e["encryptedMemo"], ENCRYPTED_MEMO_SIZE)) return false;
+  if (e["leafIndex"] !== void 0 && !isValidLeafIndex(e["leafIndex"])) return false;
+  if (e["spent"] !== void 0 && typeof e["spent"] !== "boolean") return false;
+  if (e["spentAt"] !== void 0 && e["spentAt"] !== null && typeof e["spentAt"] !== "number") {
     return false;
   }
   return true;
@@ -5728,6 +5880,7 @@ function isEntry2(value) {
 
 // src/wallet/ops/notes/paymentSlipImport.ts
 function importPaymentSlip(slip, keys) {
+  assertSecretKeyBytes(keys.viewingSecretKey, "importPaymentSlip: viewingSecretKey");
   const envelope = typeof slip === "string" ? decodePaymentSlip(slip) : slip;
   if (!envelope) return null;
   const fields = openPaymentSlip(keys.viewingSecretKey, envelope);
@@ -5856,10 +6009,7 @@ async function transferNotes(deps, params, onProgress) {
   const merkleRoot = merkleA.root;
   onProgress?.("building-output-notes");
   const effectiveSenderPk = senderPk ?? noteA.ownerPk;
-  const senderViewingPublicKey = deriveViewingPublicKey(
-    deriveViewingSecretKey(noteA.spendingKey)
-  );
-  const recipientNote = await deps.buildNote({
+  const { note: recipientNote, outgoingIndex } = await deps.buildNote({
     value: transferAmount,
     assetId: noteA.assetId,
     ownerPk: recipientPk,
@@ -5869,13 +6019,17 @@ async function transferNotes(deps, params, onProgress) {
     // With a viewing key present this activates stealth derivation.
     recipientOwnerPk: recipientPk
   });
-  const changeNote = await deps.buildNote({
+  const changeSourcePk = outgoingIndex !== void 0 && recipientViewingPublicKey !== void 0 && deps.outgoingViewingKey !== void 0 ? bytesToBigintLE(
+    sealRecipientBookEntry(
+      recipientViewingPublicKey,
+      deps.outgoingViewingKey,
+      recipientNote.commitmentHex
+    )
+  ) : recipientNote.ownerPk;
+  const { note: changeNote } = await deps.buildNote({
     value: changeValue,
     assetId: noteA.assetId,
-    ownerPk: effectiveSenderPk,
-    spendingKey: noteA.spendingKey,
-    sourcePk: recipientNote.ownerPk,
-    viewingPublicKey: senderViewingPublicKey
+    sourcePk: changeSourcePk
   });
   onProgress?.("generating-zk");
   const noteToInput = (note, proof) => ({
@@ -5992,7 +6146,7 @@ async function unshieldNote(deps, params, onProgress) {
   if (changeValue > 0n) {
     const { ownerPk, spendingKey } = deps.stealthKeys;
     changeBlinding = randomBlinding();
-    changeNote = await deps.buildNote({
+    changeNote = (await deps.buildNote({
       value: changeValue,
       assetId: note.assetId,
       ownerPk,
@@ -6000,7 +6154,7 @@ async function unshieldNote(deps, params, onProgress) {
       spendingKey,
       // Activates stealth: the commitment covers a one-time ownerPk.
       recipientOwnerPk: ownerPk
-    });
+    })).note;
   }
   const { provider, version: circuitVersion } = await deps.resolver.resolve(
     CircuitType6.Unshield,
@@ -6286,8 +6440,9 @@ var KEY_PREFIX = "orbinum_sk_";
 function isEnvelope(value) {
   return typeof value === "object" && value !== null && value.v === 1 && typeof value.iv === "string" && typeof value.ct === "string";
 }
-function sessionCacheKey(address, chainId) {
-  return `${KEY_PREFIX}${chainId}_${canonicalAccountId(address)}`;
+function sessionCacheKey(address, chainId, version = "v3") {
+  const marker = `${version}_`;
+  return `${KEY_PREFIX}${marker}${chainId}_${canonicalAccountId(address)}`;
 }
 async function hasCachedSession(store, address, chainId) {
   return await store.get(sessionCacheKey(address, chainId)) !== null;
@@ -6323,9 +6478,55 @@ async function clearSession(store, address, chainId) {
 
 // src/wallet/identity/vaultName.ts
 var PREFIX = "orbinum-vault";
-function vaultStorageName(address, chainFingerprint) {
+var versionMarker = (version) => `${version}-`;
+var VERSION_MARKERS = ["v3-"];
+function assertNoVersionMarker(component, label) {
+  for (const marker of VERSION_MARKERS) {
+    if (component.startsWith(marker)) {
+      throw new Error(
+        `vaultStorageName: ${label} must not start with "${marker}" \u2014 it would collide with another identity version`
+      );
+    }
+  }
+}
+function vaultStorageName(address, chainFingerprint, version = "v3") {
   const account = canonicalAccountId(address);
-  return chainFingerprint ? `${PREFIX}-${chainFingerprint.toLowerCase()}-${account}` : `${PREFIX}-${account}`;
+  assertNoVersionMarker(account, "account");
+  const marker = versionMarker(version);
+  if (chainFingerprint) assertNoVersionMarker(chainFingerprint.toLowerCase(), "chainFingerprint");
+  return chainFingerprint ? `${PREFIX}-${marker}${chainFingerprint.toLowerCase()}-${account}` : `${PREFIX}-${marker}${account}`;
+}
+
+// src/wallet/identity/walletIdentity.ts
+function deriveIdentity(rootSecret, version) {
+  if (rootSecret.length !== 32) {
+    throw new Error(`deriveIdentity: rootSecret must be 32 bytes, got ${rootSecret.length}`);
+  }
+  if (rootSecret.every((b) => b === 0)) {
+    throw new Error("deriveIdentity: rootSecret is all zeros \u2014 every wallet would share it");
+  }
+  if (version !== "v3") {
+    throw new Error(`deriveIdentity: unknown identity version ${String(version)}`);
+  }
+  const spendingKey = deriveSpendingKeyV3(rootSecret);
+  const viewingSecretKey = deriveViewingSecretKeyV3(rootSecret);
+  return {
+    version,
+    spendingKey,
+    ownerPk: deriveOwnerPk(spendingKey),
+    viewingSecretKey,
+    viewingPublicKey: deriveViewingPublicKey(viewingSecretKey),
+    outgoingViewingKey: deriveOutgoingViewingKeyV3(rootSecret)
+  };
+}
+function exportViewingCredential(identity, options = {}) {
+  return {
+    version: identity.version,
+    ownerPk: identity.ownerPk,
+    viewingSecretKey: Uint8Array.from(identity.viewingSecretKey),
+    viewingPublicKey: Uint8Array.from(identity.viewingPublicKey),
+    ...options.includeOutgoing && identity.outgoingViewingKey ? { outgoingViewingKey: Uint8Array.from(identity.outgoingViewingKey) } : {}
+  };
 }
 
 // src/wallet/identity/injectedExtensions.ts
@@ -6363,25 +6564,36 @@ var OrbinumWallet = class {
   session;
   notes;
   vaultStore;
-  /** Set at unlock; every key below is derived from it. */
-  spendingKey = null;
+  /**
+   * The identity this wallet is unlocked as, or null.
+   *
+   * Held as a bundle rather than a single scalar because v3 keys are SIBLINGS:
+   * the spending key no longer produces the viewing key, so there is nothing
+   * left to derive the others from once unlock returns. Keeping the root out
+   * of this object is deliberate — the branches are what the wallet needs, and
+   * the root is the thing worth not retaining.
+   */
+  identity = null;
   /** The underlying store, for operations the facade does not cover. */
   get vault() {
     return this.vaultStore;
   }
   get unlocked() {
-    return this.session.unlocked && this.spendingKey !== null;
+    return this.session.unlocked && this.identity !== null;
   }
   /**
    * Opens the wallet from the master key bytes a `SpendingKeyRequest`
    * signature produces — the same value `PrivacyKeyManager.getMasterBytes()`
    * returns.
    *
-   * Master bytes rather than the spending-key scalar, deliberately: the scalar
-   * is the master reduced modulo the curve order, so deriving the vault key
-   * from it would tie the encrypted vault to the CURRENT modulus. The master
-   * is pre-reduction, which keeps a stored vault readable across a modulus
-   * change. Everything else — viewing keys, ownerPk — comes from the scalar.
+   * Master bytes rather than the spending-key scalar, deliberately: the master
+   * is the root EVERY branch hangs off — spending key, viewing key, outgoing
+   * viewing key and vault key are each their own HKDF of it, none derived
+   * from another. Only `ownerPk` comes from the spending scalar, because the
+   * circuit defines it that way.
+   *
+   * It is also what keeps a stored vault readable across a modulus change:
+   * the vault key is derived pre-reduction.
    *
    * Reports whether the stored vault was RESET: a different chain, a different
    * key, or notes the chain no longer recognises. When it was, the wallet
@@ -6395,14 +6607,12 @@ var OrbinumWallet = class {
    * against a vault that was never read.
    */
   async unlock(masterBytes, options = {}) {
-    if (masterBytes.length !== 32) {
-      throw new Error(`Master key must be 32 bytes, got ${masterBytes.length}.`);
-    }
+    assertSecretKeyBytes(masterBytes, "Master key");
     this.session.open(
       await deriveVaultKey(masterBytes),
       await deriveVaultBlindKey(masterBytes)
     );
-    this.spendingKey = deriveSpendingKeyFromMaster(masterBytes);
+    this.identity = deriveIdentity(masterBytes, this.config.identityVersion ?? "v3");
     try {
       return await this.vaultStore.unlock(this.session.cryptoKey, options);
     } catch (err) {
@@ -6413,8 +6623,12 @@ var OrbinumWallet = class {
   /** Drops the in-memory keys. The stored vault is untouched. */
   lock() {
     this.session.lock();
-    this.spendingKey = null;
+    this.identity = null;
     this.notes.set([]);
+    try {
+      this.config.pool.terminate();
+    } catch {
+    }
   }
   /** The notes currently held. Empty while locked. */
   getNotes() {
@@ -6426,11 +6640,8 @@ var OrbinumWallet = class {
   }
   /** This wallet's privacy identity: the keys a payer needs to address it. */
   privacyKeys() {
-    const spendingKey = this.requireKey();
-    return {
-      ownerPk: deriveOwnerPk(spendingKey),
-      viewingPublicKey: deriveViewingPublicKey(deriveViewingSecretKey(spendingKey))
-    };
+    const { ownerPk, viewingPublicKey } = this.requireIdentity();
+    return { ownerPk, viewingPublicKey };
   }
   /**
    * Walks the feed, recovers this wallet's notes, and persists them with their
@@ -6440,15 +6651,21 @@ var OrbinumWallet = class {
    * `sinceLeafIndex` for a full scan, which is what a restore needs.
    */
   async scan(options = {}) {
-    const spendingKey = this.requireKey();
-    const viewingKey = deriveViewingSecretKey(spendingKey);
+    const identity = this.requireIdentity();
     return runScan({
       vault: this.vaultStore,
       storage: this.config.storage,
       hints: this.config.hints,
       nullifiers: this.config.nullifiers,
       pool: this.config.pool,
-      keys: { viewingKey, spendingKey, ownerPk: deriveOwnerPk(spendingKey) },
+      keys: {
+        viewingKey: identity.viewingSecretKey,
+        spendingKey: identity.spendingKey,
+        ownerPk: identity.ownerPk,
+        // Absent on a watch-only identity: the scan then finds every
+        // note the wallet owns and reconstructs no payment history.
+        ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
+      },
       sinceLeafIndex: options.sinceLeafIndex,
       viewTagActivationLeaf: this.config.viewTagActivationLeaf,
       onProgress: options.onProgress,
@@ -6470,13 +6687,14 @@ var OrbinumWallet = class {
    * reusing an index would republish an ephPk and link the two notes.
    */
   async buildNote(params) {
-    const spendingKey = this.requireKey();
+    const identity = this.requireIdentity();
     return buildZkNote(params, {
       keys: {
-        ownerPk: deriveOwnerPk(spendingKey),
-        spendingKey,
-        viewingPublicKey: deriveViewingPublicKey(deriveViewingSecretKey(spendingKey)),
-        viewingSecretKey: deriveViewingSecretKey(spendingKey)
+        ownerPk: identity.ownerPk,
+        spendingKey: identity.spendingKey,
+        viewingPublicKey: identity.viewingPublicKey,
+        viewingSecretKey: identity.viewingSecretKey,
+        ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
       },
       storage: this.config.storage
     });
@@ -6493,11 +6711,12 @@ var OrbinumWallet = class {
    * Treat the result as secret: it can spend every note this wallet holds.
    */
   spendKeys() {
-    const spendingKey = this.requireKey();
+    const identity = this.requireIdentity();
     return {
-      spendingKey,
-      viewingSecretKey: deriveViewingSecretKey(spendingKey),
-      ownerPk: deriveOwnerPk(spendingKey)
+      spendingKey: identity.spendingKey,
+      viewingSecretKey: identity.viewingSecretKey,
+      ownerPk: identity.ownerPk,
+      ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
     };
   }
   /**
@@ -6519,7 +6738,20 @@ var OrbinumWallet = class {
    * verifying-key rotation, and the failure surfaces much later.
    */
   buildOutputNote = async (params) => {
-    return this.buildNote({ ...params, circuitVersion: await this.circuitVersion() });
+    const identity = this.requireIdentity();
+    return buildZkNoteWithIndex(
+      { ...params, circuitVersion: await this.circuitVersion() },
+      {
+        keys: {
+          ownerPk: identity.ownerPk,
+          spendingKey: identity.spendingKey,
+          viewingPublicKey: identity.viewingPublicKey,
+          viewingSecretKey: identity.viewingSecretKey,
+          ...identity.outgoingViewingKey ? { outgoingViewingKey: identity.outgoingViewingKey } : {}
+        },
+        storage: this.config.storage
+      }
+    );
   };
   /** The circuit version a new note should carry. */
   async circuitVersion() {
@@ -6531,11 +6763,11 @@ var OrbinumWallet = class {
     }
     return chainActiveCircuitVersion(this.config.zkVerifier);
   }
-  requireKey() {
-    if (this.spendingKey === null) {
+  requireIdentity() {
+    if (this.identity === null) {
       throw new Error("Wallet is locked. Call unlock() before using it.");
     }
-    return this.spendingKey;
+    return this.identity;
   }
 };
 export {
@@ -6566,9 +6798,8 @@ export {
   NATIVE_ASSET_ID,
   NOTE_BACKUP_VERSION,
   NOTE_BIGINT_FIELDS,
-  NOTE_TRANSFER_URI_SCHEME,
   NoteBuilder,
-  OVK_BLOB_SIZE,
+  OUTGOING_EPH_WINDOW,
   OrbinumClient,
   OrbinumClientProvider,
   OrbinumWallet,
@@ -6578,7 +6809,6 @@ export {
   PRECOMPILE_ADDR,
   PrivacyKeyManager,
   PrivacyModule,
-  QR_PAGE_MAX_CHARS,
   RECOVERED_TX_RESULT,
   RelayerStatusModule,
   RpcV2Module,
@@ -6603,7 +6833,7 @@ export {
   addressToFieldElement,
   applyBatch,
   applyNoteStatus,
-  assembleNoteTransfer,
+  assertSecretKeyBytes,
   base58,
   base64UrlDecode,
   base64UrlEncode,
@@ -6616,6 +6846,7 @@ export {
   buildShieldBatchOperations,
   buildShieldParams,
   buildZkNote,
+  buildZkNoteWithIndex,
   bytesToBigintLE,
   bytesToBjjScalar,
   cacheSession,
@@ -6645,15 +6876,17 @@ export {
   createWorkerPool,
   decodeNoteBackup,
   decodeNoteDisclosureKey,
-  decodeNoteTransferPage,
   decodePaymentSlip,
   decodePrecompileCalldata,
   decryptHintBatch,
   decryptJson,
   decryptNoteRecord,
+  deriveIdentity,
   deriveMasterKeyBytes,
-  deriveOutgoingCipherKey,
-  deriveOutgoingViewingKey,
+  deriveOutgoingEphPk,
+  deriveOutgoingEphSk,
+  deriveOutgoingSharedSecret,
+  deriveOutgoingViewingKeyV3,
   deriveOwnerPk,
   derivePairwiseEphSk,
   derivePairwiseSharedSecret,
@@ -6662,6 +6895,7 @@ export {
   deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessageV2,
   deriveSpendingKeyTypedData,
+  deriveSpendingKeyV3,
   deriveStealthOwnerPk,
   deriveStealthSk,
   deriveVaultBlindKey,
@@ -6669,9 +6903,9 @@ export {
   deriveViewTag,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
+  deriveViewingSecretKeyV3,
   detectCommitmentMismatch,
   encodeNoteBackup,
-  encodeNoteTransferPages,
   encodePaymentSlip,
   encryptJson,
   encryptNote,
@@ -6681,6 +6915,7 @@ export {
   evmToImplicitSubstrate,
   evmToMappedAccountHex,
   evmToSubstrate,
+  exportViewingCredential,
   extractPalletError,
   failed,
   fastMulBase,
@@ -6721,9 +6956,9 @@ export {
   isNativeAsset,
   isNoteSelfConsistent,
   isSpendable,
-  isSs58,
   isSubstrateAddress,
   isUnifiedAddress,
+  isUsableSecretKey,
   isValidLeafIndex,
   leHexToBigint,
   mapExtrinsicArgs,
@@ -6740,10 +6975,10 @@ export {
   noteMatchesCommitment,
   noteOrigin,
   noteSpentTxHash,
-  noteToTransferEntry,
   noteTxKind,
-  openOutgoingBlob,
   openPaymentSlip,
+  openRecipientBookEntry,
+  outgoingEphWindow,
   outranks,
   pairwiseEphWindow,
   palletErrorKind,
@@ -6754,15 +6989,18 @@ export {
   planTransfer,
   planUnshield,
   randomBlinding,
-  randomOutgoingBlob,
+  reconstructOutgoingIndex,
   reconstructOutgoingTxRecords,
   recoverOwnerPkPoint,
   recoverSelfStealthNote,
+  recoverSentFromSharedSecret,
+  recoverSentNote,
   refuseIfAlreadySpent,
   regeneratePaymentSlip,
+  registerPairwiseCounterparty,
   removeByCommitment,
   requireSessionKeys,
-  reservePairwiseIndex,
+  reserveOutgoingIndex,
   reserveSelfEphIndex,
   resolveSelfEphCeiling,
   resolveSpentSet,
@@ -6771,8 +7009,8 @@ export {
   runScan,
   scalarToHex,
   scanAbortError,
-  sealOutgoingBlob,
   sealPaymentSlip,
+  sealRecipientBookEntry,
   selectDescribingNote,
   selectDescribingNoteByCommitment,
   selectGhosts,
@@ -6798,10 +7036,10 @@ export {
   truncateMiddle,
   tryDecryptNote,
   tryDecryptNoteVerbose,
-  tryRecoverOutgoing,
   txLandedAfterError,
   u128,
   u64,
+  unpackUsableViewingKey,
   unshieldNote,
   upsertNote,
   vaultReplacer,