Stealth Addresses

You publish:  scan_pubkey + spend_pubkey  (66 bytes, your stealth meta-address)

Sender:
  1. Generate random ephemeral key R
  2. ECDH: shared_secret = HKDF(R × scan_pubkey)
  3. one_time_address = spend_pubkey + shared_secret × G
  4. Attach (R, view_tag) to transaction

You (scanning):
  1. For each tx: shared_secret = HKDF(scan_privkey × R)
  2. View tag matches? → Compute full address to confirm
  3. Match → Spend with: spend_privkey + shared_secret_scalar

import {
  deriveStealthKeyPair,
  encodeStealthMetaAddress,
  generateStealthAddress,
  getMyStealthTransactions,
  deriveStealthPrivkey,
} from '@yattacorp/nexus-sdk';

// ── Recipient: set up your stealth keypair ──────────────────────────────────
const stealthKeys = deriveStealthKeyPair(myMasterPrivkey);

// Publish this — it's your stealth meta-address (safe to share)
const metaAddress = encodeStealthMetaAddress(stealthKeys);
// e.g. "02abc...def02ghi...jkl" (66 bytes hex)

// ── Sender: generate a one-time address for the recipient ───────────────────
const { stealthAddress, ephemeralPubkey, viewTag } = generateStealthAddress(
  recipientScanPubkeyHex,
  recipientSpendPubkeyHex,
);
// Use stealthAddress as tx.from, attach ephemeralPubkey + viewTag to tx

// ── Recipient: scan for incoming transactions ───────────────────────────────
const myTxs = getMyStealthTransactions(
  allStealthTxsFromSnapshot,  // fetched from node
  stealthKeys.scanPrivkey,
  stealthKeys.spendPubkey,
);

// ── Recipient: derive private key to spend ──────────────────────────────────
for (const tx of myTxs) {
  const privkey = deriveStealthPrivkey(stealthKeys.spendPrivkey, tx.sharedSecretScalar);
  // sign transactions with privkey
}

scan_privkey  = HKDF(master, salt="nexus-stealth-scan",  info="scan-key-v2",  32 bytes)
spend_privkey = HKDF(master, salt="nexus-stealth-spend", info="spend-key-v2", 32 bytes)