diff --git a/.cargo/config.toml b/.cargo/config.toml
new file mode 100644
index 0000000000..e724ea0856
--- /dev/null
+++ b/.cargo/config.toml
@@ -0,0 +1,2 @@
+[env]
+RUST_BACKTRACE = "1"
diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000000..12f32366ab
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,7 @@
+# EditorConfig is awesome:http://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*.md]
+indent_style = space
diff --git a/.gitattributes b/.gitattributes
index e5a028af21..9d5816faad 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,2 +1,3 @@
 zcash_client_backend/src/proto/compact_formats.rs linguist-generated=true
 zcash_client_backend/src/proto/service.rs linguist-generated=true
+zcash_client_backend/src/proto/proposal.rs linguist-generated=true
diff --git a/.github/actions/prepare/action.yml b/.github/actions/prepare/action.yml
new file mode 100644
index 0000000000..9ac597d495
--- /dev/null
+++ b/.github/actions/prepare/action.yml
@@ -0,0 +1,39 @@
+name: 'Prepare CI'
+description: 'Prepares feature flags'
+inputs:
+  extra-features:
+    description: 'Extra feature flags to enable'
+    required: false
+    default: ''
+  test-dependencies:
+    description: 'Include test dependencies'
+    required: false
+    default: true
+outputs:
+  feature-flags:
+    description: 'Feature flags'
+    value: ${{ steps.prepare.outputs.flags }}
+runs:
+  using: 'composite'
+  steps:
+    - id: test
+      shell: bash
+      run: echo "feature=test-dependencies" >> $GITHUB_OUTPUT
+      if: inputs.test-dependencies == 'true'
+    - name: Prepare feature flags
+      id: prepare
+      shell: bash
+      run: >
+        echo "flags=--features '
+        bundled-prover
+        download-params
+        lightwalletd-tonic
+        sync
+        temporary-zcashd
+        transparent-inputs
+        unstable
+        unstable-serialization
+        unstable-spanning-tree
+        ${{ inputs.extra-features }}
+        ${{ steps.test.outputs.feature }}
+        '" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/aggregate-audits.yml b/.github/workflows/aggregate-audits.yml
new file mode 100644
index 0000000000..546d37d3b6
--- /dev/null
+++ b/.github/workflows/aggregate-audits.yml
@@ -0,0 +1,24 @@
+name: Aggregate audits
+
+on:
+  push:
+    branches: main
+    paths:
+      - '.github/workflows/aggregate-audits.yml'
+      - 'supply-chain/audits.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  trigger:
+    name: Trigger
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger aggregation in zcash/rust-ecosystem
+        run: >
+          gh api repos/zcash/rust-ecosystem/dispatches
+            --field event_type="aggregate-audits"
+            --field client_payload[sha]="$GITHUB_SHA"
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/audits.yml b/.github/workflows/audits.yml
new file mode 100644
index 0000000000..f6a3bbc738
--- /dev/null
+++ b/.github/workflows/audits.yml
@@ -0,0 +1,42 @@
+name: Audits
+
+on:
+  pull_request:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-vet:
+    name: Vet Rust dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+      - run: rustup override set ${{steps.toolchain.outputs.name}}
+      - run: cargo install cargo-vet --version ~0.10
+      - run: cargo vet --locked
+
+  cargo-deny:
+    name: Check licenses
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check licenses
+
+  required-checks:
+    name: Required status checks have passed
+    needs:
+      - cargo-vet
+      - cargo-deny
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine whether all required-pass steps succeeded
+        run: |
+          echo '${{ toJSON(needs) }}' | jq -e '[ .[] | .result == "success" ] | all'
diff --git a/.github/workflows/book.yml b/.github/workflows/book.yml
index f62273e552..c649b89417 100644
--- a/.github/workflows/book.yml
+++ b/.github/workflows/book.yml
@@ -3,19 +3,25 @@ name: librustzcash documentation
 on:
   push:
     branches:
-      - master
+      - main
 
 jobs:
   deploy:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
       - uses: dtolnay/rust-toolchain@nightly
         id: toolchain
       - run: rustup override set ${{steps.toolchain.outputs.name}}
 
       - name: Build latest rustdocs
-        run: cargo doc --no-deps --workspace --all-features
+        run: >
+          cargo doc
+          --no-deps
+          --workspace
+          ${{ steps.prepare.outputs.feature-flags }}
         env:
           RUSTDOCFLAGS: -Z unstable-options --enable-index-page --cfg docsrs
 
@@ -25,7 +31,7 @@ jobs:
           mv ./target/doc ./book/book/rustdoc/latest
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./book/book
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0611a39c6c..4aab93a21b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,40 +1,173 @@
-name: CI checks
+name: CI
 
-on: [push, pull_request]
+on:
+  pull_request:
+  push:
+    branches: main
+  merge_group:
 
 jobs:
   test:
-    name: Test on ${{ matrix.os }}
+    name: >
+      Test${{
+      matrix.state != 'NOT_A_PUZZLE' && format(' {0}', matrix.state) || ''
+      }} on ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.state != 'NOT_A_PUZZLE' }}
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
+        target:
+          - Linux
+          - macOS
+          - Windows
+        state:
+          - NOT_A_PUZZLE
+          - Orchard
+          - NU7
+
+        include:
+          - target: Linux
+            os: ubuntu-latest-8cores
+          - target: macOS
+            os: macOS-latest
+          - target: Windows
+            os: windows-latest-8cores
+
+          - state: Orchard
+            extra_flags: orchard
+          - state: NU7
+            rustflags: '--cfg zcash_unstable="nu7"'
+
+        exclude:
+          - target: macOS
+            state: NU7
+
+    env:
+      RUSTFLAGS: ${{ matrix.rustflags }}
+      RUSTDOCFLAGS: ${{ matrix.rustflags }}
 
     steps:
-      - uses: actions/checkout@v3
-      - name: Fetch path to Zcash parameters
-        working-directory: ./zcash_proofs
-        shell: bash
-        run: echo "ZCASH_PARAMS=$(cargo run --release --example get-params-path --features directories)" >> $GITHUB_ENV
-      - name: Cache Zcash parameters
-        id: cache-params
-        uses: actions/cache@v3.3.1
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
         with:
-          path: ${{ env.ZCASH_PARAMS }}
-          key: ${{ runner.os }}-params
-      - name: Fetch Zcash parameters
-        if: steps.cache-params.outputs.cache-hit != 'true'
-        working-directory: ./zcash_proofs
-        run: cargo run --release --example download-params --features download-params
-
+          extra-features: ${{ matrix.state != 'NOT_A_PUZZLE' && matrix.extra_flags || '' }}
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-msrv-${{ hashFiles('**/Cargo.lock') }}
       - name: Run tests
-        run: cargo test  --all-features --verbose --release --all
+        run: >
+          cargo test
+          --workspace
+          ${{ steps.prepare.outputs.feature-flags }}
       - name: Run slow tests
-        run: cargo test --all-features --verbose --release --all -- --ignored
+        run: >
+          cargo test
+          --workspace
+          ${{ steps.prepare.outputs.feature-flags }}
+          --features expensive-tests
+          -- --ignored
+      - name: Verify working directory is clean
+        run: git diff --exit-code
+
+  # States that we want to ensure can be built, but that we don't actively run tests for.
+  check-msrv:
+    name: >
+      Check${{
+      matrix.state != 'NOT_A_PUZZLE' && format(' {0}', matrix.state) || ''
+      }} build on ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.state != 'NOT_A_PUZZLE' }}
+    strategy:
+      matrix:
+        target:
+          - Linux
+          - macOS
+          - Windows
+        state:
+          - ZFuture
+
+        include:
+          - target: Linux
+            os: ubuntu-latest
+          - target: macOS
+            os: macOS-latest
+          - target: Windows
+            os: windows-latest
+
+          - state: ZFuture
+            rustflags: '--cfg zcash_unstable="zfuture"'
+
+    env:
+      RUSTFLAGS: ${{ matrix.rustflags }}
+      RUSTDOCFLAGS: ${{ matrix.rustflags }}
+
+    steps:
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
+        with:
+          extra-features: ${{ matrix.state != 'NOT_A_PUZZLE' && matrix.extra_flags || '' }}
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-msrv-${{ hashFiles('**/Cargo.lock') }}
+      - name: Run check
+        run: >
+          cargo check
+          --release
+          --workspace
+          --tests
+          ${{ steps.prepare.outputs.feature-flags }}
       - name: Verify working directory is clean
         run: git diff --exit-code
 
-  build:
+  build-latest:
+    name: Latest build on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macOS-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-latest
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+      - run: rustup override set ${{steps.toolchain.outputs.name}}
+      - name: Remove lockfile to build with latest dependencies
+        run: rm Cargo.lock
+      - name: Build crates
+        run: >
+          cargo build
+          --workspace
+          --all-targets
+          ${{ steps.prepare.outputs.feature-flags }}
+          --verbose
+      - name: Verify working directory is clean (excluding lockfile)
+        run: git diff --exit-code ':!Cargo.lock'
+
+  build-nodefault:
     name: Build target ${{ matrix.target }}
     runs-on: ubuntu-latest
     strategy:
@@ -43,46 +176,69 @@ jobs:
           - wasm32-wasi
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          path: crates
+      # We use a synthetic crate to ensure no dev-dependencies are enabled, which can
+      # be incompatible with some of these targets.
+      - name: Create synthetic crate for testing
+        run: cargo init --lib ci-build
+      - name: Copy Rust version into synthetic crate
+        run: cp crates/rust-toolchain.toml ci-build/
+      - name: Copy patch directives into synthetic crate
+        run: |
+          echo "[patch.crates-io]" >> ./ci-build/Cargo.toml
+          cat ./crates/Cargo.toml | sed "0,/.\+\(patch.crates.\+\)/d" >> ./ci-build/Cargo.toml
+      - name: Add zcash_proofs as a dependency of the synthetic crate
+        working-directory: ./ci-build
+        run: cargo add --no-default-features --path ../crates/zcash_proofs
+      - name: Add zcash_client_backend as a dependency of the synthetic crate
+        working-directory: ./ci-build
+        run: cargo add --path ../crates/zcash_client_backend
+      - name: Copy pinned dependencies into synthetic crate
+        run: cp crates/Cargo.lock ci-build/
       - name: Add target
+        working-directory: ./ci-build
         run: rustup target add ${{ matrix.target }}
-      - run: cargo fetch
-      - name: Build zcash_proofs for target
-        working-directory: ./zcash_proofs
-        run: cargo build --verbose --no-default-features --target ${{ matrix.target }}
-      - name: Build zcash_client_backend for target
-        working-directory: ./zcash_client_backend
-        run: cargo build --verbose --no-default-features --target ${{ matrix.target }}
+      - name: Build for target
+        working-directory: ./ci-build
+        run: cargo build --verbose --target ${{ matrix.target }}
 
   bitrot:
     name: Bitrot check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       # Build benchmarks to prevent bitrot
       - name: Build benchmarks
         run: cargo build --all --benches
 
   clippy:
     name: Clippy (MSRV)
-    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
       - name: Run clippy
         uses: actions-rs/clippy-check@v1
         with:
           name: Clippy (MSRV)
           token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features --all-targets -- -D warnings
+          args: >
+            ${{ steps.prepare.outputs.feature-flags }}
+            --all-targets
+            --
+            -D warnings
 
   clippy-beta:
     name: Clippy (beta)
-    timeout-minutes: 30
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
       - uses: dtolnay/rust-toolchain@beta
         id: toolchain
       - run: rustup override set ${{steps.toolchain.outputs.name}}
@@ -92,7 +248,11 @@ jobs:
         with:
           name: Clippy (beta)
           token: ${{ secrets.GITHUB_TOKEN }}
-          args: --all-features --all-targets -- -W clippy::all
+          args: >
+            ${{ steps.prepare.outputs.feature-flags }}
+            --all-targets
+            --
+            -W clippy::all
 
   codecov:
     name: Code coverage
@@ -102,42 +262,125 @@ jobs:
       options: --security-opt seccomp=unconfined
 
     steps:
-      - uses: actions/checkout@v3
-      - name: Fetch path to Zcash parameters
-        working-directory: ./zcash_proofs
-        shell: bash
-        run: echo "ZCASH_PARAMS=$(cargo run --release --example get-params-path --features directories)" >> $GITHUB_ENV
-      - name: Cache Zcash parameters
-        id: cache-params
-        uses: actions/cache@v3.3.1
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
+      - uses: actions/cache@v4
         with:
-          path: ${{ env.ZCASH_PARAMS }}
-          key: ${{ runner.os }}-params
-      - name: Fetch Zcash parameters
-        if: steps.cache-params.outputs.cache-hit != 'true'
-        working-directory: ./zcash_proofs
-        run: cargo run --release --example download-params --features download-params
-
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: codecov-cargo-${{ hashFiles('**/Cargo.lock') }}
       - name: Generate coverage report
-        run: cargo tarpaulin --engine llvm --all-features --release --timeout 600 --out Xml
+        run: >
+          cargo tarpaulin
+          --engine llvm
+          ${{ steps.prepare.outputs.feature-flags }}
+          --release
+          --timeout 600
+          --out xml
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3.1.3
+        uses: codecov/codecov-action@v4.6.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   doc-links:
     name: Intra-doc links
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
       - run: cargo fetch
       # Requires #![deny(rustdoc::broken_intra_doc_links)] in crates.
       - name: Check intra-doc links
-        run: cargo doc --all --document-private-items
+        run: >
+          cargo doc
+          --all
+          ${{ steps.prepare.outputs.feature-flags }}
+          --document-private-items
 
   fmt:
     name: Rustfmt
-    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Check formatting
         run: cargo fmt --all -- --check
+
+  protobuf:
+    name: protobuf consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - id: prepare
+        uses: ./.github/actions/prepare
+      - name: Install protoc
+        uses: supplypike/setup-bin@v4
+        with:
+          uri: 'https://github.com/protocolbuffers/protobuf/releases/download/v25.1/protoc-25.1-linux-x86_64.zip'
+          name: 'protoc'
+          version: '25.1'
+          subPath: 'bin'
+      - name: Trigger protobuf regeneration
+        run: >
+          cargo check
+          --workspace
+          ${{ steps.prepare.outputs.feature-flags }}
+      - name: Verify working directory is clean
+        run: git diff --exit-code
+
+  uuid:
+    name: UUID validity
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Extract UUIDs
+        id: extract
+        run: |
+          {
+            echo 'UUIDS<<EOF'
+            git grep -h "const MIGRATION_ID: Uuid = Uuid::from_u128" zcash_client_sqlite/ |
+              sed -e "s,.*Uuid::from_u128(0x,," -e "s,_,-,g" -e "s,);,,"
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+      - name: Check UUID validity
+        env:
+          UUIDS: ${{ steps.extract.outputs.UUIDS }}
+        run: uuidparse -n -o type $UUIDS | xargs -L 1 test "invalid" !=
+      - name: Check UUID type
+        env:
+          UUIDS: ${{ steps.extract.outputs.UUIDS }}
+        run: uuidparse -n -o type $UUIDS | xargs -L 1 test "random" =
+      - name: Check UUID uniqueness
+        env:
+          UUIDS: ${{ steps.extract.outputs.UUIDS }}
+        run: >
+          test $(
+            uuidparse -n -o uuid $U4 | wc -l
+          ) -eq $(
+            uuidparse -n -o uuid $U4 | sort | uniq | wc -l
+          )
+
+  required-checks:
+    name: Required status checks have passed
+    needs:
+      - test
+      - check-msrv
+      - build-latest
+      - build-nodefault
+      - bitrot
+      - clippy
+      - doc-links
+      - fmt
+      - protobuf
+      - uuid
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine whether all required-pass steps succeeded
+        run: |
+          echo '${{ toJSON(needs) }}' | jq -e '[ .[] | .result == "success" ] | all'
diff --git a/.gitignore b/.gitignore
index fa8d85ac52..eb5a316cbd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
-Cargo.lock
 target
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
deleted file mode 100644
index 001f415bb4..0000000000
--- a/.gitlab-ci.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-
-# /************************************************************************
- #  File: .gitlab-ci.yml
- #  Author: mdr0id
- #  Date: 9/10/2018
- #  Description:  Used to setup runners/jobs for librustzcash
- #  Usage: Commit source and the pipeline will trigger the according jobs.
- #         For now the build and test are done in the same jobs.
- #
- #  Known bugs/missing features:
- #
- # ************************************************************************/
-  
-stages:
-  - build
-  - test
-  - deploy
-
-rust-latest:
-  stage: build
-  image: rust:latest
-  script:
-    - cargo --verbose --version
-    - time cargo build --verbose
-
-rust-nightly:
-  stage: build
-  image: rustlang/rust:nightly
-  script:
-    - cargo --verbose --version
-    - cargo build --verbose
-  allow_failure: true
-
-librustzcash-test-latest:
-  stage: test
-  image: rust:latest
-  script:
-    - cargo --verbose --version
-    - time cargo test --release --verbose
-
-librustzcash-test-rust-nightly:
-  stage: test
-  image: rustlang/rust:nightly
-  script:
-    - cargo --verbose --version
-    - cargo test --release --verbose
-  allow_failure: true
-
-#used to manually deploy a given release
-librustzcash-rust-rc:
-  stage: deploy
-  image: rust:latest
-  script:
-    - cargo --verbose --version
-    - time cargo build --release --verbose
-  when: manual
-
-#used to manually deploy a given release
-librustzcash-rust-nightly-rc:
-  stage: deploy
-  image: rustlang/rust:nightly
-  script:
-    - cargo --verbose --version
-    - cargo build --release --verbose
-  allow_failure: true
-  when: manual
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000000..b31e2934f4
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,4 @@
+{
+    "rust-analyzer.cargo.features": "all",
+    "rust-analyzer.server.extraEnv": { "RUSTUP_TOOLCHAIN": "stable" }
+}
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000000..a0390d68d1
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,6384 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+ "zeroize",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
+[[package]]
+name = "ambassador"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b27ba24e4d8a188489d5a03c7fabc167a60809a383cdb4d15feb37479cd2a48"
+dependencies = [
+ "itertools 0.10.5",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "amplify"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e711289a6cb28171b4f0e6c8019c69ff9476050508dc082167575d458ff74d0"
+dependencies = [
+ "amplify_derive",
+ "amplify_num",
+ "ascii",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "amplify_derive"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "759dcbfaf94d838367a86d493ec34ccc8aa6fe365cb7880d6bf89006de24d9c1"
+dependencies = [
+ "amplify_syn",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "amplify_num"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04c009c5c4de814911b177e2ea59e4930bb918978ed3cce4900d846a6ceb0838"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "amplify_syn"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7736fb8d473c0d83098b5bac44df6a561e20470375cd8bcae30516dc889fd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anes"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
+
+[[package]]
+name = "anstyle"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bec1de6f59aedf83baf9ff929c98f2ad654b97c9510f4e70cf6f661d49fd5b1"
+
+[[package]]
+name = "anyhow"
+version = "1.0.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25bdb32cbbdce2b519a9cd7df3a678443100e265d5e25ca763b7572a5104f5f3"
+
+[[package]]
+name = "arrayref"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b4930d2cb77ce62f89ee5d5289b4ac049559b1c45539271f5ed4fdc7db34545"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+
+[[package]]
+name = "arti-client"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5a726d39f22ddf0dcf0ea903d900592167d60a32e46f202e83651a1be8c452e"
+dependencies = [
+ "async-trait",
+ "cfg-if",
+ "derive-deftly",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "educe",
+ "fs-mistrust",
+ "futures",
+ "hostname-validator",
+ "humantime",
+ "humantime-serde",
+ "libc",
+ "postage",
+ "rand",
+ "safelog",
+ "serde",
+ "thiserror",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-chanmgr",
+ "tor-circmgr",
+ "tor-config",
+ "tor-dirmgr",
+ "tor-error",
+ "tor-guardmgr",
+ "tor-keymgr",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-memquota",
+ "tor-netdir",
+ "tor-netdoc",
+ "tor-persist",
+ "tor-proto",
+ "tor-rtcompat",
+ "tracing",
+ "void",
+]
+
+[[package]]
+name = "ascii"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
+
+[[package]]
+name = "assert_matches"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
+
+[[package]]
+name = "async-compression"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd066d0b4ef8ecb03a55319dc13aa6910616d0f44008a045bb1835af830abff5"
+dependencies = [
+ "flate2",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "pin-project-lite",
+ "xz2",
+ "zstd",
+ "zstd-safe",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd56dd203fef61ac097dd65721a419ddccb106b2d2b70ba60a6b529f03961a51"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16e62a023e7c117e27523144c5d2459f4397fcc3cab0085af8e2224f643a0193"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e0c28dcc82d7c8ead5cb13beb15405b57b8546e93215673ff8ca0349a028107"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "async_executors"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a982d2f86de6137cc05c9db9a915a19886c97911f9790d04f174cede74be01a5"
+dependencies = [
+ "blanket",
+ "futures-core",
+ "futures-task",
+ "futures-util",
+ "pin-project",
+ "rustc_version",
+ "tokio",
+]
+
+[[package]]
+name = "asynchronous-codec"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a860072022177f903e59730004fb5dc13db9275b79bb2aef7ba8ce831956c233"
+dependencies = [
+ "bytes",
+ "futures-sink",
+ "futures-util",
+ "memchr",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "atomic"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c59bdb34bc650a32731b31bd8f0829cc15d24a708ee31559e0bb34f2bc320cba"
+
+[[package]]
+name = "atomic"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d818003e740b63afc82337e3160717f4f63078720a810b7b903e70a5d1d2994"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+
+[[package]]
+name = "axum"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a6c9af12842a67734c9a2e355436e5d03b22383ed60cf13cd0c18fbfe3dcbcf"
+dependencies = [
+ "async-trait",
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "sync_wrapper 1.0.1",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a15c63fd72d41492dc4f497196f5da1fb04fb7529e631d73630d1b491e47a2e3"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper 0.1.2",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "backtrace"
+version = "0.3.71"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b05800d2e817c8b3b4b54abd461726265fa9789ae34330622f2db9ee696f9d"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
+[[package]]
+name = "bech32"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d86b93f97252c47b41663388e6d155714a9d0c398b99f1005cbc5f978b29f445"
+
+[[package]]
+name = "bellman"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afceed28bac7f9f5a508bca8aeeff51cdfa4770c0b967ac55c621e2ddfd6171"
+dependencies = [
+ "bitvec",
+ "blake2s_simd",
+ "byteorder",
+ "crossbeam-channel",
+ "ff",
+ "group",
+ "lazy_static",
+ "log",
+ "num_cpus",
+ "pairing",
+ "rand_core",
+ "rayon",
+ "subtle",
+]
+
+[[package]]
+name = "bip0039"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e68a5a99c65851e7be249f5cf510c0a136f18c9bca32139576d59bd3f577b043"
+dependencies = [
+ "hmac",
+ "pbkdf2",
+ "rand",
+ "sha2",
+ "unicode-normalization",
+ "zeroize",
+]
+
+[[package]]
+name = "bip32"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e141fb0f8be1c7b45887af94c88b182472b57c96b56773250ae00cd6a14a164"
+dependencies = [
+ "bs58",
+ "hmac",
+ "rand_core",
+ "ripemd",
+ "secp256k1",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
+
+[[package]]
+name = "bitvec"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "blake2b_simd"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23285ad32269793932e830392f2fe2f83e26488fd3ec778883a93c8323735780"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "constant_time_eq",
+]
+
+[[package]]
+name = "blake2s_simd"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94230421e395b9920d23df13ea5d77a20e1725331f90fbbf6df6040b33f756ae"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "constant_time_eq",
+]
+
+[[package]]
+name = "blanket"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0b121a9fe0df916e362fb3271088d071159cdf11db0e4182d02152850756eff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bls12_381"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7bc6d6292be3a19e6379786dac800f551e5865a5bb51ebbe3064ab80433f403"
+dependencies = [
+ "ff",
+ "group",
+ "pairing",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "bounded-vec-deque"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2225b558afc76c596898f5f1b3fc35cfce0eb1b13635cbd7d1b2a7177dc10ccd"
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "sha2",
+ "tinyvec",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+
+[[package]]
+name = "by_address"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
+
+[[package]]
+name = "bytemuck"
+version = "1.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "102087e286b4677862ea56cf8fc58bb2cdfa8725c40ffb80fe3a008eb7f2fc83"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
+
+[[package]]
+name = "caret"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1df55dc0c84d5a555c4b8b84ecf3cff724df77a7b1a8c4a70cd66a981524cff0"
+
+[[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cc"
+version = "1.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b16803a61b81d9eabb7eae2588776c4c1e584b738ede45fdbb4c972cec1e9945"
+dependencies = [
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "num-traits",
+ "serde",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "ciborium"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
+dependencies = [
+ "ciborium-io",
+ "ciborium-ll",
+ "serde",
+]
+
+[[package]]
+name = "ciborium-io"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
+
+[[package]]
+name = "ciborium-ll"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
+dependencies = [
+ "ciborium-io",
+ "half",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97f376d85a664d5837dbae44bf546e6477a679ff6610010f17276f686d867e8"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19bc80abd44e4bed93ca373a0704ccbd1b710dc5749406201bb018272808dc54"
+dependencies = [
+ "anstyle",
+ "clap_lex",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1462739cb27611015575c0c11df5df7601141071f07518d56fcc1be504cbec97"
+
+[[package]]
+name = "coarsetime"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b3839cf01bb7960114be3ccf2340f541b6d0c81f8690b007b2b39f750f7e5d"
+dependencies = [
+ "libc",
+ "wasix",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
+
+[[package]]
+name = "convert_case"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+
+[[package]]
+name = "cpp_demangle"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8227005286ec39567949b33df9896bcadfa6051bccca2488129f108ca23119"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53fe5e26ff1b7aef8bca9c6080520cfb8d9333c7568e1829cef191a9723e5504"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "criterion"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
+dependencies = [
+ "anes",
+ "cast",
+ "ciborium",
+ "clap",
+ "criterion-plot",
+ "is-terminal",
+ "itertools 0.10.5",
+ "num-traits",
+ "once_cell",
+ "oorandom",
+ "plotters",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "tinytemplate",
+ "walkdir",
+]
+
+[[package]]
+name = "criterion-plot"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
+dependencies = [
+ "cast",
+ "itertools 0.10.5",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab3db02a9c5b5121e1e42fbdb1aeb65f5e02624cc58c43f2884c6ccac0b82f95"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+
+[[package]]
+name = "crunchy"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "rand_core",
+ "typenum",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "daggy"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91a9304e55e9d601a39ae4deaba85406d5c0980e106f65afcf0460e9af1e7602"
+dependencies = [
+ "petgraph",
+]
+
+[[package]]
+name = "darling"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b750cb3417fd1b327431a470f388520309479ab0bf5e323505daf0290cd3850"
+dependencies = [
+ "darling_core 0.14.4",
+ "darling_macro 0.14.4",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+dependencies = [
+ "darling_core 0.20.10",
+ "darling_macro 0.20.10",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "109c1ca6e6b7f82cc233a97004ea8ed7ca123a9af07a8230878fcfda9b158bf0"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.10.0",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4aab4dbc9f7611d8b55048a3a16d2d010c2c8334e46304b40ac1cc14bf3b48e"
+dependencies = [
+ "darling_core 0.14.4",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+dependencies = [
+ "darling_core 0.20.10",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
+
+[[package]]
+name = "debugid"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef552e6f588e446098f6ba40d89ac146c8c7b64aade83c051ee00bb5d2bc18d"
+dependencies = [
+ "uuid",
+]
+
+[[package]]
+name = "der"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+ "serde",
+]
+
+[[package]]
+name = "derive-adhoc"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5283ac2881753c76c0892406705553f0d9ab30649f81e18964d3408f4501edb8"
+dependencies = [
+ "derive-adhoc-macros",
+ "heck 0.4.1",
+]
+
+[[package]]
+name = "derive-adhoc-macros"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c21b673a9b8c78c34908e6fcb42b922e11c4df2de5237f1c3f58d3285904a84b"
+dependencies = [
+ "heck 0.4.1",
+ "itertools 0.11.0",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "sha3",
+ "strum 0.25.0",
+ "syn 1.0.109",
+ "void",
+]
+
+[[package]]
+name = "derive-deftly"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f9bc3564f74be6c35d49a7efee54380d7946ccc631323067f33fabb9246027"
+dependencies = [
+ "derive-deftly-macros",
+ "heck 0.5.0",
+]
+
+[[package]]
+name = "derive-deftly-macros"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b84d32b18d9a256d81e4fec2e4cfd0ab6dde5e5ff49be1713ae0adbd0060c2"
+dependencies = [
+ "heck 0.5.0",
+ "indexmap 2.6.0",
+ "itertools 0.13.0",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "sha3",
+ "strum 0.26.3",
+ "syn 2.0.63",
+ "void",
+]
+
+[[package]]
+name = "derive_builder_core_fork_arti"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24c1b715c79be6328caa9a5e1a387a196ea503740f0722ec3dd8f67a9e72314d"
+dependencies = [
+ "darling 0.14.4",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "derive_builder_fork_arti"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3eae24d595f4d0ecc90a9a5a6d11c2bd8dafe2375ec4a1ec63250e5ade7d228"
+dependencies = [
+ "derive_builder_macro_fork_arti",
+]
+
+[[package]]
+name = "derive_builder_macro_fork_arti"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69887769a2489cd946bf782eb2b1bb2cb7bc88551440c94a765d4f040c08ebf3"
+dependencies = [
+ "derive_builder_core_fork_arti",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "derive_more"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a9b99b9cbbe49445b21764dc0625032a89b145a2642e67603e1c936f5458d05"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7330aeadfbe296029522e6c40f315320aba36fc43a5b3632f3795348f3bd22"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+ "unicode-xid",
+]
+
+[[package]]
+name = "devtools"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "bech32",
+ "bellman",
+ "bip0039",
+ "blake2b_simd",
+ "ed25519-zebra",
+ "equihash",
+ "group",
+ "gumdrop",
+ "hex",
+ "jubjub",
+ "lazy_static",
+ "orchard",
+ "sapling-crypto",
+ "secp256k1",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tokio",
+ "tonic",
+ "uint",
+ "zcash_address",
+ "zcash_client_backend",
+ "zcash_encoding",
+ "zcash_keys",
+ "zcash_note_encryption",
+ "zcash_primitives",
+ "zcash_proofs",
+ "zcash_protocol",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "directories"
+version = "5.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a49173b84e034382284f27f1af4dcbbd231ffa358c0fe316541a7337f376a35"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs"
+version = "5.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef5282ad69563b5fc40319526ba27e0e7363d552a896f0297d54f767717f9b95"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d6ef0072f8a535281e4876be788938b528e9a1d43900b82c2569af7da799125"
+
+[[package]]
+name = "dynosaur"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47baef31f408cc1a54eadcb0160ffe2b935b5963bd2b519719f3a101749af524"
+dependencies = [
+ "dynosaur_derive",
+ "trait-variant",
+]
+
+[[package]]
+name = "dynosaur_derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320c6861ca45ea23faee2bd86a6c7f20ec4b7a64a2773971cd4f52ae61615463"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "serde",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "merlin",
+ "rand_core",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "ed25519-zebra"
+version = "4.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d9ce6874da5d4415896cd45ffbc4d1cfc0c4f9c079427bd870742c30f2f65a9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "hashbrown 0.14.5",
+ "hex",
+ "rand_core",
+ "serde",
+ "sha2",
+ "zeroize",
+]
+
+[[package]]
+name = "educe"
+version = "0.4.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0042ff8246a363dbe77d2ceedb073339e85a804b9a47636c6e016a9a32c05f"
+dependencies = [
+ "enum-ordinalize",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "either"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "pkcs8",
+ "rand_core",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "enum-ordinalize"
+version = "3.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bf1fa3f06bbff1ea5b1a9c7b14aa992a39657db60a2759457328d7e058f49ee"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "equihash"
+version = "0.2.0"
+dependencies = [
+ "blake2b_simd",
+ "byteorder",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "5.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6032be9bd27023a771701cc49f9f053c751055f71efb2e0ae5c15809093675ba"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "f4jumble"
+version = "0.1.0"
+dependencies = [
+ "blake2b_simd",
+ "hex",
+ "proptest",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "fastrand"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
+
+[[package]]
+name = "ff"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
+dependencies = [
+ "bitvec",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "figment"
+version = "0.10.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cb01cd46b0cf372153850f4c6c272d9cbea2da513e07538405148f95bd789f3"
+dependencies = [
+ "atomic 0.6.0",
+ "serde",
+ "toml",
+ "uncased",
+ "version_check",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35c0522e981e68cbfa8c3f978441a5f34b30b96e146b33cd3359176b50fe8586"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "libredox",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "findshlibs"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40b9e59cd0f7e0806cca4be089683ecb6434e602038df21fe6bf6711b2f07f64"
+dependencies = [
+ "cc",
+ "lazy_static",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "fixed-hash"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "835c052cb0c08c1acf6ffd71c022172e18723949c8282f2b9f27efbc51e64534"
+dependencies = [
+ "static_assertions",
+]
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "flate2"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fluid-let"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "749cff877dc1af878a0b31a41dd221a753634401ea0ef2f87b62d3171522485a"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "fpe"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c4b37de5ae15812a764c958297cfc50f5c010438f60c6ce75d11b802abd404"
+dependencies = [
+ "cbc",
+ "cipher",
+ "libm",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "fs-mistrust"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf84fbaf375e6a485fa126f6335c0cfa7741114aa4f86ba37960a42cd1994b8"
+dependencies = [
+ "derive_builder_fork_arti",
+ "dirs",
+ "libc",
+ "once_cell",
+ "pwd-grp",
+ "serde",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "fslock"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04412b8935272e3a9bae6f48c7bfff74c2911f60525404edfdd28e49884c3bfb"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
+[[package]]
+name = "futures"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "645c6916888f6cb6350d2550b80fb63e734897a8498abe35cfb732b6487804b0"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac8f7d7865dcb88bd4373ab671c8cf4508703796caa2b1985a9ca867b3fcb78"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfc6580bb841c5a68e9ef15c77ccc837b40a7504914d52e47b8b0e9bbda25a1d"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a576fc72ae164fca6b9db127eaa9a9dda0d61316034f33a0a0d4eda41f02b01d"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "futures-rustls"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f2f12607f92c69b12ed746fabf9ca4f5c482cba46679c1a75b874ed7c26adb"
+dependencies = [
+ "futures-io",
+ "rustls 0.23.12",
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb8e00e87438d937621c1c6269e53f536c14d3fbd6a042bb24879e57d474fb5"
+
+[[package]]
+name = "futures-task"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d84fa142264698cdce1a9f9172cf383a0c82de1bddcf3092901442c4097004"
+
+[[package]]
+name = "futures-util"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d6401deb83407ab3da39eba7e33987a73c3df0c82b4bb5813ee871c19c41d48"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+ "zeroize",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "gimli"
+version = "0.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4271d37baee1b8c7e4b708028c57d816cf9d2434acb33a549475f78c181f6253"
+
+[[package]]
+name = "glob-match"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9985c9503b412198aa4197559e9a318524ebc4519c229bfa05a535828c950b9d"
+
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "memuse",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "gumdrop"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bc700f989d2f6f0248546222d9b4258f5b02a171a431f8285a81c08142629e3"
+dependencies = [
+ "gumdrop_derive",
+]
+
+[[package]]
+name = "gumdrop_derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "729f9bd3449d77e7831a18abfb7ba2f99ee813dfd15b8c2167c9a54ba20aa99d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa82e28a107a8cc405f0839610bdc9b15f1e25ec7d696aa5cf173edbcb1486ab"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.6.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b4af3693f1b705df946e9fe5631932443781d0aabb423b62fcd4d73f6d2fd0"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "halo2_gadgets"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "126a150072b0c38c7b573fe3eaf0af944a7fed09e154071bf2436d3f016f7230"
+dependencies = [
+ "arrayvec",
+ "bitvec",
+ "ff",
+ "group",
+ "halo2_proofs",
+ "lazy_static",
+ "pasta_curves",
+ "rand",
+ "subtle",
+ "uint",
+]
+
+[[package]]
+name = "halo2_legacy_pdqsort"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47716fe1ae67969c5e0b2ef826f32db8c3be72be325e1aa3c1951d06b5575ec5"
+
+[[package]]
+name = "halo2_proofs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b867a8d9bbb85fca76fff60652b5cd19b853a1c4d0665cb89bee68b18d2caf0"
+dependencies = [
+ "blake2b_simd",
+ "ff",
+ "group",
+ "halo2_legacy_pdqsort",
+ "maybe-rayon",
+ "pasta_curves",
+ "rand_core",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e087f84d4f86bf4b218b927129862374b72199ae7d8657835f1e89000eea4fb"
+
+[[package]]
+name = "hashlink"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "hostname-validator"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f558a64ac9af88b5ba400d99b579451af0d39c6d360980045b91aac966d705e2"
+
+[[package]]
+name = "http"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "humantime-serde"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57a3db5ea5923d99402c94e9feb261dc5ee9b4efa158b0315f788cf549cc200c"
+dependencies = [
+ "humantime",
+ "serde",
+]
+
+[[package]]
+name = "hyper"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50dfd22e0e76d0f662d429a5f80fcaf3855009297eab6a0a9f8543834744ba05"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3203a961e5c83b6f5498933e78b6b263e208c197b63e9c6c53cc82ffd3f63793"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab92f4f49ee4fb4f997c784b7a2e0fa70050211e0b6a287f898c3c9785ca956"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "incrementalmerkletree"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45063fbc4b0a37837f6bfe0445f269d13d730ad0aa3b5a7f74aa7bf27a0f4df"
+dependencies = [
+ "either",
+ "proptest",
+ "rand",
+ "rand_core",
+]
+
+[[package]]
+name = "incrementalmerkletree-testing"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc7fb094e413bc6daea7b30a6f2c749e47fd07e98691c6ef3b3423d4ef4b7fb6"
+dependencies = [
+ "incrementalmerkletree",
+ "proptest",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707907fe3c25f5424cce2cb7e1cbcafee6bdbe735ca90ef77c29e84591e5b9da"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.15.0",
+ "serde",
+]
+
+[[package]]
+name = "inferno"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "321f0f839cd44a4686e9504b0a62b4d69a50b62072144c71c68f5873c167b8d9"
+dependencies = [
+ "ahash",
+ "indexmap 2.6.0",
+ "is-terminal",
+ "itoa",
+ "log",
+ "num-format",
+ "once_cell",
+ "quick-xml",
+ "rgb",
+ "str_stack",
+]
+
+[[package]]
+name = "inotify"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
+[[package]]
+name = "inotify-sys"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "inventory"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f958d3d68f4167080a18141e10381e7634563984a537f2a49a30fd8e53ac5767"
+
+[[package]]
+name = "is-terminal"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "jobserver"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2b099aaa34a9751c5bf0878add70444e1ed2dd73f347be99003d4577277de6e"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jubjub"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8499f7a74008aafbecb2a2e608a3e13e4dd3e84df198b604451efe93f2de6e61"
+dependencies = [
+ "bitvec",
+ "bls12_381",
+ "ff",
+ "group",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "keccak"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f6d5ed8676d904364de097082f4e7d240b571b67989ced0240f08b7f966f940"
+dependencies = [
+ "cpufeatures",
+]
+
+[[package]]
+name = "known-folders"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4397c789f2709d23cfcb703b316e0766a8d4b17db2d47b0ab096ef6047cae1d8"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "kqueue"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
+dependencies = [
+ "kqueue-sys",
+ "libc",
+]
+
+[[package]]
+name = "kqueue-sys"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.8",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
+
+[[package]]
+name = "libm"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
+
+[[package]]
+name = "libredox"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+dependencies = [
+ "bitflags 2.6.0",
+ "libc",
+ "redox_syscall",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+
+[[package]]
+name = "litrs"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ce301924b7887e9d637144fdade93f9dfff9b60981d4ac161db09720d39aa5"
+
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+
+[[package]]
+name = "lzma-sys"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "matchers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+dependencies = [
+ "regex-automata 0.1.10",
+]
+
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
+[[package]]
+name = "maybe-rayon"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
+dependencies = [
+ "cfg-if",
+ "rayon",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memmap2"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe751422e4a8caa417e13c3ea66452215d7d63e19e604f4980461212f3ae1322"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "memuse"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2145869435ace5ea6ea3d35f59be559317ec9a0d04e1812d5f185a87b6d36f1a"
+dependencies = [
+ "nonempty",
+]
+
+[[package]]
+name = "merlin"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58c38e2799fc0978b65dfff8023ec7843e2330bb462f19198840b34b6582397d"
+dependencies = [
+ "byteorder",
+ "keccak",
+ "rand_core",
+ "zeroize",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d811f3e15f28568be3407c8e7fdb6514c1cda3cb30683f15b6a1a1dc4ea14a7"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "minreq"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "763d142cdff44aaadd9268bebddb156ef6c65a0e13486bb81673cf2d8739f9b0"
+dependencies = [
+ "log",
+ "once_cell",
+ "rustls 0.21.12",
+ "rustls-webpki 0.101.7",
+ "webpki-roots 0.25.4",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "multimap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5ce46fe64a9d73be07dcbe690a38ce1b293be448fd8ce1e6c1b8062c9f72c6a"
+
+[[package]]
+name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nonempty"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
+
+[[package]]
+name = "notify"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+dependencies = [
+ "bitflags 2.6.0",
+ "filetime",
+ "inotify",
+ "kqueue",
+ "libc",
+ "log",
+ "mio",
+ "walkdir",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c165a9ab64cf766f73521c0dd2cfdff64f488b8f0b3e621face3462d3db536d7"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-format"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a652d9771a63711fd3c3deb670acfbe5c30a4072e664d7a3bf5a9e1056ac72c3"
+dependencies = [
+ "arrayvec",
+ "itoa",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02339744ee7253741199f897151b38e72257d13802d4ee837285cc2990a90845"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "681030a937600a36906c185595136d26abfebb4aa9c65701cefcaf8578bb982b"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "object"
+version = "0.32.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6a622008b6e321afc04970976f62ee297fdbaa6f95318ca343e3eebb9648441"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "oneshot-fused-workaround"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f49cbc8293c5ba37516d29aba392a94a34638367d17d67617cea34e4f9acd05"
+dependencies = [
+ "futures",
+]
+
+[[package]]
+name = "oorandom"
+version = "11.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b410bbe7e14ab526a0e86877eb47c6996a2bd7746f027ba551028c925390e4e9"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "orchard"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f18e997fa121de5c73e95cdc7e8512ae43b7de38904aeea5e5713cc48f3c0ba"
+dependencies = [
+ "aes",
+ "bitvec",
+ "blake2b_simd",
+ "ff",
+ "fpe",
+ "group",
+ "halo2_gadgets",
+ "halo2_proofs",
+ "hex",
+ "incrementalmerkletree",
+ "lazy_static",
+ "memuse",
+ "nonempty",
+ "pasta_curves",
+ "proptest",
+ "rand",
+ "reddsa",
+ "serde",
+ "subtle",
+ "tracing",
+ "visibility",
+ "zcash_note_encryption",
+ "zcash_spec",
+ "zip32",
+]
+
+[[package]]
+name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70786f51bcc69f6a4c0360e063a4cac5419ef7c5cd5b3c99ad70f3be5ba79209"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
+name = "p521"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
+dependencies = [
+ "base16ct",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "rand_core",
+ "sha2",
+]
+
+[[package]]
+name = "pairing"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81fec4625e73cf41ef4bb6846cafa6d44736525f442ba45e407c4a000a13996f"
+dependencies = [
+ "group",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb813b8af86854136c6922af0598d719255ecb2179515e6e7730d468f05c9cae"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
+dependencies = [
+ "base64ct",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "pasta_curves"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e57598f73cc7e1b2ac63c79c517b31a0877cd7c402cdcaa311b5208de7a095"
+dependencies = [
+ "blake2b_simd",
+ "ff",
+ "group",
+ "lazy_static",
+ "rand",
+ "static_assertions",
+ "subtle",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pbkdf2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
+dependencies = [
+ "digest",
+ "password-hash",
+]
+
+[[package]]
+name = "pczt"
+version = "0.0.0"
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "petgraph"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
+dependencies = [
+ "fixedbitset",
+ "indexmap 2.6.0",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ade2d8b8f33c7333b51bcf0428d37e217e9f32192ae4772156f65063b8ce03dc"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e4cc64c2ad9ebe670cb8fd69dd50ae301650392e81c05f9bfcb2d5bdbc24b0"
+dependencies = [
+ "phf_shared",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3444646e286606587e49f3bcf1679b8cef1dc2c5ecc29ddacaffc305180d464b"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bda66fc9667c18cb2758a2ac84d1167245054bcf85d5d1aaa6923f45801bdd02"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+
+[[package]]
+name = "plotters"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c224ba00d7cadd4d5c660deaf2098e5e80e07846537c51f9cfa4be50c1fd45"
+dependencies = [
+ "num-traits",
+ "plotters-backend",
+ "plotters-svg",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e76628b4d3a7581389a35d5b6e2139607ad7c75b17aed325f210aa91f4a9609"
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38f6d39893cca0701371e3c27294f09797214b86f1fb951b89ade8ec04e2abab"
+dependencies = [
+ "plotters-backend",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "postage"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af3fb618632874fb76937c2361a7f22afd393c982a2165595407edc75b06d3c1"
+dependencies = [
+ "atomic 0.5.3",
+ "crossbeam-queue",
+ "futures",
+ "parking_lot",
+ "pin-project",
+ "static_assertions",
+ "thiserror",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "pprof"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef5c97c51bd34c7e742402e216abdeb44d415fbe6ae41d56b114723e953711cb"
+dependencies = [
+ "backtrace",
+ "cfg-if",
+ "criterion",
+ "findshlibs",
+ "inferno",
+ "libc",
+ "log",
+ "nix",
+ "once_cell",
+ "parking_lot",
+ "smallvec",
+ "symbolic-demangle",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f12335488a2f3b0a83b14edad48dca9879ce89b2edd10e80237e4e852dd645e"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
+[[package]]
+name = "primitive-types"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b34d9fd68ae0b74a41b21c03c2f62847aa0ffea044eee893b4c140b37e244e2"
+dependencies = [
+ "fixed-hash",
+ "uint",
+]
+
+[[package]]
+name = "priority-queue"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714c75db297bc88a63783ffc6ab9f830698a6705aa0201416931759ef4c8183d"
+dependencies = [
+ "autocfg",
+ "equivalent",
+ "indexmap 2.6.0",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proptest"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b476131c3c86cb68032fdc5cb6d5a1045e3e42d96b69fa599fd77701e1f5bf"
+dependencies = [
+ "bit-set",
+ "bit-vec",
+ "bitflags 2.6.0",
+ "lazy_static",
+ "num-traits",
+ "rand",
+ "rand_chacha",
+ "rand_xorshift",
+ "regex-syntax 0.8.4",
+ "rusty-fork",
+ "tempfile",
+ "unarray",
+]
+
+[[package]]
+name = "prost"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13db3d3fde688c61e2446b4d843bc27a7e8af269a69440c0308021dc92333cc"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-build"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bb182580f71dd070f88d01ce3de9f4da5021db7115d2e1c3605a754153b77c1"
+dependencies = [
+ "bytes",
+ "heck 0.5.0",
+ "itertools 0.13.0",
+ "log",
+ "multimap",
+ "once_cell",
+ "petgraph",
+ "prettyplease",
+ "prost",
+ "prost-types",
+ "regex",
+ "syn 2.0.63",
+ "tempfile",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18bec9b0adc4eba778b33684b7ba3e7137789434769ee3ce3930463ef904cfca"
+dependencies = [
+ "anyhow",
+ "itertools 0.13.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cee5168b05f49d4b0ca581206eb14a7b22fafd963efe729ac48eb03266e25cc2"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "pwd-grp"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6955c41fd7e4283bdf6ff3e7218b7e3f8ef24c4236b31d22be050f4cfd5e2a2c"
+dependencies = [
+ "derive-adhoc",
+ "libc",
+ "paste",
+ "thiserror",
+]
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quick-xml"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f50b1c63b38611e7d4d7f68b82d3ad0cc71a2ad2e7f61fc10f1328d917c93cd"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d25bf25ec5ae4a3f1b92f929810509a2f53d7dca2f50b794ff57e3face536c8f"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rayon"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1465873a3dfdaa8ae7cb14b4383657caab0b3e8a0aa9ae8e04b044854c8dfce2"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "reddsa"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78a5191930e84973293aa5f532b513404460cd2216c1cfb76d08748c15b40b02"
+dependencies = [
+ "blake2b_simd",
+ "byteorder",
+ "group",
+ "hex",
+ "jubjub",
+ "pasta_curves",
+ "rand_core",
+ "serde",
+ "thiserror",
+ "zeroize",
+]
+
+[[package]]
+name = "redjubjub"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a60db2c3bc9c6fd1e8631fee75abc008841d27144be744951d6b9b75f9b569c"
+dependencies = [
+ "rand_core",
+ "reddsa",
+ "serde",
+ "thiserror",
+ "zeroize",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "469052894dcb553421e483e4209ee581a45100d31b4018de03e5a7ad86374a7e"
+dependencies = [
+ "bitflags 2.6.0",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd283d9651eeda4b2a83a43c1c91b266c40fd76ecd39a50a8c630ae69dc72891"
+dependencies = [
+ "getrandom",
+ "libredox",
+ "thiserror",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.4.7",
+ "regex-syntax 0.8.4",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38caf58cc5ef2fed281f89292ef23f6365465ed9a41b7a7754eb4e26496c92df"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.4",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a66a03ae7c801facd77a29370b4faec201768915ac14a721ba36f20bc9c209b"
+
+[[package]]
+name = "retry-error"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ef93545b13f6dd83a9f98c8a656ccbd7bc2b95a747844346c70f7e6f5a5932"
+
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
+[[package]]
+name = "rgb"
+version = "0.8.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted 0.7.1",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "spin 0.9.8",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ripemd"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core",
+ "sha2",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+dependencies = [
+ "bitflags 2.6.0",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+ "time",
+ "uuid",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1790d1c4c0ca81211399e0e0af16333276f375209e71a37b67698a373db5b47a"
+dependencies = [
+ "arrayvec",
+ "num-traits",
+ "serde",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
+dependencies = [
+ "bitflags 2.6.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring 0.17.8",
+ "rustls-webpki 0.101.7",
+ "sct",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c58f8c84392efc0a126acce10fa59ff7b3d2ac06ab451a33f2741989b806b044"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring 0.17.8",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.6",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
+dependencies = [
+ "base64",
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "976295e77ce332211c0d24d92c0e83e50f5c5f046d11082cea19f3df13a3562d"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring 0.17.8",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e6b52d4fda176fd835fdc55a835d4a89b8499cad995885a21149d5ad62f852e"
+dependencies = [
+ "ring 0.17.8",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6"
+
+[[package]]
+name = "rusty-fork"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
+dependencies = [
+ "fnv",
+ "quick-error",
+ "tempfile",
+ "wait-timeout",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "safelog"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3939f5e7c65f96a54e7d2a6853e3994d691c95f54f5263916a2d1877dad70789"
+dependencies = [
+ "derive_more",
+ "educe",
+ "either",
+ "fluid-let",
+ "thiserror",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "sanitize-filename"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ed72fbaf78e6f2d41744923916966c4fbe3d7c74e3037a8ee482f1115572603"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
+[[package]]
+name = "sapling-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfff8cfce16aeb38da50b8e2ed33c9018f30552beff2210c266662a021b17f38"
+dependencies = [
+ "aes",
+ "bellman",
+ "bitvec",
+ "blake2b_simd",
+ "blake2s_simd",
+ "bls12_381",
+ "byteorder",
+ "document-features",
+ "ff",
+ "fpe",
+ "group",
+ "hex",
+ "incrementalmerkletree",
+ "jubjub",
+ "lazy_static",
+ "memuse",
+ "proptest",
+ "rand",
+ "rand_core",
+ "redjubjub",
+ "subtle",
+ "tracing",
+ "zcash_note_encryption",
+ "zcash_spec",
+ "zip32",
+]
+
+[[package]]
+name = "schemerz"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e82960ac11ccabd77d53c933532612079e01205b5873ec5095f4b3426493434"
+dependencies = [
+ "daggy",
+ "indexmap 1.9.3",
+ "log",
+ "thiserror",
+ "uuid",
+]
+
+[[package]]
+name = "schemerz-rusqlite"
+version = "0.320.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65ff99b7d9e8790fb20a7e52a482f66fddb3c28c3ce700c6c2665cacbf1b5529"
+dependencies = [
+ "rusqlite",
+ "schemerz",
+ "uuid",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring 0.17.8",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "secp256k1"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25996b82292a7a57ed3508f052cfff8640d38d32018784acd714758b43da9c8f"
+dependencies = [
+ "secp256k1-sys",
+]
+
+[[package]]
+name = "secp256k1-sys"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70a129b9e9efbfb223753b9163c4ab3b13cff7fd9c7f010fbac25ab4099fa07e"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "secrecy"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bd1c54ea06cfd2f6b63219704de0b9b4f72dcc2b8fdef820be6cd799780e91e"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b"
+
+[[package]]
+name = "serde"
+version = "1.0.204"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float",
+ "serde",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.204"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "serde_ignored"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8e319a36d1b52126a0d608f24e93b2d81297091818cd70625fcf50a15d84ddf"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
+dependencies = [
+ "base64",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.6.0",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
+dependencies = [
+ "darling 0.20.10",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha3"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
+dependencies = [
+ "digest",
+ "keccak",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shardtree"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f2390975ebfe8838f9e861f7a588123d49a7a7a0a08568ea831d8ad53fc9b4"
+dependencies = [
+ "assert_matches",
+ "bitflags 2.6.0",
+ "either",
+ "incrementalmerkletree",
+ "incrementalmerkletree-testing",
+ "proptest",
+ "tracing",
+]
+
+[[package]]
+name = "shellexpand"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da03fa3b94cc19e3ebfc88c4229c49d8f08cdbd1228870a45f0ffdf84988e14b"
+dependencies = [
+ "dirs",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8229b473baa5980ac72ef434c4415e70c4b5e71b423043adb4ba059f89c99a1"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core",
+]
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adc4e5204eb1910f40f9cfa375f6f05b68c3abac4b6fd879c8ff5e7ae8a0a085"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "slotmap"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbff4acf519f630b3a3ddcfaea6c06b42174d9a44bc70c620e9ed1649d58b82a"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "socket2"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "ssh-cipher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caac132742f0d33c3af65bfcde7f6aa8f62f0e991d80db99149eb9d44708784f"
+dependencies = [
+ "cipher",
+ "ssh-encoding",
+]
+
+[[package]]
+name = "ssh-encoding"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb9242b9ef4108a78e8cd1a2c98e193ef372437f8c22be363075233321dd4a15"
+dependencies = [
+ "base64ct",
+ "pem-rfc7468",
+ "sha2",
+]
+
+[[package]]
+name = "ssh-key"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca9b366a80cf18bb6406f4cf4d10aebfb46140a8c0c33f666a144c5c76ecbafc"
+dependencies = [
+ "p256",
+ "p384",
+ "p521",
+ "rand_core",
+ "rsa",
+ "sec1",
+ "sha2",
+ "signature",
+ "ssh-cipher",
+ "ssh-encoding",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "str_stack"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9091b6114800a5f2141aee1d1b9d6ca3592ac062dc5decb3764ec5895a47b4eb"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290d54ea6f91c969195bdbcd7442c8c2a2ba87da8bf60a7ee86a235d4bc1e125"
+dependencies = [
+ "strum_macros 0.25.3",
+]
+
+[[package]]
+name = "strum"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
+dependencies = [
+ "strum_macros 0.26.4",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.25.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "symbolic-common"
+version = "12.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71297dc3e250f7dbdf8adb99e235da783d690f5819fdeb4cce39d9cfb0aca9f1"
+dependencies = [
+ "debugid",
+ "memmap2",
+ "stable_deref_trait",
+ "uuid",
+]
+
+[[package]]
+name = "symbolic-demangle"
+version = "12.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "424fa2c9bf2c862891b9cfd354a752751a6730fd838a4691e7f6c2c7957b9daf"
+dependencies = [
+ "cpp_demangle",
+ "rustc-demangle",
+ "symbolic-common",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf5be731623ca1a1fb7d8be6f261a3be6d3e2337b8a1f97be944d020c8fcb704"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
+[[package]]
+name = "tempfile"
+version = "3.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "rustix",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.63"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "time"
+version = "0.3.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+dependencies = [
+ "displaydoc",
+]
+
+[[package]]
+name = "tinytemplate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "libc",
+ "mio",
+ "num_cpus",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0d409377ff5b1e3ca6437aa86c1eb7d40c134bfec254e44c830defa92669db5"
+dependencies = [
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
+dependencies = [
+ "rustls 0.23.12",
+ "rustls-pki-types",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "267ac89e0bec6e691e5813911606935d77c476ff49024f98abcea3e7b15e37af"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit 0.22.22",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap 2.6.0",
+ "toml_datetime",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ae48d6208a266e853d946088ed816055e556cc6028c5e8e2b84d9fa5dd7c7f5"
+dependencies = [
+ "indexmap 2.6.0",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow 0.6.20",
+]
+
+[[package]]
+name = "tonic"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38659f4a91aba8598d27821589f5db7dddd94601e7a01b1e485a50e5484c7401"
+dependencies = [
+ "async-stream",
+ "async-trait",
+ "axum",
+ "base64",
+ "bytes",
+ "flate2",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "prost",
+ "rustls-pemfile",
+ "socket2",
+ "tokio",
+ "tokio-rustls 0.26.0",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+ "webpki-roots 0.26.3",
+]
+
+[[package]]
+name = "tonic-build"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "568392c5a2bd0020723e3f387891176aabafe36fd9fcd074ad309dfa0c8eb964"
+dependencies = [
+ "prettyplease",
+ "proc-macro2",
+ "prost-build",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "tor-async-utils"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef2adb0fa957cad5a1f408e357a4450931366a9d35b78235d72260b6842518ba"
+dependencies = [
+ "educe",
+ "futures",
+ "oneshot-fused-workaround",
+ "pin-project",
+ "postage",
+ "void",
+]
+
+[[package]]
+name = "tor-basic-utils"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d080757c5d7404813f936147e3d72f7c035eba541c1422de29acd2242b98f36"
+dependencies = [
+ "derive_more",
+ "hex",
+ "itertools 0.13.0",
+ "libc",
+ "paste",
+ "rand",
+ "rand_chacha",
+ "serde",
+ "slab",
+ "thiserror",
+]
+
+[[package]]
+name = "tor-bytes"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23db3a71001bc0a3f25b0f6ee824b559d128768275811de0d913369990f9a83b"
+dependencies = [
+ "bytes",
+ "derive-deftly",
+ "digest",
+ "educe",
+ "getrandom",
+ "safelog",
+ "thiserror",
+ "tor-error",
+ "tor-llcrypto",
+ "zeroize",
+]
+
+[[package]]
+name = "tor-cell"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "637cf998679d463138d9bffe07c55bec1c3ccc43a66e4a587d8952ceaa6ee7d4"
+dependencies = [
+ "bitflags 2.6.0",
+ "bytes",
+ "caret",
+ "derive_more",
+ "educe",
+ "paste",
+ "rand",
+ "smallvec",
+ "thiserror",
+ "tor-basic-utils",
+ "tor-bytes",
+ "tor-cert",
+ "tor-error",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-units",
+]
+
+[[package]]
+name = "tor-cert"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "437567f6b43fab396478d01ff15ce717587bda41a15f06c4de87f8fee1fefbb0"
+dependencies = [
+ "caret",
+ "derive_more",
+ "digest",
+ "thiserror",
+ "tor-bytes",
+ "tor-checkable",
+ "tor-llcrypto",
+]
+
+[[package]]
+name = "tor-chanmgr"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc267bf4aba055859d51c34dcab067c109b89cefed9501409377772cbb296d8b"
+dependencies = [
+ "async-trait",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "educe",
+ "futures",
+ "oneshot-fused-workaround",
+ "postage",
+ "rand",
+ "safelog",
+ "serde",
+ "thiserror",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-cell",
+ "tor-config",
+ "tor-error",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-netdir",
+ "tor-proto",
+ "tor-rtcompat",
+ "tor-socksproto",
+ "tor-units",
+ "tracing",
+ "void",
+]
+
+[[package]]
+name = "tor-checkable"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a052723dc4fc53605232652d75997940cd51abc4cd3ff74daca746c150f5ac7"
+dependencies = [
+ "humantime",
+ "signature",
+ "thiserror",
+ "tor-llcrypto",
+]
+
+[[package]]
+name = "tor-circmgr"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c00458ecadba3e0f8566f6be9fcf41bd2a50b3f45f0a349057510b2d37322c21"
+dependencies = [
+ "amplify",
+ "async-trait",
+ "bounded-vec-deque",
+ "cfg-if",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "downcast-rs",
+ "dyn-clone",
+ "educe",
+ "futures",
+ "humantime-serde",
+ "itertools 0.13.0",
+ "once_cell",
+ "oneshot-fused-workaround",
+ "pin-project",
+ "rand",
+ "retry-error",
+ "safelog",
+ "serde",
+ "static_assertions",
+ "thiserror",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-chanmgr",
+ "tor-config",
+ "tor-error",
+ "tor-guardmgr",
+ "tor-linkspec",
+ "tor-netdir",
+ "tor-netdoc",
+ "tor-persist",
+ "tor-proto",
+ "tor-protover",
+ "tor-relay-selection",
+ "tor-rtcompat",
+ "tracing",
+ "void",
+ "weak-table",
+]
+
+[[package]]
+name = "tor-config"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7281aaa74794b23cf570547ff7706fbca5f8564d421921943420f2c70ddecfa"
+dependencies = [
+ "amplify",
+ "derive-deftly",
+ "derive_builder_fork_arti",
+ "directories",
+ "educe",
+ "either",
+ "figment",
+ "fs-mistrust",
+ "futures",
+ "itertools 0.13.0",
+ "notify",
+ "once_cell",
+ "paste",
+ "postage",
+ "regex",
+ "serde",
+ "serde-value",
+ "serde_ignored",
+ "shellexpand",
+ "strum 0.26.3",
+ "thiserror",
+ "toml",
+ "tor-basic-utils",
+ "tor-error",
+ "tor-rtcompat",
+ "tracing",
+ "void",
+]
+
+[[package]]
+name = "tor-consdiff"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0da0ead1be2509af9558ff9b8004d25e7e4795a3dfa4d78968d8c43d231e76c7"
+dependencies = [
+ "digest",
+ "hex",
+ "thiserror",
+ "tor-llcrypto",
+]
+
+[[package]]
+name = "tor-dirclient"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b3fb55282536a5aaf998ceaa1d2f5a268119c3b3cf8de741eaf98f5ed5af079"
+dependencies = [
+ "async-compression",
+ "base64ct",
+ "derive_more",
+ "futures",
+ "hex",
+ "http",
+ "httparse",
+ "httpdate",
+ "itertools 0.13.0",
+ "memchr",
+ "thiserror",
+ "tor-circmgr",
+ "tor-error",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-netdoc",
+ "tor-proto",
+ "tor-rtcompat",
+ "tracing",
+]
+
+[[package]]
+name = "tor-dirmgr"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8bf47d53f83a55f4cc61fa77bcd051c283d1a1da60f67e9370d845df3480256"
+dependencies = [
+ "async-trait",
+ "base64ct",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "digest",
+ "educe",
+ "event-listener",
+ "fs-mistrust",
+ "fslock",
+ "futures",
+ "hex",
+ "humantime",
+ "humantime-serde",
+ "itertools 0.13.0",
+ "memmap2",
+ "once_cell",
+ "oneshot-fused-workaround",
+ "paste",
+ "postage",
+ "rand",
+ "rusqlite",
+ "safelog",
+ "scopeguard",
+ "serde",
+ "signature",
+ "strum 0.26.3",
+ "thiserror",
+ "time",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-checkable",
+ "tor-circmgr",
+ "tor-config",
+ "tor-consdiff",
+ "tor-dirclient",
+ "tor-error",
+ "tor-guardmgr",
+ "tor-llcrypto",
+ "tor-netdir",
+ "tor-netdoc",
+ "tor-persist",
+ "tor-proto",
+ "tor-rtcompat",
+ "tracing",
+]
+
+[[package]]
+name = "tor-error"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d764640168b176da6c44e4d5ceda97db3aca89d6f7e5ee398f454c56ba6a34c2"
+dependencies = [
+ "derive_more",
+ "futures",
+ "once_cell",
+ "paste",
+ "retry-error",
+ "static_assertions",
+ "strum 0.26.3",
+ "thiserror",
+ "tracing",
+ "void",
+]
+
+[[package]]
+name = "tor-guardmgr"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82444165f5f3a2587e4c93258c7a554718a4985780d262ae158a5e24fcbee019"
+dependencies = [
+ "amplify",
+ "base64ct",
+ "derive-deftly",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "dyn-clone",
+ "educe",
+ "futures",
+ "humantime",
+ "humantime-serde",
+ "itertools 0.13.0",
+ "num_enum",
+ "oneshot-fused-workaround",
+ "pin-project",
+ "postage",
+ "rand",
+ "safelog",
+ "serde",
+ "strum 0.26.3",
+ "thiserror",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-config",
+ "tor-error",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-netdir",
+ "tor-netdoc",
+ "tor-persist",
+ "tor-proto",
+ "tor-relay-selection",
+ "tor-rtcompat",
+ "tor-units",
+ "tracing",
+]
+
+[[package]]
+name = "tor-hscrypto"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eda7d9ec707605c7bdd71c29a94e5cf6c1a61ed42f815b5dd2da3f1546393ca1"
+dependencies = [
+ "data-encoding",
+ "derive_more",
+ "digest",
+ "itertools 0.13.0",
+ "paste",
+ "rand",
+ "safelog",
+ "signature",
+ "subtle",
+ "thiserror",
+ "tor-basic-utils",
+ "tor-bytes",
+ "tor-error",
+ "tor-llcrypto",
+ "tor-units",
+]
+
+[[package]]
+name = "tor-key-forge"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06c2a026f0a21f9870799eb3ac24340bfa71efb6126d9c7294a6d6c401a8ba67"
+dependencies = [
+ "derive-deftly",
+ "derive_more",
+ "downcast-rs",
+ "paste",
+ "rand",
+ "signature",
+ "ssh-key",
+ "thiserror",
+ "tor-error",
+ "tor-hscrypto",
+ "tor-llcrypto",
+]
+
+[[package]]
+name = "tor-keymgr"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f66ea6684cd1110c8b405443611b1c8f24cca4d8ca05a41ee747ea4479ad4c5c"
+dependencies = [
+ "amplify",
+ "arrayvec",
+ "derive-deftly",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "downcast-rs",
+ "dyn-clone",
+ "fs-mistrust",
+ "glob-match",
+ "humantime",
+ "inventory",
+ "itertools 0.13.0",
+ "rand",
+ "serde",
+ "ssh-key",
+ "thiserror",
+ "tor-basic-utils",
+ "tor-config",
+ "tor-error",
+ "tor-hscrypto",
+ "tor-key-forge",
+ "tor-llcrypto",
+ "tor-persist",
+ "tracing",
+ "walkdir",
+ "zeroize",
+]
+
+[[package]]
+name = "tor-linkspec"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53ccbd9372da197987699399c88695ecd1737c2b0e6267c540a3febdf92b5643"
+dependencies = [
+ "base64ct",
+ "by_address",
+ "caret",
+ "derive-deftly",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "hex",
+ "itertools 0.13.0",
+ "safelog",
+ "serde",
+ "serde_with",
+ "strum 0.26.3",
+ "thiserror",
+ "tor-basic-utils",
+ "tor-bytes",
+ "tor-config",
+ "tor-llcrypto",
+ "tor-protover",
+]
+
+[[package]]
+name = "tor-llcrypto"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b0c146b5c77f609dda6992f60940586fee2aa711dab5d59b3ecc7c8c958d787"
+dependencies = [
+ "aes",
+ "base64ct",
+ "ctr",
+ "curve25519-dalek",
+ "derive_more",
+ "digest",
+ "ed25519-dalek",
+ "educe",
+ "getrandom",
+ "hex",
+ "rand_core",
+ "rsa",
+ "safelog",
+ "serde",
+ "sha1",
+ "sha2",
+ "sha3",
+ "signature",
+ "simple_asn1",
+ "subtle",
+ "thiserror",
+ "visibility",
+ "x25519-dalek",
+ "zeroize",
+]
+
+[[package]]
+name = "tor-log-ratelim"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a6fada5f9dae169bd0caf2d61932c528e8136790a5a553eac9de30d6290fe7e"
+dependencies = [
+ "futures",
+ "humantime",
+ "once_cell",
+ "thiserror",
+ "tor-error",
+ "tor-rtcompat",
+ "tracing",
+ "weak-table",
+]
+
+[[package]]
+name = "tor-memquota"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12551616f15f9d1fb4e37ee14ffc0b6743d0c31affbb4643374f456c0a820073"
+dependencies = [
+ "derive-deftly",
+ "derive_more",
+ "educe",
+ "futures",
+ "pin-project",
+ "serde",
+ "slotmap",
+ "static_assertions",
+ "thiserror",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-config",
+ "tor-error",
+ "tor-log-ratelim",
+ "tor-rtcompat",
+ "tracing",
+ "void",
+]
+
+[[package]]
+name = "tor-netdir"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d9b832338169a882cb895c79ea60089641749e1c2d6d4f7b8e23cc010185dfa"
+dependencies = [
+ "bitflags 2.6.0",
+ "derive_more",
+ "futures",
+ "humantime",
+ "itertools 0.13.0",
+ "num_enum",
+ "rand",
+ "serde",
+ "static_assertions",
+ "strum 0.26.3",
+ "thiserror",
+ "tor-basic-utils",
+ "tor-error",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-netdoc",
+ "tor-protover",
+ "tor-units",
+ "tracing",
+ "typed-index-collections",
+]
+
+[[package]]
+name = "tor-netdoc"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a5fbfe1444d96e08bb97cdf717a62738e5f1bd5a594c5520a05f683b8a516e3"
+dependencies = [
+ "amplify",
+ "base64ct",
+ "bitflags 2.6.0",
+ "cipher",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "digest",
+ "educe",
+ "hex",
+ "humantime",
+ "itertools 0.13.0",
+ "once_cell",
+ "phf",
+ "serde",
+ "serde_with",
+ "signature",
+ "smallvec",
+ "subtle",
+ "thiserror",
+ "time",
+ "tinystr",
+ "tor-basic-utils",
+ "tor-bytes",
+ "tor-cell",
+ "tor-cert",
+ "tor-checkable",
+ "tor-error",
+ "tor-llcrypto",
+ "tor-protover",
+ "void",
+ "weak-table",
+ "zeroize",
+]
+
+[[package]]
+name = "tor-persist"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5acf1de8a8ad4817d8ebdf1250bddbe9efa4b25dea0a339ae8dbb1f7d7f28583"
+dependencies = [
+ "derive-deftly",
+ "derive_more",
+ "filetime",
+ "fs-mistrust",
+ "fslock",
+ "futures",
+ "itertools 0.13.0",
+ "oneshot-fused-workaround",
+ "paste",
+ "sanitize-filename",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-error",
+ "tracing",
+ "void",
+]
+
+[[package]]
+name = "tor-proto"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "073a996250f73d7a814d9049de321a1f59a710dc18b92a4da8d26f002a5735dd"
+dependencies = [
+ "asynchronous-codec",
+ "bitvec",
+ "bytes",
+ "cipher",
+ "coarsetime",
+ "derive_builder_fork_arti",
+ "derive_more",
+ "digest",
+ "educe",
+ "futures",
+ "hkdf",
+ "hmac",
+ "oneshot-fused-workaround",
+ "pin-project",
+ "rand",
+ "rand_core",
+ "safelog",
+ "subtle",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tor-async-utils",
+ "tor-basic-utils",
+ "tor-bytes",
+ "tor-cell",
+ "tor-cert",
+ "tor-checkable",
+ "tor-config",
+ "tor-error",
+ "tor-linkspec",
+ "tor-llcrypto",
+ "tor-log-ratelim",
+ "tor-rtcompat",
+ "tor-rtmock",
+ "tor-units",
+ "tracing",
+ "typenum",
+ "void",
+ "zeroize",
+]
+
+[[package]]
+name = "tor-protover"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae806e57efcbd59694fd3c3c8100bc7dabc2dfd0bda70f122c7489fc0e889704"
+dependencies = [
+ "caret",
+ "thiserror",
+]
+
+[[package]]
+name = "tor-relay-selection"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ca1a4d767cd52ee8723dfe9dc3ec640b7a37527e009bc0860301a1aad249871"
+dependencies = [
+ "rand",
+ "serde",
+ "tor-basic-utils",
+ "tor-linkspec",
+ "tor-netdir",
+ "tor-netdoc",
+]
+
+[[package]]
+name = "tor-rtcompat"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df693852fb9a1c1a8bca1673fa3a8e1bca929fb2753165b1efce70f9381323b0"
+dependencies = [
+ "async-trait",
+ "async_executors",
+ "coarsetime",
+ "derive_more",
+ "educe",
+ "futures",
+ "futures-rustls",
+ "paste",
+ "pin-project",
+ "rustls-pki-types",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tor-error",
+ "tracing",
+ "void",
+ "x509-signature",
+]
+
+[[package]]
+name = "tor-rtmock"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f540f59b3194f4ad697d6ffa13013e2b92e1058cd1b3beb9c8a500d2b805a92"
+dependencies = [
+ "amplify",
+ "async-trait",
+ "derive-deftly",
+ "derive_more",
+ "educe",
+ "futures",
+ "humantime",
+ "itertools 0.13.0",
+ "oneshot-fused-workaround",
+ "pin-project",
+ "priority-queue",
+ "slotmap",
+ "strum 0.26.3",
+ "thiserror",
+ "tor-error",
+ "tor-rtcompat",
+ "tracing",
+ "tracing-test",
+ "void",
+]
+
+[[package]]
+name = "tor-socksproto"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308849623b9aa2a604c42a68081f7956ea6d4b5f378dd94ef0a36f05e86399ff"
+dependencies = [
+ "caret",
+ "subtle",
+ "thiserror",
+ "tor-bytes",
+ "tor-error",
+]
+
+[[package]]
+name = "tor-units"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de60d366ac1128f4cd3e1bae601a3d0393cd0c4e9e0e05eee605d28a8a5ce704"
+dependencies = [
+ "derive_more",
+ "thiserror",
+]
+
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 1.9.3",
+ "pin-project",
+ "pin-project-lite",
+ "rand",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0f048c97dbd9faa9b7df56362b8ebcaa52adb06b498c050d2f4e32f90a7a8b"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "tracing-test"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "557b891436fe0d5e0e363427fc7f217abf9ccd510d5136549847bdcbcd011d68"
+dependencies = [
+ "tracing-core",
+ "tracing-subscriber",
+ "tracing-test-macro",
+]
+
+[[package]]
+name = "tracing-test-macro"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04659ddb06c87d233c566112c1c9c5b9e98256d9af50ec3bc9c8327f873a7568"
+dependencies = [
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "trait-variant"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70977707304198400eb4835a78f6a9f928bf41bba420deb8fdb175cd965d77a7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typed-index-collections"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "183496e014253d15abbe6235677b1392dba2d40524c88938991226baa38ac7c4"
+
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "uint"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76f64bba2c53b04fcab63c01a7d7427eadc821e3bc48c34dc9ba29c501164b52"
+dependencies = [
+ "byteorder",
+ "crunchy",
+ "hex",
+ "static_assertions",
+]
+
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
+[[package]]
+name = "uncased"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1b88fcfe09e89d3866a5c11019378088af2d24c3fbd4f0543f96b479ec90697"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a56d1686db2308d901306f92a263857ef59ea39678a5458e7cb17f01415101f5"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "uuid"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a183cf7feeba97b4dd1c0d46788634f6221d87fa961b305bed08c851829efcc0"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "visibility"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d674d135b4a8c1d7e813e2f8d1c9a58308aee4a680323066025e53132218bd91"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "void"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
+
+[[package]]
+name = "wagyu-zcash-parameters"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c904628658374e651288f000934c33ef738b2d8b3e65d4100b70b395dbe2bb"
+dependencies = [
+ "wagyu-zcash-parameters-1",
+ "wagyu-zcash-parameters-2",
+ "wagyu-zcash-parameters-3",
+ "wagyu-zcash-parameters-4",
+ "wagyu-zcash-parameters-5",
+ "wagyu-zcash-parameters-6",
+]
+
+[[package]]
+name = "wagyu-zcash-parameters-1"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bf2e21bb027d3f8428c60d6a720b54a08bf6ce4e6f834ef8e0d38bb5695da8"
+
+[[package]]
+name = "wagyu-zcash-parameters-2"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a616ab2e51e74cc48995d476e94de810fb16fc73815f390bf2941b046cc9ba2c"
+
+[[package]]
+name = "wagyu-zcash-parameters-3"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14da1e2e958ff93c0830ee68e91884069253bf3462a67831b02b367be75d6147"
+
+[[package]]
+name = "wagyu-zcash-parameters-4"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f058aeef03a2070e8666ffb5d1057d8bb10313b204a254a6e6103eb958e9a6d6"
+
+[[package]]
+name = "wagyu-zcash-parameters-5"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ffe916b30e608c032ae1b734f02574a3e12ec19ab5cc5562208d679efe4969d"
+
+[[package]]
+name = "wagyu-zcash-parameters-6"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7b6d5a78adc3e8f198e9cd730f219a695431467f7ec29dcfc63ade885feebe1"
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasix"
+version = "0.12.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1fbb4ef9bbca0c1170e0b00dd28abc9e3b68669821600cad1caaed606583c6d"
+dependencies = [
+ "wasi",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+
+[[package]]
+name = "weak-table"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "323f4da9523e9a669e1eaf9c6e763892769b1d38c623913647bfdc1532fe4549"
+
+[[package]]
+name = "web-sys"
+version = "0.3.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77afa9a11836342370f4817622a2f0f418b134426d91a82dfb48f532d2ec13ef"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.25.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd7c23921eeb1713a4e851530e9b9756e4fb0e89978582942612524cf09f01cd"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "which"
+version = "6.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ee928febd44d98f2f459a4a79bd4d928591333a494a10a868418ac1b39cf1f"
+dependencies = [
+ "either",
+ "home",
+ "rustix",
+ "winsafe",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+dependencies = [
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "0.6.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36c1fec1a2bb5866f07c25f68c26e565c4c200aebb96d7e55710c19d3e8ac49b"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winsafe"
+version = "0.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
+
+[[package]]
+name = "wyz"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "x509-signature"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb2bc2a902d992cd5f471ee3ab0ffd6603047a4207384562755b9d6de977518"
+dependencies = [
+ "ring 0.16.20",
+ "untrusted 0.7.1",
+]
+
+[[package]]
+name = "xdg"
+version = "2.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "213b7324336b53d2414b2db8537e56544d981803139155afa84f76eeebb7a546"
+
+[[package]]
+name = "xz2"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2"
+dependencies = [
+ "lzma-sys",
+]
+
+[[package]]
+name = "zcash"
+version = "0.1.0"
+dependencies = [
+ "document-features",
+ "zcash_primitives",
+]
+
+[[package]]
+name = "zcash_address"
+version = "0.6.0"
+dependencies = [
+ "assert_matches",
+ "bech32",
+ "bs58",
+ "f4jumble",
+ "proptest",
+ "zcash_encoding",
+ "zcash_protocol",
+]
+
+[[package]]
+name = "zcash_client_backend"
+version = "0.15.0"
+dependencies = [
+ "ambassador",
+ "arti-client",
+ "assert_matches",
+ "async-trait",
+ "base64",
+ "bech32",
+ "bip32",
+ "bls12_381",
+ "bs58",
+ "byteorder",
+ "crossbeam-channel",
+ "document-features",
+ "dynosaur",
+ "futures-util",
+ "group",
+ "gumdrop",
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "incrementalmerkletree",
+ "jubjub",
+ "memuse",
+ "nom",
+ "nonempty",
+ "orchard",
+ "pasta_curves",
+ "percent-encoding",
+ "proptest",
+ "prost",
+ "rand",
+ "rand_chacha",
+ "rand_core",
+ "rayon",
+ "rust_decimal",
+ "sapling-crypto",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "shardtree",
+ "subtle",
+ "time",
+ "tokio",
+ "tokio-rustls 0.24.0",
+ "tonic",
+ "tonic-build",
+ "tor-rtcompat",
+ "tower",
+ "tracing",
+ "trait-variant",
+ "webpki-roots 0.25.4",
+ "which",
+ "zcash_address",
+ "zcash_encoding",
+ "zcash_keys",
+ "zcash_note_encryption",
+ "zcash_primitives",
+ "zcash_proofs",
+ "zcash_protocol",
+ "zip32",
+ "zip321",
+]
+
+[[package]]
+name = "zcash_client_sqlite"
+version = "0.13.0"
+dependencies = [
+ "ambassador",
+ "assert_matches",
+ "bip32",
+ "bls12_381",
+ "bs58",
+ "byteorder",
+ "document-features",
+ "group",
+ "incrementalmerkletree",
+ "incrementalmerkletree-testing",
+ "jubjub",
+ "maybe-rayon",
+ "nonempty",
+ "orchard",
+ "pasta_curves",
+ "proptest",
+ "prost",
+ "rand_chacha",
+ "rand_core",
+ "regex",
+ "rusqlite",
+ "sapling-crypto",
+ "schemerz",
+ "schemerz-rusqlite",
+ "secrecy",
+ "shardtree",
+ "static_assertions",
+ "subtle",
+ "tempfile",
+ "time",
+ "tracing",
+ "uuid",
+ "zcash_address",
+ "zcash_client_backend",
+ "zcash_encoding",
+ "zcash_keys",
+ "zcash_note_encryption",
+ "zcash_primitives",
+ "zcash_proofs",
+ "zcash_protocol",
+ "zip32",
+ "zip321",
+]
+
+[[package]]
+name = "zcash_encoding"
+version = "0.2.1"
+dependencies = [
+ "byteorder",
+ "nonempty",
+]
+
+[[package]]
+name = "zcash_extensions"
+version = "0.1.0"
+dependencies = [
+ "blake2b_simd",
+ "ff",
+ "jubjub",
+ "orchard",
+ "rand_core",
+ "sapling-crypto",
+ "zcash_address",
+ "zcash_primitives",
+ "zcash_proofs",
+]
+
+[[package]]
+name = "zcash_history"
+version = "0.4.0"
+dependencies = [
+ "assert_matches",
+ "blake2b_simd",
+ "byteorder",
+ "primitive-types",
+ "proptest",
+]
+
+[[package]]
+name = "zcash_keys"
+version = "0.5.0"
+dependencies = [
+ "bech32",
+ "bip32",
+ "blake2b_simd",
+ "bls12_381",
+ "bs58",
+ "byteorder",
+ "document-features",
+ "group",
+ "hex",
+ "jubjub",
+ "memuse",
+ "nonempty",
+ "orchard",
+ "proptest",
+ "rand_core",
+ "sapling-crypto",
+ "secrecy",
+ "subtle",
+ "tracing",
+ "zcash_address",
+ "zcash_encoding",
+ "zcash_primitives",
+ "zcash_protocol",
+ "zip32",
+]
+
+[[package]]
+name = "zcash_note_encryption"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b4580cd6cee12e44421dac43169be8d23791650816bdb34e6ddfa70ac89c1c5"
+dependencies = [
+ "chacha20",
+ "chacha20poly1305",
+ "cipher",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "zcash_primitives"
+version = "0.20.0"
+dependencies = [
+ "aes",
+ "assert_matches",
+ "bip32",
+ "blake2b_simd",
+ "bs58",
+ "byteorder",
+ "chacha20poly1305",
+ "criterion",
+ "document-features",
+ "equihash",
+ "ff",
+ "fpe",
+ "group",
+ "hex",
+ "incrementalmerkletree",
+ "jubjub",
+ "memuse",
+ "nonempty",
+ "orchard",
+ "pprof",
+ "proptest",
+ "rand",
+ "rand_core",
+ "rand_xorshift",
+ "redjubjub",
+ "ripemd",
+ "sapling-crypto",
+ "secp256k1",
+ "sha2",
+ "subtle",
+ "tracing",
+ "zcash_address",
+ "zcash_encoding",
+ "zcash_note_encryption",
+ "zcash_protocol",
+ "zcash_spec",
+ "zip32",
+]
+
+[[package]]
+name = "zcash_proofs"
+version = "0.20.0"
+dependencies = [
+ "bellman",
+ "blake2b_simd",
+ "bls12_381",
+ "byteorder",
+ "document-features",
+ "group",
+ "home",
+ "jubjub",
+ "known-folders",
+ "lazy_static",
+ "minreq",
+ "rand_core",
+ "redjubjub",
+ "sapling-crypto",
+ "tracing",
+ "wagyu-zcash-parameters",
+ "xdg",
+ "zcash_primitives",
+]
+
+[[package]]
+name = "zcash_protocol"
+version = "0.4.1"
+dependencies = [
+ "document-features",
+ "incrementalmerkletree",
+ "incrementalmerkletree-testing",
+ "memuse",
+ "proptest",
+]
+
+[[package]]
+name = "zcash_spec"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7a3bf58b673cb3dacd8ae09ba345998923a197ab0da70d6239d8e8838949e9b"
+dependencies = [
+ "blake2b_simd",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.63",
+]
+
+[[package]]
+name = "zip32"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4226d0aee9c9407c27064dfeec9d7b281c917de3374e1e5a2e2cfad9e09de19e"
+dependencies = [
+ "blake2b_simd",
+ "memuse",
+ "subtle",
+]
+
+[[package]]
+name = "zip321"
+version = "0.2.0"
+dependencies = [
+ "base64",
+ "nom",
+ "percent-encoding",
+ "proptest",
+ "zcash_address",
+ "zcash_protocol",
+]
+
+[[package]]
+name = "zstd"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d789b1514203a1120ad2429eae43a7bd32b90976a7bb8a05f7ec02fa88cc23a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1cd99b45c6bc03a018c8b8a86025678c87e55526064e38f9df301989dce7ec0a"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.10+zstd.1.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c253a4914af5bafc8fa8c86ee400827e83cf6ec01195ec1f1ed8441bf00d65aa"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/Cargo.toml b/Cargo.toml
index 044d879e93..727f2dd701 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,16 +4,180 @@ members = [
     "components/f4jumble",
     "components/zcash_address",
     "components/zcash_encoding",
-    "components/zcash_note_encryption",
+    "components/zcash_protocol",
+    "components/zip321",
+    "devtools",
+    "pczt",
+    "zcash",
     "zcash_client_backend",
     "zcash_client_sqlite",
     "zcash_extensions",
     "zcash_history",
+    "zcash_keys",
     "zcash_primitives",
     "zcash_proofs",
 ]
 
+[workspace.package]
+edition = "2021"
+rust-version = "1.77"
+repository = "https://github.com/zcash/librustzcash"
+license = "MIT OR Apache-2.0"
+categories = ["cryptography::cryptocurrencies"]
+
+# Common dependencies across all of our crates. Dependencies used only by a single crate
+# (and that don't have cross-crate versioning needs) are specified by the crate itself.
+#
+# See the individual crate `Cargo.toml` files for information about which dependencies are
+# part of a public API, and which can be updated without a SemVer bump.
+[workspace.dependencies]
+# Intra-workspace dependencies
+equihash = { version = "0.2", path = "components/equihash" }
+zcash_address = { version = "0.6", path = "components/zcash_address" }
+zcash_client_backend = { version = "0.15", path = "zcash_client_backend" }
+zcash_encoding = { version = "0.2.1", path = "components/zcash_encoding" }
+zcash_keys = { version = "0.5", path = "zcash_keys" }
+zcash_protocol = { version = "0.4.1", path = "components/zcash_protocol" }
+zip321 = { version = "0.2", path = "components/zip321" }
+
+zcash_note_encryption = "0.4"
+zcash_primitives = { version = "0.20", path = "zcash_primitives", default-features = false }
+zcash_proofs = { version = "0.20", path = "zcash_proofs", default-features = false }
+
+# Shielded protocols
+bellman = { version = "0.14", default-features = false, features = ["groth16"] }
+ff = "0.13"
+group = "0.13"
+incrementalmerkletree = "0.7"
+shardtree = "0.5"
+zcash_spec = "0.1"
+
+# Payment protocols
+# - Sapling
+bitvec = "1"
+blake2s_simd = "1"
+bls12_381 = "0.8"
+jubjub = "0.10"
+sapling = { package = "sapling-crypto", version = "0.3", default-features = false }
+
+# - Orchard
+nonempty = "0.7"
+orchard = { version = "0.10", default-features = false }
+pasta_curves = "0.5"
+
+# - Transparent
+bip32 = { version = "0.5", default-features = false, features = ["secp256k1-ffi"] }
+ripemd = "0.1"
+secp256k1 = "0.27"
+
+# CSPRNG
+rand = "0.8"
+rand_core = "0.6"
+
+# Currency conversions
+rust_decimal = { version = "1.35", default-features = false, features = ["serde"] }
+
+# Digests
+blake2b_simd = "1"
+sha2 = "0.10"
+
+# Documentation
+document-features = "0.2"
+
+# Encodings
+base64 = "0.22"
+bech32 = "0.9"
+bs58 = { version = "0.5", features = ["check"] }
+byteorder = "1"
+hex = "0.4"
+percent-encoding = "2.1.0"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+# HTTP
+hyper = "1"
+http-body-util = "0.1"
+hyper-util = { version = "0.1.1", features = ["tokio"] }
+tokio-rustls = "0.24"
+webpki-roots = "0.25"
+
+# Logging and metrics
+memuse = "0.2.1"
+tracing = "0.1"
+
+# Parallel processing
+crossbeam-channel = "0.5"
+maybe-rayon = { version = "0.1.0", default-features = false }
+rayon = "1.5"
+
+# Protobuf and gRPC
+prost = "0.13"
+tonic = { version = "0.12", default-features = false }
+tonic-build = { version = "0.12", default-features = false }
+
+# Secret management
+secrecy = "0.8"
+subtle = "2.2.3"
+
+# SQLite databases
+# - Warning: One of the downstream consumers requires that SQLite be available through
+#   CocoaPods, due to being bound to React Native. We need to ensure that the SQLite
+#   version required for `rusqlite` is a version that is available through CocoaPods.
+rusqlite = { version = "0.32", features = ["bundled"] }
+schemerz = "0.2"
+schemerz-rusqlite = "0.320"
+time = "0.3.22"
+uuid = "1.1"
+
+# Static constants and assertions
+lazy_static = "1"
+static_assertions = "1"
+
+# Tests and benchmarks
+ambassador = "0.4"
+assert_matches = "1.5"
+criterion = "0.5"
+proptest = "1"
+rand_chacha = "0.3"
+rand_xorshift = "0.3"
+incrementalmerkletree-testing = "0.2"
+
+# Tor
+# - `arti-client` depends on `rusqlite`, and a version mismatch there causes a compilation
+#   failure due to incompatible `libsqlite3-sys` versions.
+arti-client = { version = "0.23", default-features = false, features = ["compression", "rustls", "tokio"] }
+dynosaur = "0.1.1"
+tokio = "1"
+tor-rtcompat = "0.23"
+tower = "0.4"
+trait-variant = "0.1"
+
+# ZIP 32
+aes = "0.8"
+fpe = "0.6"
+zip32 = "0.1.1"
+
 [profile.release]
 lto = true
 panic = 'abort'
 codegen-units = 1
+
+[profile.test]
+# Since we have many computationally expensive tests, this changes the test profile to
+# compile with optimizations by default, but keep full debug info.
+#
+# This differs from the release profile in the following ways:
+# - it does not set `lto = true`, which increases compile times without substantially
+#   speeding up tests;
+# - it does not set `codegen-units = 1`, which increases compile times and is only
+#   useful to improve determinism of release builds;
+# - it does not set `panic = 'abort'`, which is in any case ignored for tests.
+#
+# To get results as close as possible to a release build, use `cargo test --release`.
+# To speed up compilation and avoid optimizations potentially resulting in lower-quality
+# debug info, use `cargo test --profile=dev`.
+opt-level = 3
+debug = true
+
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(zcash_unstable, values("zfuture", "tze", "nsm"))'] }
diff --git a/README.md b/README.md
index c10053bd85..696e4caddd 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,11 @@
 # Zcash Rust crates
 
-This repository contains a (work-in-progress) set of Rust crates for
-working with Zcash.
+This repository contains a (work-in-progress) set of Rust crates for working
+with Zcash.
 
 ## Security Warnings
 
-These libraries are currently under development and have not been fully-reviewed.
+These libraries are under development and have not been fully reviewed.
 
 ## License
 
@@ -16,20 +16,8 @@ All code in this workspace is licensed under either of
 
 at your option.
 
-Downstream code forks should note that some (but not all) of these crates
-and components depend on the 'orchard' crate, which is licensed under the
-[Bootstrap Open Source License](https://github.com/zcash/orchard/blob/main/LICENSE-BOSL).
-A license exception is provided allowing some derived works that are linked or
-combined with the 'orchard' crate to be copied or distributed under the original
-licenses (in this case MIT / Apache 2.0), provided that the included portions of
-the 'orchard' code remain subject to BOSL.
-See <https://github.com/zcash/orchard/blob/main/COPYING> for details of which
-derived works can make use of this exception, and the `README.md` files in
-subdirectories for which crates and components this applies to.
-
 ### Contribution
 
-Unless you explicitly state otherwise, any contribution intentionally
-submitted for inclusion in the work by you, as defined in the Apache-2.0
-license, shall be dual licensed as above, without any additional terms or
-conditions.
+Unless you explicitly state otherwise, any contribution intentionally submitted
+for inclusion in the work by you, as defined in the Apache-2.0 license, shall
+be dual licensed as above, without any additional terms or conditions.
diff --git a/components/equihash/src/lib.rs b/components/equihash/src/lib.rs
index fc23642063..cb6131ca3b 100644
--- a/components/equihash/src/lib.rs
+++ b/components/equihash/src/lib.rs
@@ -20,6 +20,8 @@
 // Catch documentation errors caused by code changes.
 #![deny(rustdoc::broken_intra_doc_links)]
 
+mod minimal;
+mod params;
 mod verify;
 
 #[cfg(test)]
diff --git a/components/equihash/src/minimal.rs b/components/equihash/src/minimal.rs
new file mode 100644
index 0000000000..81da63e657
--- /dev/null
+++ b/components/equihash/src/minimal.rs
@@ -0,0 +1,190 @@
+use std::io::Cursor;
+use std::mem::size_of;
+
+use byteorder::{BigEndian, ReadBytesExt};
+
+use crate::params::Params;
+
+pub(crate) fn expand_array(vin: &[u8], bit_len: usize, byte_pad: usize) -> Vec<u8> {
+    assert!(bit_len >= 8);
+    assert!(u32::BITS as usize >= 7 + bit_len);
+
+    let out_width = (bit_len + 7) / 8 + byte_pad;
+    let out_len = 8 * out_width * vin.len() / bit_len;
+
+    // Shortcut for parameters where expansion is a no-op
+    if out_len == vin.len() {
+        return vin.to_vec();
+    }
+
+    let mut vout: Vec<u8> = vec![0; out_len];
+    let bit_len_mask: u32 = (1 << bit_len) - 1;
+
+    // The acc_bits least-significant bits of acc_value represent a bit sequence
+    // in big-endian order.
+    let mut acc_bits = 0;
+    let mut acc_value: u32 = 0;
+
+    let mut j = 0;
+    for b in vin {
+        acc_value = (acc_value << 8) | u32::from(*b);
+        acc_bits += 8;
+
+        // When we have bit_len or more bits in the accumulator, write the next
+        // output element.
+        if acc_bits >= bit_len {
+            acc_bits -= bit_len;
+            for x in byte_pad..out_width {
+                vout[j + x] = ((
+                    // Big-endian
+                    acc_value >> (acc_bits + (8 * (out_width - x - 1)))
+                ) & (
+                    // Apply bit_len_mask across byte boundaries
+                    (bit_len_mask >> (8 * (out_width - x - 1))) & 0xFF
+                )) as u8;
+            }
+            j += out_width;
+        }
+    }
+
+    vout
+}
+
+/// Returns `None` if the parameters are invalid for this minimal encoding.
+pub(crate) fn indices_from_minimal(p: Params, minimal: &[u8]) -> Option<Vec<u32>> {
+    let c_bit_len = p.collision_bit_length();
+    // Division is exact because k >= 3.
+    if minimal.len() != ((1 << p.k) * (c_bit_len + 1)) / 8 {
+        return None;
+    }
+
+    assert!(((c_bit_len + 1) + 7) / 8 <= size_of::<u32>());
+    let len_indices = u32::BITS as usize * minimal.len() / (c_bit_len + 1);
+    let byte_pad = size_of::<u32>() - ((c_bit_len + 1) + 7) / 8;
+
+    let mut csr = Cursor::new(expand_array(minimal, c_bit_len + 1, byte_pad));
+    let mut ret = Vec::with_capacity(len_indices);
+
+    // Big-endian so that lexicographic array comparison is equivalent to integer
+    // comparison
+    while let Ok(i) = csr.read_u32::<BigEndian>() {
+        ret.push(i);
+    }
+
+    Some(ret)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{expand_array, indices_from_minimal, Params};
+
+    #[test]
+    fn array_expansion() {
+        let check_array = |(bit_len, byte_pad), compact, expanded| {
+            assert_eq!(expand_array(compact, bit_len, byte_pad), expanded);
+        };
+
+        // 8 11-bit chunks, all-ones
+        check_array(
+            (11, 0),
+            &[
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+            ],
+            &[
+                0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff,
+                0x07, 0xff,
+            ][..],
+        );
+        // 8 21-bit chunks, alternating 1s and 0s
+        check_array(
+            (21, 0),
+            &[
+                0xaa, 0xaa, 0xad, 0x55, 0x55, 0x6a, 0xaa, 0xab, 0x55, 0x55, 0x5a, 0xaa, 0xaa, 0xd5,
+                0x55, 0x56, 0xaa, 0xaa, 0xb5, 0x55, 0x55,
+            ],
+            &[
+                0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55,
+                0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55,
+            ][..],
+        );
+        // 8 21-bit chunks, based on example in the spec
+        check_array(
+            (21, 0),
+            &[
+                0x00, 0x02, 0x20, 0x00, 0x0a, 0x7f, 0xff, 0xfe, 0x00, 0x12, 0x30, 0x22, 0xb3, 0x82,
+                0x26, 0xac, 0x19, 0xbd, 0xf2, 0x34, 0x56,
+            ],
+            &[
+                0x00, 0x00, 0x44, 0x00, 0x00, 0x29, 0x1f, 0xff, 0xff, 0x00, 0x01, 0x23, 0x00, 0x45,
+                0x67, 0x00, 0x89, 0xab, 0x00, 0xcd, 0xef, 0x12, 0x34, 0x56,
+            ][..],
+        );
+        // 16 14-bit chunks, alternating 11s and 00s
+        check_array(
+            (14, 0),
+            &[
+                0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33, 0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33,
+                0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33, 0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33,
+            ],
+            &[
+                0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33,
+                0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33,
+                0x33, 0x33, 0x33, 0x33,
+            ][..],
+        );
+        // 8 11-bit chunks, all-ones, 2-byte padding
+        check_array(
+            (11, 2),
+            &[
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+            ],
+            &[
+                0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00,
+                0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff,
+                0x00, 0x00, 0x07, 0xff,
+            ][..],
+        );
+    }
+
+    #[test]
+    fn minimal_solution_repr() {
+        let check_repr = |minimal, indices| {
+            assert_eq!(
+                indices_from_minimal(Params { n: 80, k: 3 }, minimal).unwrap(),
+                indices,
+            );
+        };
+
+        // The solutions here are not intended to be valid.
+        check_repr(
+            &[
+                0x00, 0x00, 0x08, 0x00, 0x00, 0x40, 0x00, 0x02, 0x00, 0x00, 0x10, 0x00, 0x00, 0x80,
+                0x00, 0x04, 0x00, 0x00, 0x20, 0x00, 0x01,
+            ],
+            &[1, 1, 1, 1, 1, 1, 1, 1],
+        );
+        check_repr(
+            &[
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+            ],
+            &[
+                2097151, 2097151, 2097151, 2097151, 2097151, 2097151, 2097151, 2097151,
+            ],
+        );
+        check_repr(
+            &[
+                0x0f, 0xff, 0xf8, 0x00, 0x20, 0x03, 0xff, 0xfe, 0x00, 0x08, 0x00, 0xff, 0xff, 0x80,
+                0x02, 0x00, 0x3f, 0xff, 0xe0, 0x00, 0x80,
+            ],
+            &[131071, 128, 131071, 128, 131071, 128, 131071, 128],
+        );
+        check_repr(
+            &[
+                0x00, 0x02, 0x20, 0x00, 0x0a, 0x7f, 0xff, 0xfe, 0x00, 0x4d, 0x10, 0x01, 0x4c, 0x80,
+                0x0f, 0xfc, 0x00, 0x00, 0x2f, 0xff, 0xff,
+            ],
+            &[68, 41, 2097151, 1233, 665, 1023, 1, 1048575],
+        );
+    }
+}
diff --git a/components/equihash/src/params.rs b/components/equihash/src/params.rs
new file mode 100644
index 0000000000..2e17700065
--- /dev/null
+++ b/components/equihash/src/params.rs
@@ -0,0 +1,37 @@
+#[derive(Clone, Copy)]
+pub(crate) struct Params {
+    pub(crate) n: u32,
+    pub(crate) k: u32,
+}
+
+impl Params {
+    /// Returns `None` if the parameters are invalid.
+    pub(crate) fn new(n: u32, k: u32) -> Option<Self> {
+        // We place the following requirements on the parameters:
+        // - n is a multiple of 8, so the hash output has an exact byte length.
+        // - k >= 3 so the encoded solutions have an exact byte length.
+        // - k < n, so the collision bit length is at least 1.
+        // - n is a multiple of k + 1, so we have an integer collision bit length.
+        if (n % 8 == 0) && (k >= 3) && (k < n) && (n % (k + 1) == 0) {
+            Some(Params { n, k })
+        } else {
+            None
+        }
+    }
+    pub(crate) fn indices_per_hash_output(&self) -> u32 {
+        512 / self.n
+    }
+    pub(crate) fn hash_output(&self) -> u8 {
+        (self.indices_per_hash_output() * self.n / 8) as u8
+    }
+    pub(crate) fn collision_bit_length(&self) -> usize {
+        (self.n / (self.k + 1)) as usize
+    }
+    pub(crate) fn collision_byte_length(&self) -> usize {
+        (self.collision_bit_length() + 7) / 8
+    }
+    #[cfg(test)]
+    pub(crate) fn hash_length(&self) -> usize {
+        ((self.k as usize) + 1) * self.collision_byte_length()
+    }
+}
diff --git a/components/equihash/src/test_vectors/invalid.rs b/components/equihash/src/test_vectors/invalid.rs
index 11da849e0d..5dbec5a33d 100644
--- a/components/equihash/src/test_vectors/invalid.rs
+++ b/components/equihash/src/test_vectors/invalid.rs
@@ -1,4 +1,4 @@
-use crate::verify::{Kind, Params};
+use crate::{params::Params, verify::Kind};
 
 pub(crate) struct TestVector {
     pub(crate) params: Params,
diff --git a/components/equihash/src/test_vectors/valid.rs b/components/equihash/src/test_vectors/valid.rs
index a55de1b96a..4df20c642a 100644
--- a/components/equihash/src/test_vectors/valid.rs
+++ b/components/equihash/src/test_vectors/valid.rs
@@ -1,4 +1,4 @@
-use crate::verify::Params;
+use crate::params::Params;
 
 pub(crate) struct TestVector {
     pub(crate) params: Params,
diff --git a/components/equihash/src/verify.rs b/components/equihash/src/verify.rs
index 2015008838..53071ddc01 100644
--- a/components/equihash/src/verify.rs
+++ b/components/equihash/src/verify.rs
@@ -3,16 +3,13 @@
 //! [Equihash]: https://zips.z.cash/protocol/protocol.pdf#equihash
 
 use blake2b_simd::{Hash as Blake2bHash, Params as Blake2bParams, State as Blake2bState};
-use byteorder::{BigEndian, LittleEndian, ReadBytesExt, WriteBytesExt};
+use byteorder::{LittleEndian, WriteBytesExt};
 use std::fmt;
-use std::io::Cursor;
-use std::mem::size_of;
 
-#[derive(Clone, Copy)]
-pub(crate) struct Params {
-    pub(crate) n: u32,
-    pub(crate) k: u32,
-}
+use crate::{
+    minimal::{expand_array, indices_from_minimal},
+    params::Params,
+};
 
 #[derive(Clone)]
 struct Node {
@@ -20,37 +17,6 @@ struct Node {
     indices: Vec<u32>,
 }
 
-impl Params {
-    fn new(n: u32, k: u32) -> Result<Self, Error> {
-        // We place the following requirements on the parameters:
-        // - n is a multiple of 8, so the hash output has an exact byte length.
-        // - k >= 3 so the encoded solutions have an exact byte length.
-        // - k < n, so the collision bit length is at least 1.
-        // - n is a multiple of k + 1, so we have an integer collision bit length.
-        if (n % 8 == 0) && (k >= 3) && (k < n) && (n % (k + 1) == 0) {
-            Ok(Params { n, k })
-        } else {
-            Err(Error(Kind::InvalidParams))
-        }
-    }
-    fn indices_per_hash_output(&self) -> u32 {
-        512 / self.n
-    }
-    fn hash_output(&self) -> u8 {
-        (self.indices_per_hash_output() * self.n / 8) as u8
-    }
-    fn collision_bit_length(&self) -> usize {
-        (self.n / (self.k + 1)) as usize
-    }
-    fn collision_byte_length(&self) -> usize {
-        (self.collision_bit_length() + 7) / 8
-    }
-    #[cfg(test)]
-    fn hash_length(&self) -> usize {
-        ((self.k as usize) + 1) * self.collision_byte_length()
-    }
-}
-
 impl Node {
     fn new(p: &Params, state: &Blake2bState, i: u32) -> Self {
         let hash = generate_hash(state, i / p.indices_per_hash_output());
@@ -168,74 +134,6 @@ fn generate_hash(base_state: &Blake2bState, i: u32) -> Blake2bHash {
     state.finalize()
 }
 
-fn expand_array(vin: &[u8], bit_len: usize, byte_pad: usize) -> Vec<u8> {
-    assert!(bit_len >= 8);
-    assert!(u32::BITS as usize >= 7 + bit_len);
-
-    let out_width = (bit_len + 7) / 8 + byte_pad;
-    let out_len = 8 * out_width * vin.len() / bit_len;
-
-    // Shortcut for parameters where expansion is a no-op
-    if out_len == vin.len() {
-        return vin.to_vec();
-    }
-
-    let mut vout: Vec<u8> = vec![0; out_len];
-    let bit_len_mask: u32 = (1 << bit_len) - 1;
-
-    // The acc_bits least-significant bits of acc_value represent a bit sequence
-    // in big-endian order.
-    let mut acc_bits = 0;
-    let mut acc_value: u32 = 0;
-
-    let mut j = 0;
-    for b in vin {
-        acc_value = (acc_value << 8) | u32::from(*b);
-        acc_bits += 8;
-
-        // When we have bit_len or more bits in the accumulator, write the next
-        // output element.
-        if acc_bits >= bit_len {
-            acc_bits -= bit_len;
-            for x in byte_pad..out_width {
-                vout[j + x] = ((
-                    // Big-endian
-                    acc_value >> (acc_bits + (8 * (out_width - x - 1)))
-                ) & (
-                    // Apply bit_len_mask across byte boundaries
-                    (bit_len_mask >> (8 * (out_width - x - 1))) & 0xFF
-                )) as u8;
-            }
-            j += out_width;
-        }
-    }
-
-    vout
-}
-
-fn indices_from_minimal(p: Params, minimal: &[u8]) -> Result<Vec<u32>, Error> {
-    let c_bit_len = p.collision_bit_length();
-    // Division is exact because k >= 3.
-    if minimal.len() != ((1 << p.k) * (c_bit_len + 1)) / 8 {
-        return Err(Error(Kind::InvalidParams));
-    }
-
-    assert!(((c_bit_len + 1) + 7) / 8 <= size_of::<u32>());
-    let len_indices = u32::BITS as usize * minimal.len() / (c_bit_len + 1);
-    let byte_pad = size_of::<u32>() - ((c_bit_len + 1) + 7) / 8;
-
-    let mut csr = Cursor::new(expand_array(minimal, c_bit_len + 1, byte_pad));
-    let mut ret = Vec::with_capacity(len_indices);
-
-    // Big-endian so that lexicographic array comparison is equivalent to integer
-    // comparison
-    while let Ok(i) = csr.read_u32::<BigEndian>() {
-        ret.push(i);
-    }
-
-    Ok(ret)
-}
-
 fn has_collision(a: &Node, b: &Node, len: usize) -> bool {
     a.hash
         .iter()
@@ -347,8 +245,8 @@ pub fn is_valid_solution(
     nonce: &[u8],
     soln: &[u8],
 ) -> Result<(), Error> {
-    let p = Params::new(n, k)?;
-    let indices = indices_from_minimal(p, soln)?;
+    let p = Params::new(n, k).ok_or(Error(Kind::InvalidParams))?;
+    let indices = indices_from_minimal(p, soln).ok_or(Error(Kind::InvalidParams))?;
 
     // Recursive validation is faster
     is_valid_solution_recursive(p, input, nonce, &indices)
@@ -356,122 +254,9 @@ pub fn is_valid_solution(
 
 #[cfg(test)]
 mod tests {
-    use super::{
-        expand_array, indices_from_minimal, is_valid_solution, is_valid_solution_iterative,
-        is_valid_solution_recursive, Params,
-    };
+    use super::{is_valid_solution, is_valid_solution_iterative, is_valid_solution_recursive};
     use crate::test_vectors::{INVALID_TEST_VECTORS, VALID_TEST_VECTORS};
 
-    #[test]
-    fn array_expansion() {
-        let check_array = |(bit_len, byte_pad), compact, expanded| {
-            assert_eq!(expand_array(compact, bit_len, byte_pad), expanded);
-        };
-
-        // 8 11-bit chunks, all-ones
-        check_array(
-            (11, 0),
-            &[
-                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-            ],
-            &[
-                0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff, 0x07, 0xff,
-                0x07, 0xff,
-            ][..],
-        );
-        // 8 21-bit chunks, alternating 1s and 0s
-        check_array(
-            (21, 0),
-            &[
-                0xaa, 0xaa, 0xad, 0x55, 0x55, 0x6a, 0xaa, 0xab, 0x55, 0x55, 0x5a, 0xaa, 0xaa, 0xd5,
-                0x55, 0x56, 0xaa, 0xaa, 0xb5, 0x55, 0x55,
-            ],
-            &[
-                0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55,
-                0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55, 0x15, 0x55, 0x55,
-            ][..],
-        );
-        // 8 21-bit chunks, based on example in the spec
-        check_array(
-            (21, 0),
-            &[
-                0x00, 0x02, 0x20, 0x00, 0x0a, 0x7f, 0xff, 0xfe, 0x00, 0x12, 0x30, 0x22, 0xb3, 0x82,
-                0x26, 0xac, 0x19, 0xbd, 0xf2, 0x34, 0x56,
-            ],
-            &[
-                0x00, 0x00, 0x44, 0x00, 0x00, 0x29, 0x1f, 0xff, 0xff, 0x00, 0x01, 0x23, 0x00, 0x45,
-                0x67, 0x00, 0x89, 0xab, 0x00, 0xcd, 0xef, 0x12, 0x34, 0x56,
-            ][..],
-        );
-        // 16 14-bit chunks, alternating 11s and 00s
-        check_array(
-            (14, 0),
-            &[
-                0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33, 0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33,
-                0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33, 0xcc, 0xcf, 0x33, 0x3c, 0xcc, 0xf3, 0x33,
-            ],
-            &[
-                0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33,
-                0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33,
-                0x33, 0x33, 0x33, 0x33,
-            ][..],
-        );
-        // 8 11-bit chunks, all-ones, 2-byte padding
-        check_array(
-            (11, 2),
-            &[
-                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-            ],
-            &[
-                0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00,
-                0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff, 0x00, 0x00, 0x07, 0xff,
-                0x00, 0x00, 0x07, 0xff,
-            ][..],
-        );
-    }
-
-    #[test]
-    fn minimal_solution_repr() {
-        let check_repr = |minimal, indices| {
-            assert_eq!(
-                indices_from_minimal(Params { n: 80, k: 3 }, minimal).unwrap(),
-                indices,
-            );
-        };
-
-        // The solutions here are not intended to be valid.
-        check_repr(
-            &[
-                0x00, 0x00, 0x08, 0x00, 0x00, 0x40, 0x00, 0x02, 0x00, 0x00, 0x10, 0x00, 0x00, 0x80,
-                0x00, 0x04, 0x00, 0x00, 0x20, 0x00, 0x01,
-            ],
-            &[1, 1, 1, 1, 1, 1, 1, 1],
-        );
-        check_repr(
-            &[
-                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-                0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-            ],
-            &[
-                2097151, 2097151, 2097151, 2097151, 2097151, 2097151, 2097151, 2097151,
-            ],
-        );
-        check_repr(
-            &[
-                0x0f, 0xff, 0xf8, 0x00, 0x20, 0x03, 0xff, 0xfe, 0x00, 0x08, 0x00, 0xff, 0xff, 0x80,
-                0x02, 0x00, 0x3f, 0xff, 0xe0, 0x00, 0x80,
-            ],
-            &[131071, 128, 131071, 128, 131071, 128, 131071, 128],
-        );
-        check_repr(
-            &[
-                0x00, 0x02, 0x20, 0x00, 0x0a, 0x7f, 0xff, 0xfe, 0x00, 0x4d, 0x10, 0x01, 0x4c, 0x80,
-                0x0f, 0xfc, 0x00, 0x00, 0x2f, 0xff, 0xff,
-            ],
-            &[68, 41, 2097151, 1233, 665, 1023, 1, 1048575],
-        );
-    }
-
     #[test]
     fn valid_test_vectors() {
         for tv in VALID_TEST_VECTORS {
diff --git a/components/zcash_address/CHANGELOG.md b/components/zcash_address/CHANGELOG.md
index a7bf6f6385..7eeb56b994 100644
--- a/components/zcash_address/CHANGELOG.md
+++ b/components/zcash_address/CHANGELOG.md
@@ -7,6 +7,37 @@ and this library adheres to Rust's notion of
 
 ## [Unreleased]
 
+## [0.6.0] - 2024-10-02
+### Changed
+- Migrated to `zcash_protocol 0.4`.
+
+## [0.5.0] - 2024-08-26
+### Changed
+- Updated `zcash_protocol` dependency to version `0.3`
+
+## [0.4.0] - 2024-08-19
+### Added
+- `zcash_address::ZcashAddress::{can_receive_memo, can_receive_as, matches_receiver}`
+- `zcash_address::unified::Address::{can_receive_memo, has_receiver_of_type, contains_receiver}`
+- Module `zcash_address::testing` under the `test-dependencies` feature.
+- Module `zcash_address::unified::address::testing` under the
+  `test-dependencies` feature.
+
+### Changed
+- Updated `zcash_protocol` dependency to version `0.2`
+
+## [0.3.2] - 2024-03-06
+### Added
+- `zcash_address::convert`:
+  - `TryFromRawAddress::try_from_raw_tex`
+  - `TryFromAddress::try_from_tex`
+  - `ToAddress::from_tex`
+
+## [0.3.1] - 2024-01-12
+### Fixed
+- Stubs for `zcash_address::convert` traits that are created by `rust-analyzer`
+  and similar LSPs no longer reference crate-private type aliases.
+
 ## [0.3.0] - 2023-06-06
 ### Changed
 - Bumped bs58 dependency to `0.5`.
diff --git a/components/zcash_address/Cargo.toml b/components/zcash_address/Cargo.toml
index 3ccef17a46..f2201d2612 100644
--- a/components/zcash_address/Cargo.toml
+++ b/components/zcash_address/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "zcash_address"
 description = "Zcash address parsing and serialization"
-version = "0.3.0"
+version = "0.6.0"
 authors = [
     "Jack Grigg <jack@electriccoin.co>",
 ]
@@ -14,18 +14,24 @@ rust-version = "1.52"
 categories = ["cryptography::cryptocurrencies", "encoding"]
 keywords = ["zcash", "address", "sapling", "unified"]
 
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
 [dependencies]
-bech32 = "0.9"
-bs58 = { version = "0.5", features = ["check"] }
+bech32.workspace = true
+bs58.workspace = true
 f4jumble = { version = "0.1", path = "../f4jumble" }
-zcash_encoding = { version = "0.2", path = "../zcash_encoding" }
+zcash_protocol.workspace = true
+zcash_encoding.workspace = true
+proptest = { workspace = true, optional = true }
 
 [dev-dependencies]
-assert_matches = "1.3.0"
-proptest = "1"
+assert_matches.workspace = true
+proptest.workspace = true
 
 [features]
-test-dependencies = []
+test-dependencies = ["dep:proptest"]
 
 [lib]
 bench = false
diff --git a/components/zcash_address/src/convert.rs b/components/zcash_address/src/convert.rs
index 38b04f374a..225b8775bb 100644
--- a/components/zcash_address/src/convert.rs
+++ b/components/zcash_address/src/convert.rs
@@ -2,7 +2,7 @@ use std::{error::Error, fmt};
 
 use crate::{kind::*, AddressKind, Network, ZcashAddress};
 
-/// An address type is not supported for conversion.
+/// An error indicating that an address type is not supported for conversion.
 #[derive(Debug)]
 pub struct UnsupportedAddress(&'static str);
 
@@ -107,12 +107,12 @@ pub trait TryFromRawAddress: Sized {
     /// [`Self::try_from_raw_sapling`] as a valid Sapling address).
     type Error;
 
-    fn try_from_raw_sprout(data: sprout::Data) -> Result<Self, ConversionError<Self::Error>> {
+    fn try_from_raw_sprout(data: [u8; 64]) -> Result<Self, ConversionError<Self::Error>> {
         let _ = data;
         Err(ConversionError::Unsupported(UnsupportedAddress("Sprout")))
     }
 
-    fn try_from_raw_sapling(data: sapling::Data) -> Result<Self, ConversionError<Self::Error>> {
+    fn try_from_raw_sapling(data: [u8; 43]) -> Result<Self, ConversionError<Self::Error>> {
         let _ = data;
         Err(ConversionError::Unsupported(UnsupportedAddress("Sapling")))
     }
@@ -123,7 +123,7 @@ pub trait TryFromRawAddress: Sized {
     }
 
     fn try_from_raw_transparent_p2pkh(
-        data: p2pkh::Data,
+        data: [u8; 20],
     ) -> Result<Self, ConversionError<Self::Error>> {
         let _ = data;
         Err(ConversionError::Unsupported(UnsupportedAddress(
@@ -131,14 +131,19 @@ pub trait TryFromRawAddress: Sized {
         )))
     }
 
-    fn try_from_raw_transparent_p2sh(
-        data: p2sh::Data,
-    ) -> Result<Self, ConversionError<Self::Error>> {
+    fn try_from_raw_transparent_p2sh(data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
         let _ = data;
         Err(ConversionError::Unsupported(UnsupportedAddress(
             "transparent P2SH",
         )))
     }
+
+    fn try_from_raw_tex(data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
+        let _ = data;
+        Err(ConversionError::Unsupported(UnsupportedAddress(
+            "transparent-source restricted P2PKH",
+        )))
+    }
 }
 
 /// A helper trait for converting a [`ZcashAddress`] into another type.
@@ -187,17 +192,14 @@ pub trait TryFromAddress: Sized {
     /// [`Self::try_from_sapling`] as a valid Sapling address).
     type Error;
 
-    fn try_from_sprout(
-        net: Network,
-        data: sprout::Data,
-    ) -> Result<Self, ConversionError<Self::Error>> {
+    fn try_from_sprout(net: Network, data: [u8; 64]) -> Result<Self, ConversionError<Self::Error>> {
         let _ = (net, data);
         Err(ConversionError::Unsupported(UnsupportedAddress("Sprout")))
     }
 
     fn try_from_sapling(
         net: Network,
-        data: sapling::Data,
+        data: [u8; 43],
     ) -> Result<Self, ConversionError<Self::Error>> {
         let _ = (net, data);
         Err(ConversionError::Unsupported(UnsupportedAddress("Sapling")))
@@ -213,7 +215,7 @@ pub trait TryFromAddress: Sized {
 
     fn try_from_transparent_p2pkh(
         net: Network,
-        data: p2pkh::Data,
+        data: [u8; 20],
     ) -> Result<Self, ConversionError<Self::Error>> {
         let _ = (net, data);
         Err(ConversionError::Unsupported(UnsupportedAddress(
@@ -223,28 +225,32 @@ pub trait TryFromAddress: Sized {
 
     fn try_from_transparent_p2sh(
         net: Network,
-        data: p2sh::Data,
+        data: [u8; 20],
     ) -> Result<Self, ConversionError<Self::Error>> {
         let _ = (net, data);
         Err(ConversionError::Unsupported(UnsupportedAddress(
             "transparent P2SH",
         )))
     }
+
+    fn try_from_tex(net: Network, data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
+        let _ = (net, data);
+        Err(ConversionError::Unsupported(UnsupportedAddress(
+            "transparent-source restricted P2PKH",
+        )))
+    }
 }
 
 impl<T: TryFromRawAddress> TryFromAddress for (Network, T) {
     type Error = T::Error;
 
-    fn try_from_sprout(
-        net: Network,
-        data: sprout::Data,
-    ) -> Result<Self, ConversionError<Self::Error>> {
+    fn try_from_sprout(net: Network, data: [u8; 64]) -> Result<Self, ConversionError<Self::Error>> {
         T::try_from_raw_sprout(data).map(|addr| (net, addr))
     }
 
     fn try_from_sapling(
         net: Network,
-        data: sapling::Data,
+        data: [u8; 43],
     ) -> Result<Self, ConversionError<Self::Error>> {
         T::try_from_raw_sapling(data).map(|addr| (net, addr))
     }
@@ -258,17 +264,21 @@ impl<T: TryFromRawAddress> TryFromAddress for (Network, T) {
 
     fn try_from_transparent_p2pkh(
         net: Network,
-        data: p2pkh::Data,
+        data: [u8; 20],
     ) -> Result<Self, ConversionError<Self::Error>> {
         T::try_from_raw_transparent_p2pkh(data).map(|addr| (net, addr))
     }
 
     fn try_from_transparent_p2sh(
         net: Network,
-        data: p2sh::Data,
+        data: [u8; 20],
     ) -> Result<Self, ConversionError<Self::Error>> {
         T::try_from_raw_transparent_p2sh(data).map(|addr| (net, addr))
     }
+
+    fn try_from_tex(net: Network, data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
+        T::try_from_raw_tex(data).map(|addr| (net, addr))
+    }
 }
 
 /// A helper trait for converting another type into a [`ZcashAddress`].
@@ -303,19 +313,21 @@ impl<T: TryFromRawAddress> TryFromAddress for (Network, T) {
 /// );
 /// ```
 pub trait ToAddress: private::Sealed {
-    fn from_sprout(net: Network, data: sprout::Data) -> Self;
+    fn from_sprout(net: Network, data: [u8; 64]) -> Self;
 
-    fn from_sapling(net: Network, data: sapling::Data) -> Self;
+    fn from_sapling(net: Network, data: [u8; 43]) -> Self;
 
     fn from_unified(net: Network, data: unified::Address) -> Self;
 
-    fn from_transparent_p2pkh(net: Network, data: p2pkh::Data) -> Self;
+    fn from_transparent_p2pkh(net: Network, data: [u8; 20]) -> Self;
+
+    fn from_transparent_p2sh(net: Network, data: [u8; 20]) -> Self;
 
-    fn from_transparent_p2sh(net: Network, data: p2sh::Data) -> Self;
+    fn from_tex(net: Network, data: [u8; 20]) -> Self;
 }
 
 impl ToAddress for ZcashAddress {
-    fn from_sprout(net: Network, data: sprout::Data) -> Self {
+    fn from_sprout(net: Network, data: [u8; 64]) -> Self {
         ZcashAddress {
             net: if let Network::Regtest = net {
                 Network::Test
@@ -326,7 +338,7 @@ impl ToAddress for ZcashAddress {
         }
     }
 
-    fn from_sapling(net: Network, data: sapling::Data) -> Self {
+    fn from_sapling(net: Network, data: [u8; 43]) -> Self {
         ZcashAddress {
             net,
             kind: AddressKind::Sapling(data),
@@ -340,7 +352,7 @@ impl ToAddress for ZcashAddress {
         }
     }
 
-    fn from_transparent_p2pkh(net: Network, data: p2pkh::Data) -> Self {
+    fn from_transparent_p2pkh(net: Network, data: [u8; 20]) -> Self {
         ZcashAddress {
             net: if let Network::Regtest = net {
                 Network::Test
@@ -351,7 +363,7 @@ impl ToAddress for ZcashAddress {
         }
     }
 
-    fn from_transparent_p2sh(net: Network, data: p2sh::Data) -> Self {
+    fn from_transparent_p2sh(net: Network, data: [u8; 20]) -> Self {
         ZcashAddress {
             net: if let Network::Regtest = net {
                 Network::Test
@@ -361,6 +373,13 @@ impl ToAddress for ZcashAddress {
             kind: AddressKind::P2sh(data),
         }
     }
+
+    fn from_tex(net: Network, data: [u8; 20]) -> Self {
+        ZcashAddress {
+            net,
+            kind: AddressKind::Tex(data),
+        }
+    }
 }
 
 mod private {
diff --git a/components/zcash_address/src/encoding.rs b/components/zcash_address/src/encoding.rs
index 9e5e422ce6..a0d3c117d6 100644
--- a/components/zcash_address/src/encoding.rs
+++ b/components/zcash_address/src/encoding.rs
@@ -1,9 +1,11 @@
 use std::{convert::TryInto, error::Error, fmt, str::FromStr};
 
 use bech32::{self, FromBase32, ToBase32, Variant};
+use zcash_protocol::consensus::{NetworkConstants, NetworkType};
+use zcash_protocol::constants::{mainnet, regtest, testnet};
 
 use crate::kind::unified::Encoding;
-use crate::{kind::*, AddressKind, Network, ZcashAddress};
+use crate::{kind::*, AddressKind, ZcashAddress};
 
 /// An error while attempting to parse a string as a Zcash address.
 #[derive(Debug, PartialEq, Eq)]
@@ -54,55 +56,87 @@ impl FromStr for ZcashAddress {
                     kind: AddressKind::Unified(data),
                 });
             }
-            Err(unified::ParseError::NotUnified) => {
-                // allow decoding to fall through to Sapling/Transparent
+            Err(unified::ParseError::NotUnified | unified::ParseError::UnknownPrefix(_)) => {
+                // allow decoding to fall through to Sapling/TEX/Transparent
             }
             Err(e) => {
                 return Err(ParseError::from(e));
             }
         }
 
-        // Try decoding as a Sapling address (Bech32)
-        if let Ok((hrp, data, Variant::Bech32)) = bech32::decode(s) {
-            // If we reached this point, the encoding is supposed to be valid Bech32.
+        // Try decoding as a Sapling or TEX address (Bech32/Bech32m)
+        if let Ok((hrp, data, variant)) = bech32::decode(s) {
+            // If we reached this point, the encoding is found to be valid Bech32 or Bech32m.
             let data = Vec::<u8>::from_base32(&data).map_err(|_| ParseError::InvalidEncoding)?;
 
-            let net = match hrp.as_str() {
-                sapling::MAINNET => Network::Main,
-                sapling::TESTNET => Network::Test,
-                sapling::REGTEST => Network::Regtest,
-                // We will not define new Bech32 address encodings.
-                _ => {
-                    return Err(ParseError::NotZcash);
+            match variant {
+                Variant::Bech32 => {
+                    let net = match hrp.as_str() {
+                        mainnet::HRP_SAPLING_PAYMENT_ADDRESS => NetworkType::Main,
+                        testnet::HRP_SAPLING_PAYMENT_ADDRESS => NetworkType::Test,
+                        regtest::HRP_SAPLING_PAYMENT_ADDRESS => NetworkType::Regtest,
+                        // We will not define new Bech32 address encodings.
+                        _ => {
+                            return Err(ParseError::NotZcash);
+                        }
+                    };
+
+                    return data[..]
+                        .try_into()
+                        .map(AddressKind::Sapling)
+                        .map_err(|_| ParseError::InvalidEncoding)
+                        .map(|kind| ZcashAddress { net, kind });
                 }
-            };
+                Variant::Bech32m => {
+                    // Try decoding as a TEX address (Bech32m)
+                    let net = match hrp.as_str() {
+                        mainnet::HRP_TEX_ADDRESS => NetworkType::Main,
+                        testnet::HRP_TEX_ADDRESS => NetworkType::Test,
+                        regtest::HRP_TEX_ADDRESS => NetworkType::Regtest,
+                        // Not recognized as a Zcash address type
+                        _ => {
+                            return Err(ParseError::NotZcash);
+                        }
+                    };
 
-            return data[..]
-                .try_into()
-                .map(AddressKind::Sapling)
-                .map_err(|_| ParseError::InvalidEncoding)
-                .map(|kind| ZcashAddress { net, kind });
+                    return data[..]
+                        .try_into()
+                        .map(AddressKind::Tex)
+                        .map_err(|_| ParseError::InvalidEncoding)
+                        .map(|kind| ZcashAddress { net, kind });
+                }
+            }
         }
 
         // The rest use Base58Check.
         if let Ok(decoded) = bs58::decode(s).with_check(None).into_vec() {
-            let net = match decoded[..2].try_into().unwrap() {
-                sprout::MAINNET | p2pkh::MAINNET | p2sh::MAINNET => Network::Main,
-                sprout::TESTNET | p2pkh::TESTNET | p2sh::TESTNET => Network::Test,
-                // We will not define new Base58Check address encodings.
-                _ => return Err(ParseError::NotZcash),
-            };
+            if decoded.len() >= 2 {
+                let (prefix, net) = match decoded[..2].try_into().unwrap() {
+                    prefix @ (mainnet::B58_PUBKEY_ADDRESS_PREFIX
+                    | mainnet::B58_SCRIPT_ADDRESS_PREFIX
+                    | mainnet::B58_SPROUT_ADDRESS_PREFIX) => (prefix, NetworkType::Main),
+                    prefix @ (testnet::B58_PUBKEY_ADDRESS_PREFIX
+                    | testnet::B58_SCRIPT_ADDRESS_PREFIX
+                    | testnet::B58_SPROUT_ADDRESS_PREFIX) => (prefix, NetworkType::Test),
+                    // We will not define new Base58Check address encodings.
+                    _ => return Err(ParseError::NotZcash),
+                };
 
-            return match decoded[..2].try_into().unwrap() {
-                sprout::MAINNET | sprout::TESTNET => {
-                    decoded[2..].try_into().map(AddressKind::Sprout)
+                return match prefix {
+                    mainnet::B58_SPROUT_ADDRESS_PREFIX | testnet::B58_SPROUT_ADDRESS_PREFIX => {
+                        decoded[2..].try_into().map(AddressKind::Sprout)
+                    }
+                    mainnet::B58_PUBKEY_ADDRESS_PREFIX | testnet::B58_PUBKEY_ADDRESS_PREFIX => {
+                        decoded[2..].try_into().map(AddressKind::P2pkh)
+                    }
+                    mainnet::B58_SCRIPT_ADDRESS_PREFIX | testnet::B58_SCRIPT_ADDRESS_PREFIX => {
+                        decoded[2..].try_into().map(AddressKind::P2sh)
+                    }
+                    _ => unreachable!(),
                 }
-                p2pkh::MAINNET | p2pkh::TESTNET => decoded[2..].try_into().map(AddressKind::P2pkh),
-                p2sh::MAINNET | p2sh::TESTNET => decoded[2..].try_into().map(AddressKind::P2sh),
-                _ => unreachable!(),
+                .map_err(|_| ParseError::InvalidEncoding)
+                .map(|kind| ZcashAddress { kind, net });
             }
-            .map_err(|_| ParseError::InvalidEncoding)
-            .map(|kind| ZcashAddress { kind, net });
         };
 
         // If it's not valid Bech32, Bech32m, or Base58Check, it's not a Zcash address.
@@ -110,8 +144,8 @@ impl FromStr for ZcashAddress {
     }
 }
 
-fn encode_bech32(hrp: &str, data: &[u8]) -> String {
-    bech32::encode(hrp, data.to_base32(), Variant::Bech32).expect("hrp is invalid")
+fn encode_bech32(hrp: &str, data: &[u8], variant: Variant) -> String {
+    bech32::encode(hrp, data.to_base32(), variant).expect("hrp is invalid")
 }
 
 fn encode_b58(prefix: [u8; 2], data: &[u8]) -> String {
@@ -124,36 +158,18 @@ fn encode_b58(prefix: [u8; 2], data: &[u8]) -> String {
 impl fmt::Display for ZcashAddress {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let encoded = match &self.kind {
-            AddressKind::Sprout(data) => encode_b58(
-                match self.net {
-                    Network::Main => sprout::MAINNET,
-                    Network::Test | Network::Regtest => sprout::TESTNET,
-                },
-                data,
-            ),
+            AddressKind::Sprout(data) => encode_b58(self.net.b58_sprout_address_prefix(), data),
             AddressKind::Sapling(data) => encode_bech32(
-                match self.net {
-                    Network::Main => sapling::MAINNET,
-                    Network::Test => sapling::TESTNET,
-                    Network::Regtest => sapling::REGTEST,
-                },
+                self.net.hrp_sapling_payment_address(),
                 data,
+                Variant::Bech32,
             ),
             AddressKind::Unified(addr) => addr.encode(&self.net),
-            AddressKind::P2pkh(data) => encode_b58(
-                match self.net {
-                    Network::Main => p2pkh::MAINNET,
-                    Network::Test | Network::Regtest => p2pkh::TESTNET,
-                },
-                data,
-            ),
-            AddressKind::P2sh(data) => encode_b58(
-                match self.net {
-                    Network::Main => p2sh::MAINNET,
-                    Network::Test | Network::Regtest => p2sh::TESTNET,
-                },
-                data,
-            ),
+            AddressKind::P2pkh(data) => encode_b58(self.net.b58_pubkey_address_prefix(), data),
+            AddressKind::P2sh(data) => encode_b58(self.net.b58_script_address_prefix(), data),
+            AddressKind::Tex(data) => {
+                encode_bech32(self.net.hrp_tex_address(), data, Variant::Bech32m)
+            }
         };
         write!(f, "{}", encoded)
     }
@@ -161,8 +177,10 @@ impl fmt::Display for ZcashAddress {
 
 #[cfg(test)]
 mod tests {
+    use assert_matches::assert_matches;
+
     use super::*;
-    use crate::kind::unified;
+    use crate::{kind::unified, Network};
 
     fn encoding(encoded: &str, decoded: ZcashAddress) {
         assert_eq!(decoded.to_string(), encoded);
@@ -269,6 +287,74 @@ mod tests {
         );
     }
 
+    #[test]
+    fn tex() {
+        let p2pkh_str = "t1VmmGiyjVNeCjxDZzg7vZmd99WyzVby9yC";
+        let tex_str = "tex1s2rt77ggv6q989lr49rkgzmh5slsksa9khdgte";
+
+        // Transcode P2PKH to TEX
+        let p2pkh_zaddr: ZcashAddress = p2pkh_str.parse().unwrap();
+        assert_matches!(p2pkh_zaddr.net, Network::Main);
+        if let AddressKind::P2pkh(zaddr_data) = p2pkh_zaddr.kind {
+            let tex_zaddr = ZcashAddress {
+                net: p2pkh_zaddr.net,
+                kind: AddressKind::Tex(zaddr_data),
+            };
+
+            assert_eq!(tex_zaddr.to_string(), tex_str);
+        } else {
+            panic!("Decoded address should have been a P2PKH address.");
+        }
+
+        // Transcode TEX to P2PKH
+        let tex_zaddr: ZcashAddress = tex_str.parse().unwrap();
+        assert_matches!(tex_zaddr.net, Network::Main);
+        if let AddressKind::Tex(zaddr_data) = tex_zaddr.kind {
+            let p2pkh_zaddr = ZcashAddress {
+                net: tex_zaddr.net,
+                kind: AddressKind::P2pkh(zaddr_data),
+            };
+
+            assert_eq!(p2pkh_zaddr.to_string(), p2pkh_str);
+        } else {
+            panic!("Decoded address should have been a TEX address.");
+        }
+    }
+
+    #[test]
+    fn tex_testnet() {
+        let p2pkh_str = "tm9ofD7kHR7AF8MsJomEzLqGcrLCBkD9gDj";
+        let tex_str = "textest1qyqszqgpqyqszqgpqyqszqgpqyqszqgpfcjgfy";
+
+        // Transcode P2PKH to TEX
+        let p2pkh_zaddr: ZcashAddress = p2pkh_str.parse().unwrap();
+        assert_matches!(p2pkh_zaddr.net, Network::Test);
+        if let AddressKind::P2pkh(zaddr_data) = p2pkh_zaddr.kind {
+            let tex_zaddr = ZcashAddress {
+                net: p2pkh_zaddr.net,
+                kind: AddressKind::Tex(zaddr_data),
+            };
+
+            assert_eq!(tex_zaddr.to_string(), tex_str);
+        } else {
+            panic!("Decoded address should have been a P2PKH address.");
+        }
+
+        // Transcode TEX to P2PKH
+        let tex_zaddr: ZcashAddress = tex_str.parse().unwrap();
+        assert_matches!(tex_zaddr.net, Network::Test);
+        if let AddressKind::Tex(zaddr_data) = tex_zaddr.kind {
+            let p2pkh_zaddr = ZcashAddress {
+                net: tex_zaddr.net,
+                kind: AddressKind::P2pkh(zaddr_data),
+            };
+
+            assert_eq!(p2pkh_zaddr.to_string(), p2pkh_str);
+        } else {
+            panic!("Decoded address should have been a TEX address.");
+        }
+    }
+
     #[test]
     fn whitespace() {
         assert_eq!(
diff --git a/components/zcash_address/src/kind.rs b/components/zcash_address/src/kind.rs
index 5397c027f8..38b4557a6e 100644
--- a/components/zcash_address/src/kind.rs
+++ b/components/zcash_address/src/kind.rs
@@ -1,7 +1 @@
 pub mod unified;
-
-pub(crate) mod sapling;
-pub(crate) mod sprout;
-
-pub(crate) mod p2pkh;
-pub(crate) mod p2sh;
diff --git a/components/zcash_address/src/kind/p2pkh.rs b/components/zcash_address/src/kind/p2pkh.rs
deleted file mode 100644
index 0120e2c39f..0000000000
--- a/components/zcash_address/src/kind/p2pkh.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-/// The prefix for a Base58Check-encoded mainnet transparent P2PKH address.
-pub(crate) const MAINNET: [u8; 2] = [0x1c, 0xb8];
-
-/// The prefix for a Base58Check-encoded testnet transparent P2PKH address.
-pub(crate) const TESTNET: [u8; 2] = [0x1d, 0x25];
-
-pub(crate) type Data = [u8; 20];
diff --git a/components/zcash_address/src/kind/p2sh.rs b/components/zcash_address/src/kind/p2sh.rs
deleted file mode 100644
index 5059513182..0000000000
--- a/components/zcash_address/src/kind/p2sh.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-/// The prefix for a Base58Check-encoded mainnet transparent P2SH address.
-pub(crate) const MAINNET: [u8; 2] = [0x1c, 0xbd];
-
-/// The prefix for a Base58Check-encoded testnet transparent P2SH address.
-pub(crate) const TESTNET: [u8; 2] = [0x1c, 0xba];
-
-pub(crate) type Data = [u8; 20];
diff --git a/components/zcash_address/src/kind/sapling.rs b/components/zcash_address/src/kind/sapling.rs
deleted file mode 100644
index 2cbf914d61..0000000000
--- a/components/zcash_address/src/kind/sapling.rs
+++ /dev/null
@@ -1,22 +0,0 @@
-/// The HRP for a Bech32-encoded mainnet Sapling address.
-///
-/// Defined in the [Zcash Protocol Specification section 5.6.4][saplingpaymentaddrencoding].
-///
-/// [saplingpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#saplingpaymentaddrencoding
-pub(crate) const MAINNET: &str = "zs";
-
-/// The HRP for a Bech32-encoded testnet Sapling address.
-///
-/// Defined in the [Zcash Protocol Specification section 5.6.4][saplingpaymentaddrencoding].
-///
-/// [saplingpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#saplingpaymentaddrencoding
-pub(crate) const TESTNET: &str = "ztestsapling";
-
-/// The HRP for a Bech32-encoded regtest Sapling address.
-///
-/// It is defined in [the `zcashd` codebase].
-///
-/// [the `zcashd` codebase]: https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L493
-pub(crate) const REGTEST: &str = "zregtestsapling";
-
-pub(crate) type Data = [u8; 43];
diff --git a/components/zcash_address/src/kind/sprout.rs b/components/zcash_address/src/kind/sprout.rs
deleted file mode 100644
index fae74aab28..0000000000
--- a/components/zcash_address/src/kind/sprout.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-/// The prefix for a Base58Check-encoded mainnet Sprout address.
-///
-/// Defined in the [Zcash Protocol Specification section 5.6.3][sproutpaymentaddrencoding].
-///
-/// [sproutpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#sproutpaymentaddrencoding
-pub(crate) const MAINNET: [u8; 2] = [0x16, 0x9a];
-
-/// The prefix for a Base58Check-encoded testnet Sprout address.
-///
-/// Defined in the [Zcash Protocol Specification section 5.6.3][sproutpaymentaddrencoding].
-///
-/// [sproutpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#sproutpaymentaddrencoding
-pub(crate) const TESTNET: [u8; 2] = [0x16, 0xb6];
-
-pub(crate) type Data = [u8; 64];
diff --git a/components/zcash_address/src/kind/unified.rs b/components/zcash_address/src/kind/unified.rs
index 98bfa54130..fd7e4d5703 100644
--- a/components/zcash_address/src/kind/unified.rs
+++ b/components/zcash_address/src/kind/unified.rs
@@ -1,3 +1,5 @@
+//! Implementation of [ZIP 316](https://zips.z.cash/zip-0316) Unified Addresses and Viewing Keys.
+
 use bech32::{self, FromBase32, ToBase32, Variant};
 use std::cmp;
 use std::convert::{TryFrom, TryInto};
@@ -17,12 +19,23 @@ pub use ivk::{Ivk, Uivk};
 
 const PADDING_LEN: usize = 16;
 
+/// The known Receiver and Viewing Key types.
+///
+/// The typecodes `0xFFFA..=0xFFFF` reserved for experiments are currently not
+/// distinguished from unknown values, and will be parsed as [`Typecode::Unknown`].
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum Typecode {
+    /// A transparent P2PKH address, FVK, or IVK encoding as specified in [ZIP 316](https://zips.z.cash/zip-0316).
     P2pkh,
+    /// A transparent P2SH address.
+    ///
+    /// This typecode cannot occur in a [`Ufvk`] or [`Uivk`].
     P2sh,
+    /// A Sapling raw address, FVK, or IVK encoding as specified in [ZIP 316](https://zips.z.cash/zip-0316).
     Sapling,
+    /// An Orchard raw address, FVK, or IVK encoding as specified in [ZIP 316](https://zips.z.cash/zip-0316).
     Orchard,
+    /// An unknown or experimental typecode.
     Unknown(u32),
 }
 
@@ -396,7 +409,7 @@ pub trait Encoding: private::SealedContainer {
     }
 }
 
-/// Trait for for Unified containers, that exposes the items within them.
+/// Trait for Unified containers, that exposes the items within them.
 pub trait Container {
     /// The type of item in this unified container.
     type Item: SealedItem;
diff --git a/components/zcash_address/src/kind/unified/address.rs b/components/zcash_address/src/kind/unified/address.rs
index addba7d186..9b50e9b1ec 100644
--- a/components/zcash_address/src/kind/unified/address.rs
+++ b/components/zcash_address/src/kind/unified/address.rs
@@ -1,5 +1,6 @@
+use zcash_protocol::PoolType;
+
 use super::{private::SealedItem, ParseError, Typecode};
-use crate::kind;
 
 use std::convert::{TryFrom, TryInto};
 
@@ -7,9 +8,9 @@ use std::convert::{TryFrom, TryInto};
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub enum Receiver {
     Orchard([u8; 43]),
-    Sapling(kind::sapling::Data),
-    P2pkh(kind::p2pkh::Data),
-    P2sh(kind::p2sh::Data),
+    Sapling([u8; 43]),
+    P2pkh([u8; 20]),
+    P2sh([u8; 20]),
     Unknown { typecode: u32, data: Vec<u8> },
 }
 
@@ -56,9 +57,76 @@ impl SealedItem for Receiver {
 }
 
 /// A Unified Address.
+///
+/// # Examples
+///
+/// ```
+/// # use std::convert::Infallible;
+/// # use std::error::Error;
+/// use zcash_address::{
+///     unified::{self, Container, Encoding},
+///     ConversionError, TryFromRawAddress, ZcashAddress,
+/// };
+///
+/// # fn main() -> Result<(), Box<dyn Error>> {
+/// # let address_from_user = || "u1pg2aaph7jp8rpf6yhsza25722sg5fcn3vaca6ze27hqjw7jvvhhuxkpcg0ge9xh6drsgdkda8qjq5chpehkcpxf87rnjryjqwymdheptpvnljqqrjqzjwkc2ma6hcq666kgwfytxwac8eyex6ndgr6ezte66706e3vaqrd25dzvzkc69kw0jgywtd0cmq52q5lkw6uh7hyvzjse8ksx";
+/// let example_ua: &str = address_from_user();
+///
+/// // We can parse this directly as a `unified::Address`:
+/// let (network, ua) = unified::Address::decode(example_ua)?;
+///
+/// // Or we can parse via `ZcashAddress` (which you should do):
+/// struct MyUnifiedAddress(unified::Address);
+/// impl TryFromRawAddress for MyUnifiedAddress {
+///     // In this example we aren't checking the validity of the
+///     // inner Unified Address, but your code should do so!
+///     type Error = Infallible;
+///
+///     fn try_from_raw_unified(ua: unified::Address) -> Result<Self, ConversionError<Self::Error>> {
+///         Ok(MyUnifiedAddress(ua))
+///     }
+/// }
+/// let addr: ZcashAddress = example_ua.parse()?;
+/// let parsed = addr.convert_if_network::<MyUnifiedAddress>(network)?;
+/// assert_eq!(parsed.0, ua);
+///
+/// // We can obtain the receivers for the UA in preference order
+/// // (the order in which wallets should prefer to use them):
+/// let receivers: Vec<unified::Receiver> = ua.items();
+///
+/// // And we can create the UA from a list of receivers:
+/// let new_ua = unified::Address::try_from_items(receivers)?;
+/// assert_eq!(new_ua, ua);
+/// # Ok(())
+/// # }
+/// ```
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct Address(pub(crate) Vec<Receiver>);
 
+impl Address {
+    /// Returns whether this address has the ability to receive transfers of the given pool type.
+    pub fn has_receiver_of_type(&self, pool_type: PoolType) -> bool {
+        self.0.iter().any(|r| match r {
+            Receiver::Orchard(_) => pool_type == PoolType::ORCHARD,
+            Receiver::Sapling(_) => pool_type == PoolType::SAPLING,
+            Receiver::P2pkh(_) | Receiver::P2sh(_) => pool_type == PoolType::TRANSPARENT,
+            Receiver::Unknown { .. } => false,
+        })
+    }
+
+    /// Returns whether this address contains the given receiver.
+    pub fn contains_receiver(&self, receiver: &Receiver) -> bool {
+        self.0.contains(receiver)
+    }
+
+    /// Returns whether this address can receive a memo.
+    pub fn can_receive_memo(&self) -> bool {
+        self.0
+            .iter()
+            .any(|r| matches!(r, Receiver::Sapling(_) | Receiver::Orchard(_)))
+    }
+}
+
 impl super::private::SealedContainer for Address {
     /// The HRP for a Bech32m-encoded mainnet Unified Address.
     ///
@@ -92,26 +160,18 @@ impl super::Container for Address {
 }
 
 #[cfg(any(test, feature = "test-dependencies"))]
-pub mod test_vectors;
-
-#[cfg(test)]
-mod tests {
-    use assert_matches::assert_matches;
-    use zcash_encoding::MAX_COMPACT_SIZE;
-
-    use crate::{
-        kind::unified::{private::SealedContainer, Container, Encoding},
-        Network,
-    };
-
+pub mod testing {
     use proptest::{
         array::{uniform11, uniform20, uniform32},
         collection::vec,
         prelude::*,
         sample::select,
+        strategy::Strategy,
     };
+    use zcash_encoding::MAX_COMPACT_SIZE;
 
-    use super::{Address, ParseError, Receiver, Typecode};
+    use super::{Address, Receiver};
+    use crate::unified::Typecode;
 
     prop_compose! {
         fn uniform43()(a in uniform11(0u8..), b in uniform32(0u8..)) -> [u8; 43] {
@@ -122,11 +182,13 @@ mod tests {
         }
     }
 
-    fn arb_transparent_typecode() -> impl Strategy<Value = Typecode> {
+    /// A strategy to generate an arbitrary transparent typecode.
+    pub fn arb_transparent_typecode() -> impl Strategy<Value = Typecode> {
         select(vec![Typecode::P2pkh, Typecode::P2sh])
     }
 
-    fn arb_shielded_typecode() -> impl Strategy<Value = Typecode> {
+    /// A strategy to generate an arbitrary shielded (Sapling, Orchard, or unknown) typecode.
+    pub fn arb_shielded_typecode() -> impl Strategy<Value = Typecode> {
         prop_oneof![
             Just(Typecode::Sapling),
             Just(Typecode::Orchard),
@@ -137,7 +199,7 @@ mod tests {
     /// A strategy to generate an arbitrary valid set of typecodes without
     /// duplication and containing only one of P2sh and P2pkh transparent
     /// typecodes. The resulting vector will be sorted in encoding order.
-    fn arb_typecodes() -> impl Strategy<Value = Vec<Typecode>> {
+    pub fn arb_typecodes() -> impl Strategy<Value = Vec<Typecode>> {
         prop::option::of(arb_transparent_typecode()).prop_flat_map(|transparent| {
             prop::collection::hash_set(arb_shielded_typecode(), 1..4).prop_map(move |xs| {
                 let mut typecodes: Vec<_> = xs.into_iter().chain(transparent).collect();
@@ -147,7 +209,11 @@ mod tests {
         })
     }
 
-    fn arb_unified_address_for_typecodes(
+    /// Generates an arbitrary Unified address containing receivers corresponding to the provided
+    /// set of typecodes. The receivers of this address are likely to not represent valid protocol
+    /// receivers, and should only be used for testing parsing and/or encoding functions that do
+    /// not concern themselves with the validity of the underlying receivers.
+    pub fn arb_unified_address_for_typecodes(
         typecodes: Vec<Typecode>,
     ) -> impl Strategy<Value = Vec<Receiver>> {
         typecodes
@@ -164,11 +230,33 @@ mod tests {
             .collect::<Vec<_>>()
     }
 
-    fn arb_unified_address() -> impl Strategy<Value = Address> {
+    /// Generates an arbitrary Unified address. The receivers of this address are likely to not
+    /// represent valid protocol receivers, and should only be used for testing parsing and/or
+    /// encoding functions that do not concern themselves with the validity of the underlying
+    /// receivers.
+    pub fn arb_unified_address() -> impl Strategy<Value = Address> {
         arb_typecodes()
             .prop_flat_map(arb_unified_address_for_typecodes)
             .prop_map(Address)
     }
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod test_vectors;
+
+#[cfg(test)]
+mod tests {
+    use assert_matches::assert_matches;
+
+    use crate::{
+        kind::unified::{private::SealedContainer, Container, Encoding},
+        unified::address::testing::arb_unified_address,
+        Network,
+    };
+
+    use proptest::{prelude::*, sample::select};
+
+    use super::{Address, ParseError, Receiver, Typecode};
 
     proptest! {
         #[test]
@@ -296,7 +384,7 @@ mod tests {
     #[test]
     fn only_transparent() {
         // Encoding of `Address(vec![Receiver::P2pkh([0; 20])])`.
-        let encoded = vec![
+        let encoded = [
             0xf0, 0x9e, 0x9d, 0x6e, 0xf5, 0xa6, 0xac, 0x16, 0x50, 0xf0, 0xdb, 0xe1, 0x2c, 0xa5,
             0x36, 0x22, 0xa2, 0x04, 0x89, 0x86, 0xe9, 0x6a, 0x9b, 0xf3, 0xff, 0x6d, 0x2f, 0xe6,
             0xea, 0xdb, 0xc5, 0x20, 0x62, 0xf9, 0x6f, 0xa9, 0x86, 0xcc,
diff --git a/components/zcash_address/src/kind/unified/fvk.rs b/components/zcash_address/src/kind/unified/fvk.rs
index 2afc80de66..2133c54d0e 100644
--- a/components/zcash_address/src/kind/unified/fvk.rs
+++ b/components/zcash_address/src/kind/unified/fvk.rs
@@ -78,6 +78,30 @@ impl SealedItem for Fvk {
 }
 
 /// A Unified Full Viewing Key.
+///
+/// # Examples
+///
+/// ```
+/// # use std::error::Error;
+/// use zcash_address::unified::{self, Container, Encoding};
+///
+/// # fn main() -> Result<(), Box<dyn Error>> {
+/// # let ufvk_from_user = || "uview1cgrqnry478ckvpr0f580t6fsahp0a5mj2e9xl7hv2d2jd4ldzy449mwwk2l9yeuts85wjls6hjtghdsy5vhhvmjdw3jxl3cxhrg3vs296a3czazrycrr5cywjhwc5c3ztfyjdhmz0exvzzeyejamyp0cr9z8f9wj0953fzht0m4lenk94t70ruwgjxag2tvp63wn9ftzhtkh20gyre3w5s24f6wlgqxnjh40gd2lxe75sf3z8h5y2x0atpxcyf9t3em4h0evvsftluruqne6w4sm066sw0qe5y8qg423grple5fftxrqyy7xmqmatv7nzd7tcjadu8f7mqz4l83jsyxy4t8pkayytyk7nrp467ds85knekdkvnd7hqkfer8mnqd7pv";
+/// let example_ufvk: &str = ufvk_from_user();
+///
+/// let (network, ufvk) = unified::Ufvk::decode(example_ufvk)?;
+///
+/// // We can obtain the pool-specific Full Viewing Keys for the UFVK in preference
+/// // order (the order in which wallets should prefer to use their corresponding
+/// // address receivers):
+/// let fvks: Vec<unified::Fvk> = ufvk.items();
+///
+/// // And we can create the UFVK from a list of FVKs:
+/// let new_ufvk = unified::Ufvk::try_from_items(fvks)?;
+/// assert_eq!(new_ufvk, ufvk);
+/// # Ok(())
+/// # }
+/// ```
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct Ufvk(pub(crate) Vec<Fvk>);
 
@@ -210,7 +234,7 @@ mod tests {
         // The test cases below use `Ufvk(vec![Fvk::Orchard([1; 96])])` as base.
 
         // Invalid padding ([0xff; 16] instead of [b'u', 0x00, 0x00, 0x00...])
-        let invalid_padding = vec![
+        let invalid_padding = [
             0x6b, 0x32, 0x44, 0xf1, 0xb, 0x67, 0xe9, 0x8f, 0x6, 0x57, 0xe3, 0x5, 0x17, 0xa0, 0x7,
             0x5c, 0xb0, 0xc9, 0x23, 0xcc, 0xb7, 0x54, 0xac, 0x55, 0x6a, 0x65, 0x99, 0x95, 0x32,
             0x97, 0xd5, 0x34, 0xa7, 0xc8, 0x6f, 0xc, 0xd7, 0x3b, 0xe0, 0x88, 0x19, 0xf3, 0x3e,
@@ -228,7 +252,7 @@ mod tests {
         );
 
         // Short padding (padded to 15 bytes instead of 16)
-        let truncated_padding = vec![
+        let truncated_padding = [
             0xdf, 0xea, 0x84, 0x55, 0xc3, 0x4a, 0x7c, 0x6e, 0x9f, 0x83, 0x3, 0x21, 0x14, 0xb0,
             0xcf, 0xb0, 0x60, 0x84, 0x75, 0x3a, 0xdc, 0xb9, 0x93, 0x16, 0xc0, 0x8f, 0x28, 0x5f,
             0x61, 0x5e, 0xf0, 0x8e, 0x44, 0xae, 0xa6, 0x74, 0xc5, 0x64, 0xad, 0xfa, 0xdc, 0x7d,
@@ -276,7 +300,7 @@ mod tests {
         );
 
         // - Truncated after the typecode of the Sapling fvk.
-        let truncated_after_sapling_typecode = vec![
+        let truncated_after_sapling_typecode = [
             0xac, 0x26, 0x5b, 0x19, 0x8f, 0x88, 0xb0, 0x7, 0xb3, 0x0, 0x91, 0x19, 0x52, 0xe1, 0x73,
             0x48, 0xff, 0x66, 0x7a, 0xef, 0xcf, 0x57, 0x9c, 0x65, 0xe4, 0x6a, 0x7a, 0x1d, 0x19,
             0x75, 0x6b, 0x43, 0xdd, 0xcf, 0xb9, 0x9a, 0xf3, 0x7a, 0xf8, 0xb, 0x23, 0x96, 0x64,
@@ -306,7 +330,7 @@ mod tests {
     #[test]
     fn only_transparent() {
         // Raw encoding of `Ufvk(vec![Fvk::P2pkh([0; 65])])`.
-        let encoded = vec![
+        let encoded = [
             0xc4, 0x70, 0xc8, 0x7a, 0xcc, 0xe6, 0x6b, 0x1a, 0x62, 0xc7, 0xcd, 0x5f, 0x76, 0xd8,
             0xcc, 0x9c, 0x50, 0xbd, 0xce, 0x85, 0x80, 0xd7, 0x78, 0x25, 0x3e, 0x47, 0x9, 0x57,
             0x7d, 0x6a, 0xdb, 0x10, 0xb4, 0x11, 0x80, 0x13, 0x4c, 0x83, 0x76, 0xb4, 0x6b, 0xbd,
diff --git a/components/zcash_address/src/kind/unified/ivk.rs b/components/zcash_address/src/kind/unified/ivk.rs
index 31c2ad56f0..2a4ebb4fa2 100644
--- a/components/zcash_address/src/kind/unified/ivk.rs
+++ b/components/zcash_address/src/kind/unified/ivk.rs
@@ -83,6 +83,30 @@ impl SealedItem for Ivk {
 }
 
 /// A Unified Incoming Viewing Key.
+///
+/// # Examples
+///
+/// ```
+/// # use std::error::Error;
+/// use zcash_address::unified::{self, Container, Encoding};
+///
+/// # fn main() -> Result<(), Box<dyn Error>> {
+/// # let uivk_from_user = || "uivk1djetqg3fws7y7qu5tekynvcdhz69gsyq07ewvppmzxdqhpfzdgmx8urnkqzv7ylz78ez43ux266pqjhecd59fzhn7wpe6zarnzh804hjtkyad25ryqla5pnc8p5wdl3phj9fczhz64zprun3ux7y9jc08567xryumuz59rjmg4uuflpjqwnq0j0tzce0x74t4tv3gfjq7nczkawxy6y7hse733ae3vw7qfjd0ss0pytvezxp42p6rrpzeh6t2zrz7zpjk0xhngcm6gwdppxs58jkx56gsfflugehf5vjlmu7vj3393gj6u37wenavtqyhdvcdeaj86s6jczl4zq";
+/// let example_uivk: &str = uivk_from_user();
+///
+/// let (network, uivk) = unified::Uivk::decode(example_uivk)?;
+///
+/// // We can obtain the pool-specific Incoming Viewing Keys for the UIVK in
+/// // preference order (the order in which wallets should prefer to use their
+/// // corresponding address receivers):
+/// let ivks: Vec<unified::Ivk> = uivk.items();
+///
+/// // And we can create the UIVK from a list of IVKs:
+/// let new_uivk = unified::Uivk::try_from_items(ivks)?;
+/// assert_eq!(new_uivk, uivk);
+/// # Ok(())
+/// # }
+/// ```
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct Uivk(pub(crate) Vec<Ivk>);
 
@@ -203,7 +227,7 @@ mod tests {
         // The test cases below use `Uivk(vec![Ivk::Orchard([1; 64])])` as base.
 
         // Invalid padding ([0xff; 16] instead of [b'u', 0x00, 0x00, 0x00...])
-        let invalid_padding = vec![
+        let invalid_padding = [
             0xba, 0xbc, 0xc0, 0x71, 0xcd, 0x3b, 0xfd, 0x9a, 0x32, 0x19, 0x7e, 0xeb, 0x8a, 0xa7,
             0x6e, 0xd4, 0xac, 0xcb, 0x59, 0xc2, 0x54, 0x26, 0xc6, 0xab, 0x71, 0xc7, 0xc3, 0x72,
             0xc, 0xa9, 0xad, 0xa4, 0xad, 0x8c, 0x9e, 0x35, 0x7b, 0x4c, 0x5d, 0xc7, 0x66, 0x12,
@@ -219,7 +243,7 @@ mod tests {
         );
 
         // Short padding (padded to 15 bytes instead of 16)
-        let truncated_padding = vec![
+        let truncated_padding = [
             0x96, 0x73, 0x6a, 0x56, 0xbc, 0x44, 0x38, 0xe2, 0x47, 0x41, 0x1c, 0x70, 0xe4, 0x6,
             0x87, 0xbe, 0xb6, 0x90, 0xbd, 0xab, 0x1b, 0xd8, 0x27, 0x10, 0x0, 0x21, 0x30, 0x2, 0x77,
             0x87, 0x0, 0x25, 0x96, 0x94, 0x8f, 0x1e, 0x39, 0xd2, 0xd8, 0x65, 0xb4, 0x3c, 0x72,
@@ -242,7 +266,7 @@ mod tests {
         // with the ivk data truncated, but valid padding.
 
         // - Missing the last data byte of the Sapling ivk.
-        let truncated_sapling_data = vec![
+        let truncated_sapling_data = [
             0xce, 0xbc, 0xfe, 0xc5, 0xef, 0x2d, 0xe, 0x66, 0xc2, 0x8c, 0x34, 0xdc, 0x2e, 0x24,
             0xd2, 0xc7, 0x4b, 0xac, 0x36, 0xe0, 0x43, 0x72, 0xa7, 0x33, 0xa4, 0xe, 0xe0, 0x52,
             0x15, 0x64, 0x66, 0x92, 0x36, 0xa7, 0x60, 0x8e, 0x48, 0xe8, 0xb0, 0x30, 0x4d, 0xcb,
@@ -261,7 +285,7 @@ mod tests {
         );
 
         // - Truncated after the typecode of the Sapling ivk.
-        let truncated_after_sapling_typecode = vec![
+        let truncated_after_sapling_typecode = [
             0xf7, 0x3, 0xd8, 0xbe, 0x6a, 0x27, 0xfa, 0xa1, 0xd3, 0x11, 0xea, 0x25, 0x94, 0xe2, 0xb,
             0xde, 0xed, 0x6a, 0xaa, 0x8, 0x46, 0x7d, 0xe4, 0xb1, 0xe, 0xf1, 0xde, 0x61, 0xd7, 0x95,
             0xf7, 0x82, 0x62, 0x32, 0x7a, 0x73, 0x8c, 0x55, 0x93, 0xa1, 0x63, 0x75, 0xe2, 0xca,
@@ -288,7 +312,7 @@ mod tests {
     #[test]
     fn only_transparent() {
         // Raw Encoding of `Uivk(vec![Ivk::P2pkh([0; 65])])`.
-        let encoded = vec![
+        let encoded = [
             0x12, 0x51, 0x37, 0xc7, 0xac, 0x8c, 0xd, 0x13, 0x3a, 0x5f, 0xc6, 0x84, 0x53, 0x90,
             0xf8, 0xe7, 0x23, 0x34, 0xfb, 0xda, 0x49, 0x3c, 0x87, 0x1c, 0x8f, 0x1a, 0xe1, 0x63,
             0xba, 0xdf, 0x77, 0x64, 0x43, 0xcf, 0xdc, 0x37, 0x1f, 0xd2, 0x89, 0x60, 0xe3, 0x77,
diff --git a/components/zcash_address/src/lib.rs b/components/zcash_address/src/lib.rs
index c0f7fbc62c..32a3c05f4d 100644
--- a/components/zcash_address/src/lib.rs
+++ b/components/zcash_address/src/lib.rs
@@ -1,3 +1,134 @@
+//! *Parser for all defined Zcash address types.*
+//!
+//! This crate implements address parsing as a two-phase process, built around the opaque
+//! [`ZcashAddress`] type.
+//!
+//! - [`ZcashAddress`] can be parsed from, and encoded to, strings.
+//! - [`ZcashAddress::convert`] or [`ZcashAddress::convert_if_network`] can be used to
+//!   convert a parsed address into custom types that implement the [`TryFromAddress`] or
+//!   [`TryFromRawAddress`] traits.
+//! - Custom types can be converted into a [`ZcashAddress`] via its implementation of the
+//!   [`ToAddress`] trait.
+//!
+//! ```text
+//!         s.parse()              .convert()
+//!         -------->              --------->
+//! Strings           ZcashAddress            Custom types
+//!         <--------              <---------
+//!         .encode()              ToAddress
+//! ```
+//!
+//! It is important to note that this crate does not depend on any of the Zcash protocol
+//! crates (e.g. `sapling-crypto` or `orchard`). This crate has minimal dependencies by
+//! design; it focuses solely on parsing, handling those concerns for you, while exposing
+//! APIs that enable you to convert the parsed data into the Rust types you want to use.
+//!
+//! # Using this crate
+//!
+//! ## I just need to validate Zcash addresses
+//!
+//! ```
+//! # use zcash_address::ZcashAddress;
+//! fn is_valid_zcash_address(addr_string: &str) -> bool {
+//!     addr_string.parse::<ZcashAddress>().is_ok()
+//! }
+//! ```
+//!
+//! ## I want to parse Zcash addresses in a Rust wallet app that uses the `zcash_primitives` transaction builder
+//!
+//! Use `zcash_client_backend::address::RecipientAddress`, which implements the traits in
+//! this crate to parse address strings into protocol types that work with the transaction
+//! builder in the `zcash_primitives` crate (as well as the wallet functionality in the
+//! `zcash_client_backend` crate itself).
+//!
+//! > We intend to refactor the key and address types from the `zcash_client_backend` and
+//! > `zcash_primitives` crates into a separate crate focused on dealing with Zcash key
+//! > material. That crate will then be what you should use.
+//!
+//! ## I want to parse Unified Addresses
+//!
+//! See the [`unified::Address`] documentation for examples.
+//!
+//! While the [`unified::Address`] type does have parsing methods, you should still parse
+//! your address strings with [`ZcashAddress`] and then convert; this will ensure that for
+//! other Zcash address types you get a [`ConversionError::Unsupported`], which is a
+//! better error for your users.
+//!
+//! ## I want to parse mainnet Zcash addresses in a language that supports C FFI
+//!
+//! As an example, you could use static functions to create the address types in the
+//! target language from the parsed data.
+//!
+//! ```
+//! use std::ffi::{CStr, c_char, c_void};
+//! use std::ptr;
+//!
+//! use zcash_address::{ConversionError, Network, TryFromRawAddress, ZcashAddress};
+//!
+//! // Functions that return a pointer to a heap-allocated address of the given kind in
+//! // the target language. These should be augmented to return any relevant errors.
+//! extern {
+//!     fn addr_from_sapling(data: *const u8) -> *mut c_void;
+//!     fn addr_from_transparent_p2pkh(data: *const u8) -> *mut c_void;
+//! }
+//!
+//! struct ParsedAddress(*mut c_void);
+//!
+//! impl TryFromRawAddress for ParsedAddress {
+//!     type Error = &'static str;
+//!
+//!     fn try_from_raw_sapling(
+//!         data: [u8; 43],
+//!     ) -> Result<Self, ConversionError<Self::Error>> {
+//!         let parsed = unsafe { addr_from_sapling(data[..].as_ptr()) };
+//!         if parsed.is_null() {
+//!             Err("Reason for the failure".into())
+//!         } else {
+//!             Ok(Self(parsed))
+//!         }
+//!     }
+//!
+//!     fn try_from_raw_transparent_p2pkh(
+//!         data: [u8; 20],
+//!     ) -> Result<Self, ConversionError<Self::Error>> {
+//!         let parsed = unsafe { addr_from_transparent_p2pkh(data[..].as_ptr()) };
+//!         if parsed.is_null() {
+//!             Err("Reason for the failure".into())
+//!         } else {
+//!             Ok(Self(parsed))
+//!         }
+//!     }
+//! }
+//!
+//! pub extern "C" fn parse_zcash_address(encoded: *const c_char) -> *mut c_void {
+//!     let encoded = unsafe { CStr::from_ptr(encoded) }.to_str().expect("valid");
+//!
+//!     let addr = match ZcashAddress::try_from_encoded(encoded) {
+//!         Ok(addr) => addr,
+//!         Err(e) => {
+//!             // This was either an invalid address encoding, or not a Zcash address.
+//!             // You should pass this error back across the FFI.
+//!             return ptr::null_mut();
+//!         }
+//!     };
+//!
+//!     match addr.convert_if_network::<ParsedAddress>(Network::Main) {
+//!         Ok(parsed) => parsed.0,
+//!         Err(e) => {
+//!             // We didn't implement all of the methods of `TryFromRawAddress`, so if an
+//!             // address with one of those kinds is parsed, it will result in an error
+//!             // here that should be passed back across the FFI.
+//!             ptr::null_mut()
+//!         }
+//!     }
+//! }
+//! ```
+
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+// Catch documentation errors caused by code changes.
+#![deny(rustdoc::broken_intra_doc_links)]
+
 mod convert;
 mod encoding;
 mod kind;
@@ -10,6 +141,9 @@ pub use convert::{
 };
 pub use encoding::ParseError;
 pub use kind::unified;
+use kind::unified::Receiver;
+pub use zcash_protocol::consensus::NetworkType as Network;
+use zcash_protocol::PoolType;
 
 /// A Zcash address.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
@@ -18,28 +152,15 @@ pub struct ZcashAddress {
     kind: AddressKind,
 }
 
-/// The Zcash network for which an address is encoded.
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum Network {
-    /// Zcash Mainnet.
-    Main,
-    /// Zcash Testnet.
-    Test,
-    /// Private integration / regression testing, used in `zcashd`.
-    ///
-    /// For some address types there is no distinction between test and regtest encodings;
-    /// those will always be parsed as `Network::Test`.
-    Regtest,
-}
-
 /// Known kinds of Zcash addresses.
 #[derive(Clone, Debug, PartialEq, Eq, Hash)]
 enum AddressKind {
-    Sprout(kind::sprout::Data),
-    Sapling(kind::sapling::Data),
+    Sprout([u8; 64]),
+    Sapling([u8; 43]),
     Unified(unified::Address),
-    P2pkh(kind::p2pkh::Data),
-    P2sh(kind::p2sh::Data),
+    P2pkh([u8; 20]),
+    P2sh([u8; 20]),
+    Tex([u8; 20]),
 }
 
 impl ZcashAddress {
@@ -104,6 +225,7 @@ impl ZcashAddress {
             AddressKind::Unified(data) => T::try_from_unified(self.net, data),
             AddressKind::P2pkh(data) => T::try_from_transparent_p2pkh(self.net, data),
             AddressKind::P2sh(data) => T::try_from_transparent_p2sh(self.net, data),
+            AddressKind::Tex(data) => T::try_from_tex(self.net, data),
         }
     }
 
@@ -139,10 +261,123 @@ impl ZcashAddress {
                 T::try_from_raw_transparent_p2pkh(data)
             }
             AddressKind::P2sh(data) if regtest_exception => T::try_from_raw_transparent_p2sh(data),
+            AddressKind::Tex(data) if network_matches => T::try_from_raw_tex(data),
             _ => Err(ConversionError::IncorrectNetwork {
                 expected: net,
                 actual: self.net,
             }),
         }
     }
+
+    /// Returns whether this address has the ability to receive transfers of the given pool type.
+    pub fn can_receive_as(&self, pool_type: PoolType) -> bool {
+        use AddressKind::*;
+        match &self.kind {
+            Sprout(_) => false,
+            Sapling(_) => pool_type == PoolType::SAPLING,
+            Unified(addr) => addr.has_receiver_of_type(pool_type),
+            P2pkh(_) | P2sh(_) | Tex(_) => pool_type == PoolType::TRANSPARENT,
+        }
+    }
+
+    /// Returns whether this address can receive a memo.
+    pub fn can_receive_memo(&self) -> bool {
+        use AddressKind::*;
+        match &self.kind {
+            Sprout(_) | Sapling(_) => true,
+            Unified(addr) => addr.can_receive_memo(),
+            P2pkh(_) | P2sh(_) | Tex(_) => false,
+        }
+    }
+
+    /// Returns whether or not this address contains or corresponds to the given unified address
+    /// receiver.
+    pub fn matches_receiver(&self, receiver: &Receiver) -> bool {
+        match (&self.kind, receiver) {
+            (AddressKind::Unified(ua), r) => ua.contains_receiver(r),
+            (AddressKind::Sapling(d), Receiver::Sapling(r)) => r == d,
+            (AddressKind::P2pkh(d), Receiver::P2pkh(r)) => r == d,
+            (AddressKind::Tex(d), Receiver::P2pkh(r)) => r == d,
+            (AddressKind::P2sh(d), Receiver::P2sh(r)) => r == d,
+            _ => false,
+        }
+    }
+}
+
+#[cfg(feature = "test-dependencies")]
+pub mod testing {
+    use std::convert::TryInto;
+
+    use proptest::{array::uniform20, collection::vec, prelude::any, prop_compose, prop_oneof};
+
+    use crate::{unified::address::testing::arb_unified_address, AddressKind, ZcashAddress};
+    use zcash_protocol::consensus::NetworkType;
+
+    prop_compose! {
+        fn arb_sprout_addr_kind()(
+            r_bytes in vec(any::<u8>(), 64)
+        ) -> AddressKind {
+            AddressKind::Sprout(r_bytes.try_into().unwrap())
+        }
+    }
+
+    prop_compose! {
+        fn arb_sapling_addr_kind()(
+            r_bytes in vec(any::<u8>(), 43)
+        ) -> AddressKind {
+            AddressKind::Sapling(r_bytes.try_into().unwrap())
+        }
+    }
+
+    prop_compose! {
+        fn arb_p2pkh_addr_kind()(
+            r_bytes in uniform20(any::<u8>())
+        ) -> AddressKind {
+            AddressKind::P2pkh(r_bytes)
+        }
+    }
+
+    prop_compose! {
+        fn arb_p2sh_addr_kind()(
+            r_bytes in uniform20(any::<u8>())
+        ) -> AddressKind {
+            AddressKind::P2sh(r_bytes)
+        }
+    }
+
+    prop_compose! {
+        fn arb_unified_addr_kind()(
+            uaddr in arb_unified_address()
+        ) -> AddressKind {
+            AddressKind::Unified(uaddr)
+        }
+    }
+
+    prop_compose! {
+        fn arb_tex_addr_kind()(
+            r_bytes in uniform20(any::<u8>())
+        ) -> AddressKind {
+            AddressKind::Tex(r_bytes)
+        }
+    }
+
+    prop_compose! {
+        /// Create an arbitrary, structurally-valid `ZcashAddress` value.
+        ///
+        /// Note that the data contained in the generated address does _not_ necessarily correspond
+        /// to a valid address according to the Zcash protocol; binary data in the resulting value
+        /// is entirely random.
+        pub fn arb_address(net: NetworkType)(
+            kind in prop_oneof!(
+                arb_sprout_addr_kind(),
+                arb_sapling_addr_kind(),
+                arb_p2pkh_addr_kind(),
+                arb_p2sh_addr_kind(),
+                arb_unified_addr_kind(),
+                arb_tex_addr_kind()
+            )
+        ) -> ZcashAddress {
+            ZcashAddress { net, kind }
+        }
+    }
 }
diff --git a/components/zcash_encoding/CHANGELOG.md b/components/zcash_encoding/CHANGELOG.md
index da71b50f7c..f8733c1bd2 100644
--- a/components/zcash_encoding/CHANGELOG.md
+++ b/components/zcash_encoding/CHANGELOG.md
@@ -7,6 +7,11 @@ and this library adheres to Rust's notion of
 
 ## [Unreleased]
 
+## [0.2.1] - 2024-08-19
+### Added
+- `zcash_encoding::CompactSize::serialized_size`
+- `zcash_encoding::Vector::serialized_size_of_u8_vec`
+
 ## [0.2.0] - 2022-10-19
 ### Changed
 - MSRV is now 1.56.1
diff --git a/components/zcash_encoding/Cargo.toml b/components/zcash_encoding/Cargo.toml
index b287a47656..02f41a0a4b 100644
--- a/components/zcash_encoding/Cargo.toml
+++ b/components/zcash_encoding/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "zcash_encoding"
 description = "Binary encodings used throughout the Zcash ecosystem."
-version = "0.2.0"
+version = "0.2.1"
 authors = [
     "Jack Grigg <jack@electriccoin.co>",
     "Kris Nuttycombe <kris@electriccoin.co>",
@@ -16,8 +16,8 @@ categories = ["cryptography::cryptocurrencies", "encoding"]
 keywords = ["zcash"]
 
 [dependencies]
-byteorder = "1"
-nonempty = "0.7"
+byteorder.workspace = true
+nonempty.workspace = true
 
 [lib]
 bench = false
diff --git a/components/zcash_encoding/src/lib.rs b/components/zcash_encoding/src/lib.rs
index 8e23f7b68f..69f1c5c63c 100644
--- a/components/zcash_encoding/src/lib.rs
+++ b/components/zcash_encoding/src/lib.rs
@@ -93,6 +93,16 @@ impl CompactSize {
             }
         }
     }
+
+    /// Returns the number of bytes needed to encode the given size in compact form.
+    pub fn serialized_size(size: usize) -> usize {
+        match size {
+            s if s < 253 => 1,
+            s if s <= 0xFFFF => 3,
+            s if s <= 0xFFFFFFFF => 5,
+            _ => 9,
+        }
+    }
 }
 
 /// Namespace for functions that perform encoding of vectors.
@@ -171,6 +181,12 @@ impl Vector {
         CompactSize::write(&mut writer, items.len())?;
         items.try_for_each(|e| func(&mut writer, e))
     }
+
+    /// Returns the serialized size of a vector of `u8` as written by `[Vector::write]`.
+    pub fn serialized_size_of_u8_vec(vec: &[u8]) -> usize {
+        let length = vec.len();
+        CompactSize::serialized_size(length) + length
+    }
 }
 
 /// Namespace for functions that perform encoding of array contents.
@@ -279,8 +295,11 @@ mod tests {
             <T as TryInto<usize>>::Error: Debug,
         {
             let mut data = vec![];
-            CompactSize::write(&mut data, value.try_into().unwrap()).unwrap();
+            let value_usize: usize = value.try_into().unwrap();
+            CompactSize::write(&mut data, value_usize).unwrap();
             assert_eq!(&data[..], expected);
+            let serialized_size = CompactSize::serialized_size(value_usize);
+            assert_eq!(serialized_size, expected.len());
             let result: io::Result<T> = CompactSize::read_t(&data[..]);
             match result {
                 Ok(n) => assert_eq!(n, value),
@@ -308,6 +327,8 @@ mod tests {
             let mut data = vec![];
             CompactSize::write(&mut data, value).unwrap();
             assert_eq!(&data[..], encoded);
+            let serialized_size = CompactSize::serialized_size(value);
+            assert_eq!(serialized_size, encoded.len());
             assert!(CompactSize::read(encoded).is_err());
         }
     }
@@ -320,6 +341,8 @@ mod tests {
                 let mut data = vec![];
                 Vector::write(&mut data, &$value, |w, e| w.write_u8(*e)).unwrap();
                 assert_eq!(&data[..], &$expected[..]);
+                let serialized_size = Vector::serialized_size_of_u8_vec(&$value);
+                assert_eq!(serialized_size, $expected.len());
                 match Vector::read(&data[..], |r| r.read_u8()) {
                     Ok(v) => assert_eq!(v, $value),
                     Err(e) => panic!("Unexpected error: {:?}", e),
diff --git a/components/zcash_note_encryption/CHANGELOG.md b/components/zcash_note_encryption/CHANGELOG.md
deleted file mode 100644
index cedc180c69..0000000000
--- a/components/zcash_note_encryption/CHANGELOG.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# Changelog
-All notable changes to this library will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this library adheres to Rust's notion of
-[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.4.0] - 2023-06-06
-### Changed
-- The `esk` and `ephemeral_key` arguments have been removed from 
-  `Domain::parse_note_plaintext_without_memo_ovk`. It is therefore no longer
-  necessary (or possible) to ensure that `ephemeral_key` is derived from `esk`
-  and the diversifier within the note plaintext. We have analyzed the safety of
-  this change in the context of callers within `zcash_note_encryption` and
-  `orchard`. See https://github.com/zcash/librustzcash/pull/848 and the
-  associated issue https://github.com/zcash/librustzcash/issues/802 for
-  additional detail.
-
-## [0.3.0] - 2023-03-22
-### Changed
-- The `recipient` parameter has been removed from `Domain::note_plaintext_bytes`.
-- The `recipient` parameter has been removed from `NoteEncryption::new`. Since 
-  the `Domain::Note` type is now expected to contain information about the
-  recipient of the note, there is no longer any need to pass this information
-  in via the encryption context.
-
-## [0.2.0] - 2022-10-13
-### Added
-- `zcash_note_encryption::Domain`:
-  - `Domain::PreparedEphemeralPublicKey` associated type.
-  - `Domain::prepare_epk` method, which produces the above type.
-
-### Changed
-- MSRV is now 1.56.1.
-- `zcash_note_encryption::Domain` now requires `epk` to be converted to
-  `Domain::PreparedEphemeralPublicKey` before being passed to
-  `Domain::ka_agree_dec`.
-- Changes to batch decryption APIs:
-  - The return types of `batch::try_note_decryption` and
-    `batch::try_compact_note_decryption` have changed. Now, instead of
-    returning entries corresponding to the cartesian product of the IVKs used for
-    decryption with the outputs being decrypted, this now returns a vector of
-    decryption results of the same length and in the same order as the `outputs`
-    argument to the function. Each successful result includes the index of the
-    entry in `ivks` used to decrypt the value.
-
-## [0.1.0] - 2021-12-17
-Initial release.
diff --git a/components/zcash_note_encryption/Cargo.toml b/components/zcash_note_encryption/Cargo.toml
deleted file mode 100644
index 34d359ef7f..0000000000
--- a/components/zcash_note_encryption/Cargo.toml
+++ /dev/null
@@ -1,34 +0,0 @@
-[package]
-name = "zcash_note_encryption"
-description = "Note encryption for Zcash transactions"
-version = "0.4.0"
-authors = [
-    "Jack Grigg <jack@electriccoin.co>",
-    "Kris Nuttycombe <kris@electriccoin.co>"
-]
-homepage = "https://github.com/zcash/librustzcash"
-repository = "https://github.com/zcash/librustzcash"
-readme = "README.md"
-license = "MIT OR Apache-2.0"
-edition = "2021"
-rust-version = "1.56.1"
-categories = ["cryptography::cryptocurrencies"]
-
-[package.metadata.docs.rs]
-all-features = true
-rustdoc-args = ["--cfg", "docsrs"]
-
-[dependencies]
-cipher = { version = "0.4", default-features = false }
-chacha20 = { version = "0.9", default-features = false }
-chacha20poly1305 = { version = "0.10", default-features = false }
-rand_core = { version = "0.6", default-features = false }
-subtle = { version = "2.3", default-features = false }
-
-[features]
-default = ["alloc"]
-alloc = []
-pre-zip-212 = []
-
-[lib]
-bench = false
diff --git a/components/zcash_note_encryption/README.md b/components/zcash_note_encryption/README.md
deleted file mode 100644
index 612b7a64fb..0000000000
--- a/components/zcash_note_encryption/README.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# zcash_note_encryption
-
-This crate implements the [in-band secret distribution scheme] for the Sapling and
-Orchard protocols. It provides reusable methods that implement common note encryption
-and trial decryption logic, and enforce protocol-agnostic verification requirements.
-
-Protocol-specific logic is handled via the `Domain` trait. Implementations of this
-trait are provided in the [`zcash_primitives`] (for Sapling) and [`orchard`] crates;
-users with their own existing types can similarly implement the trait themselves.
-
-[in-band secret distribution scheme]: https://zips.z.cash/protocol/protocol.pdf#saplingandorchardinband
-[`zcash_primitives`]: https://crates.io/crates/zcash_primitives
-[`orchard`]: https://crates.io/crates/orchard
-
-## License
-
-Licensed under either of
-
- * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
-   http://www.apache.org/licenses/LICENSE-2.0)
- * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
-
-at your option.
-
-### Contribution
-
-Unless you explicitly state otherwise, any contribution intentionally
-submitted for inclusion in the work by you, as defined in the Apache-2.0
-license, shall be dual licensed as above, without any additional terms or
-conditions.
diff --git a/components/zcash_note_encryption/src/batch.rs b/components/zcash_note_encryption/src/batch.rs
deleted file mode 100644
index ad704167c2..0000000000
--- a/components/zcash_note_encryption/src/batch.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-//! APIs for batch trial decryption.
-
-use alloc::vec::Vec; // module is alloc only
-
-use crate::{
-    try_compact_note_decryption_inner, try_note_decryption_inner, BatchDomain, EphemeralKeyBytes,
-    ShieldedOutput, COMPACT_NOTE_SIZE, ENC_CIPHERTEXT_SIZE,
-};
-
-/// Trial decryption of a batch of notes with a set of recipients.
-///
-/// This is the batched version of [`crate::try_note_decryption`].
-///
-/// Returns a vector containing the decrypted result for each output,
-/// with the same length and in the same order as the outputs were
-/// provided, along with the index in the `ivks` slice associated with
-/// the IVK that successfully decrypted the output.
-#[allow(clippy::type_complexity)]
-pub fn try_note_decryption<D: BatchDomain, Output: ShieldedOutput<D, ENC_CIPHERTEXT_SIZE>>(
-    ivks: &[D::IncomingViewingKey],
-    outputs: &[(D, Output)],
-) -> Vec<Option<((D::Note, D::Recipient, D::Memo), usize)>> {
-    batch_note_decryption(ivks, outputs, try_note_decryption_inner)
-}
-
-/// Trial decryption of a batch of notes for light clients with a set of recipients.
-///
-/// This is the batched version of [`crate::try_compact_note_decryption`].
-///
-/// Returns a vector containing the decrypted result for each output,
-/// with the same length and in the same order as the outputs were
-/// provided, along with the index in the `ivks` slice associated with
-/// the IVK that successfully decrypted the output.
-#[allow(clippy::type_complexity)]
-pub fn try_compact_note_decryption<D: BatchDomain, Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>>(
-    ivks: &[D::IncomingViewingKey],
-    outputs: &[(D, Output)],
-) -> Vec<Option<((D::Note, D::Recipient), usize)>> {
-    batch_note_decryption(ivks, outputs, try_compact_note_decryption_inner)
-}
-
-fn batch_note_decryption<D: BatchDomain, Output: ShieldedOutput<D, CS>, F, FR, const CS: usize>(
-    ivks: &[D::IncomingViewingKey],
-    outputs: &[(D, Output)],
-    decrypt_inner: F,
-) -> Vec<Option<(FR, usize)>>
-where
-    F: Fn(&D, &D::IncomingViewingKey, &EphemeralKeyBytes, &Output, &D::SymmetricKey) -> Option<FR>,
-{
-    if ivks.is_empty() {
-        return (0..outputs.len()).map(|_| None).collect();
-    };
-
-    // Fetch the ephemeral keys for each output, and batch-parse and prepare them.
-    let ephemeral_keys = D::batch_epk(outputs.iter().map(|(_, output)| output.ephemeral_key()));
-
-    // Derive the shared secrets for all combinations of (ivk, output).
-    // The scalar multiplications cannot benefit from batching.
-    let items = ephemeral_keys.iter().flat_map(|(epk, ephemeral_key)| {
-        ivks.iter().map(move |ivk| {
-            (
-                epk.as_ref().map(|epk| D::ka_agree_dec(ivk, epk)),
-                ephemeral_key,
-            )
-        })
-    });
-
-    // Run the batch-KDF to obtain the symmetric keys from the shared secrets.
-    let keys = D::batch_kdf(items);
-
-    // Finish the trial decryption!
-    keys.chunks(ivks.len())
-        .zip(ephemeral_keys.iter().zip(outputs.iter()))
-        .map(|(key_chunk, ((_, ephemeral_key), (domain, output)))| {
-            key_chunk
-                .iter()
-                .zip(ivks.iter().enumerate())
-                .filter_map(|(key, (i, ivk))| {
-                    key.as_ref()
-                        .and_then(|key| decrypt_inner(domain, ivk, ephemeral_key, output, key))
-                        .map(|out| (out, i))
-                })
-                .next()
-        })
-        .collect::<Vec<Option<_>>>()
-}
diff --git a/components/zcash_note_encryption/src/lib.rs b/components/zcash_note_encryption/src/lib.rs
deleted file mode 100644
index fb8049d40c..0000000000
--- a/components/zcash_note_encryption/src/lib.rs
+++ /dev/null
@@ -1,675 +0,0 @@
-//! Note encryption for Zcash transactions.
-//!
-//! This crate implements the [in-band secret distribution scheme] for the Sapling and
-//! Orchard protocols. It provides reusable methods that implement common note encryption
-//! and trial decryption logic, and enforce protocol-agnostic verification requirements.
-//!
-//! Protocol-specific logic is handled via the [`Domain`] trait. Implementations of this
-//! trait are provided in the [`zcash_primitives`] (for Sapling) and [`orchard`] crates;
-//! users with their own existing types can similarly implement the trait themselves.
-//!
-//! [in-band secret distribution scheme]: https://zips.z.cash/protocol/protocol.pdf#saplingandorchardinband
-//! [`zcash_primitives`]: https://crates.io/crates/zcash_primitives
-//! [`orchard`]: https://crates.io/crates/orchard
-
-#![no_std]
-#![cfg_attr(docsrs, feature(doc_cfg))]
-// Catch documentation errors caused by code changes.
-#![deny(rustdoc::broken_intra_doc_links)]
-#![deny(unsafe_code)]
-// TODO: #![deny(missing_docs)]
-
-#[cfg(feature = "alloc")]
-extern crate alloc;
-#[cfg(feature = "alloc")]
-use alloc::vec::Vec;
-
-use chacha20::{
-    cipher::{StreamCipher, StreamCipherSeek},
-    ChaCha20,
-};
-use chacha20poly1305::{aead::AeadInPlace, ChaCha20Poly1305, KeyInit};
-use cipher::KeyIvInit;
-
-use rand_core::RngCore;
-use subtle::{Choice, ConstantTimeEq};
-
-#[cfg(feature = "alloc")]
-#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-pub mod batch;
-
-/// The size of a compact note.
-pub const COMPACT_NOTE_SIZE: usize = 1 + // version
-    11 + // diversifier
-    8  + // value
-    32; // rseed (or rcm prior to ZIP 212)
-/// The size of [`NotePlaintextBytes`].
-pub const NOTE_PLAINTEXT_SIZE: usize = COMPACT_NOTE_SIZE + 512;
-/// The size of [`OutPlaintextBytes`].
-pub const OUT_PLAINTEXT_SIZE: usize = 32 + // pk_d
-    32; // esk
-const AEAD_TAG_SIZE: usize = 16;
-/// The size of an encrypted note plaintext.
-pub const ENC_CIPHERTEXT_SIZE: usize = NOTE_PLAINTEXT_SIZE + AEAD_TAG_SIZE;
-/// The size of an encrypted outgoing plaintext.
-pub const OUT_CIPHERTEXT_SIZE: usize = OUT_PLAINTEXT_SIZE + AEAD_TAG_SIZE;
-
-/// A symmetric key that can be used to recover a single Sapling or Orchard output.
-pub struct OutgoingCipherKey(pub [u8; 32]);
-
-impl From<[u8; 32]> for OutgoingCipherKey {
-    fn from(ock: [u8; 32]) -> Self {
-        OutgoingCipherKey(ock)
-    }
-}
-
-impl AsRef<[u8]> for OutgoingCipherKey {
-    fn as_ref(&self) -> &[u8] {
-        &self.0
-    }
-}
-
-/// Newtype representing the byte encoding of an [`EphemeralPublicKey`].
-///
-/// [`EphemeralPublicKey`]: Domain::EphemeralPublicKey
-#[derive(Clone, Debug)]
-pub struct EphemeralKeyBytes(pub [u8; 32]);
-
-impl AsRef<[u8]> for EphemeralKeyBytes {
-    fn as_ref(&self) -> &[u8] {
-        &self.0
-    }
-}
-
-impl From<[u8; 32]> for EphemeralKeyBytes {
-    fn from(value: [u8; 32]) -> EphemeralKeyBytes {
-        EphemeralKeyBytes(value)
-    }
-}
-
-impl ConstantTimeEq for EphemeralKeyBytes {
-    fn ct_eq(&self, other: &Self) -> Choice {
-        self.0.ct_eq(&other.0)
-    }
-}
-
-/// Newtype representing the byte encoding of a note plaintext.
-pub struct NotePlaintextBytes(pub [u8; NOTE_PLAINTEXT_SIZE]);
-/// Newtype representing the byte encoding of a outgoing plaintext.
-pub struct OutPlaintextBytes(pub [u8; OUT_PLAINTEXT_SIZE]);
-
-#[derive(Copy, Clone, PartialEq, Eq)]
-enum NoteValidity {
-    Valid,
-    Invalid,
-}
-
-/// Trait that encapsulates protocol-specific note encryption types and logic.
-///
-/// This trait enables most of the note encryption logic to be shared between Sapling and
-/// Orchard, as well as between different implementations of those protocols.
-pub trait Domain {
-    type EphemeralSecretKey: ConstantTimeEq;
-    type EphemeralPublicKey;
-    type PreparedEphemeralPublicKey;
-    type SharedSecret;
-    type SymmetricKey: AsRef<[u8]>;
-    type Note;
-    type Recipient;
-    type DiversifiedTransmissionKey;
-    type IncomingViewingKey;
-    type OutgoingViewingKey;
-    type ValueCommitment;
-    type ExtractedCommitment;
-    type ExtractedCommitmentBytes: Eq + for<'a> From<&'a Self::ExtractedCommitment>;
-    type Memo;
-
-    /// Derives the `EphemeralSecretKey` corresponding to this note.
-    ///
-    /// Returns `None` if the note was created prior to [ZIP 212], and doesn't have a
-    /// deterministic `EphemeralSecretKey`.
-    ///
-    /// [ZIP 212]: https://zips.z.cash/zip-0212
-    fn derive_esk(note: &Self::Note) -> Option<Self::EphemeralSecretKey>;
-
-    /// Extracts the `DiversifiedTransmissionKey` from the note.
-    fn get_pk_d(note: &Self::Note) -> Self::DiversifiedTransmissionKey;
-
-    /// Prepare an ephemeral public key for more efficient scalar multiplication.
-    fn prepare_epk(epk: Self::EphemeralPublicKey) -> Self::PreparedEphemeralPublicKey;
-
-    /// Derives `EphemeralPublicKey` from `esk` and the note's diversifier.
-    fn ka_derive_public(
-        note: &Self::Note,
-        esk: &Self::EphemeralSecretKey,
-    ) -> Self::EphemeralPublicKey;
-
-    /// Derives the `SharedSecret` from the sender's information during note encryption.
-    fn ka_agree_enc(
-        esk: &Self::EphemeralSecretKey,
-        pk_d: &Self::DiversifiedTransmissionKey,
-    ) -> Self::SharedSecret;
-
-    /// Derives the `SharedSecret` from the recipient's information during note trial
-    /// decryption.
-    fn ka_agree_dec(
-        ivk: &Self::IncomingViewingKey,
-        epk: &Self::PreparedEphemeralPublicKey,
-    ) -> Self::SharedSecret;
-
-    /// Derives the `SymmetricKey` used to encrypt the note plaintext.
-    ///
-    /// `secret` is the `SharedSecret` obtained from [`Self::ka_agree_enc`] or
-    /// [`Self::ka_agree_dec`].
-    ///
-    /// `ephemeral_key` is the byte encoding of the [`EphemeralPublicKey`] used to derive
-    /// `secret`. During encryption it is derived via [`Self::epk_bytes`]; during trial
-    /// decryption it is obtained from [`ShieldedOutput::ephemeral_key`].
-    ///
-    /// [`EphemeralPublicKey`]: Self::EphemeralPublicKey
-    /// [`EphemeralSecretKey`]: Self::EphemeralSecretKey
-    fn kdf(secret: Self::SharedSecret, ephemeral_key: &EphemeralKeyBytes) -> Self::SymmetricKey;
-
-    /// Encodes the given `Note` and `Memo` as a note plaintext.
-    fn note_plaintext_bytes(note: &Self::Note, memo: &Self::Memo) -> NotePlaintextBytes;
-
-    /// Derives the [`OutgoingCipherKey`] for an encrypted note, given the note-specific
-    /// public data and an `OutgoingViewingKey`.
-    fn derive_ock(
-        ovk: &Self::OutgoingViewingKey,
-        cv: &Self::ValueCommitment,
-        cmstar_bytes: &Self::ExtractedCommitmentBytes,
-        ephemeral_key: &EphemeralKeyBytes,
-    ) -> OutgoingCipherKey;
-
-    /// Encodes the outgoing plaintext for the given note.
-    fn outgoing_plaintext_bytes(
-        note: &Self::Note,
-        esk: &Self::EphemeralSecretKey,
-    ) -> OutPlaintextBytes;
-
-    /// Returns the byte encoding of the given `EphemeralPublicKey`.
-    fn epk_bytes(epk: &Self::EphemeralPublicKey) -> EphemeralKeyBytes;
-
-    /// Attempts to parse `ephemeral_key` as an `EphemeralPublicKey`.
-    ///
-    /// Returns `None` if `ephemeral_key` is not a valid byte encoding of an
-    /// `EphemeralPublicKey`.
-    fn epk(ephemeral_key: &EphemeralKeyBytes) -> Option<Self::EphemeralPublicKey>;
-
-    /// Derives the `ExtractedCommitment` for this note.
-    fn cmstar(note: &Self::Note) -> Self::ExtractedCommitment;
-
-    /// Parses the given note plaintext from the recipient's perspective.
-    ///
-    /// The implementation of this method must check that:
-    /// - The note plaintext version is valid (for the given decryption domain's context,
-    ///   which may be passed via `self`).
-    /// - The note plaintext contains valid encodings of its various fields.
-    /// - Any domain-specific requirements are satisfied.
-    ///
-    /// `&self` is passed here to enable the implementation to enforce contextual checks,
-    /// such as rules like [ZIP 212] that become active at a specific block height.
-    ///
-    /// [ZIP 212]: https://zips.z.cash/zip-0212
-    ///
-    /// # Panics
-    ///
-    /// Panics if `plaintext` is shorter than [`COMPACT_NOTE_SIZE`].
-    fn parse_note_plaintext_without_memo_ivk(
-        &self,
-        ivk: &Self::IncomingViewingKey,
-        plaintext: &[u8],
-    ) -> Option<(Self::Note, Self::Recipient)>;
-
-    /// Parses the given note plaintext from the sender's perspective.
-    ///
-    /// The implementation of this method must check that:
-    /// - The note plaintext version is valid (for the given decryption domain's context,
-    ///   which may be passed via `self`).
-    /// - The note plaintext contains valid encodings of its various fields.
-    /// - Any domain-specific requirements are satisfied.
-    ///
-    /// `&self` is passed here to enable the implementation to enforce contextual checks,
-    /// such as rules like [ZIP 212] that become active at a specific block height.
-    ///
-    /// [ZIP 212]: https://zips.z.cash/zip-0212
-    fn parse_note_plaintext_without_memo_ovk(
-        &self,
-        pk_d: &Self::DiversifiedTransmissionKey,
-        plaintext: &NotePlaintextBytes,
-    ) -> Option<(Self::Note, Self::Recipient)>;
-
-    /// Extracts the memo field from the given note plaintext.
-    ///
-    /// # Compatibility
-    ///
-    /// `&self` is passed here in anticipation of future changes to memo handling, where
-    /// the memos may no longer be part of the note plaintext.
-    fn extract_memo(&self, plaintext: &NotePlaintextBytes) -> Self::Memo;
-
-    /// Parses the `DiversifiedTransmissionKey` field of the outgoing plaintext.
-    ///
-    /// Returns `None` if `out_plaintext` does not contain a valid byte encoding of a
-    /// `DiversifiedTransmissionKey`.
-    fn extract_pk_d(out_plaintext: &OutPlaintextBytes) -> Option<Self::DiversifiedTransmissionKey>;
-
-    /// Parses the `EphemeralSecretKey` field of the outgoing plaintext.
-    ///
-    /// Returns `None` if `out_plaintext` does not contain a valid byte encoding of an
-    /// `EphemeralSecretKey`.
-    fn extract_esk(out_plaintext: &OutPlaintextBytes) -> Option<Self::EphemeralSecretKey>;
-}
-
-/// Trait that encapsulates protocol-specific batch trial decryption logic.
-///
-/// Each batchable operation has a default implementation that calls through to the
-/// non-batched implementation. Domains can override whichever operations benefit from
-/// batched logic.
-#[cfg(feature = "alloc")]
-#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))]
-pub trait BatchDomain: Domain {
-    /// Computes `Self::kdf` on a batch of items.
-    ///
-    /// For each item in the batch, if the shared secret is `None`, this returns `None` at
-    /// that position.
-    fn batch_kdf<'a>(
-        items: impl Iterator<Item = (Option<Self::SharedSecret>, &'a EphemeralKeyBytes)>,
-    ) -> Vec<Option<Self::SymmetricKey>> {
-        // Default implementation: do the non-batched thing.
-        items
-            .map(|(secret, ephemeral_key)| secret.map(|secret| Self::kdf(secret, ephemeral_key)))
-            .collect()
-    }
-
-    /// Computes `Self::epk` on a batch of ephemeral keys.
-    ///
-    /// This is useful for protocols where the underlying curve requires an inversion to
-    /// parse an encoded point.
-    ///
-    /// For usability, this returns tuples of the ephemeral keys and the result of parsing
-    /// them.
-    fn batch_epk(
-        ephemeral_keys: impl Iterator<Item = EphemeralKeyBytes>,
-    ) -> Vec<(Option<Self::PreparedEphemeralPublicKey>, EphemeralKeyBytes)> {
-        // Default implementation: do the non-batched thing.
-        ephemeral_keys
-            .map(|ephemeral_key| {
-                (
-                    Self::epk(&ephemeral_key).map(Self::prepare_epk),
-                    ephemeral_key,
-                )
-            })
-            .collect()
-    }
-}
-
-/// Trait that provides access to the components of an encrypted transaction output.
-///
-/// Implementations of this trait are required to define the length of their ciphertext
-/// field. In order to use the trial decryption APIs in this crate, the length must be
-/// either [`ENC_CIPHERTEXT_SIZE`] or [`COMPACT_NOTE_SIZE`].
-pub trait ShieldedOutput<D: Domain, const CIPHERTEXT_SIZE: usize> {
-    /// Exposes the `ephemeral_key` field of the output.
-    fn ephemeral_key(&self) -> EphemeralKeyBytes;
-
-    /// Exposes the `cmu_bytes` or `cmx_bytes` field of the output.
-    fn cmstar_bytes(&self) -> D::ExtractedCommitmentBytes;
-
-    /// Exposes the note ciphertext of the output.
-    fn enc_ciphertext(&self) -> &[u8; CIPHERTEXT_SIZE];
-}
-
-/// A struct containing context required for encrypting Sapling and Orchard notes.
-///
-/// This struct provides a safe API for encrypting Sapling and Orchard notes. In particular, it
-/// enforces that fresh ephemeral keys are used for every note, and that the ciphertexts are
-/// consistent with each other.
-///
-/// Implements section 4.19 of the
-/// [Zcash Protocol Specification](https://zips.z.cash/protocol/nu5.pdf#saplingandorchardinband)
-pub struct NoteEncryption<D: Domain> {
-    epk: D::EphemeralPublicKey,
-    esk: D::EphemeralSecretKey,
-    note: D::Note,
-    memo: D::Memo,
-    /// `None` represents the `ovk = ⊥` case.
-    ovk: Option<D::OutgoingViewingKey>,
-}
-
-impl<D: Domain> NoteEncryption<D> {
-    /// Construct a new note encryption context for the specified note,
-    /// recipient, and memo.
-    pub fn new(ovk: Option<D::OutgoingViewingKey>, note: D::Note, memo: D::Memo) -> Self {
-        let esk = D::derive_esk(&note).expect("ZIP 212 is active.");
-        NoteEncryption {
-            epk: D::ka_derive_public(&note, &esk),
-            esk,
-            note,
-            memo,
-            ovk,
-        }
-    }
-
-    /// For use only with Sapling. This method is preserved in order that test code
-    /// be able to generate pre-ZIP-212 ciphertexts so that tests can continue to
-    /// cover pre-ZIP-212 transaction decryption.
-    #[cfg(feature = "pre-zip-212")]
-    #[cfg_attr(docsrs, doc(cfg(feature = "pre-zip-212")))]
-    pub fn new_with_esk(
-        esk: D::EphemeralSecretKey,
-        ovk: Option<D::OutgoingViewingKey>,
-        note: D::Note,
-        memo: D::Memo,
-    ) -> Self {
-        NoteEncryption {
-            epk: D::ka_derive_public(&note, &esk),
-            esk,
-            note,
-            memo,
-            ovk,
-        }
-    }
-
-    /// Exposes the ephemeral secret key being used to encrypt this note.
-    pub fn esk(&self) -> &D::EphemeralSecretKey {
-        &self.esk
-    }
-
-    /// Exposes the encoding of the ephemeral public key being used to encrypt this note.
-    pub fn epk(&self) -> &D::EphemeralPublicKey {
-        &self.epk
-    }
-
-    /// Generates `encCiphertext` for this note.
-    pub fn encrypt_note_plaintext(&self) -> [u8; ENC_CIPHERTEXT_SIZE] {
-        let pk_d = D::get_pk_d(&self.note);
-        let shared_secret = D::ka_agree_enc(&self.esk, &pk_d);
-        let key = D::kdf(shared_secret, &D::epk_bytes(&self.epk));
-        let input = D::note_plaintext_bytes(&self.note, &self.memo);
-
-        let mut output = [0u8; ENC_CIPHERTEXT_SIZE];
-        output[..NOTE_PLAINTEXT_SIZE].copy_from_slice(&input.0);
-        let tag = ChaCha20Poly1305::new(key.as_ref().into())
-            .encrypt_in_place_detached(
-                [0u8; 12][..].into(),
-                &[],
-                &mut output[..NOTE_PLAINTEXT_SIZE],
-            )
-            .unwrap();
-        output[NOTE_PLAINTEXT_SIZE..].copy_from_slice(&tag);
-
-        output
-    }
-
-    /// Generates `outCiphertext` for this note.
-    pub fn encrypt_outgoing_plaintext<R: RngCore>(
-        &self,
-        cv: &D::ValueCommitment,
-        cmstar: &D::ExtractedCommitment,
-        rng: &mut R,
-    ) -> [u8; OUT_CIPHERTEXT_SIZE] {
-        let (ock, input) = if let Some(ovk) = &self.ovk {
-            let ock = D::derive_ock(ovk, cv, &cmstar.into(), &D::epk_bytes(&self.epk));
-            let input = D::outgoing_plaintext_bytes(&self.note, &self.esk);
-
-            (ock, input)
-        } else {
-            // ovk = ⊥
-            let mut ock = OutgoingCipherKey([0; 32]);
-            let mut input = [0u8; OUT_PLAINTEXT_SIZE];
-
-            rng.fill_bytes(&mut ock.0);
-            rng.fill_bytes(&mut input);
-
-            (ock, OutPlaintextBytes(input))
-        };
-
-        let mut output = [0u8; OUT_CIPHERTEXT_SIZE];
-        output[..OUT_PLAINTEXT_SIZE].copy_from_slice(&input.0);
-        let tag = ChaCha20Poly1305::new(ock.as_ref().into())
-            .encrypt_in_place_detached([0u8; 12][..].into(), &[], &mut output[..OUT_PLAINTEXT_SIZE])
-            .unwrap();
-        output[OUT_PLAINTEXT_SIZE..].copy_from_slice(&tag);
-
-        output
-    }
-}
-
-/// Trial decryption of the full note plaintext by the recipient.
-///
-/// Attempts to decrypt and validate the given shielded output using the given `ivk`.
-/// If successful, the corresponding note and memo are returned, along with the address to
-/// which the note was sent.
-///
-/// Implements section 4.19.2 of the
-/// [Zcash Protocol Specification](https://zips.z.cash/protocol/nu5.pdf#decryptivk).
-pub fn try_note_decryption<D: Domain, Output: ShieldedOutput<D, ENC_CIPHERTEXT_SIZE>>(
-    domain: &D,
-    ivk: &D::IncomingViewingKey,
-    output: &Output,
-) -> Option<(D::Note, D::Recipient, D::Memo)> {
-    let ephemeral_key = output.ephemeral_key();
-
-    let epk = D::prepare_epk(D::epk(&ephemeral_key)?);
-    let shared_secret = D::ka_agree_dec(ivk, &epk);
-    let key = D::kdf(shared_secret, &ephemeral_key);
-
-    try_note_decryption_inner(domain, ivk, &ephemeral_key, output, &key)
-}
-
-fn try_note_decryption_inner<D: Domain, Output: ShieldedOutput<D, ENC_CIPHERTEXT_SIZE>>(
-    domain: &D,
-    ivk: &D::IncomingViewingKey,
-    ephemeral_key: &EphemeralKeyBytes,
-    output: &Output,
-    key: &D::SymmetricKey,
-) -> Option<(D::Note, D::Recipient, D::Memo)> {
-    let enc_ciphertext = output.enc_ciphertext();
-
-    let mut plaintext =
-        NotePlaintextBytes(enc_ciphertext[..NOTE_PLAINTEXT_SIZE].try_into().unwrap());
-
-    ChaCha20Poly1305::new(key.as_ref().into())
-        .decrypt_in_place_detached(
-            [0u8; 12][..].into(),
-            &[],
-            &mut plaintext.0,
-            enc_ciphertext[NOTE_PLAINTEXT_SIZE..].into(),
-        )
-        .ok()?;
-
-    let (note, to) = parse_note_plaintext_without_memo_ivk(
-        domain,
-        ivk,
-        ephemeral_key,
-        &output.cmstar_bytes(),
-        &plaintext.0,
-    )?;
-    let memo = domain.extract_memo(&plaintext);
-
-    Some((note, to, memo))
-}
-
-fn parse_note_plaintext_without_memo_ivk<D: Domain>(
-    domain: &D,
-    ivk: &D::IncomingViewingKey,
-    ephemeral_key: &EphemeralKeyBytes,
-    cmstar_bytes: &D::ExtractedCommitmentBytes,
-    plaintext: &[u8],
-) -> Option<(D::Note, D::Recipient)> {
-    let (note, to) = domain.parse_note_plaintext_without_memo_ivk(ivk, plaintext)?;
-
-    if let NoteValidity::Valid = check_note_validity::<D>(&note, ephemeral_key, cmstar_bytes) {
-        Some((note, to))
-    } else {
-        None
-    }
-}
-
-fn check_note_validity<D: Domain>(
-    note: &D::Note,
-    ephemeral_key: &EphemeralKeyBytes,
-    cmstar_bytes: &D::ExtractedCommitmentBytes,
-) -> NoteValidity {
-    if &D::ExtractedCommitmentBytes::from(&D::cmstar(note)) == cmstar_bytes {
-        // In the case corresponding to specification section 4.19.3, we check that `esk` is equal
-        // to `D::derive_esk(note)` prior to calling this method.
-        if let Some(derived_esk) = D::derive_esk(note) {
-            if D::epk_bytes(&D::ka_derive_public(note, &derived_esk))
-                .ct_eq(ephemeral_key)
-                .into()
-            {
-                NoteValidity::Valid
-            } else {
-                NoteValidity::Invalid
-            }
-        } else {
-            // Before ZIP 212
-            NoteValidity::Valid
-        }
-    } else {
-        // Published commitment doesn't match calculated commitment
-        NoteValidity::Invalid
-    }
-}
-
-/// Trial decryption of the compact note plaintext by the recipient for light clients.
-///
-/// Attempts to decrypt and validate the given compact shielded output using the
-/// given `ivk`. If successful, the corresponding note is returned, along with the address
-/// to which the note was sent.
-///
-/// Implements the procedure specified in [`ZIP 307`].
-///
-/// [`ZIP 307`]: https://zips.z.cash/zip-0307
-pub fn try_compact_note_decryption<D: Domain, Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>>(
-    domain: &D,
-    ivk: &D::IncomingViewingKey,
-    output: &Output,
-) -> Option<(D::Note, D::Recipient)> {
-    let ephemeral_key = output.ephemeral_key();
-
-    let epk = D::prepare_epk(D::epk(&ephemeral_key)?);
-    let shared_secret = D::ka_agree_dec(ivk, &epk);
-    let key = D::kdf(shared_secret, &ephemeral_key);
-
-    try_compact_note_decryption_inner(domain, ivk, &ephemeral_key, output, &key)
-}
-
-fn try_compact_note_decryption_inner<D: Domain, Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>>(
-    domain: &D,
-    ivk: &D::IncomingViewingKey,
-    ephemeral_key: &EphemeralKeyBytes,
-    output: &Output,
-    key: &D::SymmetricKey,
-) -> Option<(D::Note, D::Recipient)> {
-    // Start from block 1 to skip over Poly1305 keying output
-    let mut plaintext = [0; COMPACT_NOTE_SIZE];
-    plaintext.copy_from_slice(output.enc_ciphertext());
-    let mut keystream = ChaCha20::new(key.as_ref().into(), [0u8; 12][..].into());
-    keystream.seek(64);
-    keystream.apply_keystream(&mut plaintext);
-
-    parse_note_plaintext_without_memo_ivk(
-        domain,
-        ivk,
-        ephemeral_key,
-        &output.cmstar_bytes(),
-        &plaintext,
-    )
-}
-
-/// Recovery of the full note plaintext by the sender.
-///
-/// Attempts to decrypt and validate the given shielded output using the given `ovk`.
-/// If successful, the corresponding note and memo are returned, along with the address to
-/// which the note was sent.
-///
-/// Implements [Zcash Protocol Specification section 4.19.3][decryptovk].
-///
-/// [decryptovk]: https://zips.z.cash/protocol/nu5.pdf#decryptovk
-pub fn try_output_recovery_with_ovk<D: Domain, Output: ShieldedOutput<D, ENC_CIPHERTEXT_SIZE>>(
-    domain: &D,
-    ovk: &D::OutgoingViewingKey,
-    output: &Output,
-    cv: &D::ValueCommitment,
-    out_ciphertext: &[u8; OUT_CIPHERTEXT_SIZE],
-) -> Option<(D::Note, D::Recipient, D::Memo)> {
-    let ock = D::derive_ock(ovk, cv, &output.cmstar_bytes(), &output.ephemeral_key());
-    try_output_recovery_with_ock(domain, &ock, output, out_ciphertext)
-}
-
-/// Recovery of the full note plaintext by the sender.
-///
-/// Attempts to decrypt and validate the given shielded output using the given `ock`.
-/// If successful, the corresponding note and memo are returned, along with the address to
-/// which the note was sent.
-///
-/// Implements part of section 4.19.3 of the
-/// [Zcash Protocol Specification](https://zips.z.cash/protocol/nu5.pdf#decryptovk).
-/// For decryption using a Full Viewing Key see [`try_output_recovery_with_ovk`].
-pub fn try_output_recovery_with_ock<D: Domain, Output: ShieldedOutput<D, ENC_CIPHERTEXT_SIZE>>(
-    domain: &D,
-    ock: &OutgoingCipherKey,
-    output: &Output,
-    out_ciphertext: &[u8; OUT_CIPHERTEXT_SIZE],
-) -> Option<(D::Note, D::Recipient, D::Memo)> {
-    let enc_ciphertext = output.enc_ciphertext();
-
-    let mut op = OutPlaintextBytes([0; OUT_PLAINTEXT_SIZE]);
-    op.0.copy_from_slice(&out_ciphertext[..OUT_PLAINTEXT_SIZE]);
-
-    ChaCha20Poly1305::new(ock.as_ref().into())
-        .decrypt_in_place_detached(
-            [0u8; 12][..].into(),
-            &[],
-            &mut op.0,
-            out_ciphertext[OUT_PLAINTEXT_SIZE..].into(),
-        )
-        .ok()?;
-
-    let pk_d = D::extract_pk_d(&op)?;
-    let esk = D::extract_esk(&op)?;
-
-    let ephemeral_key = output.ephemeral_key();
-    let shared_secret = D::ka_agree_enc(&esk, &pk_d);
-    // The small-order point check at the point of output parsing rejects
-    // non-canonical encodings, so reencoding here for the KDF should
-    // be okay.
-    let key = D::kdf(shared_secret, &ephemeral_key);
-
-    let mut plaintext = NotePlaintextBytes([0; NOTE_PLAINTEXT_SIZE]);
-    plaintext
-        .0
-        .copy_from_slice(&enc_ciphertext[..NOTE_PLAINTEXT_SIZE]);
-
-    ChaCha20Poly1305::new(key.as_ref().into())
-        .decrypt_in_place_detached(
-            [0u8; 12][..].into(),
-            &[],
-            &mut plaintext.0,
-            enc_ciphertext[NOTE_PLAINTEXT_SIZE..].into(),
-        )
-        .ok()?;
-
-    let (note, to) = domain.parse_note_plaintext_without_memo_ovk(&pk_d, &plaintext)?;
-    let memo = domain.extract_memo(&plaintext);
-
-    // ZIP 212: Check that the esk provided to this function is consistent with the esk we can
-    // derive from the note. This check corresponds to `ToScalar(PRF^{expand}_{rseed}([4]) = esk`
-    // in https://zips.z.cash/protocol/protocol.pdf#decryptovk. (`ρ^opt = []` for Sapling.)
-    if let Some(derived_esk) = D::derive_esk(&note) {
-        if (!derived_esk.ct_eq(&esk)).into() {
-            return None;
-        }
-    }
-
-    if let NoteValidity::Valid =
-        check_note_validity::<D>(&note, &ephemeral_key, &output.cmstar_bytes())
-    {
-        Some((note, to, memo))
-    } else {
-        None
-    }
-}
diff --git a/components/zcash_protocol/CHANGELOG.md b/components/zcash_protocol/CHANGELOG.md
new file mode 100644
index 0000000000..7a03fb52ee
--- /dev/null
+++ b/components/zcash_protocol/CHANGELOG.md
@@ -0,0 +1,103 @@
+# Changelog
+All notable changes to this library will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this library adheres to Rust's notion of
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.4.1] - 2024-11-13
+### Added
+- `zcash_protocol::value::QuotRem`
+- `zcash_protocol::value::Zatoshis::div_with_remainder`
+- `impl Mul<u64> for zcash_protocol::value::Zatoshis`
+- `impl Div<NonZeroU64> for zcash_protocol::value::Zatoshis`
+
+## [0.4.0] - 2024-10-02
+### Added
+- `impl Sub<BlockHeight> for BlockHeight` unlike the implementation that was
+  removed in version `0.3.0`, a saturating subtraction for block heights having
+  a return type of `u32` makes sense for `BlockHeight`. Subtracting one block
+  height from another yields the delta between them.
+
+### Changed
+- Mainnet activation height has been set for `consensus::BranchId::Nu6`.
+- Adding a delta to a `BlockHeight` now uses saturating addition.
+- Subtracting a delta to a `BlockHeight` now uses saturating subtraction.
+
+## [0.3.0] - 2024-08-26
+### Changed
+- Testnet activation height has been set for `consensus::BranchId::Nu6`.
+
+### Removed
+- `impl {Add, Sub} for BlockHeight` - these operations were unused, and it
+  does not make sense to add block heights (it is not a monoid.)
+
+## [0.2.0] - 2024-08-19
+### Added
+- `zcash_protocol::PoolType::{TRANSPARENT, SAPLING, ORCHARD}`
+
+### Changed
+- MSRV is now 1.70.0.
+- `consensus::BranchId` now has an additional `Nu6` variant.
+
+## [0.1.1] - 2024-03-25
+### Added
+- `zcash_protocol::memo`:
+  - `impl TryFrom<&MemoBytes> for Memo`
+
+### Removed
+- `unstable-nu6` and `zfuture` feature flags (use `--cfg zcash_unstable=\"nu6\"`
+  or `--cfg zcash_unstable=\"zfuture\"` in `RUSTFLAGS` and `RUSTDOCFLAGS`
+  instead).
+
+## [0.1.0] - 2024-03-06
+The entries below are relative to the `zcash_primitives` crate as of the tag
+`zcash_primitives-0.14.0`.
+
+### Added
+- The following modules have been extracted from `zcash_primitives` and
+  moved to this crate:
+  - `consensus`
+  - `constants`
+  - `zcash_protocol::value` replaces `zcash_primitives::transaction::components::amount`
+- `zcash_protocol::consensus`:
+  - `NetworkConstants` has been extracted from the `Parameters` trait. Relative to the
+    state prior to the extraction:
+    - The Bech32 prefixes now return `&'static str` instead of `&str`.
+    - Added `NetworkConstants::hrp_tex_address`.
+  - `NetworkType`
+  - `Parameters::b58_sprout_address_prefix`
+- `zcash_protocol::consensus`:
+  - `impl Hash for LocalNetwork`
+- `zcash_protocol::constants::{mainnet, testnet}::B58_SPROUT_ADDRESS_PREFIX`
+- Added in `zcash_protocol::value`:
+  - `Zatoshis`
+  - `ZatBalance`
+  - `MAX_BALANCE` has been added to replace previous instances where
+    `zcash_protocol::value::MAX_MONEY` was used as a signed value.
+
+### Changed
+- `zcash_protocol::value::COIN` has been changed from an `i64` to a `u64`
+- `zcash_protocol::value::MAX_MONEY` has been changed from an `i64` to a `u64`
+- `zcash_protocol::consensus::Parameters` has been split into two traits, with
+  the newly added `NetworkConstants` trait providing all network constant
+  accessors. Also, the `address_network` method has been replaced with a new
+  `network_type` method that serves the same purpose. A blanket impl of
+  `NetworkConstants` is provided for all types that implement `Parameters`,
+  so call sites for methods that have moved to `NetworkConstants` should
+  remain unchanged (though they may require an additional `use` statement.)
+
+### Removed
+- From `zcash_protocol::value`:
+  - `NonNegativeAmount` (use `Zatoshis` instead.)
+  - `Amount` (use `ZatBalance` instead.)
+  - The following conversions have been removed relative to `zcash_primitives-0.14.0`,
+    as `zcash_protocol` does not depend on the `orchard` or `sapling-crypto` crates.
+    - `From<NonNegativeAmount> for orchard::NoteValue>`
+    - `TryFrom<orchard::ValueSum> for Amount`
+    - `From<NonNegativeAmount> for sapling::value::NoteValue>`
+    - `TryFrom<sapling::value::NoteValue> for NonNegativeAmount`
+  - `impl AddAssign for NonNegativeAmount`
+  - `impl SubAssign for NonNegativeAmount`
diff --git a/components/zcash_protocol/Cargo.toml b/components/zcash_protocol/Cargo.toml
new file mode 100644
index 0000000000..c7b046f857
--- /dev/null
+++ b/components/zcash_protocol/Cargo.toml
@@ -0,0 +1,52 @@
+[package]
+name = "zcash_protocol"
+description = "Zcash protocol network constants and value types."
+version = "0.4.1"
+authors = [
+    "Jack Grigg <jack@electriccoin.co>",
+    "Kris Nuttycombe <kris@nutty.land>",
+]
+homepage = "https://github.com/zcash/librustzcash"
+repository.workspace = true
+readme = "README.md"
+license.workspace = true
+edition.workspace = true
+rust-version = "1.70"
+categories = ["cryptography::cryptocurrencies"]
+keywords = ["zcash"]
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[dependencies]
+# - Logging and metrics
+memuse.workspace = true
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Documentation
+document-features.workspace = true
+
+# - Test dependencies
+proptest = { workspace = true, optional = true }
+incrementalmerkletree = { workspace = true, optional = true }
+incrementalmerkletree-testing = { workspace = true, optional = true }
+
+[dev-dependencies]
+proptest.workspace = true
+
+[features]
+## Exposes APIs that are useful for testing, such as `proptest` strategies.
+test-dependencies = [
+    "dep:incrementalmerkletree",
+    "dep:incrementalmerkletree-testing",
+    "dep:proptest",
+    "incrementalmerkletree?/test-dependencies",
+]
+
+## Exposes support for working with a local consensus (e.g. regtest).
+local-consensus = []
+
+[lints]
+workspace = true
diff --git a/components/zcash_note_encryption/LICENSE-APACHE b/components/zcash_protocol/LICENSE-APACHE
similarity index 100%
rename from components/zcash_note_encryption/LICENSE-APACHE
rename to components/zcash_protocol/LICENSE-APACHE
diff --git a/components/zcash_note_encryption/LICENSE-MIT b/components/zcash_protocol/LICENSE-MIT
similarity index 95%
rename from components/zcash_note_encryption/LICENSE-MIT
rename to components/zcash_protocol/LICENSE-MIT
index 9500c140cc..c869731ad4 100644
--- a/components/zcash_note_encryption/LICENSE-MIT
+++ b/components/zcash_protocol/LICENSE-MIT
@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2021 Electric Coin Company
+Copyright (c) 2021-2024 Electric Coin Company
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/components/zcash_protocol/README.md b/components/zcash_protocol/README.md
new file mode 100644
index 0000000000..862adf0a84
--- /dev/null
+++ b/components/zcash_protocol/README.md
@@ -0,0 +1,20 @@
+# zcash_protocol
+
+Zcash network constants and value types.
+
+## License
+
+Licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
diff --git a/zcash_primitives/src/consensus.rs b/components/zcash_protocol/src/consensus.rs
similarity index 67%
rename from zcash_primitives/src/consensus.rs
rename to components/zcash_protocol/src/consensus.rs
index 02ceffa165..73b48d3f24 100644
--- a/zcash_primitives/src/consensus.rs
+++ b/components/zcash_protocol/src/consensus.rs
@@ -5,24 +5,32 @@ use std::cmp::{Ord, Ordering};
 use std::convert::TryFrom;
 use std::fmt;
 use std::ops::{Add, Bound, RangeBounds, Sub};
-use zcash_address;
 
-use crate::constants;
+use crate::constants::{mainnet, regtest, testnet};
 
-/// A wrapper type representing blockchain heights. Safe conversion from
-/// various integer types, as well as addition and subtraction, are provided.
+/// A wrapper type representing blockchain heights.
+///
+/// Safe conversion from various integer types, as well as addition and subtraction, are
+/// provided.
 #[repr(transparent)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub struct BlockHeight(u32);
 
 memuse::impl_no_dynamic_usage!(BlockHeight);
 
+/// The height of the genesis block on a network.
 pub const H0: BlockHeight = BlockHeight(0);
 
 impl BlockHeight {
     pub const fn from_u32(v: u32) -> BlockHeight {
         BlockHeight(v)
     }
+
+    /// Subtracts the provided value from this height, returning `H0` if this would result in
+    /// underflow of the wrapped `u32`.
+    pub fn saturating_sub(self, v: u32) -> BlockHeight {
+        BlockHeight(self.0.saturating_sub(v))
+    }
 }
 
 impl fmt::Display for BlockHeight {
@@ -95,15 +103,7 @@ impl Add<u32> for BlockHeight {
     type Output = Self;
 
     fn add(self, other: u32) -> Self {
-        BlockHeight(self.0 + other)
-    }
-}
-
-impl Add for BlockHeight {
-    type Output = Self;
-
-    fn add(self, other: Self) -> Self {
-        self + other.0
+        BlockHeight(self.0.saturating_add(other))
     }
 }
 
@@ -111,248 +111,300 @@ impl Sub<u32> for BlockHeight {
     type Output = Self;
 
     fn sub(self, other: u32) -> Self {
-        if other > self.0 {
-            panic!("Subtraction resulted in negative block height.");
-        }
-
-        BlockHeight(self.0 - other)
+        BlockHeight(self.0.saturating_sub(other))
     }
 }
 
-impl Sub for BlockHeight {
-    type Output = Self;
+impl Sub<BlockHeight> for BlockHeight {
+    type Output = u32;
 
-    fn sub(self, other: Self) -> Self {
-        self - other.0
+    fn sub(self, other: BlockHeight) -> u32 {
+        self.0.saturating_sub(other.0)
     }
 }
 
-/// Zcash consensus parameters.
-pub trait Parameters: Clone {
-    /// Returns the activation height for a particular network upgrade,
-    /// if an activation height has been set.
-    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight>;
-
-    /// Determines whether the specified network upgrade is active as of the
-    /// provided block height on the network to which this Parameters value applies.
-    fn is_nu_active(&self, nu: NetworkUpgrade, height: BlockHeight) -> bool {
-        self.activation_height(nu).map_or(false, |h| h <= height)
-    }
-
+/// Constants associated with a given Zcash network.
+pub trait NetworkConstants: Clone {
     /// The coin type for ZEC, as defined by [SLIP 44].
     ///
     /// [SLIP 44]: https://github.com/satoshilabs/slips/blob/master/slip-0044.md
     fn coin_type(&self) -> u32;
 
-    /// Returns the standard network constant for address encoding. Returns
-    /// 'None' for nonstandard networks.
-    fn address_network(&self) -> Option<zcash_address::Network>;
-
     /// Returns the human-readable prefix for Bech32-encoded Sapling extended spending keys
-    /// the network to which this Parameters value applies.
+    /// for the network to which this NetworkConstants value applies.
     ///
     /// Defined in [ZIP 32].
     ///
     /// [`ExtendedSpendingKey`]: zcash_primitives::zip32::ExtendedSpendingKey
     /// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
-    fn hrp_sapling_extended_spending_key(&self) -> &str;
+    fn hrp_sapling_extended_spending_key(&self) -> &'static str;
 
     /// Returns the human-readable prefix for Bech32-encoded Sapling extended full
-    /// viewing keys for the network to which this Parameters value applies.
+    /// viewing keys for the network to which this NetworkConstants value applies.
     ///
     /// Defined in [ZIP 32].
     ///
     /// [`ExtendedFullViewingKey`]: zcash_primitives::zip32::ExtendedFullViewingKey
     /// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
-    fn hrp_sapling_extended_full_viewing_key(&self) -> &str;
+    fn hrp_sapling_extended_full_viewing_key(&self) -> &'static str;
 
     /// Returns the Bech32-encoded human-readable prefix for Sapling payment addresses
-    /// viewing keys for the network to which this Parameters value applies.
+    /// for the network to which this NetworkConstants value applies.
     ///
     /// Defined in section 5.6.4 of the [Zcash Protocol Specification].
     ///
     /// [`PaymentAddress`]: zcash_primitives::primitives::PaymentAddress
     /// [Zcash Protocol Specification]: https://github.com/zcash/zips/blob/master/protocol/protocol.pdf
-    fn hrp_sapling_payment_address(&self) -> &str;
+    fn hrp_sapling_payment_address(&self) -> &'static str;
+
+    /// Returns the human-readable prefix for Base58Check-encoded Sprout
+    /// payment addresses for the network to which this NetworkConstants value
+    /// applies.
+    ///
+    /// Defined in the [Zcash Protocol Specification section 5.6.3][sproutpaymentaddrencoding].
+    ///
+    /// [sproutpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#sproutpaymentaddrencoding
+    fn b58_sprout_address_prefix(&self) -> [u8; 2];
 
     /// Returns the human-readable prefix for Base58Check-encoded transparent
-    /// pay-to-public-key-hash payment addresses for the network to which this Parameters value
+    /// pay-to-public-key-hash payment addresses for the network to which this NetworkConstants value
     /// applies.
     ///
     /// [`TransparentAddress::PublicKey`]: zcash_primitives::legacy::TransparentAddress::PublicKey
     fn b58_pubkey_address_prefix(&self) -> [u8; 2];
 
     /// Returns the human-readable prefix for Base58Check-encoded transparent pay-to-script-hash
-    /// payment addresses for the network to which this Parameters value applies.
+    /// payment addresses for the network to which this NetworkConstants value applies.
     ///
     /// [`TransparentAddress::Script`]: zcash_primitives::legacy::TransparentAddress::Script
     fn b58_script_address_prefix(&self) -> [u8; 2];
-}
 
-/// Marker struct for the production network.
-#[derive(PartialEq, Eq, Copy, Clone, Debug)]
-pub struct MainNetwork;
+    /// Returns the Bech32-encoded human-readable prefix for TEX addresses, for the
+    /// network to which this `NetworkConstants` value applies.
+    ///
+    /// Defined in [ZIP 320].
+    ///
+    /// [ZIP 320]: https://zips.z.cash/zip-0320
+    fn hrp_tex_address(&self) -> &'static str;
+}
 
-memuse::impl_no_dynamic_usage!(MainNetwork);
+/// The enumeration of known Zcash network types.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum NetworkType {
+    /// Zcash Mainnet.
+    Main,
+    /// Zcash Testnet.
+    Test,
+    /// Private integration / regression testing, used in `zcashd`.
+    ///
+    /// For some address types there is no distinction between test and regtest encodings;
+    /// those will always be parsed as `Network::Test`.
+    Regtest,
+}
 
-pub const MAIN_NETWORK: MainNetwork = MainNetwork;
-
-impl Parameters for MainNetwork {
-    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
-        match nu {
-            NetworkUpgrade::Overwinter => Some(BlockHeight(347_500)),
-            NetworkUpgrade::Sapling => Some(BlockHeight(419_200)),
-            NetworkUpgrade::Blossom => Some(BlockHeight(653_600)),
-            NetworkUpgrade::Heartwood => Some(BlockHeight(903_000)),
-            NetworkUpgrade::Canopy => Some(BlockHeight(1_046_400)),
-            NetworkUpgrade::Nu5 => Some(BlockHeight(1_687_104)),
-            #[cfg(feature = "zfuture")]
-            NetworkUpgrade::ZFuture => None,
-        }
-    }
+memuse::impl_no_dynamic_usage!(NetworkType);
 
+impl NetworkConstants for NetworkType {
     fn coin_type(&self) -> u32 {
-        constants::mainnet::COIN_TYPE
+        match self {
+            NetworkType::Main => mainnet::COIN_TYPE,
+            NetworkType::Test => testnet::COIN_TYPE,
+            NetworkType::Regtest => regtest::COIN_TYPE,
+        }
     }
 
-    fn address_network(&self) -> Option<zcash_address::Network> {
-        Some(zcash_address::Network::Main)
+    fn hrp_sapling_extended_spending_key(&self) -> &'static str {
+        match self {
+            NetworkType::Main => mainnet::HRP_SAPLING_EXTENDED_SPENDING_KEY,
+            NetworkType::Test => testnet::HRP_SAPLING_EXTENDED_SPENDING_KEY,
+            NetworkType::Regtest => regtest::HRP_SAPLING_EXTENDED_SPENDING_KEY,
+        }
     }
 
-    fn hrp_sapling_extended_spending_key(&self) -> &str {
-        constants::mainnet::HRP_SAPLING_EXTENDED_SPENDING_KEY
+    fn hrp_sapling_extended_full_viewing_key(&self) -> &'static str {
+        match self {
+            NetworkType::Main => mainnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+            NetworkType::Test => testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+            NetworkType::Regtest => regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+        }
     }
 
-    fn hrp_sapling_extended_full_viewing_key(&self) -> &str {
-        constants::mainnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY
+    fn hrp_sapling_payment_address(&self) -> &'static str {
+        match self {
+            NetworkType::Main => mainnet::HRP_SAPLING_PAYMENT_ADDRESS,
+            NetworkType::Test => testnet::HRP_SAPLING_PAYMENT_ADDRESS,
+            NetworkType::Regtest => regtest::HRP_SAPLING_PAYMENT_ADDRESS,
+        }
     }
 
-    fn hrp_sapling_payment_address(&self) -> &str {
-        constants::mainnet::HRP_SAPLING_PAYMENT_ADDRESS
+    fn b58_sprout_address_prefix(&self) -> [u8; 2] {
+        match self {
+            NetworkType::Main => mainnet::B58_SPROUT_ADDRESS_PREFIX,
+            NetworkType::Test => testnet::B58_SPROUT_ADDRESS_PREFIX,
+            NetworkType::Regtest => regtest::B58_SPROUT_ADDRESS_PREFIX,
+        }
     }
 
     fn b58_pubkey_address_prefix(&self) -> [u8; 2] {
-        constants::mainnet::B58_PUBKEY_ADDRESS_PREFIX
+        match self {
+            NetworkType::Main => mainnet::B58_PUBKEY_ADDRESS_PREFIX,
+            NetworkType::Test => testnet::B58_PUBKEY_ADDRESS_PREFIX,
+            NetworkType::Regtest => regtest::B58_PUBKEY_ADDRESS_PREFIX,
+        }
     }
 
     fn b58_script_address_prefix(&self) -> [u8; 2] {
-        constants::mainnet::B58_SCRIPT_ADDRESS_PREFIX
+        match self {
+            NetworkType::Main => mainnet::B58_SCRIPT_ADDRESS_PREFIX,
+            NetworkType::Test => testnet::B58_SCRIPT_ADDRESS_PREFIX,
+            NetworkType::Regtest => regtest::B58_SCRIPT_ADDRESS_PREFIX,
+        }
     }
-}
 
-/// Marker struct for the test network.
-#[derive(PartialEq, Eq, Copy, Clone, Debug)]
-pub struct TestNetwork;
+    fn hrp_tex_address(&self) -> &'static str {
+        match self {
+            NetworkType::Main => mainnet::HRP_TEX_ADDRESS,
+            NetworkType::Test => testnet::HRP_TEX_ADDRESS,
+            NetworkType::Regtest => regtest::HRP_TEX_ADDRESS,
+        }
+    }
+}
 
-memuse::impl_no_dynamic_usage!(TestNetwork);
+/// Zcash consensus parameters.
+pub trait Parameters: Clone {
+    /// Returns the type of network configured by this set of consensus parameters.
+    fn network_type(&self) -> NetworkType;
 
-pub const TEST_NETWORK: TestNetwork = TestNetwork;
+    /// Returns the activation height for a particular network upgrade,
+    /// if an activation height has been set.
+    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight>;
 
-impl Parameters for TestNetwork {
-    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
-        match nu {
-            NetworkUpgrade::Overwinter => Some(BlockHeight(207_500)),
-            NetworkUpgrade::Sapling => Some(BlockHeight(280_000)),
-            NetworkUpgrade::Blossom => Some(BlockHeight(584_000)),
-            NetworkUpgrade::Heartwood => Some(BlockHeight(903_800)),
-            NetworkUpgrade::Canopy => Some(BlockHeight(1_028_500)),
-            NetworkUpgrade::Nu5 => Some(BlockHeight(1_842_420)),
-            #[cfg(feature = "zfuture")]
-            NetworkUpgrade::ZFuture => None,
-        }
+    /// Determines whether the specified network upgrade is active as of the
+    /// provided block height on the network to which this Parameters value applies.
+    fn is_nu_active(&self, nu: NetworkUpgrade, height: BlockHeight) -> bool {
+        self.activation_height(nu).map_or(false, |h| h <= height)
     }
+}
 
+impl<P: Parameters> NetworkConstants for P {
     fn coin_type(&self) -> u32 {
-        constants::testnet::COIN_TYPE
+        self.network_type().coin_type()
     }
 
-    fn address_network(&self) -> Option<zcash_address::Network> {
-        Some(zcash_address::Network::Test)
+    fn hrp_sapling_extended_spending_key(&self) -> &'static str {
+        self.network_type().hrp_sapling_extended_spending_key()
     }
 
-    fn hrp_sapling_extended_spending_key(&self) -> &str {
-        constants::testnet::HRP_SAPLING_EXTENDED_SPENDING_KEY
+    fn hrp_sapling_extended_full_viewing_key(&self) -> &'static str {
+        self.network_type().hrp_sapling_extended_full_viewing_key()
     }
 
-    fn hrp_sapling_extended_full_viewing_key(&self) -> &str {
-        constants::testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY
+    fn hrp_sapling_payment_address(&self) -> &'static str {
+        self.network_type().hrp_sapling_payment_address()
     }
 
-    fn hrp_sapling_payment_address(&self) -> &str {
-        constants::testnet::HRP_SAPLING_PAYMENT_ADDRESS
+    fn b58_sprout_address_prefix(&self) -> [u8; 2] {
+        self.network_type().b58_sprout_address_prefix()
     }
 
     fn b58_pubkey_address_prefix(&self) -> [u8; 2] {
-        constants::testnet::B58_PUBKEY_ADDRESS_PREFIX
+        self.network_type().b58_pubkey_address_prefix()
     }
 
     fn b58_script_address_prefix(&self) -> [u8; 2] {
-        constants::testnet::B58_SCRIPT_ADDRESS_PREFIX
+        self.network_type().b58_script_address_prefix()
+    }
+
+    fn hrp_tex_address(&self) -> &'static str {
+        self.network_type().hrp_tex_address()
     }
 }
 
+/// Marker struct for the production network.
 #[derive(PartialEq, Eq, Copy, Clone, Debug)]
-pub enum Network {
-    MainNetwork,
-    TestNetwork,
-}
+pub struct MainNetwork;
 
-memuse::impl_no_dynamic_usage!(Network);
+memuse::impl_no_dynamic_usage!(MainNetwork);
 
-impl Parameters for Network {
-    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
-        match self {
-            Network::MainNetwork => MAIN_NETWORK.activation_height(nu),
-            Network::TestNetwork => TEST_NETWORK.activation_height(nu),
-        }
-    }
+/// The production network.
+pub const MAIN_NETWORK: MainNetwork = MainNetwork;
 
-    fn coin_type(&self) -> u32 {
-        match self {
-            Network::MainNetwork => MAIN_NETWORK.coin_type(),
-            Network::TestNetwork => TEST_NETWORK.coin_type(),
-        }
+impl Parameters for MainNetwork {
+    fn network_type(&self) -> NetworkType {
+        NetworkType::Main
     }
 
-    fn address_network(&self) -> Option<zcash_address::Network> {
-        match self {
-            Network::MainNetwork => Some(zcash_address::Network::Main),
-            Network::TestNetwork => Some(zcash_address::Network::Test),
+    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
+        match nu {
+            NetworkUpgrade::Overwinter => Some(BlockHeight(347_500)),
+            NetworkUpgrade::Sapling => Some(BlockHeight(419_200)),
+            NetworkUpgrade::Blossom => Some(BlockHeight(653_600)),
+            NetworkUpgrade::Heartwood => Some(BlockHeight(903_000)),
+            NetworkUpgrade::Canopy => Some(BlockHeight(1_046_400)),
+            NetworkUpgrade::Nu5 => Some(BlockHeight(1_687_104)),
+            NetworkUpgrade::Nu6 => Some(BlockHeight(2_726_400)),
+            //TODO: update this value
+            NetworkUpgrade::Nu7 => Some(BlockHeight(3_000_000)),
+            #[cfg(zcash_unstable = "zfuture")]
+            NetworkUpgrade::ZFuture => None,
         }
     }
+}
 
-    fn hrp_sapling_extended_spending_key(&self) -> &str {
-        match self {
-            Network::MainNetwork => MAIN_NETWORK.hrp_sapling_extended_spending_key(),
-            Network::TestNetwork => TEST_NETWORK.hrp_sapling_extended_spending_key(),
-        }
-    }
+/// Marker struct for the test network.
+#[derive(PartialEq, Eq, Copy, Clone, Debug)]
+pub struct TestNetwork;
 
-    fn hrp_sapling_extended_full_viewing_key(&self) -> &str {
-        match self {
-            Network::MainNetwork => MAIN_NETWORK.hrp_sapling_extended_full_viewing_key(),
-            Network::TestNetwork => TEST_NETWORK.hrp_sapling_extended_full_viewing_key(),
-        }
+memuse::impl_no_dynamic_usage!(TestNetwork);
+
+/// The test network.
+pub const TEST_NETWORK: TestNetwork = TestNetwork;
+
+impl Parameters for TestNetwork {
+    fn network_type(&self) -> NetworkType {
+        NetworkType::Test
     }
 
-    fn hrp_sapling_payment_address(&self) -> &str {
-        match self {
-            Network::MainNetwork => MAIN_NETWORK.hrp_sapling_payment_address(),
-            Network::TestNetwork => TEST_NETWORK.hrp_sapling_payment_address(),
+    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
+        match nu {
+            NetworkUpgrade::Overwinter => Some(BlockHeight(207_500)),
+            NetworkUpgrade::Sapling => Some(BlockHeight(280_000)),
+            NetworkUpgrade::Blossom => Some(BlockHeight(584_000)),
+            NetworkUpgrade::Heartwood => Some(BlockHeight(903_800)),
+            NetworkUpgrade::Canopy => Some(BlockHeight(1_028_500)),
+            NetworkUpgrade::Nu5 => Some(BlockHeight(1_842_420)),
+            NetworkUpgrade::Nu6 => Some(BlockHeight(2_976_000)),
+            //TODO: update this value
+            NetworkUpgrade::Nu7 => Some(BlockHeight(3_000_000)),
+            #[cfg(zcash_unstable = "zfuture")]
+            NetworkUpgrade::ZFuture => None,
         }
     }
+}
 
-    fn b58_pubkey_address_prefix(&self) -> [u8; 2] {
+/// The enumeration of known Zcash networks.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Network {
+    /// Zcash Mainnet.
+    MainNetwork,
+    /// Zcash Testnet.
+    TestNetwork,
+}
+
+memuse::impl_no_dynamic_usage!(Network);
+
+impl Parameters for Network {
+    fn network_type(&self) -> NetworkType {
         match self {
-            Network::MainNetwork => MAIN_NETWORK.b58_pubkey_address_prefix(),
-            Network::TestNetwork => TEST_NETWORK.b58_pubkey_address_prefix(),
+            Network::MainNetwork => NetworkType::Main,
+            Network::TestNetwork => NetworkType::Test,
         }
     }
 
-    fn b58_script_address_prefix(&self) -> [u8; 2] {
+    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
         match self {
-            Network::MainNetwork => MAIN_NETWORK.b58_script_address_prefix(),
-            Network::TestNetwork => TEST_NETWORK.b58_script_address_prefix(),
+            Network::MainNetwork => MAIN_NETWORK.activation_height(nu),
+            Network::TestNetwork => TEST_NETWORK.activation_height(nu),
         }
     }
 }
@@ -361,7 +413,7 @@ impl Parameters for Network {
 /// consensus rules enforced by the network are altered.
 ///
 /// See [ZIP 200](https://zips.z.cash/zip-0200) for more details.
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum NetworkUpgrade {
     /// The [Overwinter] network upgrade.
     ///
@@ -387,12 +439,20 @@ pub enum NetworkUpgrade {
     ///
     /// [Nu5]: https://z.cash/upgrade/nu5/
     Nu5,
+    /// The [Nu6] network upgrade.
+    ///
+    /// [Nu6]: https://z.cash/upgrade/nu6/
+    Nu6,
+    /// The [Nu7] network upgrade.
+    ///
+    /// [Nu7]: https://z.cash/upgrade/nu7/
+    Nu7,
     /// The ZFUTURE network upgrade.
     ///
     /// This upgrade is expected never to activate on mainnet;
     /// it is intended for use in integration testing of functionality
     /// that is a candidate for integration in a future network upgrade.
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "zfuture")]
     ZFuture,
 }
 
@@ -407,7 +467,9 @@ impl fmt::Display for NetworkUpgrade {
             NetworkUpgrade::Heartwood => write!(f, "Heartwood"),
             NetworkUpgrade::Canopy => write!(f, "Canopy"),
             NetworkUpgrade::Nu5 => write!(f, "Nu5"),
-            #[cfg(feature = "zfuture")]
+            NetworkUpgrade::Nu6 => write!(f, "Nu6"),
+            NetworkUpgrade::Nu7 => write!(f, "Nu7"),
+            #[cfg(zcash_unstable = "zfuture")]
             NetworkUpgrade::ZFuture => write!(f, "ZFUTURE"),
         }
     }
@@ -422,7 +484,9 @@ impl NetworkUpgrade {
             NetworkUpgrade::Heartwood => BranchId::Heartwood,
             NetworkUpgrade::Canopy => BranchId::Canopy,
             NetworkUpgrade::Nu5 => BranchId::Nu5,
-            #[cfg(feature = "zfuture")]
+            NetworkUpgrade::Nu6 => BranchId::Nu6,
+            NetworkUpgrade::Nu7 => BranchId::Nu7,
+            #[cfg(zcash_unstable = "zfuture")]
             NetworkUpgrade::ZFuture => BranchId::ZFuture,
         }
     }
@@ -439,8 +503,15 @@ const UPGRADES_IN_ORDER: &[NetworkUpgrade] = &[
     NetworkUpgrade::Heartwood,
     NetworkUpgrade::Canopy,
     NetworkUpgrade::Nu5,
+    NetworkUpgrade::Nu6,
+    NetworkUpgrade::Nu7,
+    #[cfg(zcash_unstable = "zfuture")]
+    NetworkUpgrade::ZFuture,
 ];
 
+/// The "grace period" defined in [ZIP 212].
+///
+/// [ZIP 212]: https://zips.z.cash/zip-0212#changes-to-the-process-of-receiving-sapling-or-orchard-notes
 pub const ZIP212_GRACE_PERIOD: u32 = 32256;
 
 /// A globally-unique identifier for a set of consensus rules within the Zcash chain.
@@ -455,7 +526,7 @@ pub const ZIP212_GRACE_PERIOD: u32 = 32256;
 ///
 /// See [ZIP 200](https://zips.z.cash/zip-0200) for more details.
 ///
-/// [`signature_hash`]: crate::transaction::sighash::signature_hash
+/// [`signature_hash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/transaction/sighash/fn.signature_hash.html
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum BranchId {
     /// The consensus rules at the launch of Zcash.
@@ -472,9 +543,13 @@ pub enum BranchId {
     Canopy,
     /// The consensus rules deployed by [`NetworkUpgrade::Nu5`].
     Nu5,
+    /// The consensus rules deployed by [`NetworkUpgrade::Nu6`].
+    Nu6,
+    /// The consensus rules deployed by [`NetworkUpgrade::Nu7`].
+    Nu7,
     /// Candidates for future consensus rules; this branch will never
     /// activate on mainnet.
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "zfuture")]
     ZFuture,
 }
 
@@ -492,7 +567,10 @@ impl TryFrom<u32> for BranchId {
             0xf5b9_230b => Ok(BranchId::Heartwood),
             0xe9ff_75a6 => Ok(BranchId::Canopy),
             0xc2d6_d0b4 => Ok(BranchId::Nu5),
-            #[cfg(feature = "zfuture")]
+            0xc8e7_1055 => Ok(BranchId::Nu6),
+            //TODO: update this value
+            0xffff_ffff => Ok(BranchId::Nu7),
+            #[cfg(zcash_unstable = "zfuture")]
             0xffff_ffff => Ok(BranchId::ZFuture),
             _ => Err("Unknown consensus branch ID"),
         }
@@ -509,7 +587,10 @@ impl From<BranchId> for u32 {
             BranchId::Heartwood => 0xf5b9_230b,
             BranchId::Canopy => 0xe9ff_75a6,
             BranchId::Nu5 => 0xc2d6_d0b4,
-            #[cfg(feature = "zfuture")]
+            BranchId::Nu6 => 0xc8e7_1055,
+            //TODO: update this value
+            BranchId::Nu7 => 0xffff_ffff,
+            #[cfg(zcash_unstable = "zfuture")]
             BranchId::ZFuture => 0xffff_ffff,
         }
     }
@@ -574,14 +655,20 @@ impl BranchId {
             BranchId::Canopy => params
                 .activation_height(NetworkUpgrade::Canopy)
                 .map(|lower| (lower, params.activation_height(NetworkUpgrade::Nu5))),
-            BranchId::Nu5 => params.activation_height(NetworkUpgrade::Nu5).map(|lower| {
-                #[cfg(feature = "zfuture")]
+            BranchId::Nu5 => params
+                .activation_height(NetworkUpgrade::Nu5)
+                .map(|lower| (lower, params.activation_height(NetworkUpgrade::Nu6))),
+            BranchId::Nu6 => params
+                .activation_height(NetworkUpgrade::Nu6)
+                .map(|lower| (lower, params.activation_height(NetworkUpgrade::Nu7))),
+            BranchId::Nu7 => params.activation_height(NetworkUpgrade::Nu7).map(|lower| {
+                #[cfg(zcash_unstable = "zfuture")]
                 let upper = params.activation_height(NetworkUpgrade::ZFuture);
-                #[cfg(not(feature = "zfuture"))]
+                #[cfg(not(zcash_unstable = "zfuture"))]
                 let upper = None;
                 (lower, upper)
             }),
-            #[cfg(feature = "zfuture")]
+            #[cfg(zcash_unstable = "zfuture")]
             BranchId::ZFuture => params
                 .activation_height(NetworkUpgrade::ZFuture)
                 .map(|lower| (lower, None)),
@@ -609,7 +696,9 @@ pub mod testing {
             BranchId::Heartwood,
             BranchId::Canopy,
             BranchId::Nu5,
-            #[cfg(feature = "zfuture")]
+            BranchId::Nu6,
+            BranchId::Nu7,
+            #[cfg(zcash_unstable = "zfuture")]
             BranchId::ZFuture,
         ])
     }
@@ -627,15 +716,21 @@ pub mod testing {
                 )
             })
     }
+
+    #[cfg(feature = "test-dependencies")]
+    impl incrementalmerkletree_testing::TestCheckpoint for BlockHeight {
+        fn from_u64(value: u64) -> Self {
+            BlockHeight(u32::try_from(value).expect("Test checkpoint ids do not exceed 32 bits"))
+        }
+    }
 }
 
 #[cfg(test)]
 mod tests {
-    use std::convert::TryFrom;
-
     use super::{
         BlockHeight, BranchId, NetworkUpgrade, Parameters, MAIN_NETWORK, UPGRADES_IN_ORDER,
     };
+    use std::convert::TryFrom;
 
     #[test]
     fn nu_ordering() {
@@ -697,8 +792,16 @@ mod tests {
             BranchId::Nu5,
         );
         assert_eq!(
-            BranchId::for_height(&MAIN_NETWORK, BlockHeight(5_000_000)),
+            BranchId::for_height(&MAIN_NETWORK, BlockHeight(2_726_399)),
             BranchId::Nu5,
         );
+        assert_eq!(
+            BranchId::for_height(&MAIN_NETWORK, BlockHeight(2_726_400)),
+            BranchId::Nu6,
+        );
+        assert_eq!(
+            BranchId::for_height(&MAIN_NETWORK, BlockHeight(5_000_000)),
+            BranchId::Nu7,
+        );
     }
 }
diff --git a/components/zcash_protocol/src/constants.rs b/components/zcash_protocol/src/constants.rs
new file mode 100644
index 0000000000..fc56eca937
--- /dev/null
+++ b/components/zcash_protocol/src/constants.rs
@@ -0,0 +1,5 @@
+//! Network-specific Zcash constants.
+
+pub mod mainnet;
+pub mod regtest;
+pub mod testnet;
diff --git a/components/zcash_protocol/src/constants/mainnet.rs b/components/zcash_protocol/src/constants/mainnet.rs
new file mode 100644
index 0000000000..98c81caa25
--- /dev/null
+++ b/components/zcash_protocol/src/constants/mainnet.rs
@@ -0,0 +1,52 @@
+//! Constants for the Zcash main network.
+
+/// The mainnet coin type for ZEC, as defined by [SLIP 44].
+///
+/// [SLIP 44]: https://github.com/satoshilabs/slips/blob/master/slip-0044.md
+pub const COIN_TYPE: u32 = 133;
+
+/// The HRP for a Bech32-encoded mainnet Sapling [`ExtendedSpendingKey`].
+///
+/// Defined in [ZIP 32].
+///
+/// [`ExtendedSpendingKey`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/zip32/struct.ExtendedSpendingKey.html
+/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
+pub const HRP_SAPLING_EXTENDED_SPENDING_KEY: &str = "secret-extended-key-main";
+
+/// The HRP for a Bech32-encoded mainnet [`ExtendedFullViewingKey`].
+///
+/// Defined in [ZIP 32].
+///
+/// [`ExtendedFullViewingKey`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/zip32/struct.ExtendedFullViewingKey.html
+/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
+pub const HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY: &str = "zxviews";
+
+/// The HRP for a Bech32-encoded mainnet Sapling [`PaymentAddress`].
+///
+/// Defined in section 5.6.4 of the [Zcash Protocol Specification].
+///
+/// [`PaymentAddress`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/struct.PaymentAddress.html
+/// [Zcash Protocol Specification]: https://github.com/zcash/zips/blob/master/protocol/protocol.pdf
+pub const HRP_SAPLING_PAYMENT_ADDRESS: &str = "zs";
+
+/// The prefix for a Base58Check-encoded mainnet Sprout address.
+///
+/// Defined in the [Zcash Protocol Specification section 5.6.3][sproutpaymentaddrencoding].
+///
+/// [sproutpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#sproutpaymentaddrencoding
+pub const B58_SPROUT_ADDRESS_PREFIX: [u8; 2] = [0x16, 0x9a];
+
+/// The prefix for a Base58Check-encoded mainnet [`PublicKeyHash`].
+///
+/// [`PublicKeyHash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/legacy/enum.TransparentAddress.html
+pub const B58_PUBKEY_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xb8];
+
+/// The prefix for a Base58Check-encoded mainnet [`ScriptHash`].
+///
+/// [`ScriptHash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/legacy/enum.TransparentAddress.html
+pub const B58_SCRIPT_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xbd];
+
+/// The HRP for a Bech32m-encoded mainnet [ZIP 320] TEX address.
+///
+/// [ZIP 320]: https://zips.z.cash/zip-0320
+pub const HRP_TEX_ADDRESS: &str = "tex";
diff --git a/components/zcash_protocol/src/constants/regtest.rs b/components/zcash_protocol/src/constants/regtest.rs
new file mode 100644
index 0000000000..001baa7ea4
--- /dev/null
+++ b/components/zcash_protocol/src/constants/regtest.rs
@@ -0,0 +1,59 @@
+//! # Regtest constants
+//!
+//! `regtest` is a `zcashd`-specific environment used for local testing. They mostly reuse
+//! the testnet constants.
+//! These constants are defined in [the `zcashd` codebase].
+//!
+//! [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L482-L496>
+
+/// The regtest cointype reuses the testnet cointype
+pub const COIN_TYPE: u32 = 1;
+
+/// The HRP for a Bech32-encoded regtest Sapling [`ExtendedSpendingKey`].
+///
+/// It is defined in [the `zcashd` codebase].
+///
+/// [`ExtendedSpendingKey`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/zip32/struct.ExtendedSpendingKey.html
+/// [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L496>
+pub const HRP_SAPLING_EXTENDED_SPENDING_KEY: &str = "secret-extended-key-regtest";
+
+/// The HRP for a Bech32-encoded regtest Sapling [`ExtendedFullViewingKey`].
+///
+/// It is defined in [the `zcashd` codebase].
+///
+/// [`ExtendedFullViewingKey`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/zip32/struct.ExtendedFullViewingKey.html
+/// [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L494>
+pub const HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY: &str = "zxviewregtestsapling";
+
+/// The HRP for a Bech32-encoded regtest Sapling [`PaymentAddress`].
+///
+/// It is defined in [the `zcashd` codebase].
+///
+/// [`PaymentAddress`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/struct.PaymentAddress.html
+/// [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L493>
+pub const HRP_SAPLING_PAYMENT_ADDRESS: &str = "zregtestsapling";
+
+/// The prefix for a Base58Check-encoded regtest Sprout address.
+///
+/// Defined in the [Zcash Protocol Specification section 5.6.3][sproutpaymentaddrencoding].
+/// Same as the testnet prefix.
+///
+/// [sproutpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#sproutpaymentaddrencoding
+pub const B58_SPROUT_ADDRESS_PREFIX: [u8; 2] = [0x16, 0xb6];
+
+/// The prefix for a Base58Check-encoded regtest transparent [`PublicKeyHash`].
+/// Same as the testnet prefix.
+///
+/// [`PublicKeyHash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/legacy/enum.TransparentAddress.html
+pub const B58_PUBKEY_ADDRESS_PREFIX: [u8; 2] = [0x1d, 0x25];
+
+/// The prefix for a Base58Check-encoded regtest transparent [`ScriptHash`].
+/// Same as the testnet prefix.
+///
+/// [`ScriptHash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/legacy/enum.TransparentAddress.html
+pub const B58_SCRIPT_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xba];
+
+/// The HRP for a Bech32m-encoded regtest [ZIP 320] TEX address.
+///
+/// [ZIP 320]: https://zips.z.cash/zip-0320
+pub const HRP_TEX_ADDRESS: &str = "texregtest";
diff --git a/components/zcash_protocol/src/constants/testnet.rs b/components/zcash_protocol/src/constants/testnet.rs
new file mode 100644
index 0000000000..023926546e
--- /dev/null
+++ b/components/zcash_protocol/src/constants/testnet.rs
@@ -0,0 +1,52 @@
+//! Constants for the Zcash test network.
+
+/// The testnet coin type for ZEC, as defined by [SLIP 44].
+///
+/// [SLIP 44]: https://github.com/satoshilabs/slips/blob/master/slip-0044.md
+pub const COIN_TYPE: u32 = 1;
+
+/// The HRP for a Bech32-encoded testnet Sapling [`ExtendedSpendingKey`].
+///
+/// Defined in [ZIP 32].
+///
+/// [`ExtendedSpendingKey`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/zip32/struct.ExtendedSpendingKey.html
+/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
+pub const HRP_SAPLING_EXTENDED_SPENDING_KEY: &str = "secret-extended-key-test";
+
+/// The HRP for a Bech32-encoded testnet Sapling [`ExtendedFullViewingKey`].
+///
+/// Defined in [ZIP 32].
+///
+/// [`ExtendedFullViewingKey`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/zip32/struct.ExtendedFullViewingKey.html
+/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
+pub const HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY: &str = "zxviewtestsapling";
+
+/// The HRP for a Bech32-encoded testnet Sapling [`PaymentAddress`].
+///
+/// Defined in section 5.6.4 of the [Zcash Protocol Specification].
+///
+/// [`PaymentAddress`]: https://docs.rs/sapling-crypto/latest/sapling_crypto/struct.PaymentAddress.html
+/// [Zcash Protocol Specification]: https://github.com/zcash/zips/blob/master/protocol/protocol.pdf
+pub const HRP_SAPLING_PAYMENT_ADDRESS: &str = "ztestsapling";
+
+/// The prefix for a Base58Check-encoded testnet Sprout address.
+///
+/// Defined in the [Zcash Protocol Specification section 5.6.3][sproutpaymentaddrencoding].
+///
+/// [sproutpaymentaddrencoding]: https://zips.z.cash/protocol/protocol.pdf#sproutpaymentaddrencoding
+pub const B58_SPROUT_ADDRESS_PREFIX: [u8; 2] = [0x16, 0xb6];
+
+/// The prefix for a Base58Check-encoded testnet transparent [`PublicKeyHash`].
+///
+/// [`PublicKeyHash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/legacy/enum.TransparentAddress.html
+pub const B58_PUBKEY_ADDRESS_PREFIX: [u8; 2] = [0x1d, 0x25];
+
+/// The prefix for a Base58Check-encoded testnet transparent [`ScriptHash`].
+///
+/// [`ScriptHash`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/legacy/enum.TransparentAddress.html
+pub const B58_SCRIPT_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xba];
+
+/// The HRP for a Bech32m-encoded testnet [ZIP 320] TEX address.
+///
+/// [ZIP 320]: https://zips.z.cash/zip-0320
+pub const HRP_TEX_ADDRESS: &str = "textest";
diff --git a/components/zcash_protocol/src/lib.rs b/components/zcash_protocol/src/lib.rs
new file mode 100644
index 0000000000..f73564751d
--- /dev/null
+++ b/components/zcash_protocol/src/lib.rs
@@ -0,0 +1,59 @@
+//! *A crate for Zcash protocol constants and value types.*
+//!
+//! `zcash_protocol` contains Rust structs, traits and functions that provide the network constants
+//! for the Zcash main and test networks, as well types for representing ZEC amounts and value
+//! balances.
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
+
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+// Catch documentation errors caused by code changes.
+#![deny(rustdoc::broken_intra_doc_links)]
+// Temporary until we have addressed all Result<T, ()> cases.
+#![allow(clippy::result_unit_err)]
+
+use core::fmt;
+
+pub mod consensus;
+pub mod constants;
+#[cfg(feature = "local-consensus")]
+pub mod local_consensus;
+pub mod memo;
+pub mod value;
+
+/// A Zcash shielded transfer protocol.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub enum ShieldedProtocol {
+    /// The Sapling protocol
+    Sapling,
+    /// The Orchard protocol
+    Orchard,
+}
+
+/// A value pool in the Zcash protocol.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub enum PoolType {
+    /// The transparent value pool
+    Transparent,
+    /// A shielded value pool.
+    Shielded(ShieldedProtocol),
+}
+
+impl PoolType {
+    pub const TRANSPARENT: PoolType = PoolType::Transparent;
+    pub const SAPLING: PoolType = PoolType::Shielded(ShieldedProtocol::Sapling);
+    pub const ORCHARD: PoolType = PoolType::Shielded(ShieldedProtocol::Orchard);
+}
+
+impl fmt::Display for PoolType {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            PoolType::Transparent => f.write_str("Transparent"),
+            PoolType::Shielded(ShieldedProtocol::Sapling) => f.write_str("Sapling"),
+            PoolType::Shielded(ShieldedProtocol::Orchard) => f.write_str("Orchard"),
+        }
+    }
+}
diff --git a/components/zcash_protocol/src/local_consensus.rs b/components/zcash_protocol/src/local_consensus.rs
new file mode 100644
index 0000000000..115e070f45
--- /dev/null
+++ b/components/zcash_protocol/src/local_consensus.rs
@@ -0,0 +1,221 @@
+use crate::consensus::{BlockHeight, NetworkType, NetworkUpgrade, Parameters};
+
+/// a `LocalNetwork` setup should define the activation heights
+/// of network upgrades. `None` is considered as "not activated"
+/// These heights are not validated. Callers shall initialized
+/// them according to the settings used on the Full Nodes they
+/// are connecting to.
+///
+/// Example:
+///     Regtest Zcashd using the following `zcash.conf`
+///     ```
+///     ## NUPARAMS
+///     nuparams=5ba81b19:1 # Overwinter
+///     nuparams=76b809bb:1 # Sapling
+///     nuparams=2bb40e60:1 # Blossom
+///     nuparams=f5b9230b:1 # Heartwood
+///     nuparams=e9ff75a6:1 # Canopy
+///     nuparams=c2d6d0b4:1 # NU5
+///     nuparams=c8e71055:1 # NU6
+///     ```
+///     would use the following `LocalNetwork` struct
+///     ```
+///     let regtest = LocalNetwork {
+///         overwinter: Some(BlockHeight::from_u32(1)),
+///         sapling: Some(BlockHeight::from_u32(1)),
+///         blossom: Some(BlockHeight::from_u32(1)),
+///         heartwood: Some(BlockHeight::from_u32(1)),
+///         canopy: Some(BlockHeight::from_u32(1)),
+///         nu5: Some(BlockHeight::from_u32(1)),
+///         nu6: Some(BlockHeight::from_u32(1)),
+///     };
+///     ```
+///     
+#[derive(Clone, PartialEq, Eq, Copy, Debug, Hash)]
+pub struct LocalNetwork {
+    pub overwinter: Option<BlockHeight>,
+    pub sapling: Option<BlockHeight>,
+    pub blossom: Option<BlockHeight>,
+    pub heartwood: Option<BlockHeight>,
+    pub canopy: Option<BlockHeight>,
+    pub nu5: Option<BlockHeight>,
+    pub nu6: Option<BlockHeight>,
+    pub nu7: Option<BlockHeight>,
+    #[cfg(zcash_unstable = "zfuture")]
+    pub z_future: Option<BlockHeight>,
+}
+
+/// Parameters implementation for `LocalNetwork`
+impl Parameters for LocalNetwork {
+    fn network_type(&self) -> NetworkType {
+        NetworkType::Regtest
+    }
+
+    fn activation_height(&self, nu: NetworkUpgrade) -> Option<BlockHeight> {
+        match nu {
+            NetworkUpgrade::Overwinter => self.overwinter,
+            NetworkUpgrade::Sapling => self.sapling,
+            NetworkUpgrade::Blossom => self.blossom,
+            NetworkUpgrade::Heartwood => self.heartwood,
+            NetworkUpgrade::Canopy => self.canopy,
+            NetworkUpgrade::Nu5 => self.nu5,
+            NetworkUpgrade::Nu6 => self.nu6,
+            NetworkUpgrade::Nu7 => self.nu7,
+            #[cfg(zcash_unstable = "zfuture")]
+            NetworkUpgrade::ZFuture => self.z_future,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{
+        consensus::{BlockHeight, NetworkConstants, NetworkUpgrade, Parameters},
+        constants,
+        local_consensus::LocalNetwork,
+    };
+
+    #[test]
+    fn regtest_nu_activation() {
+        let expected_overwinter = BlockHeight::from_u32(1);
+        let expected_sapling = BlockHeight::from_u32(2);
+        let expected_blossom = BlockHeight::from_u32(3);
+        let expected_heartwood = BlockHeight::from_u32(4);
+        let expected_canopy = BlockHeight::from_u32(5);
+        let expected_nu5 = BlockHeight::from_u32(6);
+        let expected_nu6 = BlockHeight::from_u32(7);
+        let expected_nu7 = BlockHeight::from_u32(8);
+        #[cfg(zcash_unstable = "zfuture")]
+        let expected_z_future = BlockHeight::from_u32(8);
+
+        let regtest = LocalNetwork {
+            overwinter: Some(expected_overwinter),
+            sapling: Some(expected_sapling),
+            blossom: Some(expected_blossom),
+            heartwood: Some(expected_heartwood),
+            canopy: Some(expected_canopy),
+            nu5: Some(expected_nu5),
+            nu6: Some(expected_nu6),
+            nu7: Some(expected_nu7),
+            #[cfg(zcash_unstable = "zfuture")]
+            z_future: Some(expected_z_future),
+        };
+
+        assert!(regtest.is_nu_active(NetworkUpgrade::Overwinter, expected_overwinter));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Sapling, expected_sapling));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Blossom, expected_blossom));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Heartwood, expected_heartwood));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Canopy, expected_canopy));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Nu5, expected_nu5));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Nu6, expected_nu6));
+        assert!(regtest.is_nu_active(NetworkUpgrade::Nu7, expected_nu7));
+        #[cfg(zcash_unstable = "zfuture")]
+        assert!(!regtest.is_nu_active(NetworkUpgrade::ZFuture, expected_nu5));
+    }
+
+    #[test]
+    fn regtest_activation_heights() {
+        let expected_overwinter = BlockHeight::from_u32(1);
+        let expected_sapling = BlockHeight::from_u32(2);
+        let expected_blossom = BlockHeight::from_u32(3);
+        let expected_heartwood = BlockHeight::from_u32(4);
+        let expected_canopy = BlockHeight::from_u32(5);
+        let expected_nu5 = BlockHeight::from_u32(6);
+        let expected_nu6 = BlockHeight::from_u32(7);
+        let expected_nu7 = BlockHeight::from_u32(8);
+        #[cfg(zcash_unstable = "zfuture")]
+        let expected_z_future = BlockHeight::from_u32(8);
+
+        let regtest = LocalNetwork {
+            overwinter: Some(expected_overwinter),
+            sapling: Some(expected_sapling),
+            blossom: Some(expected_blossom),
+            heartwood: Some(expected_heartwood),
+            canopy: Some(expected_canopy),
+            nu5: Some(expected_nu5),
+            nu6: Some(expected_nu6),
+            nu7: Some(expected_nu7),
+            #[cfg(zcash_unstable = "zfuture")]
+            z_future: Some(expected_z_future),
+        };
+
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::Overwinter),
+            Some(expected_overwinter)
+        );
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::Sapling),
+            Some(expected_sapling)
+        );
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::Blossom),
+            Some(expected_blossom)
+        );
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::Heartwood),
+            Some(expected_heartwood)
+        );
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::Canopy),
+            Some(expected_canopy)
+        );
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::Nu5),
+            Some(expected_nu5)
+        );
+        #[cfg(zcash_unstable = "zfuture")]
+        assert_eq!(
+            regtest.activation_height(NetworkUpgrade::ZFuture),
+            Some(expected_z_future)
+        );
+    }
+
+    #[test]
+    fn regtests_constants() {
+        let expected_overwinter = BlockHeight::from_u32(1);
+        let expected_sapling = BlockHeight::from_u32(2);
+        let expected_blossom = BlockHeight::from_u32(3);
+        let expected_heartwood = BlockHeight::from_u32(4);
+        let expected_canopy = BlockHeight::from_u32(5);
+        let expected_nu5 = BlockHeight::from_u32(6);
+        let expected_nu6 = BlockHeight::from_u32(7);
+        let expected_nu7 = BlockHeight::from_u32(8);
+        #[cfg(zcash_unstable = "zfuture")]
+        let expected_z_future = BlockHeight::from_u32(8);
+
+        let regtest = LocalNetwork {
+            overwinter: Some(expected_overwinter),
+            sapling: Some(expected_sapling),
+            blossom: Some(expected_blossom),
+            heartwood: Some(expected_heartwood),
+            canopy: Some(expected_canopy),
+            nu5: Some(expected_nu5),
+            nu6: Some(expected_nu6),
+            nu7: Some(expected_nu7),
+            #[cfg(zcash_unstable = "zfuture")]
+            z_future: Some(expected_z_future),
+        };
+
+        assert_eq!(regtest.coin_type(), constants::regtest::COIN_TYPE);
+        assert_eq!(
+            regtest.hrp_sapling_extended_spending_key(),
+            constants::regtest::HRP_SAPLING_EXTENDED_SPENDING_KEY
+        );
+        assert_eq!(
+            regtest.hrp_sapling_extended_full_viewing_key(),
+            constants::regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY
+        );
+        assert_eq!(
+            regtest.hrp_sapling_payment_address(),
+            constants::regtest::HRP_SAPLING_PAYMENT_ADDRESS
+        );
+        assert_eq!(
+            regtest.b58_pubkey_address_prefix(),
+            constants::regtest::B58_PUBKEY_ADDRESS_PREFIX
+        );
+        assert_eq!(
+            regtest.b58_script_address_prefix(),
+            constants::regtest::B58_SCRIPT_ADDRESS_PREFIX
+        );
+    }
+}
diff --git a/zcash_primitives/src/memo.rs b/components/zcash_protocol/src/memo.rs
similarity index 97%
rename from zcash_primitives/src/memo.rs
rename to components/zcash_protocol/src/memo.rs
index 8143eec69d..10258a52d9 100644
--- a/zcash_primitives/src/memo.rs
+++ b/components/zcash_protocol/src/memo.rs
@@ -28,7 +28,7 @@ where
 }
 
 /// Errors that may result from attempting to construct an invalid memo.
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum Error {
     InvalidUtf8(std::str::Utf8Error),
     TooLong(usize),
@@ -144,9 +144,10 @@ impl Deref for TextMemo {
 }
 
 /// An unencrypted memo received alongside a shielded note in a Zcash transaction.
-#[derive(Clone)]
+#[derive(Clone, Default)]
 pub enum Memo {
     /// An empty memo field.
+    #[default]
     Empty,
     /// A memo field containing a UTF-8 string.
     Text(TextMemo),
@@ -171,12 +172,6 @@ impl fmt::Debug for Memo {
     }
 }
 
-impl Default for Memo {
-    fn default() -> Self {
-        Memo::Empty
-    }
-}
-
 impl PartialEq for Memo {
     fn eq(&self, rhs: &Memo) -> bool {
         match (self, rhs) {
@@ -197,13 +192,25 @@ impl TryFrom<MemoBytes> for Memo {
     /// Returns an error if the provided slice does not represent a valid `Memo` (for
     /// example, if the slice is not 512 bytes, or the encoded `Memo` is non-canonical).
     fn try_from(bytes: MemoBytes) -> Result<Self, Self::Error> {
+        Self::try_from(&bytes)
+    }
+}
+
+impl TryFrom<&MemoBytes> for Memo {
+    type Error = Error;
+
+    /// Parses a `Memo` from its ZIP 302 serialization.
+    ///
+    /// Returns an error if the provided slice does not represent a valid `Memo` (for
+    /// example, if the slice is not 512 bytes, or the encoded `Memo` is non-canonical).
+    fn try_from(bytes: &MemoBytes) -> Result<Self, Self::Error> {
         match bytes.0[0] {
             0xF6 if bytes.0.iter().skip(1).all(|&b| b == 0) => Ok(Memo::Empty),
             0xFF => Ok(Memo::Arbitrary(Box::new(bytes.0[1..].try_into().unwrap()))),
             b if b <= 0xF4 => str::from_utf8(bytes.as_slice())
                 .map(|r| Memo::Text(TextMemo(r.to_owned())))
                 .map_err(Error::InvalidUtf8),
-            _ => Ok(Memo::Future(bytes)),
+            _ => Ok(Memo::Future(bytes.clone())),
         }
     }
 }
diff --git a/components/zcash_protocol/src/value.rs b/components/zcash_protocol/src/value.rs
new file mode 100644
index 0000000000..e7e5001dbc
--- /dev/null
+++ b/components/zcash_protocol/src/value.rs
@@ -0,0 +1,569 @@
+use std::convert::{Infallible, TryFrom};
+use std::error;
+use std::iter::Sum;
+use std::num::NonZeroU64;
+use std::ops::{Add, Div, Mul, Neg, Sub};
+
+use memuse::DynamicUsage;
+
+pub const COIN: u64 = 1_0000_0000;
+pub const MAX_MONEY: u64 = 21_000_000 * COIN;
+pub const MAX_BALANCE: i64 = MAX_MONEY as i64;
+
+/// A type-safe representation of a Zcash value delta, in zatoshis.
+///
+/// An ZatBalance can only be constructed from an integer that is within the valid monetary
+/// range of `{-MAX_MONEY..MAX_MONEY}` (where `MAX_MONEY` = 21,000,000 × 10⁸ zatoshis),
+/// and this is preserved as an invariant internally. (A [`Transaction`] containing serialized
+/// invalid ZatBalances would also be rejected by the network consensus rules.)
+///
+/// [`Transaction`]: https://docs.rs/zcash_primitives/latest/zcash_primitives/transaction/struct.Transaction.html
+#[derive(Clone, Copy, Debug, PartialEq, PartialOrd, Eq, Ord)]
+pub struct ZatBalance(i64);
+
+memuse::impl_no_dynamic_usage!(ZatBalance);
+
+impl ZatBalance {
+    /// Returns a zero-valued ZatBalance.
+    pub const fn zero() -> Self {
+        ZatBalance(0)
+    }
+
+    /// Creates a constant ZatBalance from an i64.
+    ///
+    /// Panics: if the amount is outside the range `{-MAX_BALANCE..MAX_BALANCE}`.
+    pub const fn const_from_i64(amount: i64) -> Self {
+        assert!(-MAX_BALANCE <= amount && amount <= MAX_BALANCE); // contains is not const
+        ZatBalance(amount)
+    }
+
+    /// Creates a constant ZatBalance from a u64.
+    ///
+    /// Panics: if the amount is outside the range `{0..MAX_BALANCE}`.
+    pub const fn const_from_u64(amount: u64) -> Self {
+        assert!(amount <= MAX_MONEY); // contains is not const
+        ZatBalance(amount as i64)
+    }
+
+    /// Creates an ZatBalance from an i64.
+    ///
+    /// Returns an error if the amount is outside the range `{-MAX_BALANCE..MAX_BALANCE}`.
+    pub fn from_i64(amount: i64) -> Result<Self, BalanceError> {
+        if (-MAX_BALANCE..=MAX_BALANCE).contains(&amount) {
+            Ok(ZatBalance(amount))
+        } else if amount < -MAX_BALANCE {
+            Err(BalanceError::Underflow)
+        } else {
+            Err(BalanceError::Overflow)
+        }
+    }
+
+    /// Creates a non-negative ZatBalance from an i64.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_BALANCE}`.
+    pub fn from_nonnegative_i64(amount: i64) -> Result<Self, BalanceError> {
+        if (0..=MAX_BALANCE).contains(&amount) {
+            Ok(ZatBalance(amount))
+        } else if amount < 0 {
+            Err(BalanceError::Underflow)
+        } else {
+            Err(BalanceError::Overflow)
+        }
+    }
+
+    /// Creates an ZatBalance from a u64.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
+    pub fn from_u64(amount: u64) -> Result<Self, BalanceError> {
+        if amount <= MAX_MONEY {
+            Ok(ZatBalance(amount as i64))
+        } else {
+            Err(BalanceError::Overflow)
+        }
+    }
+
+    /// Reads an ZatBalance from a signed 64-bit little-endian integer.
+    ///
+    /// Returns an error if the amount is outside the range `{-MAX_BALANCE..MAX_BALANCE}`.
+    pub fn from_i64_le_bytes(bytes: [u8; 8]) -> Result<Self, BalanceError> {
+        let amount = i64::from_le_bytes(bytes);
+        ZatBalance::from_i64(amount)
+    }
+
+    /// Reads a non-negative ZatBalance from a signed 64-bit little-endian integer.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_BALANCE}`.
+    pub fn from_nonnegative_i64_le_bytes(bytes: [u8; 8]) -> Result<Self, BalanceError> {
+        let amount = i64::from_le_bytes(bytes);
+        ZatBalance::from_nonnegative_i64(amount)
+    }
+
+    /// Reads an ZatBalance from an unsigned 64-bit little-endian integer.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_BALANCE}`.
+    pub fn from_u64_le_bytes(bytes: [u8; 8]) -> Result<Self, BalanceError> {
+        let amount = u64::from_le_bytes(bytes);
+        ZatBalance::from_u64(amount)
+    }
+
+    /// Returns the ZatBalance encoded as a signed 64-bit little-endian integer.
+    pub fn to_i64_le_bytes(self) -> [u8; 8] {
+        self.0.to_le_bytes()
+    }
+
+    /// Returns `true` if `self` is positive and `false` if the ZatBalance is zero or
+    /// negative.
+    pub const fn is_positive(self) -> bool {
+        self.0.is_positive()
+    }
+
+    /// Returns `true` if `self` is negative and `false` if the ZatBalance is zero or
+    /// positive.
+    pub const fn is_negative(self) -> bool {
+        self.0.is_negative()
+    }
+
+    pub fn sum<I: IntoIterator<Item = ZatBalance>>(values: I) -> Option<ZatBalance> {
+        let mut result = ZatBalance::zero();
+        for value in values {
+            result = (result + value)?;
+        }
+        Some(result)
+    }
+}
+
+impl TryFrom<i64> for ZatBalance {
+    type Error = BalanceError;
+
+    fn try_from(value: i64) -> Result<Self, BalanceError> {
+        ZatBalance::from_i64(value)
+    }
+}
+
+impl From<ZatBalance> for i64 {
+    fn from(amount: ZatBalance) -> i64 {
+        amount.0
+    }
+}
+
+impl From<&ZatBalance> for i64 {
+    fn from(amount: &ZatBalance) -> i64 {
+        amount.0
+    }
+}
+
+impl TryFrom<ZatBalance> for u64 {
+    type Error = BalanceError;
+
+    fn try_from(value: ZatBalance) -> Result<Self, Self::Error> {
+        value.0.try_into().map_err(|_| BalanceError::Underflow)
+    }
+}
+
+impl Add<ZatBalance> for ZatBalance {
+    type Output = Option<ZatBalance>;
+
+    fn add(self, rhs: ZatBalance) -> Option<ZatBalance> {
+        ZatBalance::from_i64(self.0 + rhs.0).ok()
+    }
+}
+
+impl Add<ZatBalance> for Option<ZatBalance> {
+    type Output = Self;
+
+    fn add(self, rhs: ZatBalance) -> Option<ZatBalance> {
+        self.and_then(|lhs| lhs + rhs)
+    }
+}
+
+impl Sub<ZatBalance> for ZatBalance {
+    type Output = Option<ZatBalance>;
+
+    fn sub(self, rhs: ZatBalance) -> Option<ZatBalance> {
+        ZatBalance::from_i64(self.0 - rhs.0).ok()
+    }
+}
+
+impl Sub<ZatBalance> for Option<ZatBalance> {
+    type Output = Self;
+
+    fn sub(self, rhs: ZatBalance) -> Option<ZatBalance> {
+        self.and_then(|lhs| lhs - rhs)
+    }
+}
+
+impl Sum<ZatBalance> for Option<ZatBalance> {
+    fn sum<I: Iterator<Item = ZatBalance>>(mut iter: I) -> Self {
+        iter.try_fold(ZatBalance::zero(), |acc, a| acc + a)
+    }
+}
+
+impl<'a> Sum<&'a ZatBalance> for Option<ZatBalance> {
+    fn sum<I: Iterator<Item = &'a ZatBalance>>(mut iter: I) -> Self {
+        iter.try_fold(ZatBalance::zero(), |acc, a| acc + *a)
+    }
+}
+
+impl Neg for ZatBalance {
+    type Output = Self;
+
+    fn neg(self) -> Self {
+        ZatBalance(-self.0)
+    }
+}
+
+impl Mul<usize> for ZatBalance {
+    type Output = Option<ZatBalance>;
+
+    fn mul(self, rhs: usize) -> Option<ZatBalance> {
+        let rhs: i64 = rhs.try_into().ok()?;
+        self.0
+            .checked_mul(rhs)
+            .and_then(|i| ZatBalance::try_from(i).ok())
+    }
+}
+
+/// A type-safe representation of some nonnegative amount of Zcash.
+///
+/// A Zatoshis can only be constructed from an integer that is within the valid monetary
+/// range of `{0..MAX_MONEY}` (where `MAX_MONEY` = 21,000,000 × 10⁸ zatoshis).
+#[derive(Clone, Copy, Debug, PartialEq, PartialOrd, Eq, Ord)]
+pub struct Zatoshis(u64);
+
+/// A struct that provides both the quotient and remainder of a division operation.
+pub struct QuotRem<A> {
+    quotient: A,
+    remainder: A,
+}
+
+impl<A> QuotRem<A> {
+    /// Returns the quotient portion of the value.
+    pub fn quotient(&self) -> &A {
+        &self.quotient
+    }
+
+    /// Returns the remainder portion of the value.
+    pub fn remainder(&self) -> &A {
+        &self.remainder
+    }
+}
+
+impl Zatoshis {
+    /// Returns the identity `Zatoshis`
+    pub const ZERO: Self = Zatoshis(0);
+
+    /// Returns this Zatoshis as a u64.
+    pub fn into_u64(self) -> u64 {
+        self.0
+    }
+
+    /// Creates a Zatoshis from a u64.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
+    pub fn from_u64(amount: u64) -> Result<Self, BalanceError> {
+        if (0..=MAX_MONEY).contains(&amount) {
+            Ok(Zatoshis(amount))
+        } else {
+            Err(BalanceError::Overflow)
+        }
+    }
+
+    /// Creates a constant Zatoshis from a u64.
+    ///
+    /// Panics: if the amount is outside the range `{0..MAX_MONEY}`.
+    pub const fn const_from_u64(amount: u64) -> Self {
+        assert!(amount <= MAX_MONEY); // contains is not const
+        Zatoshis(amount)
+    }
+
+    /// Creates a Zatoshis from an i64.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
+    pub fn from_nonnegative_i64(amount: i64) -> Result<Self, BalanceError> {
+        u64::try_from(amount)
+            .map_err(|_| BalanceError::Underflow)
+            .and_then(Self::from_u64)
+    }
+
+    /// Reads an Zatoshis from an unsigned 64-bit little-endian integer.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
+    pub fn from_u64_le_bytes(bytes: [u8; 8]) -> Result<Self, BalanceError> {
+        let amount = u64::from_le_bytes(bytes);
+        Self::from_u64(amount)
+    }
+
+    /// Reads a Zatoshis from a signed integer represented as a two's
+    /// complement 64-bit little-endian value.
+    ///
+    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
+    pub fn from_nonnegative_i64_le_bytes(bytes: [u8; 8]) -> Result<Self, BalanceError> {
+        let amount = i64::from_le_bytes(bytes);
+        Self::from_nonnegative_i64(amount)
+    }
+
+    /// Returns this Zatoshis encoded as a signed two's complement 64-bit
+    /// little-endian value.
+    pub fn to_i64_le_bytes(self) -> [u8; 8] {
+        (self.0 as i64).to_le_bytes()
+    }
+
+    /// Returns whether or not this `Zatoshis` is the zero value.
+    pub fn is_zero(&self) -> bool {
+        self == &Zatoshis::ZERO
+    }
+
+    /// Returns whether or not this `Zatoshis` is positive.
+    pub fn is_positive(&self) -> bool {
+        self > &Zatoshis::ZERO
+    }
+
+    /// Divides this `Zatoshis` value by the given divisor and returns the quotient and remainder.
+    pub fn div_with_remainder(&self, divisor: NonZeroU64) -> QuotRem<Zatoshis> {
+        let divisor = u64::from(divisor);
+        // `self` is already bounds-checked, and both the quotient and remainder
+        // are <= self, so we don't need to re-check them in division.
+        QuotRem {
+            quotient: Zatoshis(self.0 / divisor),
+            remainder: Zatoshis(self.0 % divisor),
+        }
+    }
+}
+
+impl From<Zatoshis> for ZatBalance {
+    fn from(n: Zatoshis) -> Self {
+        ZatBalance(n.0 as i64)
+    }
+}
+
+impl From<&Zatoshis> for ZatBalance {
+    fn from(n: &Zatoshis) -> Self {
+        ZatBalance(n.0 as i64)
+    }
+}
+
+impl From<Zatoshis> for u64 {
+    fn from(n: Zatoshis) -> Self {
+        n.into_u64()
+    }
+}
+
+impl TryFrom<u64> for Zatoshis {
+    type Error = BalanceError;
+
+    fn try_from(value: u64) -> Result<Self, Self::Error> {
+        Zatoshis::from_u64(value)
+    }
+}
+
+impl TryFrom<ZatBalance> for Zatoshis {
+    type Error = BalanceError;
+
+    fn try_from(value: ZatBalance) -> Result<Self, Self::Error> {
+        Zatoshis::from_nonnegative_i64(value.0)
+    }
+}
+
+impl Add<Zatoshis> for Zatoshis {
+    type Output = Option<Zatoshis>;
+
+    fn add(self, rhs: Zatoshis) -> Option<Zatoshis> {
+        Self::from_u64(self.0.checked_add(rhs.0)?).ok()
+    }
+}
+
+impl Add<Zatoshis> for Option<Zatoshis> {
+    type Output = Self;
+
+    fn add(self, rhs: Zatoshis) -> Option<Zatoshis> {
+        self.and_then(|lhs| lhs + rhs)
+    }
+}
+
+impl Sub<Zatoshis> for Zatoshis {
+    type Output = Option<Zatoshis>;
+
+    fn sub(self, rhs: Zatoshis) -> Option<Zatoshis> {
+        Zatoshis::from_u64(self.0.checked_sub(rhs.0)?).ok()
+    }
+}
+
+impl Sub<Zatoshis> for Option<Zatoshis> {
+    type Output = Self;
+
+    fn sub(self, rhs: Zatoshis) -> Option<Zatoshis> {
+        self.and_then(|lhs| lhs - rhs)
+    }
+}
+
+impl Mul<u64> for Zatoshis {
+    type Output = Option<Self>;
+
+    fn mul(self, rhs: u64) -> Option<Zatoshis> {
+        Zatoshis::from_u64(self.0.checked_mul(rhs)?).ok()
+    }
+}
+
+impl Mul<usize> for Zatoshis {
+    type Output = Option<Self>;
+
+    fn mul(self, rhs: usize) -> Option<Zatoshis> {
+        self * u64::try_from(rhs).ok()?
+    }
+}
+
+impl Sum<Zatoshis> for Option<Zatoshis> {
+    fn sum<I: Iterator<Item = Zatoshis>>(mut iter: I) -> Self {
+        iter.try_fold(Zatoshis::ZERO, |acc, a| acc + a)
+    }
+}
+
+impl<'a> Sum<&'a Zatoshis> for Option<Zatoshis> {
+    fn sum<I: Iterator<Item = &'a Zatoshis>>(mut iter: I) -> Self {
+        iter.try_fold(Zatoshis::ZERO, |acc, a| acc + *a)
+    }
+}
+
+impl Div<NonZeroU64> for Zatoshis {
+    type Output = Zatoshis;
+
+    fn div(self, rhs: NonZeroU64) -> Zatoshis {
+        // `self` is already bounds-checked and the quotient is <= self, so
+        // we don't need to re-check it
+        Zatoshis(self.0 / u64::from(rhs))
+    }
+}
+
+/// A type for balance violations in amount addition and subtraction
+/// (overflow and underflow of allowed ranges)
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum BalanceError {
+    Overflow,
+    Underflow,
+}
+
+impl error::Error for BalanceError {}
+
+impl std::fmt::Display for BalanceError {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        match &self {
+            BalanceError::Overflow => {
+                write!(
+                    f,
+                    "ZatBalance addition resulted in a value outside the valid range."
+                )
+            }
+            BalanceError::Underflow => write!(
+                f,
+                "ZatBalance subtraction resulted in a value outside the valid range."
+            ),
+        }
+    }
+}
+
+impl From<Infallible> for BalanceError {
+    fn from(_value: Infallible) -> Self {
+        unreachable!()
+    }
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod testing {
+    use proptest::prelude::prop_compose;
+
+    use super::{ZatBalance, Zatoshis, MAX_BALANCE, MAX_MONEY};
+
+    prop_compose! {
+        pub fn arb_zat_balance()(amt in -MAX_BALANCE..MAX_BALANCE) -> ZatBalance {
+            ZatBalance::from_i64(amt).unwrap()
+        }
+    }
+
+    prop_compose! {
+        pub fn arb_positive_zat_balance()(amt in 1i64..MAX_BALANCE) -> ZatBalance {
+            ZatBalance::from_i64(amt).unwrap()
+        }
+    }
+
+    prop_compose! {
+        pub fn arb_nonnegative_zat_balance()(amt in 0i64..MAX_BALANCE) -> ZatBalance {
+            ZatBalance::from_i64(amt).unwrap()
+        }
+    }
+
+    prop_compose! {
+        pub fn arb_zatoshis()(amt in 0u64..MAX_MONEY) -> Zatoshis {
+            Zatoshis::from_u64(amt).unwrap()
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::value::MAX_BALANCE;
+
+    use super::ZatBalance;
+
+    #[test]
+    fn amount_in_range() {
+        let zero = b"\x00\x00\x00\x00\x00\x00\x00\x00";
+        assert_eq!(ZatBalance::from_u64_le_bytes(*zero).unwrap(), ZatBalance(0));
+        assert_eq!(
+            ZatBalance::from_nonnegative_i64_le_bytes(*zero).unwrap(),
+            ZatBalance(0)
+        );
+        assert_eq!(ZatBalance::from_i64_le_bytes(*zero).unwrap(), ZatBalance(0));
+
+        let neg_one = b"\xff\xff\xff\xff\xff\xff\xff\xff";
+        assert!(ZatBalance::from_u64_le_bytes(*neg_one).is_err());
+        assert!(ZatBalance::from_nonnegative_i64_le_bytes(*neg_one).is_err());
+        assert_eq!(
+            ZatBalance::from_i64_le_bytes(*neg_one).unwrap(),
+            ZatBalance(-1)
+        );
+
+        let max_money = b"\x00\x40\x07\x5a\xf0\x75\x07\x00";
+        assert_eq!(
+            ZatBalance::from_u64_le_bytes(*max_money).unwrap(),
+            ZatBalance(MAX_BALANCE)
+        );
+        assert_eq!(
+            ZatBalance::from_nonnegative_i64_le_bytes(*max_money).unwrap(),
+            ZatBalance(MAX_BALANCE)
+        );
+        assert_eq!(
+            ZatBalance::from_i64_le_bytes(*max_money).unwrap(),
+            ZatBalance(MAX_BALANCE)
+        );
+
+        let max_money_p1 = b"\x01\x40\x07\x5a\xf0\x75\x07\x00";
+        assert!(ZatBalance::from_u64_le_bytes(*max_money_p1).is_err());
+        assert!(ZatBalance::from_nonnegative_i64_le_bytes(*max_money_p1).is_err());
+        assert!(ZatBalance::from_i64_le_bytes(*max_money_p1).is_err());
+
+        let neg_max_money = b"\x00\xc0\xf8\xa5\x0f\x8a\xf8\xff";
+        assert!(ZatBalance::from_u64_le_bytes(*neg_max_money).is_err());
+        assert!(ZatBalance::from_nonnegative_i64_le_bytes(*neg_max_money).is_err());
+        assert_eq!(
+            ZatBalance::from_i64_le_bytes(*neg_max_money).unwrap(),
+            ZatBalance(-MAX_BALANCE)
+        );
+
+        let neg_max_money_m1 = b"\xff\xbf\xf8\xa5\x0f\x8a\xf8\xff";
+        assert!(ZatBalance::from_u64_le_bytes(*neg_max_money_m1).is_err());
+        assert!(ZatBalance::from_nonnegative_i64_le_bytes(*neg_max_money_m1).is_err());
+        assert!(ZatBalance::from_i64_le_bytes(*neg_max_money_m1).is_err());
+    }
+
+    #[test]
+    fn add_overflow() {
+        let v = ZatBalance(MAX_BALANCE);
+        assert_eq!(v + ZatBalance(1), None)
+    }
+
+    #[test]
+    fn sub_underflow() {
+        let v = ZatBalance(-MAX_BALANCE);
+        assert_eq!(v - ZatBalance(1), None)
+    }
+}
diff --git a/components/zip321/CHANGELOG.md b/components/zip321/CHANGELOG.md
new file mode 100644
index 0000000000..d1c0d8c97d
--- /dev/null
+++ b/components/zip321/CHANGELOG.md
@@ -0,0 +1,48 @@
+# Changelog
+All notable changes to this library will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this library adheres to Rust's notion of
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Changed
+- MSRV is now 1.77.0.
+
+## [0.2.0] 2024-10-04
+
+### Changed
+- Migrated to `zcash_address 0.6`
+
+## [0.1.0] 2024-08-20
+
+The contents of this crate were factored out from `zcash_client_backend` to
+provide a better separation of concerns and simpler integration with WASM
+builds. The entries below are relative to the `zcash_client_backend` crate as
+of `zcash_client_backend-0.10.0`.
+
+### Added
+- `zip321::Payment::new`
+- `impl From<zcash_address:ConversionError<E>> for Zip321Error`
+
+### Changed
+- Fields of `zip321::Payment` are now private. Accessors have been provided for
+  the fields that are no longer public, and `Payment::new` has been added to
+  serve the needs of payment construction.
+- `zip321::Payment::recipient_address()` returns `zcash_address::ZcashAddress`
+- `zip321::Payment::without_memo` now takes a `zcash_address::ZcashAddress` for
+  its `recipient_address` argument.
+- Uses of `zcash_primitives::transaction::components::amount::NonNegartiveAmount`
+  have been replace with `zcash_protocol::value::Zatoshis`. Also, some incorrect
+  uses of the signed `zcash_primitives::transaction::components::Amount`
+  type have been corrected via replacement with the `Zatoshis` type.
+- The following methods that previously required a 
+  `zcash_primitives::consensus::Parameters` argument to facilitate address
+  parsing no longer take such an argument.
+  - `zip321::TransactionRequest::{to_uri, from_uri}`
+  - `zip321::render::addr_param`
+  - `zip321::parse::{lead_addr, zcashparam}`
+- `zip321::Param::Memo` now boxes its argument.
+- `zip321::Param::Addr` now wraps a `zcash_address::ZcashAddress`
+- MSRV is now 1.70.0.
diff --git a/components/zip321/Cargo.toml b/components/zip321/Cargo.toml
new file mode 100644
index 0000000000..be67284a39
--- /dev/null
+++ b/components/zip321/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "zip321"
+description = "Parsing functions and data types for Zcash ZIP 321 Payment Request URIs"
+version = "0.2.0"
+authors = [
+    "Kris Nuttycombe <kris@electriccoin.co>"
+]
+homepage = "https://github.com/zcash/librustzcash"
+repository.workspace = true
+readme = "README.md"
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
+
+[dependencies]
+zcash_address.workspace = true
+zcash_protocol.workspace = true
+
+# - Parsing and Encoding
+nom = "7"
+base64.workspace = true
+percent-encoding.workspace = true
+
+# - Test dependencies
+proptest = { workspace = true, optional = true }
+
+[dev-dependencies]
+zcash_address = { workspace = true, features = ["test-dependencies"] }
+zcash_protocol = { workspace = true, features = ["test-dependencies"] }
+proptest.workspace = true
+
+[features]
+## Exposes APIs that are useful for testing, such as `proptest` strategies.
+test-dependencies = ["dep:proptest"]
diff --git a/components/zip321/LICENSE-APACHE b/components/zip321/LICENSE-APACHE
new file mode 100644
index 0000000000..1e5006dc14
--- /dev/null
+++ b/components/zip321/LICENSE-APACHE
@@ -0,0 +1,202 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
diff --git a/components/zip321/LICENSE-MIT b/components/zip321/LICENSE-MIT
new file mode 100644
index 0000000000..35ad1aa6e9
--- /dev/null
+++ b/components/zip321/LICENSE-MIT
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017-2024 Electric Coin Company
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/components/zip321/README.md b/components/zip321/README.md
new file mode 100644
index 0000000000..bccff5b0ad
--- /dev/null
+++ b/components/zip321/README.md
@@ -0,0 +1,22 @@
+# zip321
+
+This library contains Rust parsing functions and data types for working with
+Zcash ZIP 321 Payment Request URIs.
+
+## License
+
+Licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
+
diff --git a/zcash_client_backend/src/zip321.rs b/components/zip321/src/lib.rs
similarity index 55%
rename from zcash_client_backend/src/zip321.rs
rename to components/zip321/src/lib.rs
index a26c3cdf48..42b81fb786 100644
--- a/zcash_client_backend/src/zip321.rs
+++ b/components/zip321/src/lib.rs
@@ -1,30 +1,30 @@
 //! Reference implementation of the ZIP-321 standard for payment requests.
 //!
-//! This module provides data structures, parsing, and rendering functions
+//! This crate provides data structures, parsing, and rendering functions
 //! for interpreting and producing valid ZIP 321 URIs.
 //!
 //! The specification for ZIP 321 URIs may be found at <https://zips.z.cash/zip-0321>
 use core::fmt::Debug;
-use std::collections::HashMap;
+use std::{
+    collections::BTreeMap,
+    fmt::{self, Display},
+};
 
 use base64::{prelude::BASE64_URL_SAFE_NO_PAD, Engine};
 use nom::{
     character::complete::char, combinator::all_consuming, multi::separated_list0,
     sequence::preceded,
 };
-use zcash_primitives::{
-    consensus,
+
+use zcash_address::{ConversionError, ZcashAddress};
+use zcash_protocol::{
     memo::{self, MemoBytes},
-    transaction::components::Amount,
+    value::BalanceError,
+    value::Zatoshis,
 };
 
-#[cfg(any(test, feature = "test-dependencies"))]
-use std::cmp::Ordering;
-
-use crate::address::RecipientAddress;
-
 /// Errors that may be produced in decoding of payment requests.
-#[derive(Debug)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum Zip321Error {
     /// A memo field in the ZIP 321 URI was not properly base-64 encoded
     InvalidBase64(base64::DecodeError),
@@ -45,16 +45,67 @@ pub enum Zip321Error {
     ParseError(String),
 }
 
+impl<E: Display> From<ConversionError<E>> for Zip321Error {
+    fn from(value: ConversionError<E>) -> Self {
+        Zip321Error::ParseError(format!("Address parsing failed: {}", value))
+    }
+}
+
+impl Display for Zip321Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Zip321Error::InvalidBase64(err) => {
+                write!(f, "Memo value was not correctly base64-encoded: {:?}", err)
+            }
+            Zip321Error::MemoBytesError(err) => write!(
+                f,
+                "Memo exceeded maximum length or violated UTF-8 encoding restrictions: {:?}",
+                err
+            ),
+            Zip321Error::TooManyPayments(n) => write!(
+                f,
+                "Cannot create a Zcash transaction containing {} payments",
+                n
+            ),
+            Zip321Error::DuplicateParameter(param, idx) => write!(
+                f,
+                "There is a duplicate {} parameter at index {}",
+                param.name(),
+                idx
+            ),
+            Zip321Error::TransparentMemo(idx) => write!(
+                f,
+                "Payment {} is invalid: cannot send a memo to a transparent recipient address",
+                idx
+            ),
+            Zip321Error::RecipientMissing(idx) => {
+                write!(f, "Payment {} is missing its recipient address", idx)
+            }
+            Zip321Error::ParseError(s) => write!(f, "Parse failure: {}", s),
+        }
+    }
+}
+
+impl std::error::Error for Zip321Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Zip321Error::InvalidBase64(err) => Some(err),
+            Zip321Error::MemoBytesError(err) => Some(err),
+            _ => None,
+        }
+    }
+}
+
 /// Converts a [`MemoBytes`] value to a ZIP 321 compatible base64-encoded string.
 ///
-/// [`MemoBytes`]: zcash_primitives::memo::MemoBytes
+/// [`MemoBytes`]: zcash_protocol::memo::MemoBytes
 pub fn memo_to_base64(memo: &MemoBytes) -> String {
     BASE64_URL_SAFE_NO_PAD.encode(memo.as_slice())
 }
 
 /// Parse a [`MemoBytes`] value from a ZIP 321 compatible base64-encoded string.
 ///
-/// [`MemoBytes`]: zcash_primitives::memo::MemoBytes
+/// [`MemoBytes`]: zcash_protocol::memo::MemoBytes
 pub fn memo_from_base64(s: &str) -> Result<MemoBytes, Zip321Error> {
     BASE64_URL_SAFE_NO_PAD
         .decode(s)
@@ -63,56 +114,104 @@ pub fn memo_from_base64(s: &str) -> Result<MemoBytes, Zip321Error> {
 }
 
 /// A single payment being requested.
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Payment {
-    /// The payment address to which the payment should be sent.
-    pub recipient_address: RecipientAddress,
+    /// The address to which the payment should be sent.
+    recipient_address: ZcashAddress,
     /// The amount of the payment that is being requested.
-    pub amount: Amount,
+    amount: Zatoshis,
     /// A memo that, if included, must be provided with the payment.
     /// If a memo is present and [`recipient_address`] is not a shielded
     /// address, the wallet should report an error.
     ///
     /// [`recipient_address`]: #structfield.recipient_address
-    pub memo: Option<MemoBytes>,
+    memo: Option<MemoBytes>,
     /// A human-readable label for this payment within the larger structure
     /// of the transaction request.
-    pub label: Option<String>,
+    label: Option<String>,
     /// A human-readable message to be displayed to the user describing the
     /// purpose of this payment.
-    pub message: Option<String>,
+    message: Option<String>,
     /// A list of other arbitrary key/value pairs associated with this payment.
-    pub other_params: Vec<(String, String)>,
+    other_params: Vec<(String, String)>,
 }
 
 impl Payment {
-    /// A utility for use in tests to help check round-trip serialization properties.
-    #[cfg(any(test, feature = "test-dependencies"))]
-    pub(in crate::zip321) fn normalize(&mut self) {
-        self.other_params.sort();
+    /// Constructs a new [`Payment`] from its constituent parts.
+    ///
+    /// Returns `None` if the payment requests that a memo be sent to a recipient that cannot
+    /// receive a memo.
+    pub fn new(
+        recipient_address: ZcashAddress,
+        amount: Zatoshis,
+        memo: Option<MemoBytes>,
+        label: Option<String>,
+        message: Option<String>,
+        other_params: Vec<(String, String)>,
+    ) -> Option<Self> {
+        if memo.is_none() || recipient_address.can_receive_memo() {
+            Some(Self {
+                recipient_address,
+                amount,
+                memo,
+                label,
+                message,
+                other_params,
+            })
+        } else {
+            None
+        }
     }
 
-    /// Returns a function which compares two normalized payments, with addresses sorted by their
-    /// string representation given the specified network. This does not perform normalization
-    /// internally, so payments must be normalized prior to being passed to the comparison function
-    /// returned from this method.
-    #[cfg(any(test, feature = "test-dependencies"))]
-    pub(in crate::zip321) fn compare_normalized<P: consensus::Parameters>(
-        params: &P,
-    ) -> impl Fn(&Payment, &Payment) -> Ordering + '_ {
-        move |a: &Payment, b: &Payment| {
-            let a_addr = a.recipient_address.encode(params);
-            let b_addr = b.recipient_address.encode(params);
-
-            a_addr
-                .cmp(&b_addr)
-                .then(a.amount.cmp(&b.amount))
-                .then(a.memo.cmp(&b.memo))
-                .then(a.label.cmp(&b.label))
-                .then(a.message.cmp(&b.message))
-                .then(a.other_params.cmp(&b.other_params))
+    /// Constructs a new [`Payment`] paying the given address the specified amount.
+    pub fn without_memo(recipient_address: ZcashAddress, amount: Zatoshis) -> Self {
+        Self {
+            recipient_address,
+            amount,
+            memo: None,
+            label: None,
+            message: None,
+            other_params: vec![],
         }
     }
+
+    /// Returns the payment address to which the payment should be sent.
+    pub fn recipient_address(&self) -> &ZcashAddress {
+        &self.recipient_address
+    }
+
+    /// Returns the value of the payment that is being requested, in zatoshis.
+    pub fn amount(&self) -> Zatoshis {
+        self.amount
+    }
+
+    /// Returns the memo that, if included, must be provided with the payment.
+    pub fn memo(&self) -> Option<&MemoBytes> {
+        self.memo.as_ref()
+    }
+
+    /// A human-readable label for this payment within the larger structure
+    /// of the transaction request.
+    pub fn label(&self) -> Option<&String> {
+        self.label.as_ref()
+    }
+
+    /// A human-readable message to be displayed to the user describing the
+    /// purpose of this payment.
+    pub fn message(&self) -> Option<&String> {
+        self.message.as_ref()
+    }
+
+    /// A list of other arbitrary key/value pairs associated with this payment.
+    pub fn other_params(&self) -> &[(String, String)] {
+        self.other_params.as_ref()
+    }
+
+    /// A utility for use in tests to help check round-trip serialization properties.
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub(crate) fn normalize(&mut self) {
+        self.other_params.sort();
+    }
 }
 
 /// A ZIP321 transaction request.
@@ -121,57 +220,88 @@ impl Payment {
 /// When constructing a transaction in response to such a request,
 /// a separate output should be added to the transaction for each
 /// payment value in the request.
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct TransactionRequest {
-    payments: Vec<Payment>,
+    payments: BTreeMap<usize, Payment>,
 }
 
 impl TransactionRequest {
     /// Constructs a new empty transaction request.
     pub fn empty() -> Self {
-        Self { payments: vec![] }
+        Self {
+            payments: BTreeMap::new(),
+        }
     }
 
-    /// Constructs a new transaction request that obeys the ZIP-321 invariants
+    /// Constructs a new transaction request that obeys the ZIP-321 invariants.
     pub fn new(payments: Vec<Payment>) -> Result<TransactionRequest, Zip321Error> {
-        let request = TransactionRequest { payments };
+        // Payment indices are limited to 4 digits
+        if payments.len() > 9999 {
+            return Err(Zip321Error::TooManyPayments(payments.len()));
+        }
+
+        let request = TransactionRequest {
+            payments: payments.into_iter().enumerate().collect(),
+        };
 
         // Enforce validity requirements.
         if !request.payments.is_empty() {
-            // It doesn't matter what params we use here, as none of the validity
-            // requirements depend on them.
-            let params = consensus::MAIN_NETWORK;
-            TransactionRequest::from_uri(&params, &request.to_uri(&params).unwrap())?;
+            TransactionRequest::from_uri(&request.to_uri())?;
         }
 
         Ok(request)
     }
 
-    /// Returns the slice of payments that make up this request.
-    pub fn payments(&self) -> &[Payment] {
-        &self.payments[..]
+    /// Constructs a new transaction request from the provided map from payment
+    /// index to payment.
+    ///
+    /// Payment index 0 will be mapped to the empty payment index.
+    pub fn from_indexed(
+        payments: BTreeMap<usize, Payment>,
+    ) -> Result<TransactionRequest, Zip321Error> {
+        if let Some(k) = payments.keys().find(|k| **k > 9999) {
+            // This is not quite the correct error, but close enough.
+            return Err(Zip321Error::TooManyPayments(*k));
+        }
+
+        Ok(TransactionRequest { payments })
+    }
+
+    /// Returns the map of payments that make up this request.
+    ///
+    /// This is a map from payment index to payment. Payment index `0` is used to denote
+    /// the empty payment index in the returned values.
+    pub fn payments(&self) -> &BTreeMap<usize, Payment> {
+        &self.payments
+    }
+
+    /// Returns the total value of payments to be made.
+    ///
+    /// Returns `Err` in the case of overflow, or if the value is
+    /// outside the range `0..=MAX_MONEY` zatoshis.
+    pub fn total(&self) -> Result<Zatoshis, BalanceError> {
+        self.payments
+            .values()
+            .map(|p| p.amount)
+            .try_fold(Zatoshis::ZERO, |acc, a| {
+                (acc + a).ok_or(BalanceError::Overflow)
+            })
     }
 
     /// A utility for use in tests to help check round-trip serialization properties.
     #[cfg(any(test, feature = "test-dependencies"))]
-    pub(in crate::zip321) fn normalize<P: consensus::Parameters>(&mut self, params: &P) {
-        for p in &mut self.payments {
+    pub(crate) fn normalize(&mut self) {
+        for p in &mut self.payments.values_mut() {
             p.normalize();
         }
-
-        self.payments.sort_by(Payment::compare_normalized(params));
     }
 
     /// A utility for use in tests to help check round-trip serialization properties.
     /// by comparing a two transaction requests for equality after normalization.
-    #[cfg(all(test, feature = "test-dependencies"))]
-    pub(in crate::zip321) fn normalize_and_eq<P: consensus::Parameters>(
-        params: &P,
-        a: &mut TransactionRequest,
-        b: &mut TransactionRequest,
-    ) -> bool {
-        a.normalize(params);
-        b.normalize(params);
+    #[cfg(test)]
+    pub(crate) fn normalize_and_eq(a: &mut TransactionRequest, b: &mut TransactionRequest) -> bool {
+        a.normalize();
+        b.normalize();
 
         a == b
     }
@@ -179,13 +309,13 @@ impl TransactionRequest {
     /// Convert this request to a URI string.
     ///
     /// Returns None if the payment request is empty.
-    pub fn to_uri<P: consensus::Parameters>(&self, params: &P) -> Option<String> {
+    pub fn to_uri(&self) -> String {
         fn payment_params(
             payment: &Payment,
             payment_index: Option<usize>,
         ) -> impl IntoIterator<Item = String> + '_ {
             std::iter::empty()
-                .chain(render::amount_param(payment.amount, payment_index))
+                .chain(Some(render::amount_param(payment.amount, payment_index)))
                 .chain(
                     payment
                         .memo
@@ -212,42 +342,44 @@ impl TransactionRequest {
                 )
         }
 
-        match &self.payments[..] {
-            [] => None,
-            [payment] => {
+        match self.payments.len() {
+            0 => "zcash:".to_string(),
+            1 if *self.payments.iter().next().unwrap().0 == 0 => {
+                let (_, payment) = self.payments.iter().next().unwrap();
                 let query_params = payment_params(payment, None)
                     .into_iter()
                     .collect::<Vec<String>>();
 
-                Some(format!(
-                    "zcash:{}?{}",
-                    payment.recipient_address.encode(params),
+                format!(
+                    "zcash:{}{}{}",
+                    payment.recipient_address.encode(),
+                    if query_params.is_empty() { "" } else { "?" },
                     query_params.join("&")
-                ))
+                )
             }
             _ => {
                 let query_params = self
                     .payments
                     .iter()
-                    .enumerate()
                     .flat_map(|(i, payment)| {
+                        let idx = if *i == 0 { None } else { Some(*i) };
                         let primary_address = payment.recipient_address.clone();
                         std::iter::empty()
-                            .chain(Some(render::addr_param(params, &primary_address, Some(i))))
-                            .chain(payment_params(payment, Some(i)))
+                            .chain(Some(render::addr_param(&primary_address, idx)))
+                            .chain(payment_params(payment, idx))
                     })
                     .collect::<Vec<String>>();
 
-                Some(format!("zcash:?{}", query_params.join("&")))
+                format!("zcash:?{}", query_params.join("&"))
             }
         }
     }
 
     /// Parse the provided URI to a payment request value.
-    pub fn from_uri<P: consensus::Parameters>(params: &P, uri: &str) -> Result<Self, Zip321Error> {
+    pub fn from_uri(uri: &str) -> Result<Self, Zip321Error> {
         // Parse the leading zcash:<address>
-        let (rest, primary_addr_param) =
-            parse::lead_addr(params)(uri).map_err(|e| Zip321Error::ParseError(e.to_string()))?;
+        let (rest, primary_addr_param) = parse::lead_addr(uri)
+            .map_err(|e| Zip321Error::ParseError(format!("Error parsing lead address: {}", e)))?;
 
         // Parse the remaining parameters as an undifferentiated list
         let (_, xs) = if rest.is_empty() {
@@ -255,13 +387,15 @@ impl TransactionRequest {
         } else {
             all_consuming(preceded(
                 char('?'),
-                separated_list0(char('&'), parse::zcashparam(params)),
+                separated_list0(char('&'), parse::zcashparam),
             ))(rest)
-            .map_err(|e| Zip321Error::ParseError(e.to_string()))?
+            .map_err(|e| {
+                Zip321Error::ParseError(format!("Error parsing query parameters: {}", e))
+            })?
         };
 
         // Construct sets of payment parameters, keyed by the payment index.
-        let mut params_by_index: HashMap<usize, Vec<parse::Param>> = HashMap::new();
+        let mut params_by_index: BTreeMap<usize, Vec<parse::Param>> = BTreeMap::new();
 
         // Add the primary address, if any, to the index.
         if let Some(p) = primary_addr_param {
@@ -288,20 +422,21 @@ impl TransactionRequest {
         // Build the actual payment values from the index.
         params_by_index
             .into_iter()
-            .map(|(i, params)| parse::to_payment(params, i))
-            .collect::<Result<Vec<_>, _>>()
+            .map(|(i, params)| parse::to_payment(params, i).map(|payment| (i, payment)))
+            .collect::<Result<BTreeMap<usize, Payment>, _>>()
             .map(|payments| TransactionRequest { payments })
     }
 }
 
 mod render {
     use percent_encoding::{utf8_percent_encode, AsciiSet, CONTROLS};
-
-    use zcash_primitives::{
-        consensus, transaction::components::amount::COIN, transaction::components::Amount,
+    use zcash_address::ZcashAddress;
+    use zcash_protocol::{
+        memo::MemoBytes,
+        value::{Zatoshis, COIN},
     };
 
-    use super::{memo_to_base64, MemoBytes, RecipientAddress};
+    use super::memo_to_base64;
 
     /// The set of ASCII characters that must be percent-encoded according
     /// to the definition of ZIP 321. This is the complement of the subset of
@@ -341,36 +476,28 @@ mod render {
 
     /// Constructs an "address" key/value pair containing the encoded recipient address
     /// at the specified parameter index.
-    pub fn addr_param<P: consensus::Parameters>(
-        params: &P,
-        addr: &RecipientAddress,
-        idx: Option<usize>,
-    ) -> String {
-        format!("address{}={}", param_index(idx), addr.encode(params))
+    pub fn addr_param(addr: &ZcashAddress, idx: Option<usize>) -> String {
+        format!("address{}={}", param_index(idx), addr.encode())
     }
 
-    /// Converts an [`Amount`] value to a correctly formatted decimal ZEC
+    /// Converts a [`Zatoshis`] value to a correctly formatted decimal ZEC
     /// value for inclusion in a ZIP 321 URI.
-    pub fn amount_str(amount: Amount) -> Option<String> {
-        if amount.is_positive() {
-            let coins = i64::from(amount) / COIN;
-            let zats = i64::from(amount) % COIN;
-            Some(if zats == 0 {
-                format!("{}", coins)
-            } else {
-                format!("{}.{:0>8}", coins, zats)
-                    .trim_end_matches('0')
-                    .to_string()
-            })
+    pub fn amount_str(amount: Zatoshis) -> String {
+        let coins = u64::from(amount) / COIN;
+        let zats = u64::from(amount) % COIN;
+        if zats == 0 {
+            format!("{}", coins)
         } else {
-            None
+            format!("{}.{:0>8}", coins, zats)
+                .trim_end_matches('0')
+                .to_string()
         }
     }
 
     /// Constructs an "amount" key/value pair containing the encoded ZEC amount
     /// at the specified parameter index.
-    pub fn amount_param(amount: Amount, idx: Option<usize>) -> Option<String> {
-        amount_str(amount).map(|s| format!("amount{}={}", param_index(idx), s))
+    pub fn amount_param(amount: Zatoshis, idx: Option<usize>) -> String {
+        format!("amount{}={}", param_index(idx), amount_str(amount))
     }
 
     /// Constructs a "memo" key/value pair containing the base64URI-encoded memo
@@ -397,33 +524,48 @@ mod parse {
     use nom::{
         bytes::complete::{tag, take_till},
         character::complete::{alpha1, char, digit0, digit1, one_of},
-        combinator::{map_opt, map_res, opt, recognize},
+        combinator::{all_consuming, map_opt, map_res, opt, recognize},
         sequence::{preceded, separated_pair, tuple},
         AsChar, IResult, InputTakeAtPosition,
     };
     use percent_encoding::percent_decode;
-    use zcash_primitives::{
-        consensus, transaction::components::amount::COIN, transaction::components::Amount,
+    use zcash_address::ZcashAddress;
+    use zcash_protocol::value::BalanceError;
+    use zcash_protocol::{
+        memo::MemoBytes,
+        value::{Zatoshis, COIN},
     };
 
-    use crate::address::RecipientAddress;
-
-    use super::{memo_from_base64, MemoBytes, Payment, Zip321Error};
+    use super::{memo_from_base64, Payment, Zip321Error};
 
     /// A data type that defines the possible parameter types which may occur within a
     /// ZIP 321 URI.
-    #[derive(Debug, PartialEq, Eq)]
+    #[derive(Debug, Clone, PartialEq, Eq)]
     pub enum Param {
-        Addr(Box<RecipientAddress>),
-        Amount(Amount),
-        Memo(MemoBytes),
+        Addr(Box<ZcashAddress>),
+        Amount(Zatoshis),
+        Memo(Box<MemoBytes>),
         Label(String),
         Message(String),
         Other(String, String),
     }
 
+    impl Param {
+        /// Returns the name of the parameter from which this value was parsed.
+        pub fn name(&self) -> String {
+            match self {
+                Param::Addr(_) => "address".to_owned(),
+                Param::Amount(_) => "amount".to_owned(),
+                Param::Memo(_) => "memo".to_owned(),
+                Param::Label(_) => "label".to_owned(),
+                Param::Message(_) => "message".to_owned(),
+                Param::Other(name, _) => name.clone(),
+            }
+        }
+    }
+
     /// A [`Param`] value with its associated index.
-    #[derive(Debug)]
+    #[derive(Debug, Clone, PartialEq, Eq)]
     pub struct IndexedParam {
         pub param: Param,
         pub payment_index: usize,
@@ -462,7 +604,7 @@ mod parse {
 
         let mut payment = Payment {
             recipient_address: *addr.ok_or(Zip321Error::RecipientMissing(i))?,
-            amount: Amount::zero(),
+            amount: Zatoshis::ZERO,
             memo: None,
             label: None,
             message: None,
@@ -472,15 +614,13 @@ mod parse {
         for v in vs {
             match v {
                 Param::Amount(a) => payment.amount = a,
-                Param::Memo(m) => match payment.recipient_address {
-                    RecipientAddress::Shielded(_) | RecipientAddress::Unified(_) => {
-                        payment.memo = Some(m)
-                    }
-                    RecipientAddress::Transparent(_) => {
-                        return Err(Zip321Error::TransparentMemo(i))
+                Param::Memo(m) => {
+                    if payment.recipient_address.can_receive_memo() {
+                        payment.memo = Some(*m);
+                    } else {
+                        return Err(Zip321Error::TransparentMemo(i));
                     }
-                },
-
+                }
                 Param::Label(m) => payment.label = Some(m),
                 Param::Message(m) => payment.message = Some(m),
                 Param::Other(n, m) => payment.other_params.push((n, m)),
@@ -492,40 +632,34 @@ mod parse {
     }
 
     /// Parses and consumes the leading "zcash:\[address\]" from a ZIP 321 URI.
-    pub fn lead_addr<P: consensus::Parameters>(
-        params: &P,
-    ) -> impl Fn(&str) -> IResult<&str, Option<IndexedParam>> + '_ {
-        move |input: &str| {
-            map_opt(
-                preceded(tag("zcash:"), take_till(|c| c == '?')),
-                |addr_str: &str| {
-                    if addr_str.is_empty() {
-                        Some(None) // no address is ok, so wrap in `Some`
-                    } else {
-                        // `decode` returns `None` on error, which we want to
-                        // then cause `map_opt` to fail.
-                        RecipientAddress::decode(params, addr_str).map(|a| {
+    pub fn lead_addr(input: &str) -> IResult<&str, Option<IndexedParam>> {
+        map_opt(
+            preceded(tag("zcash:"), take_till(|c| c == '?')),
+            |addr_str: &str| {
+                if addr_str.is_empty() {
+                    Some(None) // no address is ok, so wrap in `Some`
+                } else {
+                    // `try_from_encoded(..).ok()` returns `None` on error, which we want to then
+                    // cause `map_opt` to fail.
+                    ZcashAddress::try_from_encoded(addr_str)
+                        .map(|a| {
                             Some(IndexedParam {
                                 param: Param::Addr(Box::new(a)),
                                 payment_index: 0,
                             })
                         })
-                    }
-                },
-            )(input)
-        }
+                        .ok()
+                }
+            },
+        )(input)
     }
 
-    /// The primary parser for <name>=<value> query-string parameter pair.
-    pub fn zcashparam<P: consensus::Parameters>(
-        params: &P,
-    ) -> impl Fn(&str) -> IResult<&str, IndexedParam> + '_ {
-        move |input| {
-            map_res(
-                separated_pair(indexed_name, char('='), recognize(qchars)),
-                move |r| to_indexed_param(params, r),
-            )(input)
-        }
+    /// The primary parser for `name=value` query-string parameter pairs.
+    pub fn zcashparam(input: &str) -> IResult<&str, IndexedParam> {
+        map_res(
+            separated_pair(indexed_name, char('='), recognize(qchars)),
+            to_indexed_param,
+        )(input)
     }
 
     /// Extension for the `alphanumeric0` parser which extends that parser
@@ -567,59 +701,55 @@ mod parse {
     }
 
     /// Parses a value in decimal ZEC.
-    pub fn parse_amount(input: &str) -> IResult<&str, Amount> {
+    pub fn parse_amount(input: &str) -> IResult<&str, Zatoshis> {
         map_res(
-            tuple((
+            all_consuming(tuple((
                 digit1,
                 opt(preceded(
                     char('.'),
-                    map_opt(digit0, |s: &str| if s.len() > 8 { None } else { Some(s) }),
+                    map_opt(digit1, |s: &str| if s.len() > 8 { None } else { Some(s) }),
                 )),
-            )),
+            ))),
             |(whole_s, decimal_s): (&str, Option<&str>)| {
-                let coins: i64 = whole_s
+                let coins: u64 = whole_s
                     .to_string()
-                    .parse::<i64>()
+                    .parse::<u64>()
                     .map_err(|e| e.to_string())?;
 
-                let zats: i64 = match decimal_s {
+                let zats: u64 = match decimal_s {
                     Some(d) => format!("{:0<8}", d)
-                        .parse::<i64>()
+                        .parse::<u64>()
                         .map_err(|e| e.to_string())?,
                     None => 0,
                 };
 
-                if coins >= 21000000 && (coins > 21000000 || zats > 0) {
-                    return Err(format!(
-                        "{} coins exceeds the maximum possible Zcash value.",
-                        coins
-                    ));
-                }
-
-                let amt = coins * COIN + zats;
-
-                Amount::from_nonnegative_i64(amt)
-                    .map_err(|_| format!("Not a valid zat amount: {}", amt))
+                coins
+                    .checked_mul(COIN)
+                    .and_then(|coin_zats| coin_zats.checked_add(zats))
+                    .ok_or(BalanceError::Overflow)
+                    .and_then(Zatoshis::from_u64)
+                    .map_err(|_| format!("Not a valid zat amount: {}.{}", coins, zats))
             },
         )(input)
     }
 
-    fn to_indexed_param<'a, P: consensus::Parameters>(
-        params: &'a P,
+    fn to_indexed_param(
         ((name, iopt), value): ((&str, Option<&str>), &str),
     ) -> Result<IndexedParam, String> {
         let param = match name {
-            "address" => RecipientAddress::decode(params, value)
+            "address" => ZcashAddress::try_from_encoded(value)
                 .map(Box::new)
                 .map(Param::Addr)
-                .ok_or(format!(
-                    "Could not interpret {} as a valid Zcash address.",
-                    value
-                )),
+                .map_err(|err| {
+                    format!(
+                        "Could not interpret {} as a valid Zcash address: {}",
+                        value, err
+                    )
+                }),
 
             "amount" => parse_amount(value)
-                .map(|(_, a)| Param::Amount(a))
-                .map_err(|e| e.to_string()),
+                .map_err(|e| e.to_string())
+                .map(|(_, a)| Param::Amount(a)),
 
             "label" => percent_decode(value.as_bytes())
                 .decode_utf8()
@@ -632,6 +762,7 @@ mod parse {
                 .map_err(|e| e.to_string()),
 
             "memo" => memo_from_base64(value)
+                .map(Box::new)
                 .map(Param::Memo)
                 .map_err(|e| format!("Decoded memo was invalid: {:?}", e)),
 
@@ -657,40 +788,17 @@ mod parse {
     }
 }
 
-#[cfg(feature = "test-dependencies")]
+#[cfg(any(test, feature = "test-dependencies"))]
 pub mod testing {
     use proptest::collection::btree_map;
     use proptest::collection::vec;
     use proptest::option;
-    use proptest::prelude::{any, prop_compose, prop_oneof};
-    use proptest::strategy::Strategy;
-    use zcash_primitives::{
-        consensus::TEST_NETWORK, legacy::testing::arb_transparent_addr,
-        sapling::testing::arb_payment_address,
-        transaction::components::amount::testing::arb_nonnegative_amount,
-    };
+    use proptest::prelude::{any, prop_compose};
 
-    use crate::address::{RecipientAddress, UnifiedAddress};
+    use zcash_address::testing::arb_address;
+    use zcash_protocol::{consensus::NetworkType, value::testing::arb_zatoshis};
 
     use super::{MemoBytes, Payment, TransactionRequest};
-
-    prop_compose! {
-        fn arb_unified_addr()(
-            sapling in arb_payment_address(),
-            transparent in option::of(arb_transparent_addr()),
-        ) -> UnifiedAddress {
-            UnifiedAddress::from_receivers(None, Some(sapling), transparent).unwrap()
-        }
-    }
-
-    pub fn arb_addr() -> impl Strategy<Value = RecipientAddress> {
-        prop_oneof![
-            arb_payment_address().prop_map(RecipientAddress::Shielded),
-            arb_transparent_addr().prop_map(RecipientAddress::Transparent),
-            arb_unified_addr().prop_map(RecipientAddress::Unified),
-        ]
-    }
-
     pub const VALID_PARAMNAME: &str = "[a-zA-Z][a-zA-Z0-9+-]*";
 
     prop_compose! {
@@ -700,25 +808,20 @@ pub mod testing {
     }
 
     prop_compose! {
-        pub fn arb_zip321_payment()(
-            recipient_address in arb_addr(),
-            amount in arb_nonnegative_amount(),
+        pub fn arb_zip321_payment(network: NetworkType)(
+            recipient_address in arb_address(network),
+            amount in arb_zatoshis(),
             memo in option::of(arb_valid_memo()),
             message in option::of(any::<String>()),
             label in option::of(any::<String>()),
             // prevent duplicates by generating a set rather than a vec
             other_params in btree_map(VALID_PARAMNAME, any::<String>(), 0..3),
-            ) -> Payment {
-
-            let is_shielded = match recipient_address {
-                RecipientAddress::Transparent(_) => false,
-                RecipientAddress::Shielded(_) | RecipientAddress::Unified(_) => true,
-            };
-
+        ) -> Payment {
+            let memo = memo.filter(|_| recipient_address.can_receive_memo());
             Payment {
                 recipient_address,
                 amount,
-                memo: memo.filter(|_| is_shielded),
+                memo,
                 label,
                 message,
                 other_params: other_params.into_iter().collect(),
@@ -727,64 +830,67 @@ pub mod testing {
     }
 
     prop_compose! {
-        pub fn arb_zip321_request()(payments in vec(arb_zip321_payment(), 1..10)) -> TransactionRequest {
-            let mut req = TransactionRequest { payments };
-            req.normalize(&TEST_NETWORK); // just to make test comparisons easier
+        pub fn arb_zip321_request(network: NetworkType)(
+            payments in btree_map(0usize..10000, arb_zip321_payment(network), 1..10)
+        ) -> TransactionRequest {
+            let mut req = TransactionRequest::from_indexed(payments).unwrap();
+            req.normalize(); // just to make test comparisons easier
+            req
+        }
+    }
+
+    prop_compose! {
+        pub fn arb_zip321_request_sequential(network: NetworkType)(
+            payments in vec(arb_zip321_payment(network), 1..10)
+        ) -> TransactionRequest {
+            let mut req = TransactionRequest::new(payments).unwrap();
+            req.normalize(); // just to make test comparisons easier
             req
         }
     }
 
     prop_compose! {
-        pub fn arb_zip321_uri()(req in arb_zip321_request()) -> String {
-            req.to_uri(&TEST_NETWORK).unwrap()
+        pub fn arb_zip321_uri(network: NetworkType)(req in arb_zip321_request(network)) -> String {
+            req.to_uri()
         }
     }
 
     prop_compose! {
-        pub fn arb_addr_str()(addr in arb_addr()) -> String {
-            addr.encode(&TEST_NETWORK)
+        pub fn arb_addr_str(network: NetworkType)(
+            recipient_address in arb_address(network)
+        ) -> String {
+            recipient_address.encode()
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use proptest::prelude::{any, proptest};
     use std::str::FromStr;
-    use zcash_primitives::{
-        consensus::{Parameters, TEST_NETWORK},
-        memo::Memo,
-        transaction::components::Amount,
+
+    use zcash_address::{testing::arb_address, ZcashAddress};
+    use zcash_protocol::{
+        consensus::NetworkType,
+        memo::{Memo, MemoBytes},
+        value::{testing::arb_zatoshis, Zatoshis},
     };
 
-    use crate::address::RecipientAddress;
+    #[cfg(feature = "local-consensus")]
+    use zcash_protocol::{local_consensus::LocalNetwork, BlockHeight};
 
     use super::{
         memo_from_base64, memo_to_base64,
         parse::{parse_amount, zcashparam, Param},
-        render::amount_str,
-        MemoBytes, Payment, TransactionRequest,
-    };
-    use crate::encoding::decode_payment_address;
-
-    #[cfg(all(test, feature = "test-dependencies"))]
-    use proptest::prelude::{any, proptest};
-
-    #[cfg(all(test, feature = "test-dependencies"))]
-    use zcash_primitives::transaction::components::amount::testing::arb_nonnegative_amount;
-
-    #[cfg(all(test, feature = "test-dependencies"))]
-    use super::{
-        render::{memo_param, str_param},
-        testing::{arb_addr, arb_addr_str, arb_valid_memo, arb_zip321_request, arb_zip321_uri},
+        render::{amount_str, memo_param, str_param},
+        testing::{arb_addr_str, arb_valid_memo, arb_zip321_request, arb_zip321_uri},
+        Payment, TransactionRequest,
     };
 
     fn check_roundtrip(req: TransactionRequest) {
-        if let Some(req_uri) = req.to_uri(&TEST_NETWORK) {
-            let parsed = TransactionRequest::from_uri(&TEST_NETWORK, &req_uri).unwrap();
-            assert_eq!(parsed, req);
-        } else {
-            panic!("Generated invalid payment request: {:?}", req);
-        }
+        let req_uri = req.to_uri();
+        let parsed = TransactionRequest::from_uri(&req_uri).unwrap();
+        assert_eq!(parsed, req);
     }
 
     #[test]
@@ -792,8 +898,8 @@ mod tests {
         let amounts = vec![1u64, 1000u64, 100000u64, 100000000u64, 100000000000u64];
 
         for amt_u64 in amounts {
-            let amt = Amount::from_u64(amt_u64).unwrap();
-            let amt_str = amount_str(amt).unwrap();
+            let amt = Zatoshis::const_from_u64(amt_u64);
+            let amt_str = amount_str(amt);
             assert_eq!(amt, parse_amount(&amt_str).unwrap().1);
         }
     }
@@ -802,27 +908,27 @@ mod tests {
     fn test_zip321_parse_empty_message() {
         let fragment = "message=";
 
-        let result = zcashparam(&TEST_NETWORK)(fragment).unwrap().1.param;
+        let result = zcashparam(fragment).unwrap().1.param;
         assert_eq!(result, Param::Message("".to_string()));
     }
 
     #[test]
     fn test_zip321_parse_simple() {
         let uri = "zcash:ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k?amount=3768769.02796286&message=";
-        let parse_result = TransactionRequest::from_uri(&TEST_NETWORK, uri).unwrap();
+        let parse_result = TransactionRequest::from_uri(uri).unwrap();
 
-        let expected = TransactionRequest {
-            payments: vec![
+        let expected = TransactionRequest::new(
+            vec![
                 Payment {
-                    recipient_address: RecipientAddress::Shielded(decode_payment_address(TEST_NETWORK.hrp_sapling_payment_address(), "ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k").unwrap()),
-                    amount: Amount::from_u64(376876902796286).unwrap(),
+                    recipient_address: ZcashAddress::try_from_encoded("ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k").unwrap(),
+                    amount: Zatoshis::const_from_u64(376876902796286),
                     memo: None,
                     label: None,
                     message: Some("".to_string()),
                     other_params: vec![],
                 }
             ]
-        };
+        ).unwrap();
 
         assert_eq!(parse_result, expected);
     }
@@ -830,38 +936,38 @@ mod tests {
     #[test]
     fn test_zip321_parse_no_query_params() {
         let uri = "zcash:ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k";
-        let parse_result = TransactionRequest::from_uri(&TEST_NETWORK, uri).unwrap();
+        let parse_result = TransactionRequest::from_uri(uri).unwrap();
 
-        let expected = TransactionRequest {
-            payments: vec![
+        let expected = TransactionRequest::new(
+            vec![
                 Payment {
-                    recipient_address: RecipientAddress::Shielded(decode_payment_address(TEST_NETWORK.hrp_sapling_payment_address(), "ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k").unwrap()),
-                    amount: Amount::from_u64(0).unwrap(),
+                    recipient_address: ZcashAddress::try_from_encoded("ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k").unwrap(),
+                    amount: Zatoshis::ZERO,
                     memo: None,
                     label: None,
                     message: None,
                     other_params: vec![],
                 }
             ]
-        };
+        ).unwrap();
 
         assert_eq!(parse_result, expected);
     }
 
     #[test]
     fn test_zip321_roundtrip_empty_message() {
-        let req = TransactionRequest {
-            payments: vec![
+        let req = TransactionRequest::new(
+            vec![
                 Payment {
-                    recipient_address: RecipientAddress::Shielded(decode_payment_address(TEST_NETWORK.hrp_sapling_payment_address(), "ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k").unwrap()),
-                    amount: Amount::from_u64(0).unwrap(),
+                    recipient_address: ZcashAddress::try_from_encoded("ztestsapling1n65uaftvs2g7075q2x2a04shfk066u3lldzxsrprfrqtzxnhc9ps73v4lhx4l9yfxj46sl0q90k").unwrap(),
+                    amount: Zatoshis::ZERO,
                     memo: None,
                     label: None,
                     message: Some("".to_string()),
                     other_params: vec![]
                 }
             ]
-        };
+        ).unwrap();
 
         check_roundtrip(req);
     }
@@ -887,125 +993,163 @@ mod tests {
 
     #[test]
     fn test_zip321_spec_valid_examples() {
+        let valid_0 = "zcash:";
+        let v0r = TransactionRequest::from_uri(valid_0).unwrap();
+        assert!(v0r.payments.is_empty());
+
+        let valid_0 = "zcash:?";
+        let v0r = TransactionRequest::from_uri(valid_0).unwrap();
+        assert!(v0r.payments.is_empty());
+
         let valid_1 = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=1&memo=VGhpcyBpcyBhIHNpbXBsZSBtZW1vLg&message=Thank%20you%20for%20your%20purchase";
-        let v1r = TransactionRequest::from_uri(&TEST_NETWORK, valid_1).unwrap();
+        let v1r = TransactionRequest::from_uri(valid_1).unwrap();
         assert_eq!(
-            v1r.payments.get(0).map(|p| p.amount),
-            Some(Amount::from_u64(100000000).unwrap())
+            v1r.payments.get(&0).map(|p| p.amount),
+            Some(Zatoshis::const_from_u64(100000000))
         );
 
         let valid_2 = "zcash:?address=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU&amount=123.456&address.1=ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez&amount.1=0.789&memo.1=VGhpcyBpcyBhIHVuaWNvZGUgbWVtbyDinKjwn6aE8J-PhvCfjok";
-        let mut v2r = TransactionRequest::from_uri(&TEST_NETWORK, valid_2).unwrap();
-        v2r.normalize(&TEST_NETWORK);
+        let mut v2r = TransactionRequest::from_uri(valid_2).unwrap();
+        v2r.normalize();
         assert_eq!(
-            v2r.payments.get(0).map(|p| p.amount),
-            Some(Amount::from_u64(12345600000).unwrap())
+            v2r.payments.get(&0).map(|p| p.amount),
+            Some(Zatoshis::const_from_u64(12345600000))
         );
         assert_eq!(
-            v2r.payments.get(1).map(|p| p.amount),
-            Some(Amount::from_u64(78900000).unwrap())
+            v2r.payments.get(&1).map(|p| p.amount),
+            Some(Zatoshis::const_from_u64(78900000))
         );
 
         // valid; amount just less than MAX_MONEY
         // 20999999.99999999
         let valid_3 = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=20999999.99999999";
-        let v3r = TransactionRequest::from_uri(&TEST_NETWORK, valid_3).unwrap();
+        let v3r = TransactionRequest::from_uri(valid_3).unwrap();
         assert_eq!(
-            v3r.payments.get(0).map(|p| p.amount),
-            Some(Amount::from_u64(2099999999999999u64).unwrap())
+            v3r.payments.get(&0).map(|p| p.amount),
+            Some(Zatoshis::const_from_u64(2099999999999999))
         );
 
         // valid; MAX_MONEY
         // 21000000
         let valid_4 = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=21000000";
-        let v4r = TransactionRequest::from_uri(&TEST_NETWORK, valid_4).unwrap();
+        let v4r = TransactionRequest::from_uri(valid_4).unwrap();
         assert_eq!(
-            v4r.payments.get(0).map(|p| p.amount),
-            Some(Amount::from_u64(2100000000000000u64).unwrap())
+            v4r.payments.get(&0).map(|p| p.amount),
+            Some(Zatoshis::const_from_u64(2100000000000000))
+        );
+    }
+
+    #[cfg(feature = "local-consensus")]
+    #[test]
+    fn test_zip321_spec_regtest_valid_examples() {
+        let params = LocalNetwork {
+            overwinter: Some(BlockHeight::from_u32(1)),
+            sapling: Some(BlockHeight::from_u32(1)),
+            blossom: Some(BlockHeight::from_u32(1)),
+            heartwood: Some(BlockHeight::from_u32(1)),
+            canopy: Some(BlockHeight::from_u32(1)),
+            nu5: Some(BlockHeight::from_u32(1)),
+            nu6: Some(BlockHeight::from_u32(1)),
+            z_future: Some(BlockHeight::from_u32(1)),
+        };
+        let valid_1 = "zcash:zregtestsapling1qqqqqqqqqqqqqqqqqqcguyvaw2vjk4sdyeg0lc970u659lvhqq7t0np6hlup5lusxle7505hlz3?amount=1&memo=VGhpcyBpcyBhIHNpbXBsZSBtZW1vLg&message=Thank%20you%20for%20your%20purchase";
+        let v1r = TransactionRequest::from_uri(&params, valid_1).unwrap();
+        assert_eq!(
+            v1r.payments.get(&0).map(|p| p.amount),
+            Some(Zatoshis::const_from_u64(100000000))
         );
     }
 
     #[test]
     fn test_zip321_spec_invalid_examples() {
+        // invalid; empty string
+        let invalid_0 = "";
+        let i0r = TransactionRequest::from_uri(invalid_0);
+        assert!(i0r.is_err());
+
         // invalid; missing `address=`
         let invalid_1 = "zcash:?amount=3491405.05201255&address.1=ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez&amount.1=5740296.87793245";
-        let i1r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_1);
+        let i1r = TransactionRequest::from_uri(invalid_1);
         assert!(i1r.is_err());
 
         // invalid; missing `address.1=`
         let invalid_2 = "zcash:?address=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU&amount=1&amount.1=2&address.2=ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez";
-        let i2r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_2);
+        let i2r = TransactionRequest::from_uri(invalid_2);
         assert!(i2r.is_err());
 
         // invalid; `address.0=` and `amount.0=` are not permitted (leading 0s).
         let invalid_3 = "zcash:?address.0=ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez&amount.0=2";
-        let i3r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_3);
+        let i3r = TransactionRequest::from_uri(invalid_3);
         assert!(i3r.is_err());
 
         // invalid; duplicate `amount=` field
         let invalid_4 =
             "zcash:?amount=1.234&amount=2.345&address=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU";
-        let i4r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_4);
+        let i4r = TransactionRequest::from_uri(invalid_4);
         assert!(i4r.is_err());
 
         // invalid; duplicate `amount.1=` field
         let invalid_5 =
             "zcash:?amount.1=1.234&amount.1=2.345&address.1=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU";
-        let i5r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_5);
+        let i5r = TransactionRequest::from_uri(invalid_5);
         assert!(i5r.is_err());
 
         //invalid; memo associated with t-addr
         let invalid_6 = "zcash:?address=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU&amount=123.456&memo=eyAia2V5IjogIlRoaXMgaXMgYSBKU09OLXN0cnVjdHVyZWQgbWVtby4iIH0&address.1=ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez&amount.1=0.789&memo.1=VGhpcyBpcyBhIHVuaWNvZGUgbWVtbyDinKjwn6aE8J-PhvCfjok";
-        let i6r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_6);
+        let i6r = TransactionRequest::from_uri(invalid_6);
         assert!(i6r.is_err());
 
         // invalid; amount component exceeds an i64
         // 9223372036854775808 = i64::MAX + 1
         let invalid_7 = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=9223372036854775808";
-        let i7r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_7);
+        let i7r = TransactionRequest::from_uri(invalid_7);
         assert!(i7r.is_err());
 
         // invalid; amount component wraps into a valid small positive i64
         // 18446744073709551624
         let invalid_7a = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=18446744073709551624";
-        let i7ar = TransactionRequest::from_uri(&TEST_NETWORK, invalid_7a);
+        let i7ar = TransactionRequest::from_uri(invalid_7a);
         assert!(i7ar.is_err());
 
         // invalid; amount component is MAX_MONEY
         // 21000000.00000001
         let invalid_8 = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=21000000.00000001";
-        let i8r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_8);
+        let i8r = TransactionRequest::from_uri(invalid_8);
         assert!(i8r.is_err());
 
         // invalid; negative amount
         let invalid_9 = "zcash:ztestsapling10yy2ex5dcqkclhc7z7yrnjq2z6feyjad56ptwlfgmy77dmaqqrl9gyhprdx59qgmsnyfska2kez?amount=-1";
-        let i9r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_9);
+        let i9r = TransactionRequest::from_uri(invalid_9);
         assert!(i9r.is_err());
 
         // invalid; parameter index too large
         let invalid_10 =
             "zcash:?amount.10000=1.23&address.10000=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU";
-        let i10r = TransactionRequest::from_uri(&TEST_NETWORK, invalid_10);
+        let i10r = TransactionRequest::from_uri(invalid_10);
         assert!(i10r.is_err());
+
+        // invalid: bad amount format
+        let invalid_11 = "zcash:?address=tmEZhbWHTpdKMw5it8YDspUXSMGQyFwovpU&amount=123.";
+        let i11r = TransactionRequest::from_uri(invalid_11);
+        assert!(i11r.is_err());
     }
 
-    #[cfg(all(test, feature = "test-dependencies"))]
     proptest! {
         #[test]
-        fn prop_zip321_roundtrip_address(addr in arb_addr()) {
-            let a = addr.encode(&TEST_NETWORK);
-            assert_eq!(RecipientAddress::decode(&TEST_NETWORK, &a), Some(addr));
+        fn prop_zip321_roundtrip_address(addr in arb_address(NetworkType::Test)) {
+            let a = addr.encode();
+            assert_eq!(ZcashAddress::try_from_encoded(&a), Ok(addr));
         }
 
         #[test]
-        fn prop_zip321_roundtrip_address_str(a in arb_addr_str()) {
-            let addr = RecipientAddress::decode(&TEST_NETWORK, &a).unwrap();
-            assert_eq!(addr.encode(&TEST_NETWORK), a);
+        fn prop_zip321_roundtrip_address_str(a in arb_addr_str(NetworkType::Test)) {
+            let addr = ZcashAddress::try_from_encoded(&a).unwrap();
+            assert_eq!(addr.encode(), a);
         }
 
         #[test]
-        fn prop_zip321_roundtrip_amount(amt in arb_nonnegative_amount()) {
-            let amt_str = amount_str(amt).unwrap();
+        fn prop_zip321_roundtrip_amount(amt in arb_zatoshis()) {
+            let amt_str = amount_str(amt);
             assert_eq!(amt, parse_amount(&amt_str).unwrap().1);
         }
 
@@ -1013,7 +1157,7 @@ mod tests {
         fn prop_zip321_roundtrip_str_param(
             message in any::<String>(), i in proptest::option::of(0usize..2000)) {
             let fragment = str_param("message", &message, i);
-            let (rest, iparam) = zcashparam(&TEST_NETWORK)(&fragment).unwrap();
+            let (rest, iparam) = zcashparam(&fragment).unwrap();
             assert_eq!(rest, "");
             assert_eq!(iparam.param, Param::Message(message));
             assert_eq!(iparam.payment_index, i.unwrap_or(0));
@@ -1023,28 +1167,25 @@ mod tests {
         fn prop_zip321_roundtrip_memo_param(
             memo in arb_valid_memo(), i in proptest::option::of(0usize..2000)) {
             let fragment = memo_param(&memo, i);
-            let (rest, iparam) = zcashparam(&TEST_NETWORK)(&fragment).unwrap();
+            let (rest, iparam) = zcashparam(&fragment).unwrap();
             assert_eq!(rest, "");
-            assert_eq!(iparam.param, Param::Memo(memo));
+            assert_eq!(iparam.param, Param::Memo(Box::new(memo)));
             assert_eq!(iparam.payment_index, i.unwrap_or(0));
         }
 
         #[test]
-        fn prop_zip321_roundtrip_request(mut req in arb_zip321_request()) {
-            if let Some(req_uri) = req.to_uri(&TEST_NETWORK) {
-                let mut parsed = TransactionRequest::from_uri(&TEST_NETWORK, &req_uri).unwrap();
-                assert!(TransactionRequest::normalize_and_eq(&TEST_NETWORK, &mut parsed, &mut req));
-            } else {
-                panic!("Generated invalid payment request: {:?}", req);
-            }
+        fn prop_zip321_roundtrip_request(mut req in arb_zip321_request(NetworkType::Test)) {
+            let req_uri = req.to_uri();
+            let mut parsed = TransactionRequest::from_uri(&req_uri).unwrap();
+            assert!(TransactionRequest::normalize_and_eq(&mut parsed, &mut req));
         }
 
         #[test]
-        fn prop_zip321_roundtrip_uri(uri in arb_zip321_uri()) {
-            let mut parsed = TransactionRequest::from_uri(&TEST_NETWORK, &uri).unwrap();
-            parsed.normalize(&TEST_NETWORK);
-            let serialized = parsed.to_uri(&TEST_NETWORK);
-            assert_eq!(serialized, Some(uri))
+        fn prop_zip321_roundtrip_uri(uri in arb_zip321_uri(NetworkType::Test)) {
+            let mut parsed = TransactionRequest::from_uri(&uri).unwrap();
+            parsed.normalize();
+            let serialized = parsed.to_uri();
+            assert_eq!(serialized, uri)
         }
     }
 }
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000000..d9b2c8f95a
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,65 @@
+# Configuration file for cargo-deny
+
+[graph]
+targets = [
+    # Targets used by zcashd
+    { triple = "aarch64-unknown-linux-gnu" },
+    { triple = "x86_64-apple-darwin" },
+    { triple = "x86_64-pc-windows-gnu" },
+    { triple = "x86_64-unknown-freebsd" },
+    { triple = "x86_64-unknown-linux-gnu" },
+    # Targets used by zcash-android-wallet-sdk
+    { triple = "aarch64-linux-android" },
+    { triple = "armv7-linux-androideabi" },
+    { triple = "i686-linux-android" },
+    { triple = "x86_64-linux-android" },
+    # Targets used by zcash-swift-wallet-sdk
+    { triple = "aarch64-apple-darwin" },
+    { triple = "aarch64-apple-ios" },
+    { triple = "aarch64-apple-ios-sim" },
+    { triple = "x86_64-apple-darwin" },
+    { triple = "x86_64-apple-ios" },
+]
+all-features = true
+exclude-dev = true
+
+[licenses]
+version = 2
+allow = [
+    "Apache-2.0",
+    "MIT",
+]
+exceptions = [
+    { name = "arrayref", allow = ["BSD-2-Clause"] },
+    { name = "async_executors", allow = ["Unlicense"] },
+    { name = "bounded-vec-deque", allow = ["BSD-3-Clause"] },
+    { name = "coarsetime", allow = ["ISC"] },
+    { name = "curve25519-dalek", allow = ["BSD-3-Clause"] },
+    { name = "ed25519-dalek", allow = ["BSD-3-Clause"] },
+    { name = "inotify", allow = ["ISC"] },
+    { name = "inotify-sys", allow = ["ISC"] },
+    { name = "matchit", allow = ["BSD-3-Clause"] },
+    { name = "minreq", allow = ["ISC"] },
+    { name = "notify", allow = ["CC0-1.0"] },
+    { name = "option-ext", allow = ["MPL-2.0"] },
+    { name = "priority-queue", allow = ["MPL-2.0"] },
+    { name = "ring", allow = ["LicenseRef-ring"] },
+    { name = "rustls-webpki", allow = ["ISC"] },
+    { name = "secp256k1", allow = ["CC0-1.0"] },
+    { name = "secp256k1-sys", allow = ["CC0-1.0"] },
+    { name = "simple_asn1", allow = ["ISC"] },
+    { name = "slotmap", allow = ["Zlib"] },
+    { name = "subtle", allow = ["BSD-3-Clause"] },
+    { name = "tinystr", allow = ["Unicode-3.0"] },
+    { name = "unicode-ident", allow = ["Unicode-DFS-2016"] },
+    { name = "untrusted", allow = ["ISC"] },
+    { name = "webpki-roots", allow = ["MPL-2.0"] },
+    { name = "x25519-dalek", allow = ["BSD-3-Clause"] },
+]
+
+[[licenses.clarify]]
+name = "ring"
+expression = "LicenseRef-ring"
+license-files = [
+    { path = "LICENSE", hash = 0xbd0eed23 },
+]
diff --git a/devtools/Cargo.toml b/devtools/Cargo.toml
new file mode 100644
index 0000000000..417404ed67
--- /dev/null
+++ b/devtools/Cargo.toml
@@ -0,0 +1,55 @@
+[package]
+name = "devtools"
+version = "0.0.0"
+edition.workspace = true
+license.workspace = true
+publish = false
+
+[dependencies]
+# General tool dependencies
+gumdrop = "0.8"
+
+# General Zcash dependencies
+bech32.workspace = true
+bip0039 = "0.11"
+blake2b_simd.workspace = true
+equihash.workspace = true
+group.workspace = true
+sha2.workspace = true
+zcash_address.workspace = true
+zcash_client_backend ={ workspace = true, features = ["lightwalletd-tonic-transport"] }
+zcash_encoding.workspace = true
+zcash_keys = { workspace = true, features = ["unstable"] }
+zcash_note_encryption.workspace = true
+zcash_primitives = { workspace = true, features = ["transparent-inputs"] }
+zcash_proofs = { workspace = true, features = ["directories"] }
+zcash_protocol = {workspace = true, features = ["local-consensus"] }
+
+# Transparent
+secp256k1.workspace = true
+
+# Sprout
+ed25519-zebra = "4"
+
+# Sapling
+bellman.workspace = true
+jubjub.workspace = true
+sapling.workspace = true
+
+# Orchard
+orchard.workspace = true
+
+# zcash-inspect tool
+anyhow = "1"
+hex.workspace = true
+lazy_static.workspace = true
+secrecy.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tonic = { workspace = true, features = ["gzip", "tls-webpki-roots"] }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+uint = "0.9"
+
+[[bin]]
+name = "zcash-inspect"
+path = "src/bin/inspect/main.rs"
diff --git a/devtools/src/bin/inspect/address.rs b/devtools/src/bin/inspect/address.rs
new file mode 100644
index 0000000000..1c5aca0333
--- /dev/null
+++ b/devtools/src/bin/inspect/address.rs
@@ -0,0 +1,164 @@
+use zcash_address::{
+    unified::{self, Container, Encoding},
+    ConversionError, Network, ToAddress, ZcashAddress,
+};
+
+#[allow(dead_code)]
+enum AddressKind {
+    Sprout([u8; 64]),
+    Sapling([u8; 43]),
+    Unified(unified::Address),
+    P2pkh([u8; 20]),
+    P2sh([u8; 20]),
+    Tex([u8; 20]),
+}
+
+struct Address {
+    net: Network,
+    kind: AddressKind,
+}
+
+impl zcash_address::TryFromAddress for Address {
+    type Error = ();
+
+    fn try_from_sprout(net: Network, data: [u8; 64]) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address {
+            net,
+            kind: AddressKind::Sprout(data),
+        })
+    }
+
+    fn try_from_sapling(
+        net: Network,
+        data: [u8; 43],
+    ) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address {
+            net,
+            kind: AddressKind::Sapling(data),
+        })
+    }
+
+    fn try_from_unified(
+        net: Network,
+        data: unified::Address,
+    ) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address {
+            net,
+            kind: AddressKind::Unified(data),
+        })
+    }
+
+    fn try_from_transparent_p2pkh(
+        net: Network,
+        data: [u8; 20],
+    ) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address {
+            net,
+            kind: AddressKind::P2pkh(data),
+        })
+    }
+
+    fn try_from_transparent_p2sh(
+        net: Network,
+        data: [u8; 20],
+    ) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address {
+            net,
+            kind: AddressKind::P2sh(data),
+        })
+    }
+
+    fn try_from_tex(net: Network, data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address {
+            net,
+            kind: AddressKind::Tex(data),
+        })
+    }
+}
+
+pub(crate) fn inspect(addr: ZcashAddress) {
+    eprintln!("Zcash address");
+
+    match addr.convert::<Address>() {
+        // TODO: Check for valid internals once we have migrated to a newer zcash_address
+        // version with custom errors.
+        Err(_) => unreachable!(),
+        Ok(addr) => {
+            eprintln!(
+                " - Network: {}",
+                match addr.net {
+                    Network::Main => "main",
+                    Network::Test => "testnet",
+                    Network::Regtest => "regtest",
+                }
+            );
+            eprintln!(
+                " - Kind: {}",
+                match addr.kind {
+                    AddressKind::Sprout(_) => "Sprout",
+                    AddressKind::Sapling(_) => "Sapling",
+                    AddressKind::Unified(_) => "Unified Address",
+                    AddressKind::P2pkh(_) => "Transparent P2PKH",
+                    AddressKind::P2sh(_) => "Transparent P2SH",
+                    AddressKind::Tex(_) => "TEX (ZIP 320)",
+                }
+            );
+
+            match addr.kind {
+                AddressKind::Unified(ua) => {
+                    eprintln!(" - Receivers:");
+                    for receiver in ua.items() {
+                        match receiver {
+                            unified::Receiver::Orchard(data) => {
+                                eprintln!(
+                                    "   - Orchard ({})",
+                                    unified::Address::try_from_items(vec![
+                                        unified::Receiver::Orchard(data)
+                                    ])
+                                    .unwrap()
+                                    .encode(&addr.net)
+                                );
+                            }
+                            unified::Receiver::Sapling(data) => {
+                                eprintln!(
+                                    "   - Sapling ({})",
+                                    ZcashAddress::from_sapling(addr.net, data)
+                                );
+                            }
+                            unified::Receiver::P2pkh(data) => {
+                                eprintln!(
+                                    "   - Transparent P2PKH ({})",
+                                    ZcashAddress::from_transparent_p2pkh(addr.net, data)
+                                );
+                            }
+                            unified::Receiver::P2sh(data) => {
+                                eprintln!(
+                                    "   - Transparent P2SH ({})",
+                                    ZcashAddress::from_transparent_p2sh(addr.net, data)
+                                );
+                            }
+                            unified::Receiver::Unknown { typecode, data } => {
+                                eprintln!("   - Unknown");
+                                eprintln!("     - Typecode: {}", typecode);
+                                eprintln!("     - Payload: {}", hex::encode(data));
+                            }
+                        }
+                    }
+                }
+                AddressKind::P2pkh(data) => {
+                    eprintln!(
+                        " - Corresponding TEX: {}",
+                        ZcashAddress::from_tex(addr.net, data),
+                    );
+                }
+                AddressKind::Tex(data) => {
+                    eprintln!(
+                        " - Corresponding P2PKH: {}",
+                        ZcashAddress::from_transparent_p2pkh(addr.net, data),
+                    );
+                }
+                _ => (),
+            }
+        }
+    }
+}
diff --git a/devtools/src/bin/inspect/block.rs b/devtools/src/bin/inspect/block.rs
new file mode 100644
index 0000000000..f6a79b73c7
--- /dev/null
+++ b/devtools/src/bin/inspect/block.rs
@@ -0,0 +1,401 @@
+// To silence lints in the `uint::construct_uint!` macro.
+#![allow(clippy::assign_op_pattern)]
+#![allow(clippy::ptr_offset_with_cast)]
+
+use std::cmp;
+use std::convert::{TryFrom, TryInto};
+use std::io::{self, Read};
+
+use sha2::{Digest, Sha256};
+use zcash_encoding::Vector;
+use zcash_primitives::{
+    block::BlockHeader,
+    consensus::{BlockHeight, BranchId, Network, NetworkUpgrade, Parameters},
+    transaction::Transaction,
+};
+
+use crate::{
+    transaction::{extract_height_from_coinbase, is_coinbase},
+    Context, ZUint256,
+};
+
+const MIN_BLOCK_VERSION: i32 = 4;
+
+uint::construct_uint! {
+    pub(crate) struct U256(4);
+}
+
+impl U256 {
+    fn from_compact(compact: u32) -> (Self, bool, bool) {
+        let size = compact >> 24;
+        let word = compact & 0x007fffff;
+        let result = if size <= 3 {
+            U256::from(word >> (8 * (3 - size)))
+        } else {
+            U256::from(word) << (8 * (size - 3))
+        };
+        (
+            result,
+            word != 0 && (compact & 0x00800000) != 0,
+            word != 0
+                && ((size > 34) || (word > 0xff && size > 33) || (word > 0xffff && size > 32)),
+        )
+    }
+}
+
+pub(crate) trait BlockParams: Parameters {
+    fn equihash_n(&self) -> u32;
+    fn equihash_k(&self) -> u32;
+    fn pow_limit(&self) -> U256;
+}
+
+impl BlockParams for Network {
+    fn equihash_n(&self) -> u32 {
+        match self {
+            Self::MainNetwork | Self::TestNetwork => 200,
+        }
+    }
+
+    fn equihash_k(&self) -> u32 {
+        match self {
+            Self::MainNetwork | Self::TestNetwork => 9,
+        }
+    }
+
+    fn pow_limit(&self) -> U256 {
+        match self {
+            Self::MainNetwork => U256::from_big_endian(
+                &hex::decode("0007ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff")
+                    .unwrap(),
+            ),
+            Self::TestNetwork => U256::from_big_endian(
+                &hex::decode("07ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff")
+                    .unwrap(),
+            ),
+        }
+    }
+}
+
+pub(crate) fn guess_params(header: &BlockHeader) -> Option<Network> {
+    // If the block target falls between the testnet and mainnet powLimit, assume testnet.
+    let (target, is_negative, did_overflow) = U256::from_compact(header.bits);
+    if !(is_negative || did_overflow)
+        && target > Network::MainNetwork.pow_limit()
+        && target <= Network::TestNetwork.pow_limit()
+    {
+        return Some(Network::TestNetwork);
+    }
+
+    None
+}
+
+fn check_equihash_solution(header: &BlockHeader, params: Network) -> Result<(), equihash::Error> {
+    let eh_input = {
+        let mut eh_input = vec![];
+        header.write(&mut eh_input).unwrap();
+        eh_input.truncate(4 + 32 + 32 + 32 + 4 + 4);
+        eh_input
+    };
+    equihash::is_valid_solution(
+        params.equihash_n(),
+        params.equihash_k(),
+        &eh_input,
+        &header.nonce,
+        &header.solution,
+    )
+}
+
+fn check_proof_of_work(header: &BlockHeader, params: Network) -> Result<(), &str> {
+    let (target, is_negative, did_overflow) = U256::from_compact(header.bits);
+    let hash = U256::from_little_endian(&header.hash().0);
+
+    if is_negative {
+        Err("nBits is negative")
+    } else if target.is_zero() {
+        Err("target is zero")
+    } else if did_overflow {
+        Err("nBits overflowed")
+    } else if target > params.pow_limit() {
+        Err("target is larger than powLimit")
+    } else if hash > target {
+        Err("block hash larger than target")
+    } else {
+        Ok(())
+    }
+}
+
+fn derive_block_commitments_hash(
+    chain_history_root: [u8; 32],
+    auth_data_root: [u8; 32],
+) -> [u8; 32] {
+    blake2b_simd::Params::new()
+        .hash_length(32)
+        .personal(b"ZcashBlockCommit")
+        .to_state()
+        .update(&chain_history_root)
+        .update(&auth_data_root)
+        .update(&[0; 32])
+        .finalize()
+        .as_bytes()
+        .try_into()
+        .unwrap()
+}
+
+pub(crate) struct Block {
+    header: BlockHeader,
+    txs: Vec<Transaction>,
+}
+
+impl Block {
+    pub(crate) fn read<R: Read>(mut reader: R) -> io::Result<Self> {
+        let header = BlockHeader::read(&mut reader)?;
+        let txs = Vector::read(reader, |r| Transaction::read(r, BranchId::Sprout))?;
+
+        Ok(Block { header, txs })
+    }
+
+    pub(crate) fn guess_params(&self) -> Option<Network> {
+        guess_params(&self.header)
+    }
+
+    fn extract_height(&self) -> Option<BlockHeight> {
+        self.txs.first().and_then(extract_height_from_coinbase)
+    }
+
+    /// Builds the Merkle tree for this block and returns its root.
+    ///
+    /// The returned `bool` indicates whether mutation was detected in the Merkle tree (a
+    /// duplication of transactions in the block leading to an identical Merkle root).
+    fn build_merkle_root(&self) -> ([u8; 32], bool) {
+        // Safe upper bound for the number of total nodes.
+        let mut merkle_tree = Vec::with_capacity(self.txs.len() * 2 + 16);
+        for tx in &self.txs {
+            merkle_tree.push(sha2::digest::generic_array::GenericArray::from(
+                *tx.txid().as_ref(),
+            ));
+        }
+        let mut size = self.txs.len();
+        let mut j = 0;
+        let mut mutated = false;
+        while size > 1 {
+            let mut i = 0;
+            while i < size {
+                let i2 = cmp::min(i + 1, size - 1);
+                if i2 == i + 1 && i2 + 1 == size && merkle_tree[j + i] == merkle_tree[j + i2] {
+                    // Two identical hashes at the end of the list at a particular level.
+                    mutated = true;
+                }
+                let mut inner_hasher = Sha256::new();
+                inner_hasher.update(merkle_tree[j + i]);
+                inner_hasher.update(merkle_tree[j + i2]);
+                merkle_tree.push(Sha256::digest(inner_hasher.finalize()));
+                i += 2;
+            }
+            j += size;
+            size = (size + 1) / 2;
+        }
+        (
+            merkle_tree
+                .last()
+                .copied()
+                .map(|root| root.into())
+                .unwrap_or([0; 32]),
+            mutated,
+        )
+    }
+
+    fn build_auth_data_root(&self) -> [u8; 32] {
+        fn next_pow2(x: u64) -> u64 {
+            // Fails if `x` is greater than `1u64 << 63`, but this can't occur because a
+            // block can't feasibly contain that many transactions.
+            1u64 << (64 - x.saturating_sub(1).leading_zeros())
+        }
+
+        let perfect_size = next_pow2(self.txs.len() as u64) as usize;
+        assert_eq!((perfect_size & (perfect_size - 1)), 0);
+        let expected_size = cmp::max(perfect_size * 2, 1) - 1; // The total number of nodes.
+        let mut tree = Vec::with_capacity(expected_size);
+
+        // Add the leaves to the tree. v1-v4 transactions will append empty leaves.
+        for tx in &self.txs {
+            tree.push(<[u8; 32]>::try_from(tx.auth_commitment().as_bytes()).unwrap());
+        }
+        // Append empty leaves until we get a perfect tree.
+        tree.resize(perfect_size, [0; 32]);
+
+        let mut j = 0;
+        let mut layer_width = perfect_size;
+        while layer_width > 1 {
+            let mut i = 0;
+            while i < layer_width {
+                tree.push(
+                    blake2b_simd::Params::new()
+                        .hash_length(32)
+                        .personal(b"ZcashAuthDatHash")
+                        .to_state()
+                        .update(&tree[j + i])
+                        .update(&tree[j + i + 1])
+                        .finalize()
+                        .as_bytes()
+                        .try_into()
+                        .unwrap(),
+                );
+                i += 2;
+            }
+
+            // Move to the next layer.
+            j += layer_width;
+            layer_width /= 2;
+        }
+
+        assert_eq!(tree.len(), expected_size);
+        tree.last().copied().unwrap_or([0; 32])
+    }
+}
+
+pub(crate) fn inspect_header(header: &BlockHeader, context: Option<Context>) {
+    eprintln!("Zcash block header");
+    inspect_header_inner(
+        header,
+        guess_params(header).or_else(|| context.and_then(|c| c.network())),
+    );
+}
+
+fn inspect_header_inner(header: &BlockHeader, params: Option<Network>) {
+    eprintln!(" - Hash: {}", header.hash());
+    eprintln!(" - Version: {}", header.version);
+    if header.version < MIN_BLOCK_VERSION {
+        // zcashd: version-too-low
+        eprintln!("⚠️  Version too low",);
+    }
+    if let Some(params) = params {
+        if let Err(e) = check_equihash_solution(header, params) {
+            // zcashd: invalid-solution
+            eprintln!("⚠️  Invalid Equihash solution: {}", e);
+        }
+        if let Err(e) = check_proof_of_work(header, params) {
+            // zcashd: high-hash
+            eprintln!("⚠️  Invalid Proof-of-Work: {}", e);
+        }
+    } else {
+        eprintln!("🔎 To check contextual rules, add \"network\" to context (either \"main\" or \"test\")");
+    }
+}
+
+pub(crate) fn inspect(block: &Block, context: Option<Context>) {
+    eprintln!("Zcash block");
+    let params = block
+        .guess_params()
+        .or_else(|| context.as_ref().and_then(|c| c.network()));
+    inspect_header_inner(&block.header, params);
+
+    let height = match block.txs.len() {
+        0 => {
+            // zcashd: bad-cb-missing
+            eprintln!("⚠️  Missing coinbase transaction");
+            None
+        }
+        txs => {
+            eprintln!(" - {} transaction(s) including coinbase", txs);
+
+            if !is_coinbase(&block.txs[0]) {
+                // zcashd: bad-cb-missing
+                eprintln!("⚠️  vtx[0] is not a coinbase transaction");
+                None
+            } else {
+                let height = block.extract_height();
+                match height {
+                    Some(h) => eprintln!(" - Height: {}", h),
+                    // zcashd: bad-cb-height
+                    None => eprintln!("⚠️  No height in coinbase transaction"),
+                }
+                height
+            }
+        }
+    };
+
+    for (i, tx) in block.txs.iter().enumerate().skip(1) {
+        if is_coinbase(tx) {
+            // zcashd: bad-cb-multiple
+            eprintln!("⚠️  vtx[{}] is a coinbase transaction", i);
+        }
+    }
+
+    let (merkle_root, merkle_root_mutated) = block.build_merkle_root();
+    if merkle_root != block.header.merkle_root {
+        // zcashd: bad-txnmrklroot
+        eprintln!("⚠️  header.merkleroot doesn't match transaction Merkle tree root");
+        eprintln!("   - merkleroot (calc): {}", ZUint256(merkle_root));
+        eprintln!(
+            "   - header.merkleroot: {}",
+            ZUint256(block.header.merkle_root)
+        );
+    }
+    if merkle_root_mutated {
+        // zcashd: bad-txns-duplicate
+        eprintln!("⚠️  Transaction Merkle tree is malleable");
+    }
+
+    // The rest of the checks require network parameters and a block height.
+    let (params, height) = match (params, height) {
+        (Some(params), Some(height)) => (params, height),
+        _ => return,
+    };
+
+    if params.is_nu_active(NetworkUpgrade::Nu5, height) {
+        if block.txs[0].expiry_height() != height {
+            // zcashd: bad-cb-height
+            eprintln!(
+                "⚠️  [NU5] coinbase expiry height ({}) doesn't match coinbase scriptSig height ({})",
+                block.txs[0].expiry_height(),
+                height
+            );
+        }
+
+        if let Some(chain_history_root) = context.and_then(|c| c.chainhistoryroot) {
+            let auth_data_root = block.build_auth_data_root();
+            let block_commitments_hash =
+                derive_block_commitments_hash(chain_history_root.0, auth_data_root);
+
+            if block_commitments_hash != block.header.final_sapling_root {
+                // zcashd: bad-block-commitments-hash
+                eprintln!(
+                    "⚠️  [NU5] header.blockcommitments doesn't match ZIP 244 block commitment"
+                );
+                eprintln!("   - chainhistoryroot:        {}", chain_history_root);
+                eprintln!("   - authdataroot:            {}", ZUint256(auth_data_root));
+                eprintln!(
+                    "   - blockcommitments (calc): {}",
+                    ZUint256(block_commitments_hash)
+                );
+                eprintln!(
+                    "   - header.blockcommitments: {}",
+                    ZUint256(block.header.final_sapling_root)
+                );
+            }
+        } else {
+            eprintln!("🔎 To check header.blockcommitments, add \"chainhistoryroot\" to context");
+        }
+    } else if Some(height) == params.activation_height(NetworkUpgrade::Heartwood) {
+        if block.header.final_sapling_root != [0; 32] {
+            // zcashd: bad-heartwood-root-in-block
+            eprintln!("⚠️  This is the block that activates Heartwood but header.blockcommitments is not null");
+        }
+    } else if params.is_nu_active(NetworkUpgrade::Heartwood, height) {
+        if let Some(chain_history_root) = context.and_then(|c| c.chainhistoryroot) {
+            if chain_history_root.0 != block.header.final_sapling_root {
+                // zcashd: bad-heartwood-root-in-block
+                eprintln!(
+                "⚠️  [Heartwood] header.blockcommitments doesn't match provided chain history root"
+            );
+                eprintln!("   - chainhistoryroot:        {}", chain_history_root);
+                eprintln!(
+                    "   - header.blockcommitments: {}",
+                    ZUint256(block.header.final_sapling_root)
+                );
+            }
+        } else {
+            eprintln!("🔎 To check header.blockcommitments, add \"chainhistoryroot\" to context");
+        }
+    }
+}
diff --git a/devtools/src/bin/inspect/context.rs b/devtools/src/bin/inspect/context.rs
new file mode 100644
index 0000000000..9f78cd42cb
--- /dev/null
+++ b/devtools/src/bin/inspect/context.rs
@@ -0,0 +1,325 @@
+use std::convert::TryFrom;
+use std::fmt;
+use std::str::FromStr;
+
+use serde::{
+    de::{Unexpected, Visitor},
+    Deserialize, Serialize, Serializer,
+};
+use zcash_primitives::{
+    consensus::Network,
+    legacy::Script,
+    transaction::components::{amount::NonNegativeAmount, transparent, TxOut},
+    zip32::AccountId,
+};
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct JsonNetwork(Network);
+
+struct JsonNetworkVisitor;
+
+impl<'de> Visitor<'de> for JsonNetworkVisitor {
+    type Value = JsonNetwork;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("either \"main\" or \"test\"")
+    }
+
+    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        match v {
+            "main" => Ok(JsonNetwork(Network::MainNetwork)),
+            "test" => Ok(JsonNetwork(Network::TestNetwork)),
+            _ => Err(serde::de::Error::invalid_value(
+                Unexpected::Str(v),
+                &"either \"main\" or \"test\"",
+            )),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for JsonNetwork {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_str(JsonNetworkVisitor)
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+struct JsonAccountId(AccountId);
+
+struct JsonAccountIdVisitor;
+
+impl<'de> Visitor<'de> for JsonAccountIdVisitor {
+    type Value = JsonAccountId;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("a u31")
+    }
+
+    fn visit_i64<E>(self, v: i64) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        u32::try_from(v)
+            .map_err(|_| E::custom(format!("u32 out of range: {}", v)))
+            .and_then(|a| {
+                AccountId::try_from(a).map_err(|e| E::custom(format!("AccountId invalid: {}", e)))
+            })
+            .map(JsonAccountId)
+    }
+
+    fn visit_i128<E>(self, v: i128) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        u32::try_from(v)
+            .map_err(|_| E::custom(format!("u32 out of range: {}", v)))
+            .and_then(|a| {
+                AccountId::try_from(a).map_err(|e| E::custom(format!("AccountId invalid: {}", e)))
+            })
+            .map(JsonAccountId)
+    }
+
+    fn visit_u64<E>(self, v: u64) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        u32::try_from(v)
+            .map_err(|_| E::custom(format!("u32 out of range: {}", v)))
+            .and_then(|a| {
+                AccountId::try_from(a).map_err(|e| E::custom(format!("AccountId invalid: {}", e)))
+            })
+            .map(JsonAccountId)
+    }
+
+    fn visit_u128<E>(self, v: u128) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        u32::try_from(v)
+            .map_err(|_| E::custom(format!("u32 out of range: {}", v)))
+            .and_then(|a| {
+                AccountId::try_from(a).map_err(|e| E::custom(format!("AccountId invalid: {}", e)))
+            })
+            .map(JsonAccountId)
+    }
+}
+
+impl<'de> Deserialize<'de> for JsonAccountId {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_u32(JsonAccountIdVisitor)
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct ZUint256(pub [u8; 32]);
+
+struct ZUint256Visitor;
+
+impl<'de> Visitor<'de> for ZUint256Visitor {
+    type Value = ZUint256;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("a hex-encoded 32-byte array")
+    }
+
+    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        let mut data = [0; 32];
+        hex::decode_to_slice(v, &mut data).map_err(|e| match e {
+            hex::FromHexError::InvalidHexCharacter { c, .. } => {
+                serde::de::Error::invalid_value(Unexpected::Char(c), &"valid hex character")
+            }
+            hex::FromHexError::OddLength => {
+                serde::de::Error::invalid_length(v.len(), &"an even-length string")
+            }
+            hex::FromHexError::InvalidStringLength => {
+                serde::de::Error::invalid_length(v.len(), &"a 64-character string")
+            }
+        })?;
+        data.reverse();
+        Ok(ZUint256(data))
+    }
+}
+
+impl<'de> Deserialize<'de> for ZUint256 {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_str(ZUint256Visitor)
+    }
+}
+
+impl fmt::Display for ZUint256 {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut data = self.0;
+        data.reverse();
+        formatter.write_str(&hex::encode(data))
+    }
+}
+
+#[derive(Clone, Debug)]
+struct ZOutputValue(NonNegativeAmount);
+
+struct ZOutputValueVisitor;
+
+impl<'de> Visitor<'de> for ZOutputValueVisitor {
+    type Value = ZOutputValue;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("a non-negative integer number of zatoshis")
+    }
+
+    fn visit_u64<E>(self, v: u64) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        NonNegativeAmount::from_u64(v)
+            .map(ZOutputValue)
+            .map_err(|e| match e {
+                zcash_protocol::value::BalanceError::Overflow => serde::de::Error::invalid_type(
+                    Unexpected::Unsigned(v),
+                    &"a valid zatoshi amount",
+                ),
+                zcash_protocol::value::BalanceError::Underflow => serde::de::Error::invalid_type(
+                    Unexpected::Unsigned(v),
+                    &"a non-negative zatoshi amount",
+                ),
+            })
+    }
+}
+
+impl<'de> Deserialize<'de> for ZOutputValue {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_u64(ZOutputValueVisitor)
+    }
+}
+
+impl Serialize for ZOutputValue {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_u64(u64::from(self.0))
+    }
+}
+
+#[derive(Clone, Debug)]
+struct ZScript(Script);
+
+struct ZScriptVisitor;
+
+impl<'de> Visitor<'de> for ZScriptVisitor {
+    type Value = ZScript;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("a hex-encoded Script")
+    }
+
+    fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+    where
+        E: serde::de::Error,
+    {
+        let data = hex::decode(v).map_err(|e| match e {
+            hex::FromHexError::InvalidHexCharacter { c, .. } => {
+                serde::de::Error::invalid_value(Unexpected::Char(c), &"valid hex character")
+            }
+            hex::FromHexError::OddLength => {
+                serde::de::Error::invalid_length(v.len(), &"an even-length string")
+            }
+            hex::FromHexError::InvalidStringLength => {
+                serde::de::Error::invalid_length(v.len(), &"a 64-character string")
+            }
+        })?;
+        Ok(ZScript(Script(data)))
+    }
+}
+
+impl<'de> Deserialize<'de> for ZScript {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_str(ZScriptVisitor)
+    }
+}
+
+impl Serialize for ZScript {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&hex::encode(&self.0 .0))
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+pub(crate) struct ZTxOut {
+    value: ZOutputValue,
+    script_pubkey: ZScript,
+}
+
+impl From<TxOut> for ZTxOut {
+    fn from(out: TxOut) -> Self {
+        ZTxOut {
+            value: ZOutputValue(out.value),
+            script_pubkey: ZScript(out.script_pubkey),
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct Context {
+    network: Option<JsonNetwork>,
+    accounts: Option<Vec<JsonAccountId>>,
+    pub(crate) chainhistoryroot: Option<ZUint256>,
+    transparentcoins: Option<Vec<ZTxOut>>,
+}
+
+impl FromStr for Context {
+    type Err = serde_json::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        serde_json::from_str(s)
+    }
+}
+
+impl Context {
+    pub(crate) fn network(&self) -> Option<Network> {
+        self.network.map(|n| n.0)
+    }
+
+    pub(crate) fn addr_network(&self) -> Option<zcash_address::Network> {
+        self.network().map(|params| match params {
+            Network::MainNetwork => zcash_address::Network::Main,
+            Network::TestNetwork => zcash_address::Network::Test,
+        })
+    }
+
+    pub(crate) fn accounts(&self) -> Option<Vec<AccountId>> {
+        self.accounts
+            .as_ref()
+            .map(|accounts| accounts.iter().map(|id| id.0).collect())
+    }
+
+    pub(crate) fn transparent_coins(&self) -> Option<Vec<transparent::TxOut>> {
+        self.transparentcoins.as_ref().map(|coins| {
+            coins
+                .iter()
+                .cloned()
+                .map(|coin| transparent::TxOut {
+                    value: coin.value.0,
+                    script_pubkey: coin.script_pubkey.0,
+                })
+                .collect()
+        })
+    }
+}
diff --git a/devtools/src/bin/inspect/keys.rs b/devtools/src/bin/inspect/keys.rs
new file mode 100644
index 0000000000..4a5ad8ac82
--- /dev/null
+++ b/devtools/src/bin/inspect/keys.rs
@@ -0,0 +1,250 @@
+use std::convert::TryInto;
+use std::iter;
+
+use bech32::{FromBase32, ToBase32};
+use secrecy::Zeroize;
+use zcash_address::{
+    unified::{self, Encoding},
+    ToAddress, ZcashAddress,
+};
+use zcash_keys::keys::{UnifiedAddressRequest, UnifiedFullViewingKey};
+use zcash_primitives::{
+    legacy::{
+        keys::{AccountPrivKey, IncomingViewingKey},
+        TransparentAddress,
+    },
+    zip32,
+};
+use zcash_protocol::{
+    consensus::{Network, NetworkConstants, NetworkType},
+    local_consensus::LocalNetwork,
+};
+
+use crate::Context;
+
+pub(crate) mod view;
+
+pub(crate) fn inspect_mnemonic(mnemonic: bip0039::Mnemonic, context: Option<Context>) {
+    eprintln!("Mnemonic phrase");
+    eprintln!(" - Language: English");
+
+    if let Some(((network, addr_net), accounts)) =
+        context.and_then(|c| c.network().zip(c.addr_network()).zip(c.accounts()))
+    {
+        let mut seed = mnemonic.to_seed("");
+        for account in accounts {
+            eprintln!(" - Account {}:", u32::from(account));
+
+            let orchard_fvk = match orchard::keys::SpendingKey::from_zip32_seed(
+                &seed,
+                network.coin_type(),
+                account,
+            ) {
+                Ok(sk) => Some(orchard::keys::FullViewingKey::from(&sk)),
+                Err(e) => {
+                    eprintln!(
+                        "  ⚠️  No valid Orchard key for this account under this seed: {}",
+                        e
+                    );
+                    None
+                }
+            };
+
+            eprintln!("   - Sapling:");
+            let sapling_master = sapling::zip32::ExtendedSpendingKey::master(&seed);
+            let sapling_extsk = sapling::zip32::ExtendedSpendingKey::from_path(
+                &sapling_master,
+                &[
+                    zip32::ChildIndex::hardened(32),
+                    zip32::ChildIndex::hardened(network.coin_type()),
+                    account.into(),
+                ],
+            );
+            #[allow(deprecated)]
+            let sapling_extfvk = sapling_extsk.to_extended_full_viewing_key();
+            let sapling_default_addr = sapling_extfvk.default_address();
+
+            let mut sapling_extsk_bytes = vec![];
+            sapling_extsk.write(&mut sapling_extsk_bytes).unwrap();
+            eprintln!(
+                "     - ExtSK:  {}",
+                bech32::encode(
+                    network.hrp_sapling_extended_spending_key(),
+                    sapling_extsk_bytes.to_base32(),
+                    bech32::Variant::Bech32,
+                )
+                .unwrap(),
+            );
+
+            let mut sapling_extfvk_bytes = vec![];
+            sapling_extfvk.write(&mut sapling_extfvk_bytes).unwrap();
+            eprintln!(
+                "     - ExtFVK: {}",
+                bech32::encode(
+                    network.hrp_sapling_extended_full_viewing_key(),
+                    sapling_extfvk_bytes.to_base32(),
+                    bech32::Variant::Bech32,
+                )
+                .unwrap(),
+            );
+
+            let sapling_addr_bytes = sapling_default_addr.1.to_bytes();
+            eprintln!(
+                "     - Default address: {}",
+                bech32::encode(
+                    network.hrp_sapling_payment_address(),
+                    sapling_addr_bytes.to_base32(),
+                    bech32::Variant::Bech32,
+                )
+                .unwrap(),
+            );
+
+            let transparent_fvk = match AccountPrivKey::from_seed(&network, &seed, account)
+                .map(|sk| sk.to_account_pubkey())
+            {
+                Ok(fvk) => {
+                    eprintln!("   - Transparent:");
+                    match fvk.derive_external_ivk().map(|ivk| ivk.default_address().0) {
+                        Ok(addr) => eprintln!(
+                            "     - Default address: {}",
+                            match addr {
+                                TransparentAddress::PublicKeyHash(data) => ZcashAddress::from_transparent_p2pkh(addr_net, data),
+                                TransparentAddress::ScriptHash(_) => unreachable!(),
+                            }.encode(),
+                        ),
+                        Err(e) => eprintln!(
+                            "    ⚠️  No valid transparent default address for this account under this seed: {:?}",
+                            e
+                        ),
+                    }
+
+                    Some(fvk)
+                }
+                Err(e) => {
+                    eprintln!(
+                        "  ⚠️  No valid transparent key for this account under this seed: {:?}",
+                        e
+                    );
+                    None
+                }
+            };
+
+            let items: Vec<_> = iter::empty()
+                .chain(
+                    orchard_fvk
+                        .map(|fvk| fvk.to_bytes())
+                        .map(unified::Fvk::Orchard),
+                )
+                .chain(Some(unified::Fvk::Sapling(
+                    sapling_extfvk_bytes[41..].try_into().unwrap(),
+                )))
+                .chain(
+                    transparent_fvk
+                        .map(|fvk| fvk.serialize()[..].try_into().unwrap())
+                        .map(unified::Fvk::P2pkh),
+                )
+                .collect();
+            let item_names: Vec<_> = items
+                .iter()
+                .map(|item| match item {
+                    unified::Fvk::Orchard(_) => "Orchard",
+                    unified::Fvk::Sapling(_) => "Sapling",
+                    unified::Fvk::P2pkh(_) => "Transparent",
+                    unified::Fvk::Unknown { .. } => unreachable!(),
+                })
+                .collect();
+
+            eprintln!("   - Unified ({}):", item_names.join(", "));
+            let ufvk = unified::Ufvk::try_from_items(items).unwrap();
+            eprintln!("     - UFVK: {}", ufvk.encode(&addr_net));
+        }
+        seed.zeroize();
+    } else {
+        eprintln!("🔎 To show account details, add \"network\" (either \"main\" or \"test\") and \"accounts\" array to context");
+    }
+
+    eprintln!();
+    eprintln!(
+        "WARNING: This mnemonic phrase is now likely cached in your terminal's history buffer."
+    );
+}
+
+pub(crate) fn inspect_sapling_extsk(
+    raw: Vec<bech32::u5>,
+    variant: bech32::Variant,
+    network: NetworkType,
+) {
+    match Vec::<u8>::from_base32(&raw)
+        .map_err(|_| ())
+        .and_then(|data| sapling::zip32::ExtendedSpendingKey::read(&data[..]).map_err(|_| ()))
+    {
+        Err(_) => {
+            eprintln!("Invalid encoding that claims to be a Sapling extended spending key");
+        }
+        Ok(extsk) => {
+            eprintln!("Sapling extended spending key");
+            match variant {
+                bech32::Variant::Bech32 => (),
+                bech32::Variant::Bech32m => eprintln!("⚠️  Incorrectly encoded with Bech32m"),
+            }
+
+            let default_addr_bytes = extsk.default_address().1.to_bytes();
+            eprintln!(
+                "- Default address: {}",
+                bech32::encode(
+                    network.hrp_sapling_payment_address(),
+                    default_addr_bytes.to_base32(),
+                    bech32::Variant::Bech32,
+                )
+                .unwrap(),
+            );
+
+            #[allow(deprecated)]
+            if let Ok(ufvk) = UnifiedFullViewingKey::from_sapling_extended_full_viewing_key(
+                extsk.to_extended_full_viewing_key(),
+            ) {
+                let encoded_ufvk = match network {
+                    NetworkType::Main => ufvk.encode(&Network::MainNetwork),
+                    NetworkType::Test => ufvk.encode(&Network::TestNetwork),
+                    NetworkType::Regtest => ufvk.encode(&LocalNetwork {
+                        overwinter: None,
+                        sapling: None,
+                        blossom: None,
+                        heartwood: None,
+                        canopy: None,
+                        nu5: None,
+                        nu6: None,
+                        nu7: None,
+                        #[cfg(zcash_unstable = "zfuture")]
+                        z_future: None,
+                    }),
+                };
+                eprintln!("- UFVK: {encoded_ufvk}");
+
+                let (default_ua, _) = ufvk
+                    .default_address(UnifiedAddressRequest::unsafe_new(false, true, false))
+                    .expect("should exist");
+                let encoded_ua = match network {
+                    NetworkType::Main => default_ua.encode(&Network::MainNetwork),
+                    NetworkType::Test => default_ua.encode(&Network::TestNetwork),
+                    NetworkType::Regtest => default_ua.encode(&LocalNetwork {
+                        overwinter: None,
+                        sapling: None,
+                        blossom: None,
+                        heartwood: None,
+                        canopy: None,
+                        nu5: None,
+                        nu6: None,
+                        nu7: None,
+                        #[cfg(zcash_unstable = "zfuture")]
+                        z_future: None,
+                    }),
+                };
+                eprintln!("  - Default address: {encoded_ua}");
+            }
+        }
+    }
+
+    eprintln!();
+    eprintln!("WARNING: This spending key is now likely cached in your terminal's history buffer.");
+}
diff --git a/devtools/src/bin/inspect/keys/view.rs b/devtools/src/bin/inspect/keys/view.rs
new file mode 100644
index 0000000000..33d189c758
--- /dev/null
+++ b/devtools/src/bin/inspect/keys/view.rs
@@ -0,0 +1,165 @@
+use bech32::{FromBase32, ToBase32};
+use zcash_address::unified::{self, Container, Encoding};
+use zcash_keys::keys::{UnifiedAddressRequest, UnifiedFullViewingKey};
+use zcash_protocol::{
+    consensus::{Network, NetworkConstants, NetworkType},
+    local_consensus::LocalNetwork,
+};
+
+pub(crate) fn inspect_ufvk(ufvk: unified::Ufvk, network: NetworkType) {
+    eprintln!("Unified full viewing key");
+    eprintln!(
+        " - Network: {}",
+        match network {
+            NetworkType::Main => "main",
+            NetworkType::Test => "testnet",
+            NetworkType::Regtest => "regtest",
+        }
+    );
+    eprintln!(" - Items:");
+    for item in ufvk.items() {
+        match item {
+            unified::Fvk::Orchard(data) => {
+                eprintln!(
+                    "   - Orchard ({})",
+                    unified::Ufvk::try_from_items(vec![unified::Fvk::Orchard(data)])
+                        .unwrap()
+                        .encode(&network)
+                );
+            }
+            unified::Fvk::Sapling(data) => {
+                eprintln!(
+                    "   - Sapling ({})",
+                    bech32::encode(
+                        network.hrp_sapling_extended_full_viewing_key(),
+                        data.to_base32(),
+                        bech32::Variant::Bech32,
+                    )
+                    .unwrap(),
+                );
+            }
+            unified::Fvk::P2pkh(data) => {
+                eprintln!("   - Transparent P2PKH");
+                eprintln!("     - Payload: {}", hex::encode(data));
+            }
+            unified::Fvk::Unknown { typecode, data } => {
+                eprintln!("   - Unknown");
+                eprintln!("     - Typecode: {}", typecode);
+                eprintln!("     - Payload: {}", hex::encode(data));
+            }
+        }
+    }
+}
+
+pub(crate) fn inspect_uivk(uivk: unified::Uivk, network: NetworkType) {
+    eprintln!("Unified incoming viewing key");
+    eprintln!(
+        " - Network: {}",
+        match network {
+            NetworkType::Main => "main",
+            NetworkType::Test => "testnet",
+            NetworkType::Regtest => "regtest",
+        }
+    );
+    eprintln!(" - Items:");
+    for item in uivk.items() {
+        match item {
+            unified::Ivk::Orchard(data) => {
+                eprintln!(
+                    "   - Orchard ({})",
+                    unified::Uivk::try_from_items(vec![unified::Ivk::Orchard(data)])
+                        .unwrap()
+                        .encode(&network)
+                );
+            }
+            unified::Ivk::Sapling(data) => {
+                eprintln!("   - Sapling");
+                eprintln!("     - Payload: {}", hex::encode(data));
+            }
+            unified::Ivk::P2pkh(data) => {
+                eprintln!("   - Transparent P2PKH");
+                eprintln!("     - Payload: {}", hex::encode(data));
+            }
+            unified::Ivk::Unknown { typecode, data } => {
+                eprintln!("   - Unknown");
+                eprintln!("     - Typecode: {}", typecode);
+                eprintln!("     - Payload: {}", hex::encode(data));
+            }
+        }
+    }
+}
+
+pub(crate) fn inspect_sapling_extfvk(
+    raw: Vec<bech32::u5>,
+    variant: bech32::Variant,
+    network: NetworkType,
+) {
+    match Vec::<u8>::from_base32(&raw)
+        .map_err(|_| ())
+        .and_then(|data| sapling::zip32::ExtendedFullViewingKey::read(&data[..]).map_err(|_| ()))
+    {
+        Err(_) => {
+            eprintln!("Invalid encoding that claims to be a Sapling extended full viewing key");
+        }
+        Ok(extfvk) => {
+            eprintln!("Sapling extended full viewing key");
+            match variant {
+                bech32::Variant::Bech32 => (),
+                bech32::Variant::Bech32m => eprintln!("⚠️  Incorrectly encoded with Bech32m"),
+            }
+
+            let default_addr_bytes = extfvk.default_address().1.to_bytes();
+            eprintln!(
+                "- Default address: {}",
+                bech32::encode(
+                    network.hrp_sapling_payment_address(),
+                    default_addr_bytes.to_base32(),
+                    bech32::Variant::Bech32,
+                )
+                .unwrap(),
+            );
+
+            if let Ok(ufvk) = UnifiedFullViewingKey::from_sapling_extended_full_viewing_key(extfvk)
+            {
+                let encoded_ufvk = match network {
+                    NetworkType::Main => ufvk.encode(&Network::MainNetwork),
+                    NetworkType::Test => ufvk.encode(&Network::TestNetwork),
+                    NetworkType::Regtest => ufvk.encode(&LocalNetwork {
+                        overwinter: None,
+                        sapling: None,
+                        blossom: None,
+                        heartwood: None,
+                        canopy: None,
+                        nu5: None,
+                        nu6: None,
+                        nu7: None,
+                        #[cfg(zcash_unstable = "zfuture")]
+                        z_future: None,
+                    }),
+                };
+                eprintln!("- Equivalent UFVK: {encoded_ufvk}");
+
+                let (default_ua, _) = ufvk
+                    .default_address(UnifiedAddressRequest::unsafe_new(false, true, false))
+                    .expect("should exist");
+                let encoded_ua = match network {
+                    NetworkType::Main => default_ua.encode(&Network::MainNetwork),
+                    NetworkType::Test => default_ua.encode(&Network::TestNetwork),
+                    NetworkType::Regtest => default_ua.encode(&LocalNetwork {
+                        overwinter: None,
+                        sapling: None,
+                        blossom: None,
+                        heartwood: None,
+                        canopy: None,
+                        nu5: None,
+                        nu6: None,
+                        nu7: None,
+                        #[cfg(zcash_unstable = "zfuture")]
+                        z_future: None,
+                    }),
+                };
+                eprintln!("  - Default address: {encoded_ua}");
+            }
+        }
+    }
+}
diff --git a/devtools/src/bin/inspect/lookup.rs b/devtools/src/bin/inspect/lookup.rs
new file mode 100644
index 0000000000..8a902f378d
--- /dev/null
+++ b/devtools/src/bin/inspect/lookup.rs
@@ -0,0 +1,85 @@
+use tonic::transport::{Channel, ClientTlsConfig};
+use zcash_client_backend::proto::service::{
+    compact_tx_streamer_client::CompactTxStreamerClient, TxFilter,
+};
+use zcash_primitives::transaction::Transaction;
+use zcash_protocol::consensus::{BlockHeight, BranchId, Network};
+
+const MAINNET: Server = Server {
+    host: "zec.rocks",
+    port: 443,
+};
+
+const TESTNET: Server = Server {
+    host: "testnet.zec.rocks",
+    port: 443,
+};
+
+struct Server {
+    host: &'static str,
+    port: u16,
+}
+
+impl Server {
+    fn endpoint(&self) -> String {
+        format!("https://{}:{}", self.host, self.port)
+    }
+}
+
+async fn connect(server: &Server) -> anyhow::Result<CompactTxStreamerClient<Channel>> {
+    let channel = Channel::from_shared(server.endpoint())?;
+
+    let tls = ClientTlsConfig::new()
+        .domain_name(server.host.to_string())
+        .with_webpki_roots();
+    let channel = channel.tls_config(tls)?;
+
+    Ok(CompactTxStreamerClient::new(channel.connect().await?))
+}
+
+#[derive(Debug)]
+pub(crate) struct Lightwalletd {
+    inner: CompactTxStreamerClient<Channel>,
+    parameters: Network,
+}
+
+impl Lightwalletd {
+    pub(crate) async fn mainnet() -> anyhow::Result<Self> {
+        Ok(Self {
+            inner: connect(&MAINNET).await?,
+            parameters: Network::MainNetwork,
+        })
+    }
+
+    pub(crate) async fn testnet() -> anyhow::Result<Self> {
+        Ok(Self {
+            inner: connect(&TESTNET).await?,
+            parameters: Network::TestNetwork,
+        })
+    }
+
+    pub(crate) async fn lookup_txid(
+        &mut self,
+        candidate: [u8; 32],
+    ) -> Option<(Transaction, Option<BlockHeight>)> {
+        let request = TxFilter {
+            hash: candidate.into(),
+            ..Default::default()
+        };
+        let response = self.inner.get_transaction(request).await.ok()?.into_inner();
+
+        // `RawTransaction.height` has type u64 in the protobuf format, but is documented
+        // as using -1 for the "not mined" sentinel. Given that we only support u32 block
+        // heights, -1 in two's complement will fall outside that range.
+        let mined_height = response.height.try_into().ok();
+
+        Transaction::read(
+            &response.data[..],
+            mined_height
+                .map(|height| BranchId::for_height(&self.parameters, height))
+                .unwrap_or(BranchId::Nu5),
+        )
+        .ok()
+        .map(|tx| (tx, mined_height))
+    }
+}
diff --git a/devtools/src/bin/inspect/main.rs b/devtools/src/bin/inspect/main.rs
new file mode 100644
index 0000000000..03869a4f00
--- /dev/null
+++ b/devtools/src/bin/inspect/main.rs
@@ -0,0 +1,201 @@
+use std::env;
+use std::io;
+use std::io::Cursor;
+use std::process;
+
+use gumdrop::{Options, ParsingStyle};
+use lazy_static::lazy_static;
+use secrecy::Zeroize;
+use tokio::runtime::Runtime;
+use zcash_address::{
+    unified::{self, Encoding},
+    ZcashAddress,
+};
+use zcash_primitives::{block::BlockHeader, consensus::BranchId, transaction::Transaction};
+use zcash_proofs::{default_params_folder, load_parameters, ZcashParameters};
+use zcash_protocol::consensus::NetworkType;
+
+mod context;
+use context::{Context, ZUint256};
+use zcash_protocol::constants;
+
+mod address;
+mod block;
+mod keys;
+mod lookup;
+mod transaction;
+
+lazy_static! {
+    static ref GROTH16_PARAMS: ZcashParameters = {
+        let folder = default_params_folder().unwrap();
+        load_parameters(
+            &folder.join("sapling-spend.params"),
+            &folder.join("sapling-output.params"),
+            Some(&folder.join("sprout-groth16.params")),
+        )
+    };
+    static ref ORCHARD_VK: orchard::circuit::VerifyingKey = orchard::circuit::VerifyingKey::build();
+}
+
+#[derive(Debug, Options)]
+struct CliOptions {
+    #[options(help = "Print this help output")]
+    help: bool,
+
+    #[options(help = "Query information from the chain to help determine what the data is")]
+    lookup: bool,
+
+    #[options(free, required, help = "String or hex-encoded bytes to inspect")]
+    data: String,
+
+    #[options(
+        free,
+        help = "JSON object with keys corresponding to requested context information"
+    )]
+    context: Option<Context>,
+}
+
+fn main() {
+    let args = env::args().collect::<Vec<_>>();
+    let mut opts =
+        CliOptions::parse_args(&args[1..], ParsingStyle::default()).unwrap_or_else(|e| {
+            eprintln!("{}: {}", args[0], e);
+            process::exit(2);
+        });
+
+    if opts.help_requested() {
+        println!("Usage: {} data [context]", args[0]);
+        println!();
+        println!("{}", CliOptions::usage());
+        return;
+    }
+
+    if let Ok(mnemonic) = bip0039::Mnemonic::from_phrase(&opts.data) {
+        opts.data.zeroize();
+        keys::inspect_mnemonic(mnemonic, opts.context);
+    } else if let Ok(bytes) = hex::decode(&opts.data) {
+        inspect_bytes(bytes, opts.context, opts.lookup);
+    } else if let Ok(addr) = ZcashAddress::try_from_encoded(&opts.data) {
+        address::inspect(addr);
+    } else if let Ok((network, uivk)) = unified::Uivk::decode(&opts.data) {
+        keys::view::inspect_uivk(uivk, network);
+    } else if let Ok((network, ufvk)) = unified::Ufvk::decode(&opts.data) {
+        keys::view::inspect_ufvk(ufvk, network);
+    } else if let Ok((hrp, data, variant)) = bech32::decode(&opts.data) {
+        match hrp.as_str() {
+            constants::mainnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY => {
+                keys::view::inspect_sapling_extfvk(data, variant, NetworkType::Main);
+            }
+            constants::testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY => {
+                keys::view::inspect_sapling_extfvk(data, variant, NetworkType::Test);
+            }
+            constants::regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY => {
+                keys::view::inspect_sapling_extfvk(data, variant, NetworkType::Regtest);
+            }
+            constants::mainnet::HRP_SAPLING_EXTENDED_SPENDING_KEY => {
+                keys::inspect_sapling_extsk(data, variant, NetworkType::Main);
+            }
+            constants::testnet::HRP_SAPLING_EXTENDED_SPENDING_KEY => {
+                keys::inspect_sapling_extsk(data, variant, NetworkType::Test);
+            }
+            constants::regtest::HRP_SAPLING_EXTENDED_SPENDING_KEY => {
+                keys::inspect_sapling_extsk(data, variant, NetworkType::Regtest);
+            }
+            _ => {
+                // Unknown data format.
+                eprintln!("String does not match known Zcash data formats.");
+                process::exit(2);
+            }
+        }
+    } else {
+        // Unknown data format.
+        eprintln!("String does not match known Zcash data formats.");
+        process::exit(2);
+    }
+}
+
+/// Ensures that the given reader completely consumes the given bytes.
+fn complete<F, T>(bytes: &[u8], f: F) -> Option<T>
+where
+    F: FnOnce(&mut Cursor<&[u8]>) -> io::Result<T>,
+{
+    let mut cursor = Cursor::new(bytes);
+    let res = f(&mut cursor);
+    res.ok().and_then(|t| {
+        if cursor.position() >= bytes.len() as u64 {
+            Some(t)
+        } else {
+            None
+        }
+    })
+}
+
+fn inspect_bytes(bytes: Vec<u8>, context: Option<Context>, lookup: bool) {
+    if let Some(block) = complete(&bytes, |r| block::Block::read(r)) {
+        block::inspect(&block, context);
+    } else if let Some(header) = complete(&bytes, |r| BlockHeader::read(r)) {
+        block::inspect_header(&header, context);
+    } else if let Some(tx) = complete(&bytes, |r| Transaction::read(r, BranchId::Nu5)) {
+        // TODO: Take the branch ID used above from the context if present.
+        // https://github.com/zcash/zcash/issues/6831
+        transaction::inspect(tx, context, None);
+    } else {
+        // It's not a known variable-length format. check fixed-length data formats.
+        match bytes.len() {
+            32 => inspect_possible_hash(bytes.try_into().unwrap(), context, lookup),
+            64 => {
+                // Could be a signature
+                eprintln!("This is most likely a signature.");
+            }
+            _ => {
+                eprintln!("Binary data does not match known Zcash data formats.");
+                process::exit(2);
+            }
+        }
+    }
+}
+
+fn inspect_possible_hash(bytes: [u8; 32], context: Option<Context>, lookup: bool) {
+    let maybe_mainnet_block_hash = bytes.iter().take(4).all(|c| c == &0);
+
+    if lookup {
+        // Block hashes and txids are byte-reversed; we didn't do this when parsing the
+        // original hex because other hex byte encodings are not byte-reversed.
+        let mut candidate = bytes;
+        candidate.reverse();
+
+        let rt = Runtime::new().unwrap();
+        let found = rt.block_on(async {
+            match lookup::Lightwalletd::mainnet().await {
+                Err(e) => eprintln!("Error: Failed to connect to mainnet lightwalletd: {:?}", e),
+                Ok(mut mainnet) => {
+                    if let Some((tx, mined_height)) = mainnet.lookup_txid(candidate).await {
+                        transaction::inspect(tx, context, mined_height);
+                        return true;
+                    }
+                }
+            };
+
+            match lookup::Lightwalletd::testnet().await {
+                Err(e) => eprintln!("Error: Failed to connect to testnet lightwalletd: {:?}", e),
+                Ok(mut testnet) => {
+                    if let Some((tx, mined_height)) = testnet.lookup_txid(candidate).await {
+                        transaction::inspect(tx, context, mined_height);
+                        return true;
+                    }
+                }
+            };
+
+            false
+        });
+
+        if found {
+            return;
+        }
+    }
+
+    eprintln!("This is most likely a hash of some sort, or maybe a commitment or nullifier.");
+    if maybe_mainnet_block_hash {
+        eprintln!("- It could be a mainnet block hash.");
+    }
+}
diff --git a/devtools/src/bin/inspect/transaction.rs b/devtools/src/bin/inspect/transaction.rs
new file mode 100644
index 0000000000..2e7f0b56d6
--- /dev/null
+++ b/devtools/src/bin/inspect/transaction.rs
@@ -0,0 +1,573 @@
+use std::{
+    collections::HashMap,
+    convert::{TryFrom, TryInto},
+};
+
+use bellman::groth16;
+use group::GroupEncoding;
+use orchard::note_encryption::OrchardDomain;
+use sapling::{note_encryption::SaplingDomain, SaplingVerificationContext};
+use secp256k1::{Secp256k1, VerifyOnly};
+use zcash_address::{
+    unified::{self, Encoding},
+    ToAddress, ZcashAddress,
+};
+use zcash_note_encryption::try_output_recovery_with_ovk;
+#[allow(deprecated)]
+use zcash_primitives::{
+    consensus::BlockHeight,
+    legacy::{keys::pubkey_to_address, Script, TransparentAddress},
+    memo::{Memo, MemoBytes},
+    transaction::{
+        components::{amount::NonNegativeAmount, sapling as sapling_serialization, transparent},
+        sighash::{signature_hash, SignableInput, TransparentAuthorizingContext},
+        txid::TxIdDigester,
+        Authorization, Transaction, TransactionData, TxId, TxVersion,
+    },
+};
+
+use crate::{
+    context::{Context, ZTxOut},
+    GROTH16_PARAMS, ORCHARD_VK,
+};
+
+#[cfg(zcash_unstable = "tze")]
+use zcash_primitives::transaction::components::tze;
+
+pub fn is_coinbase(tx: &Transaction) -> bool {
+    tx.transparent_bundle()
+        .map(|b| b.is_coinbase())
+        .unwrap_or(false)
+}
+
+pub fn extract_height_from_coinbase(tx: &Transaction) -> Option<BlockHeight> {
+    const OP_0: u8 = 0x00;
+    const OP_1NEGATE: u8 = 0x4f;
+    const OP_1: u8 = 0x51;
+    const OP_16: u8 = 0x60;
+
+    tx.transparent_bundle()
+        .and_then(|bundle| bundle.vin.first())
+        .and_then(|input| match input.script_sig.0.first().copied() {
+            // {0, -1} will never occur as the first byte of a coinbase scriptSig.
+            Some(OP_0 | OP_1NEGATE) => None,
+            // Blocks 1 to 16.
+            Some(h @ OP_1..=OP_16) => Some(BlockHeight::from_u32((h - OP_1 + 1).into())),
+            // All other heights use CScriptNum encoding, which will never be longer
+            // than 5 bytes for Zcash heights. These have the format
+            // `[len(encoding)] || encoding`.
+            Some(h @ 1..=5) => {
+                let rest = &input.script_sig.0[1..];
+                let encoding_len = h as usize;
+                if rest.len() < encoding_len {
+                    None
+                } else {
+                    // Parse the encoding.
+                    let encoding = &rest[..encoding_len];
+                    if encoding.last().unwrap() & 0x80 != 0 {
+                        // Height is never negative.
+                        None
+                    } else {
+                        let mut height: u64 = 0;
+                        for (i, b) in encoding.iter().enumerate() {
+                            height |= (*b as u64) << (8 * i);
+                        }
+                        height.try_into().ok()
+                    }
+                }
+            }
+            // Anything else is an invalid height encoding.
+            _ => None,
+        })
+}
+
+fn render_value(value: u64) -> String {
+    format!(
+        "{} zatoshis ({} ZEC)",
+        value,
+        (value as f64) / 1_0000_0000f64
+    )
+}
+
+fn render_memo(memo_bytes: MemoBytes) -> String {
+    match Memo::try_from(memo_bytes) {
+        Ok(Memo::Empty) => "No memo".to_string(),
+        Ok(Memo::Text(memo)) => format!("Text memo: '{}'", String::from(memo)),
+        Ok(memo) => format!("{:?}", memo),
+        Err(e) => format!("Invalid memo: {}", e),
+    }
+}
+
+#[derive(Clone, Debug)]
+pub(crate) struct TransparentAuth {
+    all_prev_outputs: Vec<transparent::TxOut>,
+}
+
+impl transparent::Authorization for TransparentAuth {
+    type ScriptSig = Script;
+}
+
+impl TransparentAuthorizingContext for TransparentAuth {
+    fn input_amounts(&self) -> Vec<NonNegativeAmount> {
+        self.all_prev_outputs
+            .iter()
+            .map(|prevout| prevout.value)
+            .collect()
+    }
+
+    fn input_scriptpubkeys(&self) -> Vec<Script> {
+        self.all_prev_outputs
+            .iter()
+            .map(|prevout| prevout.script_pubkey.clone())
+            .collect()
+    }
+}
+
+struct MapTransparent {
+    auth: TransparentAuth,
+}
+
+impl transparent::MapAuth<transparent::Authorized, TransparentAuth> for MapTransparent {
+    fn map_script_sig(
+        &self,
+        s: <transparent::Authorized as transparent::Authorization>::ScriptSig,
+    ) -> <TransparentAuth as transparent::Authorization>::ScriptSig {
+        s
+    }
+
+    fn map_authorization(&self, _: transparent::Authorized) -> TransparentAuth {
+        // TODO: This map should consume self, so we can move self.auth
+        self.auth.clone()
+    }
+}
+
+pub(crate) struct PrecomputedAuth;
+
+impl Authorization for PrecomputedAuth {
+    type TransparentAuth = TransparentAuth;
+    type SaplingAuth = sapling::bundle::Authorized;
+    type OrchardAuth = orchard::bundle::Authorized;
+
+    #[cfg(zcash_unstable = "tze")]
+    type TzeAuth = tze::Authorized;
+}
+
+pub(crate) fn inspect(
+    tx: Transaction,
+    context: Option<Context>,
+    mined_height: Option<BlockHeight>,
+) {
+    eprintln!("Zcash transaction");
+    eprintln!(" - ID: {}", tx.txid());
+    if let Some(height) = mined_height {
+        eprintln!(" - Mined in block {}", height);
+    }
+    eprintln!(" - Version: {:?}", tx.version());
+    match tx.version() {
+        // TODO: If pre-v5 and no branch ID provided in context, disable signature checks.
+        TxVersion::Sprout(_) | TxVersion::Overwinter | TxVersion::Sapling => (),
+        TxVersion::Zip225 => {
+            eprintln!(" - Consensus branch ID: {:?}", tx.consensus_branch_id());
+        }
+        TxVersion::Zip230 => {
+            eprintln!(" - Consensus branch ID: {:?}", tx.consensus_branch_id());
+        }
+        #[cfg(zcash_unstable = "zfuture")]
+        TxVersion::ZFuture => {
+            eprintln!(" - Consensus branch ID: {:?}", tx.consensus_branch_id());
+        }
+    }
+
+    let is_coinbase = is_coinbase(&tx);
+    let height = if is_coinbase {
+        eprintln!(" - Coinbase");
+        extract_height_from_coinbase(&tx)
+    } else {
+        None
+    };
+
+    let transparent_coins = match (
+        tx.transparent_bundle().map_or(false, |b| !b.vin.is_empty()),
+        context.as_ref().and_then(|ctx| ctx.transparent_coins()),
+    ) {
+        (true, coins) => coins,
+        (false, Some(_)) => {
+            eprintln!("⚠️  Context was given \"transparentcoins\" but this transaction has no transparent inputs");
+            Some(vec![])
+        }
+        (false, None) => Some(vec![]),
+    };
+
+    let sighash_params = transparent_coins.as_ref().map(|coins| {
+        let f_transparent = MapTransparent {
+            auth: TransparentAuth {
+                all_prev_outputs: coins.clone(),
+            },
+        };
+
+        // We don't have tx.clone()
+        let mut buf = vec![];
+        tx.write(&mut buf).unwrap();
+        let tx = Transaction::read(&buf[..], tx.consensus_branch_id()).unwrap();
+
+        let tx: TransactionData<PrecomputedAuth> = tx.into_data().map_authorization(
+            f_transparent,
+            (),
+            (),
+            #[cfg(zcash_unstable = "tze")]
+            (),
+        );
+        let txid_parts = tx.digest(TxIdDigester);
+        (tx, txid_parts)
+    });
+
+    let common_sighash = sighash_params
+        .as_ref()
+        .map(|(tx, txid_parts)| signature_hash(tx, &SignableInput::Shielded, txid_parts));
+    if let Some(sighash) = &common_sighash {
+        if tx.sprout_bundle().is_some()
+            || tx.sapling_bundle().is_some()
+            || tx.orchard_bundle().is_some()
+        {
+            eprintln!(
+                " - Sighash for shielded signatures: {}",
+                hex::encode(sighash.as_ref()),
+            );
+        }
+    }
+
+    if let Some(bundle) = tx.transparent_bundle() {
+        assert!(!(bundle.vin.is_empty() && bundle.vout.is_empty()));
+        if !(bundle.vin.is_empty() || is_coinbase) {
+            eprintln!(" - {} transparent input(s)", bundle.vin.len());
+            if let Some(coins) = &transparent_coins {
+                if bundle.vin.len() != coins.len() {
+                    eprintln!("  ⚠️  \"transparentcoins\" has length {}", coins.len());
+                }
+
+                let (tx, txid_parts) = sighash_params.as_ref().unwrap();
+                let ctx = Secp256k1::<VerifyOnly>::gen_new();
+
+                for (i, (txin, coin)) in bundle.vin.iter().zip(coins).enumerate() {
+                    eprintln!(
+                        "   - prevout: txid {}, index {}",
+                        TxId::from_bytes(*txin.prevout.hash()),
+                        txin.prevout.n()
+                    );
+                    match coin.recipient_address() {
+                        Some(addr @ TransparentAddress::PublicKeyHash(_)) => {
+                            // Format is [sig_and_type_len] || sig || [hash_type] || [pubkey_len] || pubkey
+                            // where [x] encodes a single byte.
+                            let sig_and_type_len = txin.script_sig.0.first().map(|l| *l as usize);
+                            let pubkey_len = sig_and_type_len
+                                .and_then(|sig_len| txin.script_sig.0.get(1 + sig_len))
+                                .map(|l| *l as usize);
+                            let script_len = sig_and_type_len.zip(pubkey_len).map(
+                                |(sig_and_type_len, pubkey_len)| {
+                                    1 + sig_and_type_len + 1 + pubkey_len
+                                },
+                            );
+
+                            if Some(txin.script_sig.0.len()) != script_len {
+                                eprintln!(
+                                    "    ⚠️  \"transparentcoins\" {} is P2PKH; txin {} scriptSig has length {} but data {}",
+                                    i,
+                                    i,
+                                    txin.script_sig.0.len(),
+                                    if let Some(l) = script_len {
+                                        format!("implies length {}.", l)
+                                    } else {
+                                        "would cause an out-of-bounds read.".to_owned()
+                                    },
+                                );
+                            } else {
+                                let sig_len = sig_and_type_len.unwrap() - 1;
+
+                                let sig = secp256k1::ecdsa::Signature::from_der(
+                                    &txin.script_sig.0[1..1 + sig_len],
+                                );
+                                let hash_type = txin.script_sig.0[1 + sig_len];
+                                let pubkey_bytes = &txin.script_sig.0[1 + sig_len + 2..];
+                                let pubkey = secp256k1::PublicKey::from_slice(pubkey_bytes);
+
+                                if let Err(e) = sig {
+                                    eprintln!(
+                                        "    ⚠️  Txin {} has invalid signature encoding: {}",
+                                        i, e
+                                    );
+                                }
+                                if let Err(e) = pubkey {
+                                    eprintln!(
+                                        "    ⚠️  Txin {} has invalid pubkey encoding: {}",
+                                        i, e
+                                    );
+                                }
+                                if let (Ok(sig), Ok(pubkey)) = (sig, pubkey) {
+                                    #[allow(deprecated)]
+                                    if pubkey_to_address(&pubkey) != addr {
+                                        eprintln!("    ⚠️  Txin {} pubkey does not match coin's script_pubkey", i);
+                                    }
+
+                                    let sighash = signature_hash(
+                                        tx,
+                                        &SignableInput::Transparent {
+                                            hash_type,
+                                            index: i,
+                                            // For P2PKH these are the same.
+                                            script_code: &coin.script_pubkey,
+                                            script_pubkey: &coin.script_pubkey,
+                                            value: coin.value,
+                                        },
+                                        txid_parts,
+                                    );
+                                    let msg = secp256k1::Message::from_slice(sighash.as_ref())
+                                        .expect("signature_hash() returns correct length");
+
+                                    if let Err(e) = ctx.verify_ecdsa(&msg, &sig, &pubkey) {
+                                        eprintln!("    ⚠️  Spend {} is invalid: {}", i, e);
+                                        eprintln!(
+                                            "     - sighash is {}",
+                                            hex::encode(sighash.as_ref())
+                                        );
+                                        eprintln!("     - pubkey is {}", hex::encode(pubkey_bytes));
+                                    }
+                                }
+                            }
+                        }
+                        // TODO: Check P2SH structure.
+                        Some(TransparentAddress::ScriptHash(_)) => {
+                            eprintln!("  🔎 \"transparentcoins\"[{}] is a P2SH coin.", i);
+                        }
+                        // TODO: Check arbitrary scripts.
+                        None => {
+                            eprintln!(
+                                "  🔎 \"transparentcoins\"[{}] has a script we can't check yet.",
+                                i
+                            );
+                        }
+                    }
+                }
+            } else {
+                eprintln!(
+                    "  🔎 To check transparent inputs, add \"transparentcoins\" array to context."
+                );
+                eprintln!("     The following transparent inputs are required: ");
+                for txin in &bundle.vin {
+                    eprintln!(
+                        "     - txid {}, index {}",
+                        TxId::from_bytes(*txin.prevout.hash()),
+                        txin.prevout.n()
+                    )
+                }
+            }
+        }
+        if !bundle.vout.is_empty() {
+            eprintln!(" - {} transparent output(s)", bundle.vout.len());
+            for txout in &bundle.vout {
+                eprintln!(
+                    "     - {}",
+                    serde_json::to_string(&ZTxOut::from(txout.clone())).unwrap()
+                );
+            }
+        }
+    }
+
+    if let Some(bundle) = tx.sprout_bundle() {
+        eprintln!(" - {} Sprout JoinSplit(s)", bundle.joinsplits.len());
+
+        // TODO: Verify Sprout proofs once we can access the Sprout bundle parts.
+
+        match ed25519_zebra::VerificationKey::try_from(bundle.joinsplit_pubkey) {
+            Err(e) => eprintln!("  ⚠️  joinsplitPubkey is invalid: {}", e),
+            Ok(vk) => {
+                if let Some(sighash) = &common_sighash {
+                    if let Err(e) = vk.verify(
+                        &ed25519_zebra::Signature::from(bundle.joinsplit_sig),
+                        sighash.as_ref(),
+                    ) {
+                        eprintln!("  ⚠️  joinsplitSig is invalid: {}", e);
+                    }
+                } else {
+                    eprintln!(
+                        "  🔎 To check Sprout JoinSplit(s), add \"transparentcoins\" array to context"
+                    );
+                }
+            }
+        }
+    }
+
+    if let Some(bundle) = tx.sapling_bundle() {
+        assert!(!(bundle.shielded_spends().is_empty() && bundle.shielded_outputs().is_empty()));
+
+        // TODO: Separate into checking proofs, signatures, and other structural details.
+        let mut ctx = SaplingVerificationContext::new();
+
+        if !bundle.shielded_spends().is_empty() {
+            eprintln!(" - {} Sapling Spend(s)", bundle.shielded_spends().len());
+            if let Some(sighash) = &common_sighash {
+                for (i, spend) in bundle.shielded_spends().iter().enumerate() {
+                    if !ctx.check_spend(
+                        spend.cv(),
+                        *spend.anchor(),
+                        &spend.nullifier().0,
+                        *spend.rk(),
+                        sighash.as_ref(),
+                        *spend.spend_auth_sig(),
+                        groth16::Proof::read(&spend.zkproof()[..]).unwrap(),
+                        &GROTH16_PARAMS.spend_vk,
+                    ) {
+                        eprintln!("  ⚠️  Spend {} is invalid", i);
+                    }
+                }
+            } else {
+                eprintln!(
+                    "  🔎 To check Sapling Spend(s), add \"transparentcoins\" array to context"
+                );
+            }
+        }
+
+        if !bundle.shielded_outputs().is_empty() {
+            eprintln!(" - {} Sapling Output(s)", bundle.shielded_outputs().len());
+            for (i, output) in bundle.shielded_outputs().iter().enumerate() {
+                if is_coinbase {
+                    if let Some((params, addr_net)) = context
+                        .as_ref()
+                        .and_then(|ctx| ctx.network().zip(ctx.addr_network()))
+                    {
+                        if let Some((note, addr, memo)) = try_output_recovery_with_ovk(
+                            &SaplingDomain::new(sapling_serialization::zip212_enforcement(
+                                &params,
+                                height.unwrap(),
+                            )),
+                            &sapling::keys::OutgoingViewingKey([0; 32]),
+                            output,
+                            output.cv(),
+                            output.out_ciphertext(),
+                        ) {
+                            if note.value().inner() == 0 {
+                                eprintln!("   - Output {} (dummy output):", i);
+                            } else {
+                                let zaddr = ZcashAddress::from_sapling(addr_net, addr.to_bytes());
+
+                                eprintln!("   - Output {}:", i);
+                                eprintln!("     - {}", zaddr);
+                                eprintln!("     - {}", render_value(note.value().inner()));
+                            }
+                            let memo = MemoBytes::from_bytes(&memo).expect("correct length");
+                            eprintln!("     - {}", render_memo(memo));
+                        } else {
+                            eprintln!(
+                                "  ⚠️  Output {} is not recoverable with the all-zeros OVK",
+                                i
+                            );
+                        }
+                    } else {
+                        eprintln!("  🔎 To check Sapling coinbase rules, add \"network\" to context (either \"main\" or \"test\")");
+                    }
+                }
+
+                if !ctx.check_output(
+                    output.cv(),
+                    *output.cmu(),
+                    jubjub::ExtendedPoint::from_bytes(&output.ephemeral_key().0).unwrap(),
+                    groth16::Proof::read(&output.zkproof()[..]).unwrap(),
+                    &GROTH16_PARAMS.output_vk,
+                ) {
+                    eprintln!("  ⚠️  Output {} is invalid", i);
+                }
+            }
+        }
+
+        if let Some(sighash) = &common_sighash {
+            if !ctx.final_check(
+                *bundle.value_balance(),
+                sighash.as_ref(),
+                bundle.authorization().binding_sig,
+            ) {
+                eprintln!("⚠️  Sapling bindingSig is invalid");
+            }
+        } else {
+            eprintln!("🔎 To check Sapling bindingSig, add \"transparentcoins\" array to context");
+        }
+    }
+
+    if let Some(bundle) = tx.orchard_bundle() {
+        eprintln!(" - {} Orchard Action(s)", bundle.actions().len());
+
+        // Orchard nullifiers must not be duplicated within a transaction.
+        let mut nullifiers = HashMap::<[u8; 32], Vec<usize>>::default();
+        for (i, action) in bundle.actions().iter().enumerate() {
+            nullifiers
+                .entry(action.nullifier().to_bytes())
+                .or_insert_with(Vec::new)
+                .push(i);
+        }
+        for (_, indices) in nullifiers {
+            if indices.len() > 1 {
+                eprintln!("⚠️  Nullifier is duplicated between actions {:?}", indices);
+            }
+        }
+
+        if is_coinbase {
+            // All coinbase outputs must be decryptable with the all-zeroes OVK.
+            for (i, action) in bundle.actions().iter().enumerate() {
+                let ovk = orchard::keys::OutgoingViewingKey::from([0u8; 32]);
+                if let Some((note, addr, memo)) = try_output_recovery_with_ovk(
+                    &OrchardDomain::for_action(action),
+                    &ovk,
+                    action,
+                    action.cv_net(),
+                    &action.encrypted_note().out_ciphertext,
+                ) {
+                    if note.value().inner() == 0 {
+                        eprintln!("   - Output {} (dummy output):", i);
+                    } else {
+                        eprintln!("   - Output {}:", i);
+
+                        if let Some(net) = context.as_ref().and_then(|ctx| ctx.addr_network()) {
+                            assert_eq!(note.recipient(), addr);
+                            // Construct a single-receiver UA.
+                            let zaddr = ZcashAddress::from_unified(
+                                net,
+                                unified::Address::try_from_items(vec![unified::Receiver::Orchard(
+                                    addr.to_raw_address_bytes(),
+                                )])
+                                .unwrap(),
+                            );
+                            eprintln!("     - {}", zaddr);
+                        } else {
+                            eprintln!("    🔎 To show recipient address, add \"network\" to context (either \"main\" or \"test\")");
+                        }
+
+                        eprintln!("     - {}", render_value(note.value().inner()));
+                    }
+                    eprintln!(
+                        "     - {}",
+                        render_memo(MemoBytes::from_bytes(&memo).unwrap())
+                    );
+                } else {
+                    eprintln!(
+                        "  ⚠️  Output {} is not recoverable with the all-zeros OVK",
+                        i
+                    );
+                }
+            }
+        }
+
+        if let Some(sighash) = &common_sighash {
+            for (i, action) in bundle.actions().iter().enumerate() {
+                if let Err(e) = action.rk().verify(sighash.as_ref(), action.authorization()) {
+                    eprintln!("  ⚠️  Action {} spendAuthSig is invalid: {}", i, e);
+                }
+            }
+        } else {
+            eprintln!(
+                "🔎 To check Orchard Action signatures, add \"transparentcoins\" array to context"
+            );
+        }
+
+        if let Err(e) = bundle.verify_proof(&ORCHARD_VK) {
+            eprintln!("⚠️  Orchard proof is invalid: {:?}", e);
+        }
+    }
+}
diff --git a/pczt/Cargo.toml b/pczt/Cargo.toml
new file mode 100644
index 0000000000..7570408751
--- /dev/null
+++ b/pczt/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "pczt"
+version = "0.0.0"
+authors = ["Jack Grigg <jack@electriccoin.co>"]
+edition.workspace = true
+rust-version.workspace = true
+description = "Tools for working with partially-created Zcash transactions"
+homepage = "https://github.com/zcash/librustzcash"
+repository.workspace = true
+license.workspace = true
+categories.workspace = true
+
+[dependencies]
diff --git a/pczt/README.md b/pczt/README.md
new file mode 100644
index 0000000000..e5a4c7718d
--- /dev/null
+++ b/pczt/README.md
@@ -0,0 +1,21 @@
+# pczt
+
+TBD
+
+## License
+
+Licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
+
diff --git a/pczt/src/lib.rs b/pczt/src/lib.rs
new file mode 100644
index 0000000000..8b13789179
--- /dev/null
+++ b/pczt/src/lib.rs
@@ -0,0 +1 @@
+
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 5ecda6e495..0314e2f5e4 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.65.0"
+channel = "1.77.0"
 components = [ "clippy", "rustfmt" ]
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
new file mode 100644
index 0000000000..ff23245bd8
--- /dev/null
+++ b/supply-chain/audits.toml
@@ -0,0 +1,943 @@
+
+# cargo-vet audits file
+
+[criteria.crypto-reviewed]
+description = "The cryptographic code in this crate has been reviewed for correctness by a member of a designated set of cryptography experts within the project."
+
+[criteria.license-reviewed]
+description = "The license of this crate has been reviewed for compatibility with its usage in this repository."
+
+[[audits.ambassador]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+version = "0.4.1"
+notes = "Crate uses no unsafe code and the macros introduced by this crate generate the expected trait implementations without introducing additional unexpected operations."
+
+[[audits.anyhow]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.82 -> 1.0.83"
+
+[[audits.async-trait]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.78 -> 0.1.80"
+
+[[audits.async-trait]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.80 -> 0.1.81"
+notes = "Changes to generated code look fine."
+
+[[audits.autocfg]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.2.0 -> 1.3.0"
+
+[[audits.bip32]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+version = "0.5.1"
+notes = """
+- Crate has no unsafe code, and sets `#![forbid(unsafe_code)]`.
+- Crate has no powerful imports. Only filesystem acces is via `include_str!`, and is safe.
+"""
+
+[[audits.bytemuck]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "1.15.0 -> 1.16.0"
+
+[[audits.cc]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.94 -> 1.0.97"
+
+[[audits.ciborium]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.2.1 -> 0.2.2"
+
+[[audits.ciborium-io]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.2.1 -> 0.2.2"
+
+[[audits.ciborium-ll]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.2.1 -> 0.2.2"
+
+[[audits.clap]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-run"
+delta = "4.4.14 -> 4.4.18"
+
+[[audits.clap_builder]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-run"
+delta = "4.5.0 -> 4.4.18"
+
+[[audits.darling]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.20.9 -> 0.20.10"
+
+[[audits.darling_core]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.20.9 -> 0.20.10"
+
+[[audits.darling_macro]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.20.9 -> 0.20.10"
+
+[[audits.either]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.11.0 -> 1.13.0"
+
+[[audits.errno]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.8 -> 0.3.9"
+
+[[audits.fastrand]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "2.0.2 -> 2.1.0"
+notes = """
+As noted in the changelog, this version produces different output for a given seed.
+The documentation did not mention stability. It is possible that some uses relying on
+determinism across the update would be broken.
+
+The new constants do appear to match WyRand v4.2 (modulo ordering issues that I have not checked):
+https://github.com/wangyi-fudan/wyhash/blob/408620b6d12b7d667b3dd6ae39b7929a39e8fa05/wyhash.h#L145
+I have no way to check whether these constants are an improvement or not.
+"""
+
+[[audits.futures]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.30"
+notes = "Only sub-crate updates and corresponding changes to tests."
+
+[[audits.futures-executor]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.30"
+
+[[audits.futures-io]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.30"
+
+[[audits.futures-macro]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.29"
+
+[[audits.futures-macro]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+
+[[audits.futures-sink]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+
+[[audits.h2]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.21 -> 0.3.26"
+
+[[audits.h2]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.26 -> 0.4.5"
+
+[[audits.half]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "1.8.2 -> 2.2.1"
+notes = """
+All new uses of unsafe are either just accessing bit representations, or plausibly reasonable uses of intrinsics. I have not checked safety
+requirements on the latter.
+"""
+
+[[audits.hashbrown]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.14.2 -> 0.14.5"
+notes = "I did not thoroughly check the safety argument for fold_impl, but it at least seems to be well documented."
+
+[[audits.home]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.5.5 -> 0.5.9"
+notes = """
+`unsafe` changes are to switch Windows logic from `SHGetFolderPathW` to
+`SHGetKnownFolderPath`. I checked that the parameters and return values were
+being handled correctly per the Windows documentation.
+"""
+
+[[audits.http-body]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.0 -> 1.0.1"
+
+[[audits.http-body-util]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.0 -> 0.1.2"
+notes = "New uses of pin_project! look fine."
+
+[[audits.hyper-timeout]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.4.1 -> 0.5.1"
+notes = "New uses of pin_project! look fine."
+
+[[audits.hyper-util]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.5 -> 0.1.6"
+
+[[audits.inferno]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.11.17 -> 0.11.19"
+
+[[audits.is-terminal]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.4.9 -> 0.4.12"
+
+[[audits.js-sys]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.65 -> 0.3.66"
+
+[[audits.lock_api]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.4.11 -> 0.4.12"
+
+[[audits.memchr]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "2.7.2 -> 2.7.4"
+
+[[audits.memmap2]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.9.3 -> 0.9.4"
+
+[[audits.minreq]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "2.11.0 -> 2.11.2"
+
+[[audits.minreq]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "2.11.2 -> 2.12.0"
+
+[[audits.num-bigint]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.4 -> 0.4.5"
+notes = "New uses of unsafe look reasonable."
+
+[[audits.num_enum]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.7.0 -> 0.7.2"
+
+[[audits.num_enum_derive]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.7.0 -> 0.7.2"
+
+[[audits.oorandom]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-run"
+delta = "11.1.3 -> 11.1.4"
+
+[[audits.parking_lot]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.12.1 -> 0.12.2"
+
+[[audits.parking_lot]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.12.2 -> 0.12.3"
+
+[[audits.parking_lot_core]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.9.9 -> 0.9.10"
+
+[[audits.pczt]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+version = "0.0.0"
+notes = "Initial empty crate release."
+
+[[audits.pin-project-internal]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.1.3 -> 1.1.5"
+
+[[audits.pkg-config]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+
+[[audits.prettyplease]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.15 -> 0.2.20"
+
+[[audits.proc-macro2]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.81 -> 1.0.82"
+
+[[audits.proptest]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.3.1 -> 1.4.0"
+
+[[audits.prost]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.12.1 -> 0.12.3"
+
+[[audits.prost-build]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.12.1 -> 0.12.3"
+
+[[audits.prost-derive]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.12.1 -> 0.12.3"
+
+[[audits.prost-derive]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.12.3 -> 0.12.6"
+notes = "Changes to proc macro code are to fix lints after bumping MSRV."
+
+[[audits.prost-types]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.12.1 -> 0.12.3"
+
+[[audits.redox_syscall]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.4.1 -> 0.5.1"
+notes = "Uses of unsafe look plausible."
+
+[[audits.regex-automata]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.4.6 -> 0.4.7"
+
+[[audits.regex-syntax]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.8.3 -> 0.8.4"
+
+[[audits.rustc-demangle]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.23 -> 0.1.24"
+
+[[audits.rustls]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.21.8 -> 0.21.12"
+notes = """
+A comment in get_sni_extension asks whether the behaviour of parsing an IPv4 or IPv6 address
+in a host_name field of a server_name extension, but then ignoring the extension (because
+'Literal IPv4 and IPv6 addresses are not permitted in \"HostName\"'), as the server, is
+compliant with RFC 6066. As an original author of RFC 3546 which has very similar wording,
+I can speak to the intent: yes this is fine. The client is clearly nonconformant in this
+case, but the server isn't.
+
+RFC 3546 said \"If the server understood the client hello extension but does not recognize
+the server name, it SHOULD send an \"unrecognized_name\" alert (which MAY be fatal).\"
+This wording was preserved in RFC 5746, and then updated in RFC 6066 to:
+
+   If the server understood the ClientHello extension but
+   does not recognize the server name, the server SHOULD take one of two
+   actions: either abort the handshake by sending a fatal-level
+   unrecognized_name(112) alert or continue the handshake.  It is NOT
+   RECOMMENDED to send a warning-level unrecognized_name(112) alert,
+   because the client's behavior in response to warning-level alerts is
+   unpredictable.  If there is a mismatch between the server name used
+   by the client application and the server name of the credential
+   chosen by the server, this mismatch will become apparent when the
+   client application performs the server endpoint identification, at
+   which point the client application will have to decide whether to
+   proceed with the communication.
+
+To me it's clear that it is reasonable to consider an IP address as a name that the
+server does not recognize. And so the server SHOULD *either* send a fatal unrecognized_name
+alert, *or* continue the handshake and let the client application decide when it \"performs
+the server endpoint identification\". There's no conformance requirement for the server to
+take any notice of a host_name that is \"not permitted\". (It would have been clearer to
+express this by specifying the allowed client and server behaviour separately, i.e. saying
+that the client MUST NOT send an IP address in host_name, and then explicitly specifying
+the server behaviour if it does so anyway. That's how I would write it now. But honestly
+this extension was one of the most bikeshedded parts of RFC 3546, to a much greater extent
+than I'd anticipated, and I was tired.)
+"""
+
+[[audits.rustversion]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.15 -> 1.0.16"
+
+[[audits.rustversion]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.16 -> 1.0.17"
+
+[[audits.ryu]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "1.0.17 -> 1.0.18"
+
+[[audits.secp256k1]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+delta = "0.26.0 -> 0.27.0"
+
+[[audits.semver]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.22 -> 1.0.23"
+notes = """
+`build.rs` change is to enable checking for expected `#[cfg]` names if compiling
+with Rust 1.80 or later.
+"""
+
+[[audits.serde]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.201 -> 1.0.202"
+
+[[audits.serde_derive]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.201 -> 1.0.202"
+
+[[audits.serde_json]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "1.0.116 -> 1.0.117"
+
+[[audits.serde_json]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.117 -> 1.0.120"
+
+[[audits.smallvec]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.11.1 -> 1.13.2"
+
+[[audits.socket2]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.6 -> 0.5.7"
+notes = "The new uses of unsafe to access getsockopt/setsockopt look reasonable."
+
+[[audits.syn]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "2.0.53 -> 2.0.60"
+
+[[audits.syn]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "2.0.60 -> 2.0.63"
+
+[[audits.sync_wrapper]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.2 -> 1.0.1"
+
+[[audits.thiserror]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.58 -> 1.0.60"
+
+[[audits.thiserror]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.60 -> 1.0.61"
+
+[[audits.thiserror]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.61 -> 1.0.63"
+
+[[audits.thiserror-impl]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.58 -> 1.0.60"
+
+[[audits.thiserror-impl]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.60 -> 1.0.61"
+
+[[audits.thiserror-impl]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.61 -> 1.0.63"
+
+[[audits.tokio-stream]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.14 -> 0.1.15"
+
+[[audits.tokio-util]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.10 -> 0.7.11"
+
+[[audits.tonic]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.10.2 -> 0.11.0"
+
+[[audits.tonic]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.12.0 -> 0.12.1"
+notes = "Changes to generics bounds look fine"
+
+[[audits.tonic-build]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.10.2 -> 0.11.0"
+
+[[audits.tonic-build]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.11.0 -> 0.12.0"
+
+[[audits.tonic-build]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.12.0 -> 0.12.1"
+
+[[audits.utf8parse]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-run"
+delta = "0.2.1 -> 0.2.2"
+
+[[audits.visibility]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = ["safe-to-deploy", "license-reviewed"]
+version = "0.1.1"
+notes = """
+- Crate has no unsafe code, and sets `#![forbid(unsafe_code)]`.
+- Crate has no powerful imports, and exclusively provides a proc macro
+  that safely malleates a visibility modifier.
+"""
+
+[[audits.walkdir]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "2.4.0 -> 2.5.0"
+
+[[audits.wasm-bindgen-backend]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.88 -> 0.2.89"
+
+[[audits.wasm-bindgen-macro]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.88 -> 0.2.89"
+
+[[audits.web-sys]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.65 -> 0.3.66"
+
+[[audits.webpki-roots]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.25.2 -> 0.25.4"
+notes = "I have not checked consistency with the Mozilla IncludedCACertificateReportPEMCSV report."
+
+[[audits.which]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "6.0.1 -> 6.0.3"
+
+[[audits.winapi-util]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-run"
+delta = "0.1.6 -> 0.1.8"
+
+[[audits.zcash_address]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+delta = "0.3.2 -> 0.4.0"
+notes = "This release contains no unsafe code and consists soley of added convenience methods."
+
+[[audits.zcash_encoding]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+delta = "0.2.0 -> 0.2.1"
+notes = "This release adds minor convenience methods and involves no unsafe code."
+
+[[audits.zcash_keys]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+delta = "0.2.0 -> 0.3.0"
+
+[[audits.zcash_primitives]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+delta = "0.15.1 -> 0.16.0"
+notes = "The primary change here is the switch from the `hdwallet` dependency to using `bip32`."
+
+[[audits.zcash_proofs]]
+who = "Kris Nuttycombe <kris@nutty.land>"
+criteria = "safe-to-deploy"
+delta = "0.15.0 -> 0.16.0"
+notes = "This release involves only updates of previously-vetted dependencies."
+
+[[audits.zerocopy]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.32 -> 0.7.34"
+
+[[audits.zerocopy-derive]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.32 -> 0.7.34"
+
+[[audits.zeroize]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.6.0 -> 1.7.0"
+
+[[trusted.equihash]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2020-06-26"
+end = "2025-04-22"
+
+[[trusted.f4jumble]]
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+user-id = 6289 # Jack Grigg (str4d)
+start = "2021-09-22"
+end = "2025-04-22"
+
+[[trusted.halo2_gadgets]]
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+user-id = 1244 # ebfull
+start = "2022-05-10"
+end = "2025-04-22"
+
+[[trusted.halo2_legacy_pdqsort]]
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+user-id = 199950 # Daira Emma Hopwood (daira)
+start = "2023-02-24"
+end = "2025-04-22"
+
+[[trusted.halo2_proofs]]
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+user-id = 1244 # ebfull
+start = "2022-05-10"
+end = "2025-04-22"
+
+[[trusted.incrementalmerkletree]]
+criteria = "safe-to-deploy"
+user-id = 1244 # ebfull
+start = "2021-06-24"
+end = "2025-04-22"
+
+[[trusted.incrementalmerkletree]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2021-12-17"
+end = "2025-04-22"
+
+[[trusted.incrementalmerkletree]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2023-02-28"
+end = "2025-04-22"
+
+[[trusted.incrementalmerkletree-testing]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-09-25"
+end = "2025-10-02"
+
+[[trusted.orchard]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-12"
+end = "2025-08-12"
+
+[[trusted.orchard]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 1244 # ebfull
+start = "2022-10-19"
+end = "2025-04-22"
+
+[[trusted.orchard]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 6289 # Jack Grigg (str4d)
+start = "2021-01-07"
+end = "2025-04-22"
+
+[[trusted.orchard]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-12"
+end = "2025-08-12"
+
+[[trusted.sapling-crypto]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-12"
+end = "2025-08-12"
+
+[[trusted.sapling-crypto]]
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+user-id = 6289 # Jack Grigg (str4d)
+start = "2024-01-26"
+end = "2025-04-22"
+
+[[trusted.sapling-crypto]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-12"
+end = "2025-08-12"
+
+[[trusted.schemerz]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2024-10-15"
+end = "2025-10-15"
+
+[[trusted.schemerz-rusqlite]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2024-10-15"
+end = "2025-10-15"
+
+[[trusted.shardtree]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2022-12-15"
+end = "2025-04-22"
+
+[[trusted.windows-sys]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-11-15"
+end = "2025-04-22"
+
+[[trusted.windows-targets]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2022-09-09"
+end = "2025-04-22"
+
+[[trusted.windows_aarch64_gnullvm]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2022-09-01"
+end = "2025-04-22"
+
+[[trusted.windows_aarch64_msvc]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-11-05"
+end = "2025-04-22"
+
+[[trusted.windows_i686_gnu]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-28"
+end = "2025-04-22"
+
+[[trusted.windows_i686_gnullvm]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2024-04-02"
+end = "2025-05-15"
+
+[[trusted.windows_i686_msvc]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-27"
+end = "2025-04-22"
+
+[[trusted.windows_x86_64_gnu]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-28"
+end = "2025-04-22"
+
+[[trusted.windows_x86_64_gnullvm]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2022-09-01"
+end = "2025-04-22"
+
+[[trusted.windows_x86_64_msvc]]
+criteria = "safe-to-deploy"
+user-id = 64539 # Kenny Kerr (kennykerr)
+start = "2021-10-27"
+end = "2025-04-22"
+
+[[trusted.zcash]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2024-07-15"
+end = "2025-07-19"
+
+[[trusted.zcash_address]]
+criteria = "safe-to-deploy"
+user-id = 1244 # ebfull
+start = "2022-10-19"
+end = "2025-04-22"
+
+[[trusted.zcash_address]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2021-03-07"
+end = "2025-04-22"
+
+[[trusted.zcash_address]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-20"
+end = "2025-08-26"
+
+[[trusted.zcash_client_backend]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-03-25"
+end = "2025-04-22"
+
+[[trusted.zcash_client_sqlite]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2020-06-25"
+end = "2025-10-22"
+
+[[trusted.zcash_client_sqlite]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-03-25"
+end = "2025-04-22"
+
+[[trusted.zcash_encoding]]
+criteria = "safe-to-deploy"
+user-id = 1244 # ebfull
+start = "2022-10-19"
+end = "2025-04-22"
+
+[[trusted.zcash_extensions]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2020-04-24"
+end = "2025-04-23"
+
+[[trusted.zcash_history]]
+criteria = "safe-to-deploy"
+user-id = 1244 # ebfull
+start = "2020-03-04"
+end = "2025-04-22"
+
+[[trusted.zcash_history]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2024-03-01"
+end = "2025-04-22"
+
+[[trusted.zcash_keys]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-01-15"
+end = "2025-04-22"
+
+[[trusted.zcash_note_encryption]]
+criteria = ["safe-to-deploy", "crypto-reviewed"]
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2023-03-22"
+end = "2025-04-22"
+
+[[trusted.zcash_primitives]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-20"
+end = "2025-08-26"
+
+[[trusted.zcash_primitives]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 1244 # ebfull
+start = "2019-10-08"
+end = "2025-04-22"
+
+[[trusted.zcash_primitives]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 6289 # Jack Grigg (str4d)
+start = "2021-03-26"
+end = "2025-04-22"
+
+[[trusted.zcash_proofs]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-08-20"
+end = "2025-08-26"
+
+[[trusted.zcash_proofs]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 6289 # Jack Grigg (str4d)
+start = "2021-03-26"
+end = "2025-04-22"
+
+[[trusted.zcash_protocol]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-01-27"
+end = "2025-04-22"
+
+[[trusted.zcash_spec]]
+criteria = ["safe-to-deploy", "crypto-reviewed", "license-reviewed"]
+user-id = 6289 # Jack Grigg (str4d)
+start = "2023-12-07"
+end = "2025-04-22"
+
+[[trusted.zip32]]
+criteria = "safe-to-deploy"
+user-id = 6289 # Jack Grigg (str4d)
+start = "2023-12-06"
+end = "2025-04-22"
+
+[[trusted.zip321]]
+criteria = "safe-to-deploy"
+user-id = 169181 # Kris Nuttycombe (nuttycom)
+start = "2024-01-15"
+end = "2025-04-22"
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
new file mode 100644
index 0000000000..da79faef09
--- /dev/null
+++ b/supply-chain/config.toml
@@ -0,0 +1,1567 @@
+
+# cargo-vet config file
+
+[cargo-vet]
+version = "0.10"
+
+[imports.bytecode-alliance]
+url = "https://raw.githubusercontent.com/bytecodealliance/wasmtime/main/supply-chain/audits.toml"
+
+[imports.embark-studios]
+url = "https://raw.githubusercontent.com/EmbarkStudios/rust-ecosystem/main/audits.toml"
+
+[imports.fermyon]
+url = "https://raw.githubusercontent.com/fermyon/spin/main/supply-chain/audits.toml"
+
+[imports.google]
+url = "https://raw.githubusercontent.com/google/supply-chain/main/audits.toml"
+
+[imports.isrg]
+url = "https://raw.githubusercontent.com/divviup/libprio-rs/main/supply-chain/audits.toml"
+
+[imports.mozilla]
+url = "https://raw.githubusercontent.com/mozilla/supply-chain/main/audits.toml"
+
+[imports.zcash]
+url = "https://raw.githubusercontent.com/zcash/rust-ecosystem/main/supply-chain/audits.toml"
+
+[policy.equihash]
+audit-as-crates-io = true
+
+[policy.f4jumble]
+audit-as-crates-io = true
+
+[policy.pczt]
+audit-as-crates-io = true
+
+[policy.zcash]
+audit-as-crates-io = true
+
+[policy.zcash_address]
+audit-as-crates-io = true
+
+[policy.zcash_client_backend]
+audit-as-crates-io = true
+
+[policy.zcash_client_sqlite]
+audit-as-crates-io = true
+
+[policy.zcash_encoding]
+audit-as-crates-io = true
+
+[policy.zcash_extensions]
+audit-as-crates-io = true
+
+[policy.zcash_history]
+audit-as-crates-io = true
+
+[policy.zcash_keys]
+audit-as-crates-io = true
+
+[policy.zcash_primitives]
+audit-as-crates-io = true
+
+[policy.zcash_proofs]
+audit-as-crates-io = true
+
+[policy.zcash_protocol]
+audit-as-crates-io = true
+
+[policy.zip321]
+audit-as-crates-io = true
+
+[[exemptions.addr2line]]
+version = "0.21.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.aead]]
+version = "0.5.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.aes]]
+version = "0.8.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.ahash]]
+version = "0.8.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.aho-corasick]]
+version = "1.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.amplify]]
+version = "4.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.amplify_derive]]
+version = "4.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.amplify_num]]
+version = "0.5.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.amplify_syn]]
+version = "2.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.android-tzdata]]
+version = "0.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.arrayvec]]
+version = "0.7.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.arti-client]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.ascii]]
+version = "1.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.assert_matches]]
+version = "1.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.async-compression]]
+version = "0.4.11"
+criteria = "safe-to-deploy"
+
+[[exemptions.async-trait]]
+version = "0.1.78"
+criteria = "safe-to-deploy"
+
+[[exemptions.async_executors]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.asynchronous-codec]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.atomic]]
+version = "0.5.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.atomic]]
+version = "0.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.atomic-waker]]
+version = "1.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.axum]]
+version = "0.7.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.axum-core]]
+version = "0.4.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.backtrace]]
+version = "0.3.69"
+criteria = "safe-to-deploy"
+
+[[exemptions.base16ct]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.base64ct]]
+version = "1.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.bech32]]
+version = "0.9.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.bellman]]
+version = "0.14.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.bip0039]]
+version = "0.11.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.bitvec]]
+version = "1.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.blake2b_simd]]
+version = "1.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.blake2s_simd]]
+version = "1.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.blanket]]
+version = "0.3.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.bls12_381]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.bounded-vec-deque]]
+version = "0.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.bs58]]
+version = "0.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.by_address]]
+version = "1.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.bytes]]
+version = "1.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.caret]]
+version = "0.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.cbc]]
+version = "0.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.cc]]
+version = "1.1.30"
+criteria = "safe-to-deploy"
+
+[[exemptions.chacha20]]
+version = "0.9.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.chacha20poly1305]]
+version = "0.10.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.chrono]]
+version = "0.4.38"
+criteria = "safe-to-deploy"
+
+[[exemptions.ciborium]]
+version = "0.2.1"
+criteria = "safe-to-run"
+
+[[exemptions.ciborium-io]]
+version = "0.2.1"
+criteria = "safe-to-run"
+
+[[exemptions.ciborium-ll]]
+version = "0.2.1"
+criteria = "safe-to-run"
+
+[[exemptions.coarsetime]]
+version = "0.1.34"
+criteria = "safe-to-deploy"
+
+[[exemptions.concurrent-queue]]
+version = "2.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.const-oid]]
+version = "0.9.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.convert_case]]
+version = "0.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.cpufeatures]]
+version = "0.2.11"
+criteria = "safe-to-deploy"
+
+[[exemptions.criterion]]
+version = "0.4.0"
+criteria = "safe-to-run"
+
+[[exemptions.criterion-plot]]
+version = "0.5.0"
+criteria = "safe-to-run"
+
+[[exemptions.crossbeam-channel]]
+version = "0.5.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.crossbeam-deque]]
+version = "0.8.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.crossbeam-epoch]]
+version = "0.9.15"
+criteria = "safe-to-deploy"
+
+[[exemptions.crossbeam-utils]]
+version = "0.8.19"
+criteria = "safe-to-deploy"
+
+[[exemptions.crypto-bigint]]
+version = "0.5.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.ctr]]
+version = "0.9.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.curve25519-dalek]]
+version = "4.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.curve25519-dalek-derive]]
+version = "0.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.daggy]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.darling]]
+version = "0.14.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.darling]]
+version = "0.20.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.darling_core]]
+version = "0.14.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.darling_core]]
+version = "0.20.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.darling_macro]]
+version = "0.14.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.darling_macro]]
+version = "0.20.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.data-encoding]]
+version = "2.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.der]]
+version = "0.7.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive-adhoc]]
+version = "0.7.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive-adhoc-macros]]
+version = "0.7.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive-deftly]]
+version = "0.14.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive-deftly-macros]]
+version = "0.14.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive_builder_core_fork_arti]]
+version = "0.11.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive_builder_fork_arti]]
+version = "0.11.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive_builder_macro_fork_arti]]
+version = "0.11.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive_more]]
+version = "1.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.derive_more-impl]]
+version = "1.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.digest]]
+version = "0.9.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.directories]]
+version = "5.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.dirs]]
+version = "5.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.dirs-sys]]
+version = "0.4.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.downcast-rs]]
+version = "1.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.dyn-clone]]
+version = "1.0.17"
+criteria = "safe-to-deploy"
+
+[[exemptions.dynosaur]]
+version = "0.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.dynosaur_derive]]
+version = "0.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.ecdsa]]
+version = "0.16.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.ed25519]]
+version = "2.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.ed25519-dalek]]
+version = "2.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.ed25519-zebra]]
+version = "3.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.educe]]
+version = "0.4.23"
+criteria = "safe-to-deploy"
+
+[[exemptions.elliptic-curve]]
+version = "0.13.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.enum-ordinalize]]
+version = "3.1.15"
+criteria = "safe-to-deploy"
+
+[[exemptions.event-listener]]
+version = "5.3.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.fallible-iterator]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.fallible-streaming-iterator]]
+version = "0.1.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.ff]]
+version = "0.13.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.figment]]
+version = "0.10.19"
+criteria = "safe-to-deploy"
+
+[[exemptions.filetime]]
+version = "0.2.25"
+criteria = "safe-to-deploy"
+
+[[exemptions.findshlibs]]
+version = "0.10.2"
+criteria = "safe-to-run"
+
+[[exemptions.fixed-hash]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.fixedbitset]]
+version = "0.4.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.fluid-let]]
+version = "1.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.fpe]]
+version = "0.6.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.fs-mistrust]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.fslock]]
+version = "0.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.funty]]
+version = "2.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.futures-macro]]
+version = "0.3.21"
+criteria = "safe-to-deploy"
+
+[[exemptions.futures-rustls]]
+version = "0.26.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.futures-sink]]
+version = "0.3.29"
+criteria = "safe-to-deploy"
+
+[[exemptions.futures-task]]
+version = "0.3.29"
+criteria = "safe-to-deploy"
+
+[[exemptions.futures-util]]
+version = "0.3.21"
+criteria = "safe-to-deploy"
+
+[[exemptions.generic-array]]
+version = "0.14.7"
+criteria = "safe-to-deploy"
+
+[[exemptions.getrandom]]
+version = "0.2.11"
+criteria = "safe-to-deploy"
+
+[[exemptions.gimli]]
+version = "0.28.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.glob-match]]
+version = "0.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.group]]
+version = "0.13.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.gumdrop]]
+version = "0.8.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.gumdrop_derive]]
+version = "0.8.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.h2]]
+version = "0.3.21"
+criteria = "safe-to-deploy"
+
+[[exemptions.hashbrown]]
+version = "0.14.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.hashbrown]]
+version = "0.15.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.hashlink]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.hermit-abi]]
+version = "0.3.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.hkdf]]
+version = "0.12.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.home]]
+version = "0.5.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.hostname-validator]]
+version = "1.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.http]]
+version = "1.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.httparse]]
+version = "1.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.humantime]]
+version = "2.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.humantime-serde]]
+version = "1.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.hyper]]
+version = "1.4.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.hyper-timeout]]
+version = "0.4.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.hyper-util]]
+version = "0.1.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.iana-time-zone]]
+version = "0.1.60"
+criteria = "safe-to-deploy"
+
+[[exemptions.indexmap]]
+version = "1.9.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.indexmap]]
+version = "2.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.inferno]]
+version = "0.11.17"
+criteria = "safe-to-run"
+
+[[exemptions.inotify]]
+version = "0.9.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.inotify-sys]]
+version = "0.1.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.inventory]]
+version = "0.3.15"
+criteria = "safe-to-deploy"
+
+[[exemptions.itertools]]
+version = "0.10.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.itertools]]
+version = "0.11.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.itertools]]
+version = "0.13.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.jobserver]]
+version = "0.1.31"
+criteria = "safe-to-deploy"
+
+[[exemptions.js-sys]]
+version = "0.3.65"
+criteria = "safe-to-deploy"
+
+[[exemptions.jubjub]]
+version = "0.10.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.kqueue]]
+version = "1.0.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.kqueue-sys]]
+version = "1.0.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.libc]]
+version = "0.2.154"
+criteria = "safe-to-deploy"
+
+[[exemptions.libm]]
+version = "0.2.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.libredox]]
+version = "0.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.libsqlite3-sys]]
+version = "0.30.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.linux-raw-sys]]
+version = "0.4.12"
+criteria = "safe-to-deploy"
+
+[[exemptions.lock_api]]
+version = "0.4.12"
+criteria = "safe-to-deploy"
+
+[[exemptions.lzma-sys]]
+version = "0.1.20"
+criteria = "safe-to-deploy"
+
+[[exemptions.matchit]]
+version = "0.7.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.memchr]]
+version = "2.6.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.memmap2]]
+version = "0.5.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.memuse]]
+version = "0.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.merlin]]
+version = "3.0.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.mime]]
+version = "0.3.17"
+criteria = "safe-to-deploy"
+
+[[exemptions.minimal-lexical]]
+version = "0.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.minreq]]
+version = "2.11.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.mio]]
+version = "0.8.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.multimap]]
+version = "0.8.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.nonempty]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.notify]]
+version = "6.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.num-bigint-dig]]
+version = "0.8.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.num-format]]
+version = "0.4.4"
+criteria = "safe-to-run"
+
+[[exemptions.num_cpus]]
+version = "1.16.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.object]]
+version = "0.32.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.once_cell]]
+version = "1.18.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.oneshot-fused-workaround]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.option-ext]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.ordered-float]]
+version = "2.10.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.p256]]
+version = "0.13.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.p384]]
+version = "0.13.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.p521]]
+version = "0.13.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.pairing]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.parking]]
+version = "2.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.parking_lot]]
+version = "0.12.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.parking_lot_core]]
+version = "0.9.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.password-hash]]
+version = "0.3.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.pasta_curves]]
+version = "0.5.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.paste]]
+version = "1.0.15"
+criteria = "safe-to-deploy"
+
+[[exemptions.pbkdf2]]
+version = "0.9.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.pem-rfc7468]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.petgraph]]
+version = "0.6.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.phf]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.phf_generator]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.phf_macros]]
+version = "0.10.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.phf_shared]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.pin-project]]
+version = "1.1.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.pin-project-internal]]
+version = "1.1.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.pkcs1]]
+version = "0.7.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.pkcs8]]
+version = "0.10.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.plotters]]
+version = "0.3.5"
+criteria = "safe-to-run"
+
+[[exemptions.plotters-backend]]
+version = "0.3.5"
+criteria = "safe-to-run"
+
+[[exemptions.plotters-svg]]
+version = "0.3.5"
+criteria = "safe-to-run"
+
+[[exemptions.poly1305]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.postage]]
+version = "0.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.pprof]]
+version = "0.13.0"
+criteria = "safe-to-run"
+
+[[exemptions.ppv-lite86]]
+version = "0.2.17"
+criteria = "safe-to-deploy"
+
+[[exemptions.prettyplease]]
+version = "0.2.15"
+criteria = "safe-to-deploy"
+
+[[exemptions.primeorder]]
+version = "0.13.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.primitive-types]]
+version = "0.12.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.priority-queue]]
+version = "2.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.proc-macro-crate]]
+version = "1.2.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.proptest]]
+version = "1.3.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.prost]]
+version = "0.13.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.prost-build]]
+version = "0.13.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.prost-derive]]
+version = "0.13.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.prost-types]]
+version = "0.13.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.pwd-grp]]
+version = "0.1.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.quick-error]]
+version = "1.2.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.quick-xml]]
+version = "0.26.0"
+criteria = "safe-to-run"
+
+[[exemptions.radium]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.rand]]
+version = "0.8.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.reddsa]]
+version = "0.5.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.redox_syscall]]
+version = "0.5.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.redox_users]]
+version = "0.4.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.regex]]
+version = "1.10.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.regex-automata]]
+version = "0.1.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.regex-automata]]
+version = "0.4.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.regex-syntax]]
+version = "0.6.26"
+criteria = "safe-to-deploy"
+
+[[exemptions.regex-syntax]]
+version = "0.7.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.retry-error]]
+version = "0.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.rfc6979]]
+version = "0.4.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.rgb]]
+version = "0.8.37"
+criteria = "safe-to-run"
+
+[[exemptions.ring]]
+version = "0.16.12"
+criteria = "safe-to-deploy"
+
+[[exemptions.ring]]
+version = "0.17.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.ripemd]]
+version = "0.1.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.rsa]]
+version = "0.9.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.rusqlite]]
+version = "0.32.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.rust_decimal]]
+version = "1.35.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustix]]
+version = "0.38.34"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustls]]
+version = "0.21.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustls]]
+version = "0.23.12"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustls-pemfile]]
+version = "2.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustls-pki-types]]
+version = "1.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustls-webpki]]
+version = "0.101.7"
+criteria = "safe-to-deploy"
+
+[[exemptions.rustls-webpki]]
+version = "0.102.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.rusty-fork]]
+version = "0.3.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.ryu]]
+version = "1.0.18"
+criteria = "safe-to-deploy"
+
+[[exemptions.safelog]]
+version = "0.4.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.same-file]]
+version = "1.0.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.sanitize-filename]]
+version = "0.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.scopeguard]]
+version = "1.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.sct]]
+version = "0.7.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.sec1]]
+version = "0.7.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.secp256k1]]
+version = "0.26.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.secp256k1-sys]]
+version = "0.8.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.secrecy]]
+version = "0.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.serde-value]]
+version = "0.7.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.serde_ignored]]
+version = "0.1.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.serde_json]]
+version = "1.0.117"
+criteria = "safe-to-deploy"
+
+[[exemptions.serde_spanned]]
+version = "0.6.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.serde_with]]
+version = "3.8.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.serde_with_macros]]
+version = "3.8.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.sha2]]
+version = "0.10.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.shellexpand]]
+version = "3.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.shlex]]
+version = "1.3.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.simple_asn1]]
+version = "0.6.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.siphasher]]
+version = "0.3.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.slab]]
+version = "0.4.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.slotmap]]
+version = "1.0.7"
+criteria = "safe-to-deploy"
+
+[[exemptions.smallvec]]
+version = "1.11.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.socket2]]
+version = "0.5.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.spin]]
+version = "0.5.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.spin]]
+version = "0.9.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.spki]]
+version = "0.7.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.ssh-cipher]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.ssh-encoding]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.ssh-key]]
+version = "0.6.6"
+criteria = "safe-to-deploy"
+
+[[exemptions.str_stack]]
+version = "0.1.0"
+criteria = "safe-to-run"
+
+[[exemptions.strum]]
+version = "0.26.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.strum_macros]]
+version = "0.26.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.symbolic-common]]
+version = "12.9.2"
+criteria = "safe-to-run"
+
+[[exemptions.symbolic-demangle]]
+version = "12.9.2"
+criteria = "safe-to-run"
+
+[[exemptions.syn]]
+version = "1.0.96"
+criteria = "safe-to-deploy"
+
+[[exemptions.syn]]
+version = "2.0.53"
+criteria = "safe-to-deploy"
+
+[[exemptions.sync_wrapper]]
+version = "0.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.tempfile]]
+version = "3.8.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.time]]
+version = "0.3.23"
+criteria = "safe-to-deploy"
+
+[[exemptions.tokio]]
+version = "1.35.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.tokio-macros]]
+version = "2.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tokio-rustls]]
+version = "0.26.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tokio-util]]
+version = "0.7.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.toml]]
+version = "0.8.19"
+criteria = "safe-to-deploy"
+
+[[exemptions.toml_datetime]]
+version = "0.6.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.toml_edit]]
+version = "0.19.15"
+criteria = "safe-to-deploy"
+
+[[exemptions.toml_edit]]
+version = "0.22.22"
+criteria = "safe-to-deploy"
+
+[[exemptions.tonic]]
+version = "0.12.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tonic-build]]
+version = "0.10.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-async-utils]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-basic-utils]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-bytes]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-cell]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-cert]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-chanmgr]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-checkable]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-circmgr]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-config]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-consdiff]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-dirclient]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-dirmgr]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-error]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-guardmgr]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-hscrypto]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-key-forge]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-keymgr]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-linkspec]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-llcrypto]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-log-ratelim]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-memquota]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-netdir]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-netdoc]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-persist]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-proto]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-protover]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-relay-selection]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-rtcompat]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-rtmock]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-socksproto]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tor-units]]
+version = "0.23.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tower]]
+version = "0.4.13"
+criteria = "safe-to-deploy"
+
+[[exemptions.tower-layer]]
+version = "0.3.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.tower-service]]
+version = "0.3.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.tracing]]
+version = "0.1.40"
+criteria = "safe-to-deploy"
+
+[[exemptions.tracing-attributes]]
+version = "0.1.27"
+criteria = "safe-to-deploy"
+
+[[exemptions.tracing-log]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.tracing-test]]
+version = "0.2.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.tracing-test-macro]]
+version = "0.2.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.trait-variant]]
+version = "0.1.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.typed-index-collections]]
+version = "3.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.typenum]]
+version = "1.17.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.uint]]
+version = "0.9.5"
+criteria = "safe-to-deploy"
+
+[[exemptions.unarray]]
+version = "0.1.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.uncased]]
+version = "0.9.10"
+criteria = "safe-to-deploy"
+
+[[exemptions.unicode-segmentation]]
+version = "1.12.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.untrusted]]
+version = "0.9.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.uuid]]
+version = "1.8.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.wait-timeout]]
+version = "0.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.walkdir]]
+version = "2.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.wasi]]
+version = "0.11.0+wasi-snapshot-preview1"
+criteria = "safe-to-deploy"
+
+[[exemptions.wasix]]
+version = "0.12.21"
+criteria = "safe-to-deploy"
+
+[[exemptions.wasm-bindgen]]
+version = "0.2.92"
+criteria = "safe-to-deploy"
+
+[[exemptions.wasm-bindgen-backend]]
+version = "0.2.88"
+criteria = "safe-to-deploy"
+
+[[exemptions.wasm-bindgen-macro]]
+version = "0.2.88"
+criteria = "safe-to-deploy"
+
+[[exemptions.weak-table]]
+version = "0.3.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.web-sys]]
+version = "0.3.65"
+criteria = "safe-to-deploy"
+
+[[exemptions.webpki-roots]]
+version = "0.26.3"
+criteria = "safe-to-deploy"
+
+[[exemptions.which]]
+version = "4.4.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.winapi]]
+version = "0.3.9"
+criteria = "safe-to-deploy"
+
+[[exemptions.winapi-i686-pc-windows-gnu]]
+version = "0.4.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.winapi-util]]
+version = "0.1.8"
+criteria = "safe-to-deploy"
+
+[[exemptions.winapi-x86_64-pc-windows-gnu]]
+version = "0.4.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.windows-core]]
+version = "0.52.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.winnow]]
+version = "0.5.40"
+criteria = "safe-to-deploy"
+
+[[exemptions.winnow]]
+version = "0.6.20"
+criteria = "safe-to-deploy"
+
+[[exemptions.winsafe]]
+version = "0.0.19"
+criteria = "safe-to-deploy"
+
+[[exemptions.wyz]]
+version = "0.5.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.x25519-dalek]]
+version = "2.0.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.x509-signature]]
+version = "0.5.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.xdg]]
+version = "2.5.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.xz2]]
+version = "0.1.7"
+criteria = "safe-to-deploy"
+
+[[exemptions.zeroize]]
+version = "1.6.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.zeroize_derive]]
+version = "1.4.2"
+criteria = "safe-to-deploy"
+
+[[exemptions.zstd]]
+version = "0.13.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.zstd-safe]]
+version = "7.1.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.zstd-sys]]
+version = "2.0.10+zstd.1.5.6"
+criteria = "safe-to-deploy"
diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
new file mode 100644
index 0000000000..dfe1e95b1d
--- /dev/null
+++ b/supply-chain/imports.lock
@@ -0,0 +1,3446 @@
+
+# cargo-vet imports lock
+
+[[publisher.bumpalo]]
+version = "3.16.0"
+when = "2024-04-08"
+user-id = 696
+user-login = "fitzgen"
+user-name = "Nick Fitzgerald"
+
+[[publisher.core-foundation-sys]]
+version = "0.8.4"
+when = "2023-04-03"
+user-id = 5946
+user-login = "jrmuizel"
+user-name = "Jeff Muizelaar"
+
+[[publisher.equihash]]
+version = "0.2.0"
+when = "2022-06-24"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.f4jumble]]
+version = "0.1.0"
+when = "2022-05-10"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.halo2_gadgets]]
+version = "0.3.0"
+when = "2023-03-22"
+user-id = 1244
+user-login = "ebfull"
+
+[[publisher.halo2_legacy_pdqsort]]
+version = "0.1.0"
+when = "2023-03-10"
+user-id = 199950
+user-login = "daira"
+user-name = "Daira Emma Hopwood"
+
+[[publisher.halo2_proofs]]
+version = "0.3.0"
+when = "2023-03-22"
+user-id = 1244
+user-login = "ebfull"
+
+[[publisher.incrementalmerkletree]]
+version = "0.7.0"
+when = "2024-09-25"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.incrementalmerkletree-testing]]
+version = "0.2.0"
+when = "2024-10-04"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.orchard]]
+version = "0.10.0"
+when = "2024-10-02"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.sapling-crypto]]
+version = "0.3.0"
+when = "2024-10-02"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.schemerz]]
+version = "0.2.0"
+when = "2024-10-16"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.schemerz-rusqlite]]
+version = "0.320.0"
+when = "2024-10-16"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.shardtree]]
+version = "0.5.0"
+when = "2024-10-04"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.unicode-normalization]]
+version = "0.1.23"
+when = "2024-02-20"
+user-id = 1139
+user-login = "Manishearth"
+user-name = "Manish Goregaokar"
+
+[[publisher.windows-sys]]
+version = "0.48.0"
+when = "2023-03-31"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows-sys]]
+version = "0.52.0"
+when = "2023-11-15"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows-sys]]
+version = "0.59.0"
+when = "2024-07-30"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows-targets]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows-targets]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_aarch64_gnullvm]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_aarch64_gnullvm]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_aarch64_msvc]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_aarch64_msvc]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_i686_gnu]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_i686_gnu]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_i686_gnullvm]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_i686_msvc]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_i686_msvc]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_x86_64_gnu]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_x86_64_gnu]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_x86_64_gnullvm]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_x86_64_gnullvm]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_x86_64_msvc]]
+version = "0.48.5"
+when = "2023-08-18"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.windows_x86_64_msvc]]
+version = "0.52.6"
+when = "2024-07-03"
+user-id = 64539
+user-login = "kennykerr"
+user-name = "Kenny Kerr"
+
+[[publisher.zcash]]
+version = "0.1.0"
+when = "2024-07-15"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.zcash_address]]
+version = "0.6.0"
+when = "2024-10-02"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.zcash_client_backend]]
+version = "0.15.0"
+when = "2024-11-14"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_client_sqlite]]
+version = "0.13.0"
+when = "2024-11-14"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_encoding]]
+version = "0.2.0"
+when = "2022-10-19"
+user-id = 1244
+user-login = "ebfull"
+
+[[publisher.zcash_extensions]]
+version = "0.1.0"
+when = "2024-07-15"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.zcash_history]]
+version = "0.4.0"
+when = "2024-03-01"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.zcash_keys]]
+version = "0.5.0"
+when = "2024-11-14"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_note_encryption]]
+version = "0.4.0"
+when = "2023-06-06"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_primitives]]
+version = "0.20.0"
+when = "2024-11-14"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_proofs]]
+version = "0.20.0"
+when = "2024-11-14"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_protocol]]
+version = "0.4.1"
+when = "2024-11-14"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[publisher.zcash_spec]]
+version = "0.1.0"
+when = "2023-12-07"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.zip32]]
+version = "0.1.1"
+when = "2024-03-14"
+user-id = 6289
+user-login = "str4d"
+user-name = "Jack Grigg"
+
+[[publisher.zip321]]
+version = "0.2.0"
+when = "2024-10-04"
+user-id = 169181
+user-login = "nuttycom"
+user-name = "Kris Nuttycombe"
+
+[[audits.bytecode-alliance.wildcard-audits.bumpalo]]
+who = "Nick Fitzgerald <fitzgen@gmail.com>"
+criteria = "safe-to-deploy"
+user-id = 696 # Nick Fitzgerald (fitzgen)
+start = "2019-03-16"
+end = "2025-07-30"
+
+[[audits.bytecode-alliance.audits.adler]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+version = "1.0.2"
+notes = "This is a small crate which forbids unsafe code and is a straightforward implementation of the adler hashing algorithm."
+
+[[audits.bytecode-alliance.audits.anes]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.1.6"
+notes = "Contains no unsafe code, no IO, no build.rs."
+
+[[audits.bytecode-alliance.audits.anyhow]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+delta = "1.0.69 -> 1.0.71"
+
+[[audits.bytecode-alliance.audits.arrayref]]
+who = "Nick Fitzgerald <fitzgen@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.3.6"
+notes = """
+Unsafe code, but its logic looks good to me. Necessary given what it is
+doing. Well tested, has quickchecks.
+"""
+
+[[audits.bytecode-alliance.audits.base64]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.21.0"
+notes = "This crate has no dependencies, no build.rs, and contains no unsafe code."
+
+[[audits.bytecode-alliance.audits.base64]]
+who = "Andrew Brown <andrew.brown@intel.com>"
+criteria = "safe-to-deploy"
+delta = "0.21.3 -> 0.22.1"
+
+[[audits.bytecode-alliance.audits.block-buffer]]
+who = "Benjamin Bouvier <public@benj.me>"
+criteria = "safe-to-deploy"
+delta = "0.9.0 -> 0.10.2"
+
+[[audits.bytecode-alliance.audits.cipher]]
+who = "Andrew Brown <andrew.brown@intel.com>"
+criteria = "safe-to-deploy"
+version = "0.4.4"
+notes = "Most unsafe is hidden by `inout` dependency; only remaining unsafe is raw-splitting a slice and an unreachable hint. Older versions of this regularly reach ~150k daily downloads."
+
+[[audits.bytecode-alliance.audits.constant_time_eq]]
+who = "Nick Fitzgerald <fitzgen@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.4"
+notes = "A few tiny blocks of `unsafe` but each of them is very obviously correct."
+
+[[audits.bytecode-alliance.audits.core-foundation-sys]]
+who = "Dan Gohman <dev@sunfishcode.online>"
+criteria = "safe-to-deploy"
+delta = "0.8.4 -> 0.8.6"
+notes = """
+The changes here are all typical bindings updates: new functions, types, and
+constants. I have not audited all the bindings for ABI conformance.
+"""
+
+[[audits.bytecode-alliance.audits.crypto-common]]
+who = "Benjamin Bouvier <public@benj.me>"
+criteria = "safe-to-deploy"
+version = "0.1.3"
+
+[[audits.bytecode-alliance.audits.digest]]
+who = "Benjamin Bouvier <public@benj.me>"
+criteria = "safe-to-deploy"
+delta = "0.9.0 -> 0.10.3"
+
+[[audits.bytecode-alliance.audits.errno]]
+who = "Dan Gohman <dev@sunfishcode.online>"
+criteria = "safe-to-deploy"
+version = "0.3.0"
+notes = "This crate uses libc and windows-sys APIs to get and set the raw OS error value."
+
+[[audits.bytecode-alliance.audits.errno]]
+who = "Dan Gohman <dev@sunfishcode.online>"
+criteria = "safe-to-deploy"
+delta = "0.3.0 -> 0.3.1"
+notes = "Just a dependency version bump and a bug fix for redox"
+
+[[audits.bytecode-alliance.audits.fallible-iterator]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.0 -> 0.3.0"
+notes = """
+This major version update has a few minor breaking changes but everything
+this crate has to do with iterators and `Result` and such. No `unsafe` or
+anything like that, all looks good.
+"""
+
+[[audits.bytecode-alliance.audits.fastrand]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "2.0.0 -> 2.0.1"
+notes = """
+This update had a few doc updates but no otherwise-substantial source code
+updates.
+"""
+
+[[audits.bytecode-alliance.audits.futures-channel]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.27"
+notes = "build.rs is just detecting the target and setting cfg. unsafety is for implementing a concurrency primitives using atomics and unsafecell, and is not obviously incorrect (this is the sort of thing I wouldn't certify as correct without formal methods)"
+
+[[audits.bytecode-alliance.audits.futures-core]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.27"
+notes = "Unsafe used to implement a concurrency primitive AtomicWaker. Well-commented and not obviously incorrect. Like my other audits of these concurrency primitives inside the futures family, I couldn't certify that it is correct without formal methods, but that is out of scope for this vetting."
+
+[[audits.bytecode-alliance.audits.futures-executor]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.27"
+notes = "Unsafe used to implement the unpark mutex, which is well commented and not obviously incorrect. Like with futures-channel I wouldn't be able to certify it as correct without formal methods."
+
+[[audits.bytecode-alliance.audits.futures-io]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.27"
+
+[[audits.bytecode-alliance.audits.heck]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.4.1 -> 0.5.0"
+notes = "Minor changes for a `no_std` upgrade but otherwise everything looks as expected."
+
+[[audits.bytecode-alliance.audits.http-body]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "1.0.0-rc.2"
+
+[[audits.bytecode-alliance.audits.http-body]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "1.0.0-rc.2 -> 1.0.0"
+notes = "Only minor changes made for a stable release."
+
+[[audits.bytecode-alliance.audits.http-body-util]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0-rc.2"
+notes = "only one use of unsafe related to pin projection. unclear to me why pin_project! is used in many modules of the project, but the expanded output of that macro is inlined in either.rs"
+
+[[audits.bytecode-alliance.audits.http-body-util]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.1.0-rc.2 -> 0.1.0"
+notes = "Minor documentation updates an additions, nothing major."
+
+[[audits.bytecode-alliance.audits.iana-time-zone-haiku]]
+who = "Dan Gohman <dev@sunfishcode.online>"
+criteria = "safe-to-deploy"
+version = "0.1.2"
+
+[[audits.bytecode-alliance.audits.libm]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.2 -> 0.2.4"
+notes = """
+This diff primarily fixes a few issues with the `fma`-related functions,
+but also contains some other minor fixes as well. Everything looks A-OK and
+as expected.
+"""
+
+[[audits.bytecode-alliance.audits.libm]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.4 -> 0.2.7"
+notes = """
+This is a minor update which has some testing affordances as well as some
+updated math algorithms.
+"""
+
+[[audits.bytecode-alliance.audits.matchers]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0"
+
+[[audits.bytecode-alliance.audits.miniz_oxide]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+version = "0.7.1"
+notes = """
+This crate is a Rust implementation of zlib compression/decompression and has
+been used by default by the Rust standard library for quite some time. It's also
+a default dependency of the popular `backtrace` crate for decompressing debug
+information. This crate forbids unsafe code and does not otherwise access system
+resources. It's originally a port of the `miniz.c` library as well, and given
+its own longevity should be relatively hardened against some of the more common
+compression-related issues.
+"""
+
+[[audits.bytecode-alliance.audits.nu-ansi-term]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.46.0"
+notes = "one use of unsafe to call windows specific api to get console handle."
+
+[[audits.bytecode-alliance.audits.overload]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.1.1"
+notes = "small crate, only defines macro-rules!, nicely documented as well"
+
+[[audits.bytecode-alliance.audits.percent-encoding]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+version = "2.2.0"
+notes = """
+This crate is a single-file crate that does what it says on the tin. There are
+a few `unsafe` blocks related to utf-8 validation which are locally verifiable
+as correct and otherwise this crate is good to go.
+"""
+
+[[audits.bytecode-alliance.audits.pin-utils]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0"
+
+[[audits.bytecode-alliance.audits.pkg-config]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.25"
+notes = "This crate shells out to the pkg-config executable, but it appears to sanitize inputs reasonably."
+
+[[audits.bytecode-alliance.audits.pkg-config]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+delta = "0.3.26 -> 0.3.29"
+notes = """
+No `unsafe` additions or anything outside of the purview of the crate in this
+change.
+"""
+
+[[audits.bytecode-alliance.audits.rustc-demangle]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+version = "0.1.21"
+notes = "I am the author of this crate."
+
+[[audits.bytecode-alliance.audits.semver]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "1.0.17"
+notes = "plenty of unsafe pointer and vec tricks, but in well-structured and commented code that appears to be correct"
+
+[[audits.bytecode-alliance.audits.sharded-slab]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.1.4"
+notes = "I always really enjoy reading eliza's code, she left perfect comments at every use of unsafe."
+
+[[audits.bytecode-alliance.audits.signal-hook-registry]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "1.4.1"
+
+[[audits.bytecode-alliance.audits.thread_local]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "1.1.4"
+notes = "uses unsafe to implement thread local storage of objects"
+
+[[audits.bytecode-alliance.audits.tinyvec]]
+who = "Alex Crichton <alex@alexcrichton.com>"
+criteria = "safe-to-deploy"
+version = "1.6.0"
+notes = """
+This crate, while it implements collections, does so without `std::*` APIs and
+without `unsafe`. Skimming the crate everything looks reasonable and what one
+would expect from idiomatic safe collections in Rust.
+"""
+
+[[audits.bytecode-alliance.audits.tokio-rustls]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.24.0"
+notes = "no unsafe, no build, no ambient capabilities"
+
+[[audits.bytecode-alliance.audits.tracing-subscriber]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.17"
+
+[[audits.bytecode-alliance.audits.try-lock]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.2.4"
+notes = "Implements a concurrency primitive with atomics, and is not obviously incorrect"
+
+[[audits.bytecode-alliance.audits.vcpkg]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.2.15"
+notes = "no build.rs, no macros, no unsafe. It reads the filesystem and makes copies of DLLs into OUT_DIR."
+
+[[audits.bytecode-alliance.audits.want]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+version = "0.3.0"
+
+[[audits.bytecode-alliance.audits.webpki-roots]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+delta = "0.22.4 -> 0.23.0"
+
+[[audits.bytecode-alliance.audits.webpki-roots]]
+who = "Pat Hickey <phickey@fastly.com>"
+criteria = "safe-to-deploy"
+delta = "0.23.0 -> 0.25.2"
+
+[[audits.embark-studios.audits.anyhow]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "1.0.58"
+
+[[audits.embark-studios.audits.ident_case]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "1.0.1"
+notes = "No unsafe usage or ambient capabilities"
+
+[[audits.embark-studios.audits.num_enum]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "0.5.11"
+notes = "No unsafe usage or ambient capabilities"
+
+[[audits.embark-studios.audits.num_enum]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+delta = "0.5.11 -> 0.6.1"
+notes = "Minor changes"
+
+[[audits.embark-studios.audits.num_enum]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+delta = "0.6.1 -> 0.7.0"
+
+[[audits.embark-studios.audits.num_enum_derive]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "0.5.11"
+notes = "Proc macro that generates some unsafe code for conversion but looks sound, no ambient capabilities"
+
+[[audits.embark-studios.audits.num_enum_derive]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+delta = "0.5.11 -> 0.6.1"
+notes = "Minor changes"
+
+[[audits.embark-studios.audits.num_enum_derive]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+delta = "0.6.1 -> 0.7.0"
+
+[[audits.embark-studios.audits.tap]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "1.0.1"
+notes = "No unsafe usage or ambient capabilities"
+
+[[audits.embark-studios.audits.thiserror]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "1.0.40"
+notes = "Wrapper over implementation crate, found no unsafe or ambient capabilities used"
+
+[[audits.embark-studios.audits.thiserror-impl]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "1.0.40"
+notes = "Found no unsafe or ambient capabilities used"
+
+[[audits.embark-studios.audits.valuable]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0"
+notes = "No unsafe usage or ambient capabilities, sane build script"
+
+[[audits.embark-studios.audits.webpki-roots]]
+who = "Johan Andersson <opensource@embark-studios.com>"
+criteria = "safe-to-deploy"
+version = "0.22.4"
+notes = "Inspected it to confirm that it only contains data definitions and no runtime code"
+
+[[audits.fermyon.audits.oorandom]]
+who = "Radu Matei <radu.matei@fermyon.com>"
+criteria = "safe-to-run"
+version = "11.1.3"
+
+[[audits.google.audits.anstyle]]
+who = "Yu-An Wang <wyuang@google.com>"
+criteria = "safe-to-run"
+version = "1.0.4"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.anstyle]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-run"
+delta = "1.0.4 -> 1.0.6"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.anstyle]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-run"
+delta = "1.0.6 -> 1.0.7"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.anstyle]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-run"
+delta = "1.0.7 -> 1.0.8"
+notes = "Only Cargo.toml changes in the 1.0.7 => 1.0.8 delta."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.async-stream]]
+who = "Tyler Mandry <tmandry@google.com>"
+criteria = "safe-to-deploy"
+version = "0.3.4"
+notes = "Reviewed on https://fxrev.dev/761470"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.async-stream]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.3.4 -> 0.3.5"
+notes = "Reviewed on https://fxrev.dev/906795"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.async-stream-impl]]
+who = "Tyler Mandry <tmandry@google.com>"
+criteria = "safe-to-deploy"
+version = "0.3.4"
+notes = "Reviewed on https://fxrev.dev/761470"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.async-stream-impl]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.3.4 -> 0.3.5"
+notes = "Reviewed on https://fxrev.dev/906795"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.autocfg]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.1.0"
+notes = """
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
+and there were no hits except for reasonable, client-controlled usage of
+`std::fs` in `AutoCfg::with_dir`.
+
+This crate has been added to Chromium in
+https://source.chromium.org/chromium/chromium/src/+/591a0f30c5eac93b6a3d981c2714ffa4db28dbcb
+The CL description contains a link to a Google-internal document with audit details.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.autocfg]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.1.0 -> 1.2.0"
+notes = '''
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
+and nothing changed from the baseline audit of 1.1.0.  Skimmed through the
+1.1.0 => 1.2.0 delta and everything seemed okay.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.bitflags]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.3.2"
+notes = """
+Security review of earlier versions of the crate can be found at
+(Google-internal, sorry): go/image-crate-chromium-security-review
+
+The crate exposes a function marked as `unsafe`, but doesn't use any
+`unsafe` blocks (except for tests of the single `unsafe` function).  I
+think this justifies marking this crate as `ub-risk-1`.
+
+Additional review comments can be found at https://crrev.com/c/4723145/31
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.bitflags]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "2.4.2"
+notes = """
+Audit notes:
+
+* I've checked for any discussion in Google-internal cl/546819168 (where audit
+  of version 2.3.3 happened)
+* `src/lib.rs` contains `#![cfg_attr(not(test), forbid(unsafe_code))]`
+* There are 2 cases of `unsafe` in `src/external.rs` but they seem to be
+  correct in a straightforward way - they just propagate the marker trait's
+  impl (e.g. `impl bytemuck::Pod`) from the inner to the outer type
+* Additional discussion and/or notes may be found in https://crrev.com/c/5238056
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.bitflags]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "2.4.2 -> 2.5.0"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.bitflags]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "2.5.0 -> 2.6.0"
+notes = "The changes from the previous version are negligible and thus it retains the same properties."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.bytemuck]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.16.3"
+notes = """
+Review notes from the original audit (of 1.14.3) may be found in
+https://crrev.com/c/5362675.  Note that this audit has initially missed UB risk
+that was fixed in 1.16.2 - see https://github.com/Lokathor/bytemuck/pull/258.
+Because of this, the original audit has been edited to certify version `1.16.3`
+instead (see also https://crrev.com/c/5771867).
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.byteorder]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.5.0"
+notes = "Unsafe review in https://crrev.com/c/5838022"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.cast]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-run"
+version = "0.3.0"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.cfg-if]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "1.0.0"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "4.5.15"
+notes = '''
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
+and there were no hits, except for `std::net::IpAddr` usage in
+`examples/typed-derive.rs`.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "4.5.15 -> 4.5.17"
+notes = "Minor code change and toml changes."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "4.5.17 -> 4.5.18"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "4.5.18 -> 4.5.20"
+notes = "Trivial changes"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_builder]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "4.5.15"
+notes = '''
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
+and there were no hits.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_builder]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "4.5.15 -> 4.5.17"
+notes = "No new unsafe, net, fs"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_builder]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "4.5.17 -> 4.5.18"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_builder]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-run"
+delta = "4.5.18 -> 4.5.20"
+notes = "No new unsafe"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_lex]]
+who = "Ying Hsu <yinghsu@chromium.org>"
+criteria = "safe-to-run"
+version = "0.7.0"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_lex]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-run"
+delta = "0.7.0 -> 0.7.1"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.clap_lex]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-run"
+delta = "0.7.1 -> 0.7.2"
+notes = "No `.rs` changes in the delta."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.cpp_demangle]]
+who = "Hidenori Kobayashi <hidenorik@chromium.org>"
+criteria = "safe-to-run"
+version = "0.4.3"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.crc32fast]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.4.2"
+notes = """
+Security review of earlier versions of the crate can be found at
+(Google-internal, sorry): go/image-crate-chromium-security-review
+
+Audit comments for 1.4.2 can be found at https://crrev.com/c/4723145.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.equivalent]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "1.0.1"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.fastrand]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "1.9.0"
+notes = """
+`does-not-implement-crypto` is certified because this crate explicitly says
+that the RNG here is not cryptographically secure.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.flate2]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.30"
+notes = '''
+WARNING: This certification is a result of a **partial** audit.  The
+`any_zlib` code has **not** been audited.  Ability to track partial
+audits is tracked in https://github.com/mozilla/cargo-vet/issues/380
+Chromium does use the `any_zlib` feature(s).  Accidentally depending on
+this feature in the future is prevented using the `ban_features` feature
+of `gnrt` - see:
+https://crrev.com/c/4723145/31/third_party/rust/chromium_crates_io/gnrt_config.toml
+
+Security review of earlier versions of the crate can be found at
+(Google-internal, sorry): go/image-crate-chromium-security-review
+
+I grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`.
+
+All `unsafe` in `flate2` is gated behind `#[cfg(feature = "any_zlib")]`:
+
+* The code under `src/ffi/...` will not be used because the `mod c`
+  declaration in `src/ffi/mod.rs` depends on the `any_zlib` config
+* 7 uses of `unsafe` in `src/mem.rs` also all depend on the
+  `any_zlib` config:
+    - 2 in `fn set_dictionary` (under `impl Compress`)
+    - 2 in `fn set_level` (under `impl Compress`)
+    - 3 in `fn set_dictionary` (under `impl Decompress`)
+
+All hits of `'\bfs\b'` are in comments, or example code, or test code
+(but not in product code).
+
+There were no hits of `-i cipher`, `-i crypto`, `'\bnet\b'`.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.futures]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "0.3.28"
+notes = """
+`futures` has no logic other than tests - it simply `pub use`s things from
+other crates.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.heck]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "0.4.1"
+notes = """
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
+and there were no hits.
+
+`heck` (version `0.3.3`) has been added to Chromium in
+https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.httpdate]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "1.0.3"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.is-terminal]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-run"
+version = "0.4.2"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.is-terminal]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-run"
+delta = "0.4.2 -> 0.4.9"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.itoa]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.10"
+notes = '''
+I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.
+
+There are a few places where `unsafe` is used.  Unsafe review notes can be found
+in https://crrev.com/c/5350697.
+
+Version 1.0.1 of this crate has been added to Chromium in
+https://crrev.com/c/3321896.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.itoa]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.10 -> 1.0.11"
+notes = """
+Straightforward diff between 1.0.10 and 1.0.11 - only 3 commits:
+
+* Bumping up the version
+* A touch up of comments
+* And my own PR to make `unsafe` blocks more granular:
+  https://github.com/dtolnay/itoa/pull/42
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.lazy_static]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.4.0"
+notes = '''
+I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.
+
+There are two places where `unsafe` is used.  Unsafe review notes can be found
+in https://crrev.com/c/5347418.
+
+This crate has been added to Chromium in https://crrev.com/c/3321895.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.lazy_static]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.4.0 -> 1.5.0"
+notes = "Unsafe review notes: https://crrev.com/c/5650836"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.nix]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-run"
+version = "0.26.2"
+notes = """
+Reviewed on https://fxrev.dev/780283
+Issues:
+- https://github.com/nix-rust/nix/issues/1975
+- https://github.com/nix-rust/nix/issues/1977
+- https://github.com/nix-rust/nix/pull/1978
+- https://github.com/nix-rust/nix/pull/1979
+- https://github.com/nix-rust/nix/issues/1980
+- https://github.com/nix-rust/nix/issues/1981
+- https://github.com/nix-rust/nix/pull/1983
+- https://github.com/nix-rust/nix/issues/1990
+- https://github.com/nix-rust/nix/pull/1992
+- https://github.com/nix-rust/nix/pull/1993
+"""
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.nom]]
+who = "danakj@chromium.org"
+criteria = "safe-to-deploy"
+version = "7.1.3"
+notes = """
+Reviewed in https://chromium-review.googlesource.com/c/chromium/src/+/5046153
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.num-iter]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "0.1.43"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.password-hash]]
+who = "Joshua Liebow-Feeser <joshlf@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.3.2 -> 0.4.2"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.pbkdf2]]
+who = "Joshua Liebow-Feeser <joshlf@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.9.0 -> 0.11.0"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.pin-project-lite]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+version = "0.2.9"
+notes = "Reviewed on https://fxrev.dev/824504"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.pin-project-lite]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.9 -> 0.2.13"
+notes = "Audited at https://fxrev.dev/946396"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.78"
+notes = """
+Grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
+(except for a benign \"fs\" hit in a doc comment)
+
+Notes from the `unsafe` review can be found in https://crrev.com/c/5385745.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.78 -> 1.0.79"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.79 -> 1.0.80"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Dustin J. Mitchell <djmitche@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.80 -> 1.0.81"
+notes = "Comment changes only"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Dustin J. Mitchell <djmitche@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.82 -> 1.0.83"
+notes = "Substantive change is replacing String with Box<str>, saving memory."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.83 -> 1.0.84"
+notes = "Only doc comment changes in `src/lib.rs`."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "danakj@chromium.org"
+criteria = "safe-to-deploy"
+delta = "1.0.84 -> 1.0.85"
+notes = "Test-only changes."
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.proc-macro2]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.85 -> 1.0.86"
+notes = """
+Comment-only changes in `build.rs`.
+Reordering of `Cargo.toml` entries.
+Just bumping up the version number in `lib.rs`.
+Config-related changes in `test_size.rs`.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.35"
+notes = """
+Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits
+(except for benign \"net\" hit in tests and \"fs\" hit in README.md)
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.quote]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.35 -> 1.0.36"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.ring]]
+who = "Laura Peskin <pesk@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.16.12 -> 0.16.20"
+notes = """
+Reviewed on: https://fxrev.dev/923001 (0.16.13 -> 0.16.20)
+Reviewed on: https://fxrev.dev/716624 (0.16.12 -> 0.16.13)
+"""
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.rustversion]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.14"
+notes = """
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'``
+and there were no hits except for:
+
+* Using trivially-safe `unsafe` in test code:
+
+    ```
+    tests/test_const.rs:unsafe fn _unsafe() {}
+    tests/test_const.rs:const _UNSAFE: () = unsafe { _unsafe() };
+    ```
+
+* Using `unsafe` in a string:
+
+    ```
+    src/constfn.rs:            \"unsafe\" => Qualifiers::Unsafe,
+    ```
+
+* Using `std::fs` in `build/build.rs` to write `${OUT_DIR}/version.expr`
+  which is later read back via `include!` used in `src/lib.rs`.
+
+Version `1.0.6` of this crate has been added to Chromium in
+https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.rustversion]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.14 -> 1.0.15"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.197"
+notes = """
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`.
+
+There were some hits for `net`, but they were related to serialization and
+not actually opening any connections or anything like that.
+
+There were 2 hits of `unsafe` when grepping:
+* In `fn as_str` in `impl Buf`
+* In `fn serialize` in `impl Serialize for net::Ipv4Addr`
+
+Unsafe review comments can be found in https://crrev.com/c/5350573/2 (this
+review also covered `serde_json_lenient`).
+
+Version 1.0.130 of the crate has been added to Chromium in
+https://crrev.com/c/3265545.  The CL description contains a link to a
+(Google-internal, sorry) document with a mini security review.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde]]
+who = "Dustin J. Mitchell <djmitche@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.197 -> 1.0.198"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.198 -> 1.0.201"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.202 -> 1.0.203"
+notes = "s/doc_cfg/docsrs/ + tuple_impls/tuple_impl_body-related changes"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.203 -> 1.0.204"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde_derive]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.197"
+notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde_derive]]
+who = "danakj <danakj@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.197 -> 1.0.201"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde_derive]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.202 -> 1.0.203"
+notes = "Grepped for \"unsafe\", \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.serde_derive]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.203 -> 1.0.204"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.sha1]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+version = "0.10.5"
+notes = "Reviewed on https://fxrev.dev/712371."
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.stable_deref_trait]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-run"
+version = "1.2.0"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.static_assertions]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.1.0"
+notes = """
+Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'`, `'\bnet\b'`, `'\bunsafe\b'`
+and there were no hits except for one `unsafe`.
+
+The lambda where `unsafe` is used is never invoked (e.g. the `unsafe` code
+never runs) and is only introduced for some compile-time checks.  Additional
+unsafe review comments can be found in https://crrev.com/c/5353376.
+
+This crate has been added to Chromium in https://crrev.com/c/3736562.  The CL
+description contains a link to a document with an additional security review.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.strsim]]
+who = "danakj@chromium.org"
+criteria = "safe-to-deploy"
+version = "0.10.0"
+notes = """
+Reviewed in https://crrev.com/c/5171063
+
+Previously reviewed during security review and the audit is grandparented in.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.strum]]
+who = "danakj@chromium.org"
+criteria = "safe-to-deploy"
+version = "0.25.0"
+notes = """
+Reviewed in https://crrev.com/c/5171063
+
+Previously reviewed during security review and the audit is grandparented in.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.strum_macros]]
+who = "danakj@chromium.org"
+criteria = "safe-to-deploy"
+version = "0.25.3"
+notes = """
+Reviewed in https://crrev.com/c/5171063
+
+Previously reviewed during security review and the audit is grandparented in.
+"""
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.tinytemplate]]
+who = "Ying Hsu <yinghsu@chromium.org>"
+criteria = "safe-to-run"
+version = "1.2.1"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.tinyvec]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.6.0 -> 1.6.1"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.tinyvec]]
+who = "Adrian Taylor <adetaylor@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.6.1 -> 1.7.0"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.tinyvec]]
+who = "Dustin J. Mitchell <djmitche@chromium.org>"
+criteria = "safe-to-deploy"
+delta = "1.7.0 -> 1.8.0"
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.tinyvec_macros]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.tokio-stream]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+version = "0.1.11"
+notes = "Reviewed on https://fxrev.dev/804724"
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.tokio-stream]]
+who = "David Koloski <dkoloski@google.com>"
+criteria = "safe-to-deploy"
+delta = "0.1.11 -> 0.1.14"
+notes = "Reviewed on https://fxrev.dev/907732."
+aggregated-from = "https://fuchsia.googlesource.com/fuchsia/+/refs/heads/main/third_party/rust_crates/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.unicode-ident]]
+who = "Lukasz Anforowicz <lukasza@chromium.org>"
+criteria = "safe-to-deploy"
+version = "1.0.12"
+notes = '''
+I grepped for \"crypt\", \"cipher\", \"fs\", \"net\" - there were no hits.
+
+All two functions from the public API of this crate use `unsafe` to avoid bound
+checks for an array access.  Cross-module analysis shows that the offsets can
+be statically proven to be within array bounds.  More details can be found in
+the unsafe review CL at https://crrev.com/c/5350386.
+
+This crate has been added to Chromium in https://crrev.com/c/3891618.
+'''
+aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT"
+
+[[audits.google.audits.unicode-xid]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "0.2.4"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.version_check]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "0.9.4"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.google.audits.void]]
+who = "George Burgess IV <gbiv@google.com>"
+criteria = "safe-to-deploy"
+version = "1.0.2"
+aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT"
+
+[[audits.isrg.audits.aes]]
+who = "Tim Geoghegan <timg@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.8.3 -> 0.8.4"
+notes = """
+Change affects some unsafe code. The only functional change is to add an
+assertion checking alignment and to change an `as *mut u32` cast to a
+call to `std::pointer::cast`.
+"""
+
+[[audits.isrg.audits.base64]]
+who = "Tim Geoghegan <timg@letsencrypt.org>"
+criteria = "safe-to-deploy"
+delta = "0.21.0 -> 0.21.1"
+
+[[audits.isrg.audits.base64]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.21.1 -> 0.21.2"
+
+[[audits.isrg.audits.base64]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.21.2 -> 0.21.3"
+
+[[audits.isrg.audits.block-buffer]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.9.0"
+
+[[audits.isrg.audits.criterion]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-run"
+delta = "0.4.0 -> 0.5.1"
+
+[[audits.isrg.audits.crunchy]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.2.2"
+
+[[audits.isrg.audits.digest]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.10.6 -> 0.10.7"
+
+[[audits.isrg.audits.either]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "1.6.1"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.1.17"
+notes = """
+This crate does not contain any unsafe code, and does not use any items from
+the standard library or other crates, aside from operations backed by
+`std::ops`. All paths with array indexing use integer literals for indexes, so
+there are no panics due to indexes out of bounds (as rustc would catch an
+out-of-bounds literal index). I did not check whether arithmetic overflows
+could cause a panic, and I am relying on the Coq code having satisfied the
+necessary preconditions to ensure panics due to overflows are unreachable.
+"""
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.1.17 -> 0.1.18"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.18 -> 0.1.19"
+notes = """
+This release renames many items and adds a new module. The code in the new
+module is entirely composed of arithmetic and array accesses.
+"""
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.19 -> 0.1.20"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.20 -> 0.2.0"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.2.0 -> 0.2.1"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Tim Geoghegan <timg@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.1 -> 0.2.2"
+notes = "No changes to `unsafe` code, or any functional changes that I can detect at all."
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.2.2 -> 0.2.4"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.4 -> 0.2.5"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.2.5 -> 0.2.6"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.2.6 -> 0.2.7"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.7 -> 0.2.8"
+
+[[audits.isrg.audits.fiat-crypto]]
+who = "Tim Geoghegan <timg@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.8 -> 0.2.9"
+notes = "No changes to Rust code between 0.2.8 and 0.2.9"
+
+[[audits.isrg.audits.getrandom]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.11 -> 0.2.12"
+
+[[audits.isrg.audits.getrandom]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.12 -> 0.2.14"
+
+[[audits.isrg.audits.getrandom]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.14 -> 0.2.15"
+
+[[audits.isrg.audits.hmac]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.12.1"
+
+[[audits.isrg.audits.keccak]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.1.2"
+
+[[audits.isrg.audits.keccak]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.1.2 -> 0.1.3"
+
+[[audits.isrg.audits.keccak]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.1.3 -> 0.1.4"
+
+[[audits.isrg.audits.num-bigint]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.3 -> 0.4.4"
+
+[[audits.isrg.audits.num-integer]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.45 -> 0.1.46"
+
+[[audits.isrg.audits.num-iter]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.43 -> 0.1.44"
+
+[[audits.isrg.audits.num-iter]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.44 -> 0.1.45"
+
+[[audits.isrg.audits.num-traits]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.15 -> 0.2.16"
+
+[[audits.isrg.audits.num-traits]]
+who = "Ameer Ghani <inahga@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.16 -> 0.2.17"
+
+[[audits.isrg.audits.num-traits]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.17 -> 0.2.18"
+
+[[audits.isrg.audits.num-traits]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.18 -> 0.2.19"
+
+[[audits.isrg.audits.once_cell]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "1.18.0 -> 1.19.0"
+
+[[audits.isrg.audits.opaque-debug]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.3.0"
+
+[[audits.isrg.audits.rand_chacha]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.3.1"
+
+[[audits.isrg.audits.rand_core]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.6.3"
+
+[[audits.isrg.audits.rayon]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "1.6.1 -> 1.7.0"
+
+[[audits.isrg.audits.rayon]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "1.7.0 -> 1.8.0"
+
+[[audits.isrg.audits.rayon]]
+who = "Ameer Ghani <inahga@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "1.8.0 -> 1.8.1"
+
+[[audits.isrg.audits.rayon]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "1.8.1 -> 1.9.0"
+
+[[audits.isrg.audits.rayon]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "1.9.0 -> 1.10.0"
+
+[[audits.isrg.audits.rayon-core]]
+who = "Ameer Ghani <inahga@divviup.org>"
+criteria = "safe-to-deploy"
+version = "1.12.1"
+
+[[audits.isrg.audits.sha3]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.10.6"
+
+[[audits.isrg.audits.sha3]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.10.6 -> 0.10.7"
+
+[[audits.isrg.audits.sha3]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "0.10.7 -> 0.10.8"
+
+[[audits.isrg.audits.subtle]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "2.5.0 -> 2.6.1"
+
+[[audits.isrg.audits.thiserror]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "1.0.40 -> 1.0.43"
+
+[[audits.isrg.audits.thiserror-impl]]
+who = "Brandon Pitman <bran@bran.land>"
+criteria = "safe-to-deploy"
+delta = "1.0.40 -> 1.0.43"
+
+[[audits.isrg.audits.universal-hash]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.4.1"
+
+[[audits.isrg.audits.universal-hash]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.0 -> 0.5.1"
+
+[[audits.isrg.audits.untrusted]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.7.1"
+
+[[audits.isrg.audits.wasm-bindgen-shared]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+version = "0.2.83"
+
+[[audits.mozilla.wildcard-audits.core-foundation-sys]]
+who = "Bobby Holley <bobbyholley@gmail.com>"
+criteria = "safe-to-deploy"
+user-id = 5946 # Jeff Muizelaar (jrmuizel)
+start = "2020-10-14"
+end = "2023-05-04"
+renew = false
+notes = "I've reviewed every source contribution that was neither authored nor reviewed by Mozilla."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.wildcard-audits.unicode-normalization]]
+who = "Manish Goregaokar <manishsmail@gmail.com>"
+criteria = "safe-to-deploy"
+user-id = 1139 # Manish Goregaokar (Manishearth)
+start = "2019-11-06"
+end = "2024-05-03"
+notes = "All code written or reviewed by Manish"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.ahash]]
+who = "Erich Gubler <erichdongubler@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.8.7 -> 0.8.11"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.allocator-api2]]
+who = "Nicolas Silva <nical@fastmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.18"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.android_system_properties]]
+who = "Nicolas Silva <nical@fastmail.com>"
+criteria = "safe-to-deploy"
+version = "0.1.2"
+notes = "I wrote this crate, reviewed by jimb. It is mostly a Rust port of some C++ code we already ship."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.android_system_properties]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.2 -> 0.1.4"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.android_system_properties]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.4 -> 0.1.5"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.anyhow]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.57 -> 1.0.61"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.anyhow]]
+who = "Bobby Holley <bobbyholley@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "1.0.58 -> 1.0.57"
+notes = "No functional differences, just CI config and docs."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.anyhow]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.61 -> 1.0.62"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.anyhow]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.62 -> 1.0.68"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.anyhow]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.68 -> 1.0.69"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.bit-set]]
+who = "Aria Beingessner <a.beingessner@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.5.2"
+notes = "Another crate I own via contain-rs that is ancient and maintenance mode, no known issues."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.bit-set]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.2 -> 0.5.3"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.bit-vec]]
+who = "Aria Beingessner <a.beingessner@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.6.3"
+notes = "Another crate I own via contain-rs that is ancient and in maintenance mode but otherwise perfectly fine."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.block-buffer]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.10.2 -> 0.10.3"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.crossbeam-channel]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.5.8 -> 0.5.11"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.crossbeam-channel]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.5.11 -> 0.5.12"
+notes = "Minimal change fixing a memory leak."
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.crossbeam-queue]]
+who = "Matthew Gregan <kinetik@flim.org>"
+criteria = "safe-to-deploy"
+version = "0.3.8"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.crossbeam-utils]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.8.19 -> 0.8.20"
+notes = "Minor changes."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.crypto-common]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.1.3 -> 0.1.6"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.debugid]]
+who = "Gabriele Svelto <gsvelto@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.8.0"
+notes = "This crates was written by Sentry and I've fully audited it as Firefox crash reporting machinery relies on it."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.deranged]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.3.11"
+notes = """
+This crate contains a decent bit of `unsafe` code, however all internal
+unsafety is verified with copious assertions (many are compile-time), and
+otherwise the unsafety is documented and left to the caller to verify.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.digest]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.10.3 -> 0.10.6"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.displaydoc]]
+who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
+criteria = "safe-to-deploy"
+version = "0.2.3"
+notes = """
+This crate is convenient macros to implement core::fmt::Display trait.
+Although `unsafe` is used for test code to call `libc::abort()`, it has no `unsafe` code in this crate. And there is no file access.
+It meets the criteria for safe-to-deploy.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.displaydoc]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.3 -> 0.2.4"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.document-features]]
+who = "Erich Gubler <erichdongubler@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.8"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.either]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.6.1 -> 1.7.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.either]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.7.0 -> 1.8.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.either]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.8.0 -> 1.8.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.errno]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.1 -> 0.3.3"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.fastrand]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.9.0 -> 2.0.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.fnv]]
+who = "Bobby Holley <bobbyholley@gmail.com>"
+criteria = "safe-to-deploy"
+version = "1.0.7"
+notes = "Simple hasher implementation with no unsafe code."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-channel]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.27 -> 0.3.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-core]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.27 -> 0.3.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-executor]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.27 -> 0.3.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-io]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.27 -> 0.3.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-macro]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.21 -> 0.3.23"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-macro]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.23 -> 0.3.25"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-macro]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.25 -> 0.3.26"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-macro]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.26 -> 0.3.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-util]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.21 -> 0.3.23"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-util]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.23 -> 0.3.25"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-util]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.25 -> 0.3.26"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.futures-util]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.26 -> 0.3.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.half]]
+who = "John M. Schanck <jschanck@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "1.8.2"
+notes = """
+This crate contains unsafe code for bitwise casts to/from binary16 floating-point
+format. I've reviewed these and found no issues. There are no uses of ambient
+capabilities.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.hashbrown]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+version = "0.12.3"
+notes = "This version is used in rust's libstd, so effectively we're already trusting it"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.hashlink]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.0 -> 0.8.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.hashlink]]
+who = "Mark Hammond <mhammond@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.8.1 -> 0.9.1"
+notes = "New CursorMut struct and other relatively straight-forward changes."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.hex]]
+who = "Simon Friedberger <simon@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.4.3"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.litrs]]
+who = "Erich Gubler <erichdongubler@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.4.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.log]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+version = "0.4.17"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.log]]
+who = "Jan-Erik Rediger <jrediger@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.4.17 -> 0.4.18"
+notes = "One dependency removed, others updated (which we don't rely on), some APIs (which we don't use) changed."
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.log]]
+who = "Kagami Sascha Rosylight <krosylight@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.4.18 -> 0.4.20"
+notes = "Only cfg attribute and internal macro changes and module refactorings"
+aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.memmap2]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.4 -> 0.5.7"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.memmap2]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.7 -> 0.5.8"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.memmap2]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.8 -> 0.5.9"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.memmap2]]
+who = "Gabriele Svelto <gsvelto@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.5.9 -> 0.8.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.memmap2]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.9.3"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.num-bigint]]
+who = "Josh Stone <jistone@redhat.com>"
+criteria = "safe-to-deploy"
+version = "0.4.3"
+notes = "All code written or reviewed by Josh Stone."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.num-conv]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0"
+notes = """
+Very straightforward, simple crate. No dependencies, unsafe, extern,
+side-effectful std functions, etc.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.num-integer]]
+who = "Josh Stone <jistone@redhat.com>"
+criteria = "safe-to-deploy"
+version = "0.1.45"
+notes = "All code written or reviewed by Josh Stone."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.num-traits]]
+who = "Josh Stone <jistone@redhat.com>"
+criteria = "safe-to-deploy"
+version = "0.2.15"
+notes = "All code written or reviewed by Josh Stone."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.percent-encoding]]
+who = "Valentin Gosu <valentin.gosu@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "2.2.0 -> 2.3.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.percent-encoding]]
+who = "Valentin Gosu <valentin.gosu@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "2.3.0 -> 2.3.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.phf_macros]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.10.0 -> 0.11.2"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.pkg-config]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.25 -> 0.3.26"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.powerfmt]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+notes = """
+A tiny bit of unsafe code to implement functionality that isn't in stable rust
+yet, but it's all valid. Otherwise it's a pretty simple crate.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.rand_core]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.6.3 -> 0.6.4"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.rayon]]
+who = "Josh Stone <jistone@redhat.com>"
+criteria = "safe-to-deploy"
+version = "1.5.3"
+notes = "All code written or reviewed by Josh Stone or Niko Matsakis."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.rayon]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.5.3 -> 1.6.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.regex-syntax]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.6.26 -> 0.6.27"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.regex-syntax]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.6.27 -> 0.6.28"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.strsim]]
+who = "Ben Dean-Kawamura <bdk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.10.0 -> 0.11.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.subtle]]
+who = "Simon Friedberger <simon@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "2.5.0"
+notes = "The goal is to provide some constant-time correctness for cryptographic implementations. The approach is reasonable, it is known to be insufficient but this is pointed out in the documentation."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.syn]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.96 -> 1.0.99"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.syn]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.99 -> 1.0.107"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.3.23 -> 0.3.36"
+notes = """
+There's a bit of new unsafe code that is self-imposed because they now assert
+that ordinals are non-zero. All unsafe code was checked to ensure that the
+invariants claimed were true.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time-core]]
+who = "Kershaw Chang <kershaw@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.1.0"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time-core]]
+who = "Kershaw Chang <kershaw@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.1.0 -> 0.1.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time-core]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.1.1 -> 0.1.2"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time-macros]]
+who = "Kershaw Chang <kershaw@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.2.6"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time-macros]]
+who = "Kershaw Chang <kershaw@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.6 -> 0.2.10"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.time-macros]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.10 -> 0.2.18"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.tinystr]]
+who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
+criteria = "safe-to-deploy"
+version = "0.7.0"
+notes = "One of original auther was Zibi Braniecki who worked at Mozilla and maintained by ICU4X developers (Google and Mozilla). I've vetted the one instance of unsafe code."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.tinystr]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.0 -> 0.7.1"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.tinystr]]
+who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
+criteria = "safe-to-deploy"
+delta = "0.7.1 -> 0.7.4"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.tinystr]]
+who = "Makoto Kato <m_kato@ga2.so-net.ne.jp>"
+criteria = "safe-to-deploy"
+delta = "0.7.4 -> 0.7.6"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.tracing-core]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.1.30"
+notes = """
+Most unsafe code is in implementing non-std sync primitives. Unsafe impls are
+logically correct and justified in comments, and unsafe code is sound and
+justified in comments.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.unicode-xid]]
+who = "Teodor Tanasoaia <ttanasoaia@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.4 -> 0.2.5"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.unicode-xid]]
+who = "Jim Blandy <jimb@red-bean.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.5 -> 0.2.6"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.zerocopy]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.7.32"
+notes = """
+This crate is `no_std` so doesn't use any side-effectful std functions. It
+contains quite a lot of `unsafe` code, however. I verified portions of this. It
+also has a large, thorough test suite. The project claims to run tests with
+Miri to have stronger soundness checks, and also claims to use formal
+verification tools to prove correctness.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.zerocopy-derive]]
+who = "Alex Franchuk <afranchuk@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.7.32"
+notes = "Clean, safe macros for zerocopy."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.zcash.audits.ahash]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.8.6 -> 0.8.7"
+notes = "Build-time `stdsimd` detection is replaced with a nightly-only feature flag."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.aho-corasick]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.1.2 -> 1.1.3"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.anyhow]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.71 -> 1.0.75"
+notes = """
+`unsafe` changes are migrating from `core::any::Demand` to `std::error::Request` when the
+nightly features are available.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.anyhow]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.75 -> 1.0.77"
+notes = """
+- Build script changes are to rerun cargo if the `RUSTC_BOOTSTRAP` env variable
+  changes, and enable a few more `rustc` config flags.
+- Some `unsafe fn`s were altered to add `unsafe` blocks, to make the safety
+  contracts in the code clearer (instead of using the `unsafe fn`'s implicit
+  `unsafe` block); no actual `unsafe` changes were made.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.anyhow]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.77 -> 1.0.79"
+notes = """
+Build script changes are to refactor the existing probe into a separate file
+(which removes a filesystem write), and adjust how it gets rerun in response to
+changes in the build environment.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.anyhow]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.79 -> 1.0.82"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.arrayref]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.3.6 -> 0.3.7"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.backtrace]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.69 -> 0.3.71"
+notes = "This crate inherently requires a lot of `unsafe` code, but the changes look plausible."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.blake2b_simd]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.1 -> 1.0.2"
+notes = "Switches to `constant_time_eq 0.3.0`, which bumps its MSRV to 1.66."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.blake2s_simd]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.1 -> 1.0.2"
+notes = "Switches to `constant_time_eq 0.3.0`, which bumps its MSRV to 1.66."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.block-buffer]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.10.3 -> 0.10.4"
+notes = "Adds panics to prevent a block size of zero from causing unsoundness."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.bs58]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.0 -> 0.5.1"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.bytes]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.5.0 -> 1.6.0"
+notes = """
+There is significant use of `unsafe` code, but safety requirements are well documented
+and appear correct as far as I can see.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.constant_time_eq]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.4 -> 0.2.5"
+notes = "No code changes."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.constant_time_eq]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.5 -> 0.2.6"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.constant_time_eq]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.6 -> 0.3.0"
+notes = "Replaces some `unsafe` code by bumping MSRV to 1.66 (to access `core::hint::black_box`)."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.cpufeatures]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.11 -> 0.2.12"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.crossbeam-deque]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.8.3 -> 0.8.4"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.crossbeam-deque]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.8.4 -> 0.8.5"
+notes = "Changes to `unsafe` code look okay."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.crossbeam-epoch]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.9.15 -> 0.9.16"
+notes = "Moved an `unsafe` block while removing `scopeguard` dependency."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.crossbeam-epoch]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.9.16 -> 0.9.17"
+notes = """
+Changes to `unsafe` code are to replace manual pointer logic with equivalent
+`unsafe` stdlib methods, now that MSRV is high enough to use them.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.crossbeam-epoch]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.9.17 -> 0.9.18"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.curve25519-dalek]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "4.1.0 -> 4.1.1"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.curve25519-dalek]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "4.1.1 -> 4.1.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.curve25519-dalek]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "4.1.2 -> 4.1.3"
+notes = """
+- New unsafe is adding `core::ptr::read_volatile` calls for black box
+  optimization barriers.
+- `build.rs` changes are to use `CARGO_CFG_TARGET_POINTER_WIDTH` instead of
+  `TARGET` and the `platforms` crate for deciding on the target pointer width.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.curve25519-dalek-derive]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.0 -> 0.1.1"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.der]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.8 -> 0.7.9"
+notes = "The change to ignore RUSTSEC-2023-0071 is correct for this crate."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.ed25519]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "2.2.1 -> 2.2.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.ed25519]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "2.2.2 -> 2.2.3"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.ed25519-zebra]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "3.0.0 -> 3.1.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.ed25519-zebra]]
+who = "Daira Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "3.1.0 -> 4.0.0"
+notes = """
+Changes are mainly in the pem and pkcs8 features and in Java or Scala code. These do not introduce unsafe code,
+but I cannot vouch for their cryptographic correctness or conformance to PEM or PKCS8 standards. I reviewed the
+remaining changes from 3.1.0 to 4.0.0 fully.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.ed25519-zebra]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "4.0.0 -> 4.0.3"
+notes = """
+`SigningKey::from([u8; 32])` parsing now uses `Scalar::from_bytes_mod_order` instead of
+`Scalar::from_bits`. This means that the clamped scalar bits are now reduced before they
+are used, which removes the implicit mul-by-cofactor during scalar multiplication (as the
+last 3 bits of the scalar are no longer guaranteed to be zero). However, this happens to
+be fine in the context of this crate:
+
+- `SigningKey` does not expose its inner `Scalar` directly, so we only need to consider
+  how it is used within the crate.
+- For multiplication within a prime-order (sub)group, we get the same result whether we
+  reduce before or not. This means that the field-element multiplication during signing,
+  and the prime-order subgroup component of any group-element scalar multiplication, are
+  unaffected.
+- The only group element that the `Scalar` is multiplied by is the Ed25519 basepoint,
+  which is torsion free (so the implicit mul-by-cofactor is unnecessary).
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.either]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.8.1 -> 1.9.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.either]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.9.0 -> 1.11.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.errno]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.3 -> 0.3.8"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.fastrand]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "2.0.1 -> 2.0.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-channel]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.29"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-channel]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+notes = "Removes `build.rs` now that it can rely on the `target_has_atomic` attribute."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-core]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.29"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-core]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+notes = "Removes `build.rs` now that it can rely on the `target_has_atomic` attribute."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-task]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+notes = "Removes `build.rs` now that it can rely on the `target_has_atomic` attribute."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-util]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.28 -> 0.3.29"
+notes = """
+Only change to `unsafe` code is to add a `Fut: Send` bound to the
+`unsafe impl Sync for FuturesUnordered<Fut>`.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.futures-util]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.29 -> 0.3.30"
+notes = """
+- Removes `build.rs` now that it can rely on the `target_has_atomic` attribute.
+- Almost all changes to `unsafe` blocks are to either move them around, or
+  replace them with safe method calls.
+- One new `unsafe` block is added for a slice lifetime transmutation. The slice
+  reconstruction is obviously correct. AFAICT the lifetime transmutation is also
+  correct; the slice's lifetime logically comes from the `AsyncBufRead` reader
+  inside `FillBuf`, rather than the `Context`.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.hermit-abi]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.3 -> 0.3.9"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.inout]]
+who = "Daira Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+version = "0.1.3"
+notes = "Reviewed in full."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.js-sys]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.66 -> 0.3.69"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.known-folders]]
+who = "Jack Grigg <thestr4d@gmail.com>"
+criteria = "safe-to-deploy"
+version = "1.0.1"
+notes = """
+Uses `unsafe` blocks to interact with `windows-sys` crate.
+- `SHGetKnownFolderPath` safety requirements are met.
+- `CoTaskMemFree` has no effect if passed `NULL`, so there is no issue if some
+  future refactor created a pathway where `ffi::Guard` could be dropped before
+  `SHGetKnownFolderPath` is called.
+- Small nit: `ffi::Guard::as_pwstr` takes `&self` but returns `PWSTR` which is
+  the mutable type; it should instead return `PCWSTR` which is the const type
+  (and what `lstrlenW` takes) instead of implicitly const-casting the pointer,
+  as this would better reflect the intent to take an immutable reference.
+- The slice constructed from the `PWSTR` correctly goes out of scope before
+  `guard` is dropped.
+- A code comment says that `path_ptr` is valid for `len` bytes, but `PCWSTR` is
+  a `*const u16` and `lstrlenW` returns its length \"in characters\" (which the
+  Windows documentation confirms means the number of `WCHAR` values). This is
+  likely a typo; the code checks that `len * size_of::<u16>() <= isize::MAX`.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.known-folders]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.1 -> 1.1.0"
+notes = "Addresses the notes from my previous review :)"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.libm]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.7 -> 0.2.8"
+notes = "Forces some intermediate values to not have too much precision on the x87 FPU."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.libredox]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.0.1 -> 0.1.3"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.linux-raw-sys]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.12 -> 0.4.13"
+notes = "Low-level OS interface crate, so `unsafe` code is expected."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.log]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.20 -> 0.4.21"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.maybe-rayon]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.1.1"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.memchr]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "2.6.4 -> 2.7.1"
+notes = """
+Change to an `unsafe fn` is to rework the short-tail handling of a fixed-length
+comparison between `u8` pointers. The new tail code matches the existing head
+code (but adapted to `u16` and `u8` reads, instead of `u32`).
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.memchr]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "2.7.1 -> 2.7.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.miniz_oxide]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.7.1 -> 0.7.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.mio]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.8.10 -> 0.8.11"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.nix]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.26.2 -> 0.26.4"
+notes = """
+Most of the `unsafe` changes are cleaning up their usage:
+- Replacing `data.len() * std::mem::size_of::<$ty>()` with `std::mem::size_of_val(data)`.
+- Removing some `mem::transmute`s.
+- Using `*mut` instead of `*const` to convey intended semantics.
+
+A new unsafe trait method `SockaddrLike::set_length` is added; it's impls look fine.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.object]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.32.1 -> 0.32.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.opaque-debug]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.0 -> 0.3.1"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.phf]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.11.1"
+notes = """
+Mostly modernisation, migrating to `PhfBorrow`, and making more things `&'static`.
+No unsafe code in the new `OrderedMap` and `OrderedSet` types.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.phf]]
+who = "Jack Grigg <thestr4d@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.11.1 -> 0.11.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.phf_generator]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.11.1"
+notes = "Just dependency and edition bumps and code formatting."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.phf_generator]]
+who = "Jack Grigg <thestr4d@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.11.1 -> 0.11.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.phf_shared]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "0.8.0 -> 0.11.1"
+notes = """
+Adds `uncased` dependency, and newly generates unsafe code to transmute `&'static str`
+into `&'static UncasedStr`. I verified that `UncasedStr` is a `#[repr(transparent)]`
+newtype around `str`.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.phf_shared]]
+who = "Jack Grigg <thestr4d@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.11.1 -> 0.11.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.pin-project-lite]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.13 -> 0.2.14"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.proc-macro-crate]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "1.2.1 -> 1.3.0"
+notes = "Migrates from `toml` to `toml_edit`."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.proc-macro-crate]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.3.0 -> 1.3.1"
+notes = "Bumps MSRV to 1.60."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.rand_xorshift]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.3.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.redjubjub]]
+who = "Daira Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+version = "0.7.0"
+notes = """
+This crate is a thin wrapper around the `reddsa` crate, which I did not review. I also
+did not review tests or verify test vectors.
+
+The comment on `batch::Verifier::verify` has an error in the batch verification equation,
+filed as https://github.com/ZcashFoundation/redjubjub/issues/163 . It does not affect the
+implementation which just delegates to `reddsa`. `reddsa` has the same comment bug filed as
+https://github.com/ZcashFoundation/reddsa/issues/52 , but its batch verification implementation
+is correct. (I checked the latter against https://zips.z.cash/protocol/protocol.pdf#reddsabatchvalidate
+which has had previous cryptographic review by NCC group; see finding NCC-Zcash2018-009 in
+https://research.nccgroup.com/wp-content/uploads/2020/07/NCC_Group_Zcash2018_Public_Report_2019-01-30_v1.3.pdf ).
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.redox_users]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.4.3 -> 0.4.4"
+notes = "Switches from `redox_syscall` crate to `libredox` crate for syscalls."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.redox_users]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.4 -> 0.4.5"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.regex]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.10.2 -> 1.10.4"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.regex-automata]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.3 -> 0.4.6"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.regex-syntax]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.6.28 -> 0.6.29"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.regex-syntax]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.7.5 -> 0.8.2"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.regex-syntax]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.8.2 -> 0.8.3"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.rustc-demangle]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.1.21 -> 0.1.22"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.rustc-demangle]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.22 -> 0.1.23"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.rustc_version]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+version = "0.4.0"
+notes = """
+Most of the crate is code to parse and validate the output of `rustc -vV`. The caller can
+choose which `rustc` to use, or can use `rustc_version::{version, version_meta}` which will
+try `$RUSTC` followed by `rustc`.
+
+If an adversary can arbitrarily set the `$RUSTC` environment variable then this crate will
+execute arbitrary code. But when this crate is used within a build script, `$RUSTC` should
+be set correctly by `cargo`.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.scopeguard]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.1.0 -> 1.2.0"
+notes = "Only change to an `unsafe` block is to replace a `mem::forget` with `ManuallyDrop`."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.semver]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.17 -> 1.0.18"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.semver]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.18 -> 1.0.19"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.semver]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.19 -> 1.0.20"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.semver]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.20 -> 1.0.22"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.sharded-slab]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.4 -> 0.1.7"
+notes = "Only change to an `unsafe` block is to fix a clippy lint."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.signature]]
+who = "Daira Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+version = "2.1.0"
+notes = """
+This crate uses `#![forbid(unsafe_code)]`, has no build script, and only provides traits with some trivial default implementations.
+I did not review whether implementing these APIs would present any undocumented cryptographic hazards.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.signature]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "2.1.0 -> 2.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.siphasher]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.10 -> 0.3.11"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.socket2]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.5.5 -> 0.5.6"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.syn]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.107 -> 1.0.109"
+notes = "Fixes string literal parsing to only skip specified whitespace characters."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tempfile]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "3.8.1 -> 3.9.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tempfile]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "3.9.0 -> 3.10.1"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.43 -> 1.0.48"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.48 -> 1.0.51"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.51 -> 1.0.52"
+notes = "Reruns the build script if the `RUSTC_BOOTSTRAP` env variable changes."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.52 -> 1.0.56"
+notes = """
+Build script changes are to refactor the existing probe into a separate file
+(which removes a filesystem write), and adjust how it gets rerun in response to
+changes in the build environment.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.56 -> 1.0.58"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror-impl]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.43 -> 1.0.48"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror-impl]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.48 -> 1.0.51"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror-impl]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.51 -> 1.0.52"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror-impl]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "1.0.52 -> 1.0.56"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thiserror-impl]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.0.56 -> 1.0.58"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thread_local]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "1.1.4 -> 1.1.7"
+notes = """
+New `unsafe` usage:
+- An extra `deallocate_bucket`, to replace a `Mutex::lock` with a `compare_exchange`.
+- Setting and getting a `#[thread_local] static mut Option<Thread>` on nightly.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.thread_local]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.1.7 -> 1.1.8"
+notes = """
+Adds `unsafe` code that makes an assumption that `ptr::null_mut::<Entry<T>>()` is a valid representation
+of an `AtomicPtr<Entry<T>>`, but this is likely a correct assumption.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tinyvec_macros]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "0.1.0 -> 0.1.1"
+notes = "Adds `#![forbid(unsafe_code)]` and license files."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tokio]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "1.35.1 -> 1.37.0"
+notes = "Cursory review, but new and changed uses of `unsafe` code look fine, as far as I can see."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tracing-core]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.30 -> 0.1.31"
+notes = """
+The only new `unsafe` block is to intentionally leak a scoped subscriber onto
+the heap when setting it as the global default dispatcher. I checked that the
+global default can only be set once and is never dropped.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tracing-core]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.1.31 -> 0.1.32"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.tracing-subscriber]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.17 -> 0.3.18"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.try-lock]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.4 -> 0.2.5"
+notes = "Bumps MSRV to remove unsafe code block."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.universal-hash]]
+who = "Daira Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.4.1 -> 0.5.0"
+notes = "I checked correctness of to_blocks which uses unsafe code in a safe function."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters-1]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters-2]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters-3]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters-4]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters-5]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wagyu-zcash-parameters-6]]
+who = "Sean Bowe <ewillbefull@gmail.com>"
+criteria = "safe-to-deploy"
+version = "0.2.0"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.want]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.3.0 -> 0.3.1"
+notes = """
+Migrates to `try-lock 0.2.4` to replace some unsafe APIs that were not marked
+`unsafe` (but that were being used safely).
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-backend]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.89 -> 0.2.92"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-macro]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.89 -> 0.2.92"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-macro-support]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+version = "0.2.92"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-shared]]
+who = "Jack Grigg <jack@z.cash>"
+criteria = "safe-to-deploy"
+delta = "0.2.83 -> 0.2.84"
+notes = "Bumps the schema version to add `linked_modules`."
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-shared]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.84 -> 0.2.87"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-shared]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "0.2.87 -> 0.2.89"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.wasm-bindgen-shared]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.2.89 -> 0.2.92"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.web-sys]]
+who = "Daira-Emma Hopwood <daira@jacaranda.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.66 -> 0.3.69"
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
+
+[[audits.zcash.audits.which]]
+who = "Jack Grigg <jack@electriccoin.co>"
+criteria = "safe-to-deploy"
+delta = "4.4.2 -> 6.0.1"
+notes = """
+Mostly refactoring to newer APIs. New `winsafe` dependency is only used to check
+for extensionless Windows executables.
+"""
+aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml"
diff --git a/zcash/CHANGELOG.md b/zcash/CHANGELOG.md
new file mode 100644
index 0000000000..18eef9e5f0
--- /dev/null
+++ b/zcash/CHANGELOG.md
@@ -0,0 +1,16 @@
+# Changelog
+All notable changes to this library will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this library adheres to Rust's notion of
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Changed
+- MSRV is now 1.77.0.
+
+## [0.1.0] - 2024-07-15
+Initial release that re-exports other crates. Expect that the API surface of
+this crate will change significantly in future releases.
+MSRV is 1.70.0.
diff --git a/zcash/Cargo.toml b/zcash/Cargo.toml
new file mode 100644
index 0000000000..1249495fe9
--- /dev/null
+++ b/zcash/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "zcash"
+version = "0.1.0"
+authors = [
+    "Jack Grigg <jack@electriccoin.co>",
+]
+edition.workspace = true
+rust-version.workspace = true
+description = "Zcash Rust APIs"
+readme = "README.md"
+homepage = "https://github.com/zcash/librustzcash"
+repository.workspace = true
+license.workspace = true
+categories.workspace = true
+
+[dependencies]
+# Dependencies exposed in a public API:
+# (Breaking upgrades to these require a breaking upgrade to this crate.)
+zcash_primitives.workspace = true
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Documentation
+document-features.workspace = true
+
+[features]
+default = ["multicore"]
+
+## Enables multithreading support for creating proofs.
+multicore = ["zcash_primitives/multicore"]
+
+## Enables use of the transparent payment protocol for inputs.
+transparent-inputs = ["zcash_primitives/transparent-inputs"]
diff --git a/zcash/README.md b/zcash/README.md
new file mode 100644
index 0000000000..d741b3c800
--- /dev/null
+++ b/zcash/README.md
@@ -0,0 +1,23 @@
+# zcash
+
+This library exposes APIs for working with the Zcash ecosystem.
+
+It currently just re-exports the APIs of other crates. Expect that the API
+surface of this crate will change significantly in future releases.
+
+## License
+
+Licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](../LICENSE-APACHE) or
+   http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](../LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
diff --git a/zcash/src/lib.rs b/zcash/src/lib.rs
new file mode 100644
index 0000000000..a10121533d
--- /dev/null
+++ b/zcash/src/lib.rs
@@ -0,0 +1,14 @@
+//! *Zcash Rust APIs.*
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
+
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+// Catch documentation errors caused by code changes.
+#![deny(rustdoc::broken_intra_doc_links)]
+#![deny(missing_docs)]
+#![deny(unsafe_code)]
+
+pub use zcash_primitives as primitives;
diff --git a/zcash_client_backend/CHANGELOG.md b/zcash_client_backend/CHANGELOG.md
index c896b6d702..e0ad6c7244 100644
--- a/zcash_client_backend/CHANGELOG.md
+++ b/zcash_client_backend/CHANGELOG.md
@@ -6,24 +6,907 @@ and this library adheres to Rust's notion of
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+### Added
+- `zcash_client_backend::data_api::AccountSource::key_derivation`
+
+### Changed
+- `zcash_client_backend::data_api::WalletRead`:
+  - The `create_account`, `import_account_hd`, and `import_account_ufvk`
+    methods now each take additional `account_name` and `key_source` arguments.
+    These allow the wallet backend to store additional metadata that is useful
+    to applications managing these accounts.
+- `zcash_client_backend::data_api::AccountSource`:
+  - Both the `Derived` and `Importants` now have an additional `key_source`
+    property that is used to convey application-specific key source metadata.
+  - The `Copy` impl for this type has been removed.
+- `zcash_client_backend::data_api::Account` has an additional `name` method
+  that returns the human-readable name of the account, if any.
+
+## [0.15.0] - 2024-11-14
+
+### Added
+- `zcash_client_backend::data_api`:
+  - `Progress`
+  - `WalletSummary::progress`
+  - `PoolMeta`
+  - `AccountMeta`
+  - `impl Default for wallet::input_selection::GreedyInputSelector`
+  - `BoundedU8`
+  - `NoteFilter`
+- `zcash_client_backend::fees`
+  - `SplitPolicy`
+  - `StandardFeeRule` has been moved here from `zcash_primitives::fees`. Relative
+    to that type, the deprecated `PreZip313` and `Zip313` variants have been
+    removed.
+  - `zip317::{MultiOutputChangeStrategy, Zip317FeeRule}`
+  - `standard::MultiOutputChangeStrategy`
+- A new feature flag, `non-standard-fees`, has been added. This flag is now
+  required in order to make use of any types or methods that enable non-standard
+  fee calculation.
+- `zcash_client_backend::tor::http::cryptex`:
+  - `LocalExchange`, a variant of the `Exchange` trait without `Send` bounds.
+  - `DynExchange`
+  - `DynLocalExchange`
+
+### Changed
+- MSRV is now 1.77.0.
+- Migrated to `zcash_primitives 0.20.0`, `zcash_keys 0.5.0`.
+- Migrated to `arti-client 0.23`.
+- `zcash_client_backend::data_api`:
+  - `InputSource` has an added method `get_account_metadata`
+  - `error::Error` has additional variant `Error::Change`. This necessitates
+    the addition of two type parameters to the `Error` type,
+    `ChangeErrT` and `NoteRefT`.
+  - The following methods each now take an additional `change_strategy`
+    argument, along with an associated `ChangeT` type parameter:
+    - `wallet::spend`
+    - `wallet::propose_transfer`
+    - `wallet::propose_shielding`. This method also now takes an additional
+      `to_account` argument.
+    - `wallet::shield_transparent_funds`. This method also now takes an
+      additional `to_account` argument.
+  - `wallet::input_selection::InputSelectionError` now has an additional `Change`
+    variant. This necessitates the addition of two type parameters.
+  - `wallet::input_selection::InputSelector::propose_transaction` takes an
+    additional `change_strategy` argument, along with an associated `ChangeT`
+    type parameter.
+  - The `wallet::input_selection::InputSelector::FeeRule` associated type has
+    been removed. The fee rule is now part of the change strategy passed to
+    `propose_transaction`.
+  - `wallet::input_selection::ShieldingSelector::propose_shielding` takes an
+    additional `change_strategy` argument, along with an associated `ChangeT`
+    type parameter. In addition, it also takes a new `to_account` argument
+    that identifies the destination account for the shielded notes.
+  - The `wallet::input_selection::ShieldingSelector::FeeRule` associated type
+    has been removed. The fee rule is now part of the change strategy passed to
+    `propose_shielding`.
+  - The `Change` variant of `wallet::input_selection::GreedyInputSelectorError`
+    has been removed, along with the additional type parameters it necessitated.
+  - The arguments to `wallet::input_selection::GreedyInputSelector::new` have
+    changed.
+- `zcash_client_backend::fees`:
+  - `ChangeStrategy` has changed. It has two new associated types, `MetaSource`
+    and `AccountMetaT`, and its `FeeRule` associated type now has an additional
+    `Clone` bound. In addition, it defines a new `fetch_wallet_meta` method, and
+    the arguments to `compute_balance` have changed.
+  - `zip317::SingleOutputChangeStrategy` has been made polymorphic in the fee
+    rule type, and takes an additional type parameter as a consequence.
+  - The following methods now take an additional `DustOutputPolicy` argument,
+    and carry an additional type parameter:
+    - `fixed::SingleOutputChangeStrategy::new`
+    - `standard::SingleOutputChangeStrategy::new`
+    - `zip317::SingleOutputChangeStrategy::new`
+- `zcash_client_backend::proto::ProposalDecodingError` has modified variants.
+  `ProposalDecodingError::FeeRuleNotSpecified` has been removed, and
+  `ProposalDecodingError::FeeRuleNotSupported` has been added to replace it.
+- `zcash_client_backend::data_api::fees::fixed` is now available only via the
+  use of the `non-standard-fees` feature flag.
+- `zcash_client_backend::tor::http::cryptex`:
+  - The `Exchange` trait is no longer object-safe. Replace any existing uses of
+    `dyn Exchange` with `DynExchange`.
+
+### Removed
+- `zcash_client_backend::data_api`:
+  - `WalletSummary::scan_progress` and `WalletSummary::recovery_progress` have
+    been removed. Use `WalletSummary::progress` instead.
+  - `testing::input_selector` use explicit `InputSelector` constructors
+    directly instead.
+  - The deprecated `wallet::create_spend_to_address` and `wallet::spend`
+    methods have been removed. Use `propose_transfer` and
+    `create_proposed_transaction` instead.
+- `zcash_client_backend::fees`:
+  - `impl From<BalanceError> for ChangeError<...>`
+
+## [0.14.0] - 2024-10-04
+
+### Added
+- `zcash_client_backend::data_api`:
+  - `GAP_LIMIT`
+  - `WalletSummary::recovery_progress`
+  - `SpendableNotes::{take_sapling, take_orchard}`
+  - Tests and testing infrastructure have been migrated from the
+    `zcash_client_sqlite` internal tests to the `testing` module, and have been
+    generalized so that they may be used for testing arbitrary implementations
+    of the `zcash_client_backend::data_api` interfaces. The following have been
+    added under the `test-dependencies` feature flag as part of this migration:
+    - `WalletTest`
+    - `testing::AddressType`
+    - `testing::CachedBlock`
+    - `testing::DataStoreFactory`
+    - `testing::FakeCompactOutput`
+    - `testing::InitialChainState`
+    - `testing::NoteCommitments`
+    - `testing::Reset`
+    - `testing::TestAccount`
+    - `testing::TestBuilder`
+    - `testing::TestCache`
+    - `testing::TestFvk`
+    - `testing::TestState`
+    - `testing::TransactionSummary`
+    - `testing::input_selector`
+    - `testing::orchard`
+    - `testing::pool`
+    - `testing::sapling`
+
+### Changed
+- Migrated to `orchard 0.10`, `sapling-crypto 0.3`, `shardtree 0.5`,
+  `zcash_address 0.6`, `zcash_primitives 0.19`, `zcash_proofs 0.19`,
+  `zcash_protocol 0.4`.
+- The `Account` trait now uses an associated type for its `AccountId`
+  type instead of a type parameter. This change allows for the simplification
+  of some type signatures.
+- `zcash_client_backend::data_api`:
+  - `WalletSummary::scan_progress` now only reports progress for scanning blocks
+    "near" the chain tip. Progress for scanning earlier blocks is now reported
+    via `WalletSummary::recovery_progress`.
+  - `WalletRead::get_min_unspent_height` has been removed. This was added to make
+    it possible to obtain a "safe truncation" height in order to facilitate rewinds
+    to a greater depth than the available note commitment tree checkpoints provide,
+    but such rewinds are no longer supported.
+- `zcash_client_backend::sync::run`:
+  - Transparent outputs are now refreshed in addition to shielded notes.
+- `zcash_client_backend::proposal::ProposalError` has a new `AnchorNotFound`
+  variant.
+
+### Fixed
+- `zcash_client_backend::tor::grpc` now needs the `lightwalletd-tonic-tls-webpki-roots`
+  feature flag instead of `lightwalletd-tonic`, to fix compilation issues.
+
+## [0.13.0] - 2024-08-20
+
+`zcash_client_backend` now supports TEX (transparent-source-only) addresses as specified
+in ZIP 320. Sending to one or more TEX addresses will automatically create a multi-step
+proposal that uses two transactions.
+
+In order to take advantage of this support, client wallets will need to be able to send
+multiple transactions created from `zcash_client_backend::data_api::wallet::create_proposed_transactions`.
+This API was added in `zcash_client_backend` 0.11.0 but previously could only return a
+single transaction.
+
+**Note:** This feature changes the use of transparent addresses in ways that are relevant
+to security and access to funds, and that may interact with other wallet behaviour. In
+particular it exposes new ephemeral transparent addresses belonging to the wallet, which
+need to be scanned in order to recover funds if the first transaction of the proposal is
+mined but the second is not, or if someone (e.g. the TEX-address recipient) sends back
+funds to those addresses. See [ZIP 320](https://zips.z.cash/zip-0320) for details.
+
+### Added
+- `zcash_client_backend::data_api`:
+  - `chain::BlockCache` trait, behind the `sync` feature flag.
+  - `WalletRead::get_spendable_transparent_outputs`
+  - `DecryptedTransaction::mined_height`
+  - `TransactionDataRequest`
+  - `TransactionStatus`
+  - `AccountType`
+- `zcash_client_backend::fees`:
+  - `EphemeralBalance`
+  - `ChangeValue::shielded, is_ephemeral`
+  - `ChangeValue::ephemeral_transparent` (when "transparent-inputs" is enabled)
+  - `sapling::EmptyBundleView`
+  - `orchard::EmptyBundleView`
+- `zcash_client_backend::proposal`:
+  - `impl Hash for {StepOutput, StepOutputIndex}`
+- `zcash_client_backend::scanning`:
+  - `testing` module
+- `zcash_client_backend::sync` module, behind the `sync` feature flag.
+- `zcash_client_backend::tor` module, behind the `tor` feature flag.
+- `zcash_client_backend::wallet`:
+    - `Recipient::map_ephemeral_transparent_outpoint`
+    - `WalletTransparentOutput::mined_height`
+
+### Changed
+- MSRV is now 1.70.0.
+- Updated dependencies:
+  - `zcash_address 0.4`
+  - `zcash_encoding 0.2.1`
+  - `zcash_keys 0.3`
+  - `zcash_primitives 0.16`
+  - `zcash_protocol 0.2`
+  - `zip321 0.1`
+- Migrated to `tonic 0.12`.
+  - The `lightwalletd-tonic` feature flag no longer works on `wasm32-wasi` due
+    to https://github.com/hyperium/tonic/issues/1783.
+- `zcash_client_backend::{fixed,standard,zip317}::SingleOutputChangeStrategy`
+  now implement a different strategy for choosing whether there will be any
+  change, and its value. This can avoid leaking information about note amounts
+  in some cases. It also ensures that there will be a change output whenever a
+  `change_memo` is given, and defends against losing money by using
+  `DustAction::AddDustToFee` with a too-high dust threshold.
+  See [#1430](https://github.com/zcash/librustzcash/pull/1430) for details.
+- `zcash_client_backend::zip321` has been extracted to, and is now a reexport
+  of the root module of the `zip321` crate. Several of the APIs of this module
+  have changed as a consequence of this extraction; please see the `zip321`
+  CHANGELOG for details.
+- `zcash_client_backend::data_api`:
+  - `WalletRead` has a new `transaction_data_requests` method.
+  - `WalletRead` has new `get_known_ephemeral_addresses`,
+    `find_account_for_ephemeral_address`, and `get_transparent_address_metadata`
+    methods when the "transparent-inputs" feature is enabled.
+  - `WalletWrite` has a new `reserve_next_n_ephemeral_addresses` method when
+    the "transparent-inputs" feature is enabled.
+  - `WalletWrite` has new methods `import_account_hd`, `import_account_ufvk`,
+    and `set_transaction_status`.
+  - `error::Error` has new `Address` and (when the "transparent-inputs" feature
+    is enabled) `PaysEphemeralTransparentAddress` variants.
+  - The `WalletWrite::store_sent_tx` method has been renamed to
+    `store_transactions_to_be_sent`, and its signature changed to take a slice
+    of `SentTransaction`s. This can be used by the wallet storage backend (e.g.
+    `zcash_client_sqlite`) to improve transactionality of writes for multi-step
+    proposals.
+  - `wallet::input_selection::InputSelectorError` has a new `Address` variant.
+  - `wallet::decrypt_and_store_transaction` now takes an additional optional
+    `mined_height` argument that can be used to provide the mined height
+    returned by the light wallet server in a `RawTransaction` value directly to
+    the back end.
+  - `DecryptedTransaction::new` takes an additional `mined_height` argument.
+  - `SentTransaction` now stores its `outputs` and `utxos_spent` fields as
+    references to slices, with a corresponding change to `SentTransaction::new`.
+  - `SentTransaction` takes an additional `target_height` argument, which is used
+    to record the target height used in transaction generation.
+  - `AccountSource::Imported` is now a struct variant with a `purpose` field.
+  - The `Account` trait now defines a new `purpose` method with a default
+    implementation (which need not be overridden.)
+- `zcash_client_backend::data_api::fees`
+  - When the "transparent-inputs" feature is enabled, `ChangeValue` can also
+    represent an ephemeral transparent output in a proposal. Accordingly, the
+    return type of `ChangeValue::output_pool` has (unconditionally) changed
+    from `ShieldedProtocol` to `zcash_protocol::PoolType`.
+  - `ChangeStrategy::compute_balance`: this trait method has an additional
+    `Option<&EphemeralBalance>` parameter. If the "transparent-inputs" feature is
+    enabled, this can be used to specify whether the change memo should be
+    ignored, and the amounts of additional transparent P2PKH inputs and
+    outputs. Passing `None` will retain the previous
+    behaviour (and is necessary when the "transparent-inputs" feature is
+    not enabled).
+- `zcash_client_backend::input_selection::GreedyInputSelectorError` has a
+  new variant `UnsupportedTexAddress`.
+- `zcash_client_backend::proposal::ProposalError` has new variants
+  `SpendsChange`, `EphemeralOutputLeftUnspent`, and `PaysTexFromShielded`.
+  (the last two are conditional on the "transparent-inputs" feature).
+- `zcash_client_backend::proto`:
+  - `ProposalDecodingError` has a new variant `InvalidEphemeralRecipient`.
+  - `proposal::Proposal::{from_standard_proposal, try_into_standard_proposal}`
+    each no longer require a `consensus::Parameters` argument.
+- `zcash_client_backend::wallet::Recipient` variants have changed. Instead of
+  wrapping protocol-address types, the `External` and `InternalAccount` variants
+  now wrap a `zcash_address::ZcashAddress`. This simplifies the process of
+  tracking the original address to which value was sent. There is also a new
+  `EphemeralTransparent` variant, and an additional generic parameter for the
+  type of metadata associated with an ephemeral transparent outpoint.
+- `zcash_client_backend::wallet::WalletTransparentOutput::from_parts`
+  now takes its height argument as `Option<BlockHeight>` rather than
+  `BlockHeight`.
+
+### Removed
+- `zcash_client_backend::data_api`:
+  - `WalletRead::get_unspent_transparent_outputs` has been removed because its
+    semantics were unclear and could not be clarified. Use
+    `WalletRead::get_spendable_transparent_outputs` instead.
+- `zcash_client_backend::fees::ChangeValue::new`. Use `ChangeValue::shielded`
+  or `ChangeValue::ephemeral_transparent` instead.
+- `zcash_client_backend::wallet::WalletTransparentOutput::height`
+  (use `WalletTransparentOutput::mined_height` instead).
+
+## [0.12.1] - 2024-03-27
+
+### Fixed
+- This release fixes a problem in note selection when sending to a transparent
+  recipient, whereby available funds were being incorrectly excluded from
+  input selection.
+
+## [0.12.0] - 2024-03-25
+
+### Added
+- A new `orchard` feature flag has been added to make it possible to
+  build client code without `orchard` dependencies. Additions and
+  changes related to `Orchard` below are introduced under this feature
+  flag.
+- `zcash_client_backend::data_api`:
+  - `Account`
+  - `AccountBalance::with_orchard_balance_mut`
+  - `AccountBirthday::orchard_frontier`
+  - `AccountSource`
+  - `BlockMetadata::orchard_tree_size`
+  - `DecryptedTransaction::{new, tx(), orchard_outputs()}`
+  - `NoteRetention`
+  - `ScannedBlock::orchard`
+  - `ScannedBlockCommitments::orchard`
+  - `SeedRelevance`
+  - `SentTransaction::new`
+  - `SpendableNotes`
+  - `ORCHARD_SHARD_HEIGHT`
+  - `BlockMetadata::orchard_tree_size`
+  - `WalletSummary::next_orchard_subtree_index`
+  - `chain::ChainState`
+  - `chain::ScanSummary::{spent_orchard_note_count, received_orchard_note_count}`
+  - `impl Debug for chain::CommitmentTreeRoot`
+- `zcash_client_backend::fees`:
+  - `orchard`
+  - `ChangeValue::orchard`
+- `zcash_client_backend::proto`:
+  - `service::TreeState::orchard_tree`
+  - `service::TreeState::to_chain_state`
+  - `impl TryFrom<&CompactOrchardAction> for CompactAction`
+  - `CompactOrchardAction::{cmx, nf, ephemeral_key}`
+- `zcash_client_backend::scanning`:
+  - `impl ScanningKeyOps<OrchardDomain, ..> for ScanningKey<..>` for Orchard key types.
+  - `ScanningKeys::orchard`
+  - `Nullifiers::{orchard, extend_orchard, retain_orchard}`
+  - `TaggedOrchardBatch`
+  - `TaggedOrchardBatchRunner`
+- `zcash_client_backend::wallet`:
+  - `Note::Orchard`
+  - `WalletOrchardSpend`
+  - `WalletOrchardOutput`
+  - `WalletTx::{orchard_spends, orchard_outputs}`
+  - `ReceivedNote::map_note`
+  - `ReceivedNote<_, sapling::Note>::note_value`
+  - `ReceivedNote<_, orchard::note::Note>::note_value`
+- `zcash_client_backend::zip321::Payment::without_memo`
+
+### Changed
+- `zcash_client_backend::data_api`:
+  - Arguments to `AccountBirthday::from_parts` have changed.
+  - Arguments to `BlockMetadata::from_parts` have changed.
+  - Arguments to `ScannedBlock::from_parts` have changed.
+  - Changes to the `WalletRead` trait:
+    - Added `Account` associated type.
+    - Added `validate_seed` method.
+    - Added `is_seed_relevant_to_any_derived_accounts` method.
+    - Added `get_account` method.
+    - Added `get_derived_account` method.
+    - `get_account_for_ufvk` now returns `Self::Account` instead of a bare
+      `AccountId`.
+    - Added `get_orchard_nullifiers` method.
+    - `get_transaction` now returns `Result<Option<Transaction>, _>` rather
+      than returning an `Err` if the `txid` parameter does not correspond to
+      a transaction in the database.
+  - `WalletWrite::create_account` now takes its `AccountBirthday` argument by
+    reference.
+  - Changes to the `InputSource` trait:
+    - `select_spendable_notes` now takes its `target_value` argument as a
+      `NonNegativeAmount`. Also, it now returns a `SpendableNotes` data
+      structure instead of a vector.
+  - Fields of `DecryptedTransaction` are now private. Use `DecryptedTransaction::new`
+    and the newly provided accessors instead.
+  - Fields of `SentTransaction` are now private. Use `SentTransaction::new`
+    and the newly provided accessors instead.
+  - `ShieldedProtocol` has a new `Orchard` variant.
+  - `WalletCommitmentTrees`
+    - `type OrchardShardStore`
+    - `fn with_orchard_tree_mut`
+    - `fn put_orchard_subtree_roots`
+  - Removed `Error::AccountNotFound` variant.
+  - `WalletSummary::new` now takes an additional `next_orchard_subtree_index`
+    argument when the `orchard` feature flag is enabled.
+- `zcash_client_backend::decrypt`:
+  - Fields of `DecryptedOutput` are now private. Use `DecryptedOutput::new`
+    and the newly provided accessors instead.
+  - `decrypt_transaction` now returns a `DecryptedTransaction<AccountId>`
+    instead of a `DecryptedOutput<sapling::Note>` and will decrypt Orchard
+    outputs when the `orchard` feature is enabled. In addition, the type
+    constraint on its `<AccountId>` parameter has been strengthened to `Copy`.
+- `zcash_client_backend::fees`:
+  - Arguments to `ChangeStrategy::compute_balance` have changed.
+  - `ChangeError::DustInputs` now has an `orchard` field behind the `orchard`
+    feature flag.
+- `zcash_client_backend::proto`:
+  - `ProposalDecodingError` has a new variant `TransparentMemo`.
+- `zcash_client_backend::wallet::Recipient::InternalAccount` is now a structured
+  variant with an additional `external_address` field.
+- `zcash_client_backend::zip321::render::amount_str` now takes a
+  `NonNegativeAmount` rather than a signed `Amount` as its argument.
+- `zcash_client_backend::zip321::parse::parse_amount` now parses a
+  `NonNegativeAmount` rather than a signed `Amount`.
+- `zcash_client_backend::zip321::TransactionRequest::total` now
+  returns `Result<_, BalanceError>` instead of `Result<_, ()>`.
+
+### Removed
+- `zcash_client_backend::PoolType::is_receiver`: use
+  `zcash_keys::Address::has_receiver` instead.
+- `zcash_client_backend::wallet::ReceivedNote::traverse_opt` removed as
+  unnecessary.
+
+### Fixed
+- This release fixes an error in amount parsing in `zip321` that previously
+  allowed amounts having a decimal point but no decimal value to be parsed
+  as valid.
+
+## [0.11.1] - 2024-03-09
+
+### Fixed
+- Documentation now correctly builds with all feature flags.
+
+## [0.11.0] - 2024-03-01
+
+### Added
+- `zcash_client_backend`:
+  - `{PoolType, ShieldedProtocol}` (moved from `zcash_client_backend::data_api`).
+  - `PoolType::is_receiver`
+- `zcash_client_backend::data_api`:
+  - `InputSource`
+  - `ScannedBlock::{into_commitments, sapling}`
+  - `ScannedBundles`
+  - `ScannedBlockCommitments`
+  - `Balance::{add_spendable_value, add_pending_change_value, add_pending_spendable_value}`
+  - `AccountBalance::{
+      with_sapling_balance_mut,
+      add_unshielded_value
+    }`
+  - `WalletSummary::next_sapling_subtree_index`
+  - `wallet`:
+    - `propose_standard_transfer_to_address`
+    - `create_proposed_transactions`
+    - `input_selection`:
+      - `ShieldingSelector`, behind the `transparent-inputs` feature flag
+        (refactored out from the `InputSelector` trait).
+      - `impl std::error::Error for InputSelectorError`
+- `zcash_client_backend::fees`:
+  - `standard` and `sapling` modules.
+  - `ChangeValue::new`
+- `zcash_client_backend::wallet`:
+  - `{NoteId, Recipient}` (moved from `zcash_client_backend::data_api`).
+  - `Note`
+  - `ReceivedNote`
+  - `Recipient::{map_internal_account, internal_account_transpose_option}`
+  - `WalletOutput`
+  - `WalletSaplingOutput::{key_source, account_id, recipient_key_scope}`
+  - `WalletSaplingSpend::account_id`
+  - `WalletSpend`
+  - `WalletTx::new`
+  - `WalletTx` getter methods `{txid, block_index, sapling_spends, sapling_outputs}`
+    (replacing what were previously public fields.)
+  - `TransparentAddressMetadata` (which replaces `zcash_keys::address::AddressMetadata`).
+  - `impl {Debug, Clone} for OvkPolicy`
+- `zcash_client_backend::proposal`:
+  - `Proposal::{shielded_inputs, payment_pools, single_step, multi_step}`
+  - `ShieldedInputs`
+  - `Step`
+- `zcash_client_backend::proto`:
+  - `PROPOSAL_SER_V1`
+  - `ProposalDecodingError`
+  - `proposal` module, for parsing and serializing transaction proposals.
+  - `impl TryFrom<&CompactSaplingOutput> for CompactOutputDescription`
+- `zcash_client_backend::scanning`:
+  - `ScanningKeyOps` has replaced the `ScanningKey` trait.
+  - `ScanningKeys`
+  - `Nullifiers`
+- `impl Clone for zcash_client_backend::{
+     zip321::{Payment, TransactionRequest, Zip321Error, parse::Param, parse::IndexedParam},
+     wallet::WalletTransparentOutput,
+     proposal::Proposal,
+   }`
+- `impl {PartialEq, Eq} for zcash_client_backend::{
+     zip321::{Zip321Error, parse::Param, parse::IndexedParam},
+     wallet::WalletTransparentOutput,
+     proposal::Proposal,
+   }`
+- `zcash_client_backend::zip321`:
+  - `TransactionRequest::{total, from_indexed}`
+  - `parse::Param::name`
+
+### Changed
+- Migrated to `zcash_primitives 0.14`, `orchard 0.7`.
+- Several structs and functions now take an `AccountId` type parameter
+  in order to decouple the concept of an account identifier from
+  the ZIP 32 account index. Many APIs that previously referenced
+  `zcash_primitives::zip32::AccountId` now reference the generic type.
+  Impacted types and functions are:
+  - `zcash_client_backend::data_api`:
+    - `WalletRead` now has an associated `AccountId` type.
+    - `WalletRead::{
+        get_account_birthday,
+        get_current_address,
+        get_unified_full_viewing_keys,
+        get_account_for_ufvk,
+        get_wallet_summary,
+        get_sapling_nullifiers,
+        get_transparent_receivers,
+        get_transparent_balances,
+        get_account_ids
+      }` now refer to the `WalletRead::AccountId` associated type.
+    - `WalletWrite::{create_account, get_next_available_address}`
+      now refer to the `WalletRead::AccountId` associated type.
+    - `ScannedBlock` now takes an additional `AccountId` type parameter.
+    - `DecryptedTransaction` is now parameterized by `AccountId`
+    - `SentTransaction` is now parameterized by `AccountId`
+    - `SentTransactionOutput` is now parameterized by `AccountId`
+    - `WalletSummary` is now parameterized by `AccountId`
+  - `zcash_client_backend::decrypt`
+    - `DecryptedOutput` is now parameterized by `AccountId`
+    - `decrypt_transaction` is now parameterized by `AccountId`
+  - `zcash_client_backend::scanning::scan_block` is now parameterized by `AccountId`
+  - `zcash_client_backend::wallet`:
+    - `Recipient` now takes an additional `AccountId` type parameter.
+    - `WalletTx` now takes an additional `AccountId` type parameter.
+    - `WalletSaplingSpend` now takes an additional `AccountId` type parameter.
+    - `WalletSaplingOutput` now takes an additional `AccountId` type parameter.
+- `zcash_client_backend::data_api`:
+  - `BlockMetadata::sapling_tree_size` now returns an `Option<u32>` instead of
+    a `u32` for future consistency with Orchard.
+  - `ScannedBlock` is no longer parameterized by the nullifier type as a consequence
+    of the `WalletTx` change.
+  - `ScannedBlock::metadata` has been renamed to `to_block_metadata` and now
+    returns an owned value rather than a reference.
+  - Fields of `Balance` and `AccountBalance` have been made private and the values
+    of these fields have been made available via methods having the same names
+    as the previously-public fields.
+  - `WalletSummary::new` now takes an additional `next_sapling_subtree_index` argument.
+  - `WalletSummary::new` now takes a `HashMap` instead of a `BTreeMap` for its
+    `account_balances` argument.
+  - `WalletSummary::account_balances` now returns a `HashMap` instead of a `BTreeMap`.
+  - Changes to the `WalletRead` trait:
+    - Added associated type `AccountId`.
+    - Added `get_account` function.
+    - `get_checkpoint_depth` has been removed without replacement. This is no
+      longer needed given the change to use the stored anchor height for
+      transaction proposal execution.
+    - `is_valid_account_extfvk` has been removed; it was unused in the ECC
+      mobile wallet SDKs and has been superseded by `get_account_for_ufvk`.
+    - `get_spendable_sapling_notes`, `select_spendable_sapling_notes`, and
+      `get_unspent_transparent_outputs` have been removed; use
+      `data_api::InputSource` instead.
+    - Added `get_account_ids`.
+    - `get_transparent_receivers` and `get_transparent_balances` are now
+      guarded by the `transparent-inputs` feature flag, with noop default
+      implementations provided.
+    - `get_transparent_receivers` now returns
+      `Option<zcash_client_backend::wallet::TransparentAddressMetadata>` as part of
+      its result where previously it returned `zcash_keys::address::AddressMetadata`.
+  - `WalletWrite::get_next_available_address` now takes an additional
+    `UnifiedAddressRequest` argument.
+  - `chain::scan_cached_blocks` now returns a `ScanSummary` containing metadata
+    about the scanned blocks on success.
+  - `error::Error` enum changes:
+    - The `NoteMismatch` variant now wraps a `NoteId` instead of a
+      backend-specific note identifier. The related `NoteRef` type parameter has
+      been removed from `error::Error`.
+    - New variants have been added:
+      - `Error::UnsupportedChangeType`
+      - `Error::NoSupportedReceivers`
+      - `Error::NoSpendingKey`
+      - `Error::Proposal`
+      - `Error::ProposalNotSupported`
+    - Variant `ChildIndexOutOfRange` has been removed.
+  - `wallet`:
+    - `shield_transparent_funds` no longer takes a `memo` argument; instead,
+      memos to be associated with the shielded outputs should be specified in
+      the construction of the value of the `input_selector` argument, which is
+      used to construct the proposed shielded values as internal "change"
+      outputs. Also, it returns its result as a `NonEmpty<TxId>` instead of a
+      single `TxId`.
+    - `create_proposed_transaction` has been replaced by
+      `create_proposed_transactions`. Relative to the prior method, the new
+      method has the following changes:
+      - It no longer takes a `change_memo` argument; instead, change memos are
+        represented in the individual values of the `proposed_change` field of
+        the `Proposal`'s `TransactionBalance`.
+      - `create_proposed_transactions` takes its `proposal` argument by
+        reference instead of as an owned value.
+      - `create_proposed_transactions` no longer takes a `min_confirmations`
+        argument. Instead, it uses the anchor height from its `proposal`
+        argument.
+      - `create_proposed_transactions` forces implementations to ignore the
+        database identifiers for its contained notes by universally quantifying
+        the `NoteRef` type parameter.
+      - It returns a `NonEmpty<TxId>` instead of a single `TxId` value.
+    - `create_spend_to_address` now takes additional `change_memo` and
+      `fallback_change_pool` arguments. It also returns its result as a
+      `NonEmpty<TxId>` instead of a single `TxId`.
+    - `spend` returns its result as a `NonEmpty<TxId>` instead of a single
+      `TxId`.
+    - The error type of `create_spend_to_address` has been changed to use
+      `zcash_primitives::transaction::fees::zip317::FeeError` instead of
+      `zcash_primitives::transaction::components::amount::BalanceError`. Yes
+      this is confusing because `create_spend_to_address` is explicitly not
+      using ZIP 317 fees; it's just an artifact of the internal implementation,
+      and the error variants are not specific to ZIP 317.
+    - The following methods now take `&impl SpendProver, &impl OutputProver`
+      instead of `impl TxProver`:
+      - `create_proposed_transactions`
+      - `create_spend_to_address`
+      - `shield_transparent_funds`
+      - `spend`
+    - `propose_shielding` and `shield_transparent_funds` now take their
+      `min_confirmations` arguments as `u32` rather than a `NonZeroU32`, to
+      permit implementations to enable zero-conf shielding.
+    - `input_selection`:
+      - `InputSelector::propose_shielding` has been moved out to the
+        newly-created `ShieldingSelector` trait.
+        - `ShieldingSelector::propose_shielding` has been altered such that it
+          takes an explicit `target_height` in order to minimize the
+          capabilities that the `data_api::InputSource` trait must expose. Also,
+          it now takes its `min_confirmations` argument as `u32` instead of
+          `NonZeroU32`.
+      - The `InputSelector::DataSource` associated type has been renamed to
+        `InputSource`.
+      - `InputSelectorError` has added variant `Proposal`.
+      - The signature of `InputSelector::propose_transaction` has been altered
+        such that it longer takes `min_confirmations` as an argument, instead
+        taking explicit `target_height` and `anchor_height` arguments. This
+        helps to minimize the set of capabilities that the
+        `data_api::InputSource` must expose.
+      - `GreedyInputSelector` now has relaxed requirements for its `InputSource`
+        associated type.
+- `zcash_client_backend::proposal`:
+  - Arguments to `Proposal::from_parts` have changed.
+  - `Proposal::min_anchor_height` has been removed in favor of storing this
+    value in `SaplingInputs`.
+  - `Proposal::sapling_inputs` has been replaced by `Proposal::shielded_inputs`
+  - In addition to having been moved to the `zcash_client_backend::proposal`
+    module, the `Proposal` type has been substantially modified in order to make
+    it possible to represent multi-step transactions, such as a deshielding
+    transaction followed by a zero-conf transfer as required by ZIP 320. Individual
+    transaction proposals are now represented by the `proposal::Step` type.
+  - `ProposalError` has new variants:
+    - `ReferenceError`
+    - `StepDoubleSpend`
+    - `ChainDoubleSpend`
+    - `PaymentPoolsMismatch`
+- `zcash_client_backend::fees`:
+  - `ChangeStrategy::compute_balance` arguments have changed.
+  - `ChangeValue` is now a struct. In addition to the existing change value, it
+    now also provides the output pool to which change should be sent and an
+    optional memo to be associated with the change output.
+  - `ChangeError` has a new `BundleError` variant.
+  - `fixed::SingleOutputChangeStrategy::new`,
+    `zip317::SingleOutputChangeStrategy::new`, and
+    `standard::SingleOutputChangeStrategy::new` each now accept additional
+    `change_memo` and `fallback_change_pool` arguments.
+- `zcash_client_backend::wallet`:
+  - `Recipient` is now polymorphic in the type of the payload for wallet-internal
+    recipients. This simplifies the handling of wallet-internal outputs.
+  - `SentTransactionOutput::from_parts` now takes a `Recipient<Note>`.
+  - `SentTransactionOutput::recipient` now returns a `Recipient<Note>`.
+  - `OvkPolicy::Custom` is now a structured variant that can contain independent
+    Sapling and Orchard `OutgoingViewingKey`s.
+  - `WalletSaplingOutput::from_parts` arguments have changed.
+  - `WalletSaplingOutput::nf` now returns an `Option<sapling::Nullifier>`.
+  - `WalletTx` is no longer parameterized by the nullifier type; instead, the
+    nullifier is present as an optional value.
+- `zcash_client_backend::scanning`:
+  - Arguments to `scan_blocks` have changed.
+  - `ScanError` has new variants `TreeSizeInvalid` and `EncodingInvalid`.
+  - `ScanningKey` is now a concrete type that bundles an incoming viewing key
+    with an optional nullifier key and key source metadata. The trait that
+    provides uniform access to scanning key information is now `ScanningKeyOps`.
+- `zcash_client_backend::zip321`:
+  - `TransactionRequest::payments` now returns a `BTreeMap<usize, Payment>`
+    instead of `&[Payment]` so that parameter indices may be preserved.
+  - `TransactionRequest::to_uri` now returns a `String` instead of an
+    `Option<String>` and provides canonical serialization for the empty
+    proposal.
+  - `TransactionRequest::from_uri` previously stripped payment indices, meaning
+    that round-trip serialization was not supported. Payment indices are now
+    retained.
+- The following fields now have type `NonNegativeAmount` instead of `Amount`:
+  - `zcash_client_backend::data_api`:
+    - `error::Error::InsufficientFunds.{available, required}`
+    - `wallet::input_selection::InputSelectorError::InsufficientFunds.{available, required}`
+  - `zcash_client_backend::fees`:
+    - `ChangeError::InsufficientFunds.{available, required}`
+  - `zcash_client_backend::zip321::Payment.amount`
+- The following methods now take `NonNegativeAmount` instead of `Amount`:
+  - `zcash_client_backend::data_api`:
+    - `SentTransactionOutput::from_parts`
+    - `wallet::create_spend_to_address`
+    - `wallet::input_selection::InputSelector::propose_shielding`
+  - `zcash_client_backend::fees`:
+    - `ChangeValue::sapling`
+    - `DustOutputPolicy::new`
+    - `TransactionBalance::new`
+- The following methods now return `NonNegativeAmount` instead of `Amount`:
+  - `zcash_client_backend::data_api::SentTransactionOutput::value`
+  - `zcash_client_backend::fees`:
+    - `ChangeValue::value`
+    - `DustOutputPolicy::dust_threshold`
+    - `TransactionBalance::{fee_required, total}`
+  - `zcash_client_backend::wallet::WalletTransparentOutput::value`
+
+### Deprecated
+- `zcash_client_backend::data_api::wallet`:
+  - `spend` (use `propose_transfer` and `create_proposed_transactions` instead).
+
+### Removed
+- `zcash_client_backend::wallet`:
+  - `ReceivedSaplingNote` (use `zcash_client_backend::ReceivedNote` instead).
+  - `input_selection::{Proposal, ShieldedInputs, ProposalError}` (moved to
+    `zcash_client_backend::proposal`).
+  - `SentTransactionOutput::sapling_change_to` - the note created by an internal
+    transfer is now conveyed in the `recipient` field.
+  - `WalletSaplingOutput::cmu` (use `WalletSaplingOutput::note` and
+    `sapling_crypto::Note::cmu` instead).
+  - `WalletSaplingOutput::account` (use `WalletSaplingOutput::account_id` instead)
+  - `WalletSaplingSpend::account` (use `WalletSaplingSpend::account_id` instead)
+  - `WalletTx` fields `{txid, index, sapling_spends, sapling_outputs}` (use
+    the new getters instead.)
+- `zcash_client_backend::data_api`:
+  - `{PoolType, ShieldedProtocol}` (moved to `zcash_client_backend`).
+  - `{NoteId, Recipient}` (moved to `zcash_client_backend::wallet`).
+  - `ScannedBlock::from_parts`
+  - `ScannedBlock::{sapling_tree_size, sapling_nullifier_map, sapling_commitments}`
+    (use `ScannedBundles::{tree_size, nullifier_map, commitments}` instead).
+  - `ScannedBlock::into_sapling_commitments`
+    (use `ScannedBlock::into_commitments` instead).
+  - `wallet::create_proposed_transaction`
+    (use `wallet::create_proposed_transactions` instead).
+  - `chain::ScanSummary::from_parts`
+- `zcash_client_backend::proposal`:
+  - `Proposal::min_anchor_height` (use `ShieldedInputs::anchor_height` instead).
+  - `Proposal::sapling_inputs` (use `Proposal::shielded_inputs` instead).
+
+## [0.10.0] - 2023-09-25
+
+### Notable Changes
+- `zcash_client_backend` now supports out-of-order scanning of blockchain history.
+  See the module documentation for `zcash_client_backend::data_api::chain`
+  for details on how to make use of the new scanning capabilities.
+- This release of `zcash_client_backend` defines the concept of an account
+  birthday. The account birthday is defined as the minimum height among blocks
+  to be scanned when recovering an account.
+- Account creation now requires the caller to provide account birthday information,
+  including the state of the note commitment tree at the end of the block prior
+  to the birthday height. A wallet's birthday is the earliest birthday height
+  among accounts maintained by the wallet.
+
 ### Added
 - `impl Eq for zcash_client_backend::address::RecipientAddress`
 - `impl Eq for zcash_client_backend::zip321::{Payment, TransactionRequest}`
-- `data_api::NullifierQuery` for use with `WalletRead::get_sapling_nullifiers`
+- `impl Debug` for `zcash_client_backend::{data_api::wallet::input_selection::Proposal, wallet::ReceivedSaplingNote}`
+- `zcash_client_backend::data_api`:
+  - `AccountBalance`
+  - `AccountBirthday`
+  - `Balance`
+  - `BirthdayError`
+  - `BlockMetadata`
+  - `NoteId`
+  - `NullifierQuery` for use with `WalletRead::get_sapling_nullifiers`
+  - `Ratio`
+  - `ScannedBlock`
+  - `ShieldedProtocol`
+  - `WalletCommitmentTrees`
+  - `WalletSummary`
+  - `WalletRead::{
+       chain_height, block_metadata, block_max_scanned, block_fully_scanned,
+       suggest_scan_ranges, get_wallet_birthday, get_account_birthday, get_wallet_summary
+     }`
+  - `WalletWrite::{put_blocks, update_chain_tip}`
+  - `chain::CommitmentTreeRoot`
+  - `scanning` A new module containing types required for `suggest_scan_ranges`
+  - `testing::MockWalletDb::new`
+  - `wallet::input_selection::Proposal::{min_target_height, min_anchor_height}`
+  - `SAPLING_SHARD_HEIGHT` constant
+- `zcash_client_backend::proto::compact_formats`:
+  - `impl<A: sapling::Authorization> From<&sapling::SpendDescription<A>> for CompactSaplingSpend`
+  - `impl<A: sapling::Authorization> From<&sapling::OutputDescription<A>> for CompactSaplingOutput`
+  - `impl<SpendAuth> From<&orchard::Action<SpendAuth>> for CompactOrchardAction`
+- `zcash_client_backend::wallet::WalletSaplingOutput::note_commitment_tree_position`
+- `zcash_client_backend::scanning`:
+  - `ScanError`
+  - `impl<K: ScanningKey> ScanningKey for &K`
+  - `impl ScanningKey for (zip32::Scope, sapling::SaplingIvk, sapling::NullifierDerivingKey)`
+- Test utility functions `zcash_client_backend::keys::UnifiedSpendingKey::{default_address,
+  default_transparent_address}` are now available under the `test-dependencies` feature flag.
 
 ### Changed
 - MSRV is now 1.65.0.
-- Bumped dependencies to `hdwallet 0.4`, `zcash_primitives 0.12`, `zcash_note_encryption 0.4`,
-  `incrementalmerkletree 0.4`, `orchard 0.5`, `bs58 0.5`
-- `WalletRead::get_memo` now returns `Result<Option<Memo>, Self::Error>`
-  instead of `Result<Memo, Self::Error>` in order to make representable
-  wallet states where the full note plaintext is not available.
-- `WalletRead::get_nullifiers` has been renamed to `WalletRead::get_sapling_nullifiers`
-  and its signature has changed; it now subsumes the removed `WalletRead::get_all_nullifiers`.
-- `wallet::SpendableNote` has been renamed to `wallet::ReceivedSaplingNote`.
+- Bumped dependencies to `hdwallet 0.4`, `zcash_primitives 0.13`, `zcash_note_encryption 0.4`,
+  `incrementalmerkletree 0.5`, `orchard 0.6`, `bs58 0.5`, `tempfile 3.5.0`, `prost 0.12`,
+  `tonic 0.10`.
+- `zcash_client_backend::data_api`:
+  - `WalletRead::TxRef` has been removed in favor of consistently using `TxId` instead.
+  - `WalletRead::get_transaction` now takes a `TxId` as its argument.
+  - `WalletRead::create_account` now takes an additional `birthday` argument.
+  - `WalletWrite::{store_decrypted_tx, store_sent_tx}` now return `Result<(), Self::Error>`
+    as the `WalletRead::TxRef` associated type has been removed. Use
+    `WalletRead::get_transaction` with the transaction's `TxId` instead.
+  - `WalletRead::get_memo` now takes a `NoteId` as its argument instead of `Self::NoteRef`
+    and returns `Result<Option<Memo>, Self::Error>` instead of `Result<Memo,
+    Self::Error>` in order to make representable wallet states where the full
+    note plaintext is not available.
+  - `WalletRead::get_nullifiers` has been renamed to `WalletRead::get_sapling_nullifiers`
+    and its signature has changed; it now subsumes the removed `WalletRead::get_all_nullifiers`.
+  - `WalletRead::get_target_and_anchor_heights` now takes its argument as a `NonZeroU32`
+  - `chain::scan_cached_blocks` now takes a `from_height` argument that
+    permits the caller to control the starting position of the scan range.
+    In addition, the `limit` parameter is now required and has type `usize`.
+  - `chain::BlockSource::with_blocks` now takes its limit as an `Option<usize>`
+    instead of `Option<u32>`. It is also now required to return an error if
+    `from_height` is set to a block that does not exist in `self`.
+  - A new `CommitmentTree` variant has been added to `data_api::error::Error`
+  - `wallet::{create_spend_to_address, create_proposed_transaction,
+    shield_transparent_funds}` all now require that `WalletCommitmentTrees` be
+    implemented for the type passed to them for the `wallet_db` parameter.
+  - `wallet::create_proposed_transaction` now takes an additional
+    `min_confirmations` argument.
+  - `wallet::{spend, create_spend_to_address, shield_transparent_funds,
+    propose_transfer, propose_shielding, create_proposed_transaction}` now take their
+    respective `min_confirmations` arguments as `NonZeroU32`
+  - A new `Scan` variant replaces the `Chain` variant of `data_api::chain::error::Error`.
+    The `NoteRef` parameter to `data_api::chain::error::Error` has been removed
+    in favor of using `NoteId` to report the specific note for which a failure occurred.
+  - A new `SyncRequired` variant has been added to `data_api::wallet::input_selection::InputSelectorError`.
+  - The variants of the `PoolType` enum have changed; the `PoolType::Sapling` variant has been
+    removed in favor of a `PoolType::Shielded` variant that wraps a `ShieldedProtocol` value.
+- `zcash_client_backend::wallet`:
+  - `SpendableNote` has been renamed to `ReceivedSaplingNote`.
+  - Arguments to `WalletSaplingOutput::from_parts` have changed.
+- `zcash_client_backend::data_api::wallet::input_selection::InputSelector`:
+  - Arguments to `{propose_transaction, propose_shielding}` have changed.
+  - `InputSelector::{propose_transaction, propose_shielding}`
+    now take their respective `min_confirmations` arguments as `NonZeroU32`
+- `zcash_client_backend::data_api::wallet::{create_spend_to_address, spend,
+  create_proposed_transaction, shield_transparent_funds}` now return the `TxId`
+  for the newly created transaction instead an internal database identifier.
+- `zcash_client_backend::wallet::ReceivedSaplingNote::note_commitment_tree_position`
+  has replaced the `witness` field in the same struct.
+- `zcash_client_backend::welding_rig` has been renamed to `zcash_client_backend::scanning`
+- `zcash_client_backend::scanning::ScanningKey::sapling_nf` has been changed to
+  take a note position instead of an incremental witness for the note.
+- Arguments to `zcash_client_backend::scanning::scan_block` have changed. This
+  method now takes an optional `BlockMetadata` argument instead of a base commitment
+  tree and incremental witnesses for each previously-known note. In addition, the
+  return type has now been updated to return a `Result<ScannedBlock, ScanError>`.
+- `zcash_client_backend::proto::service`:
+  - The module is no longer behind the `lightwalletd-tonic` feature flag; that
+    now only gates the `service::compact_tx_streamer_client` submodule. This
+    exposes the service types to parse messages received by other gRPC clients.
+  - The module has been updated to include the new gRPC endpoints supported by
+    `lightwalletd` v0.4.15.
 
 ### Removed
-- `WalletRead::get_all_nullifiers`
+- `zcash_client_backend::data_api`:
+  - `WalletRead::block_height_extrema` has been removed. Use `chain_height`
+    instead to obtain the wallet's view of the chain tip instead, or
+    `suggest_scan_ranges` to obtain information about blocks that need to be
+    scanned.
+  - `WalletRead::get_balance_at` has been removed. Use `WalletRead::get_wallet_summary`
+    instead.
+  - `WalletRead::{get_all_nullifiers, get_commitment_tree, get_witnesses}` have
+    been removed without replacement. The utility of these methods is now
+    subsumed by those available from the `WalletCommitmentTrees` trait.
+  - `WalletWrite::advance_by_block` (use `WalletWrite::put_blocks` instead).
+  - `PrunedBlock` has been replaced by `ScannedBlock`
+  - `testing::MockWalletDb`, which is available under the `test-dependencies`
+    feature flag, has been modified by the addition of a `sapling_tree` property.
+  - `wallet::input_selection`:
+    - `Proposal::target_height` (use `Proposal::min_target_height` instead).
+- `zcash_client_backend::data_api::chain::validate_chain` (logic merged into
+  `chain::scan_cached_blocks`).
+- `zcash_client_backend::data_api::chain::error::{ChainError, Cause}` have been
+  replaced by `zcash_client_backend::scanning::ScanError`
+- `zcash_client_backend::proto::compact_formats`:
+  - `impl<A> From<sapling::OutputDescription<A>> for CompactSaplingOutput`
+    (use `From<&sapling::OutputDescription<A>>` instead).
+- `zcash_client_backend::wallet::WalletSaplingOutput::{witness, witness_mut}`
+  have been removed as individual incremental witnesses are no longer tracked on a
+  per-note basis. The global note commitment tree for the wallet should be used
+  to obtain witnesses for spend operations instead.
+- Default implementations of `zcash_client_backend::data_api::WalletRead::{
+    get_target_and_anchor_heights, get_max_height_hash
+  }` have been removed. These should be implemented in a backend-specific fashion.
+
 
 ## [0.9.0] - 2023-04-28
 ### Added
@@ -165,8 +1048,8 @@ and this library adheres to Rust's notion of
   - `WalletWrite::get_next_available_address`
   - `WalletWrite::put_received_transparent_utxo`
   - `impl From<prost::DecodeError> for error::Error`
-  - `chain::error`: a module containing error types type that that can occur only
-    in chain validation and sync have been separated out from errors related to
+  - `chain::error`: a module containing error types that can occur only
+    in chain validation and sync, separated out from errors related to
     other wallet operations.
   - `input_selection`: a module containing types related to the process
     of selecting inputs to be spent, given a transaction request.
@@ -199,7 +1082,7 @@ and this library adheres to Rust's notion of
   likely to be modified and/or moved to a different module in a future
   release:
   - `zcash_client_backend::address::UnifiedAddress`
-  - `zcash_client_backend::keys::{UnifiedSpendingKey`, `UnifiedFullViewingKey`, `Era`, `DecodingError`}
+  - `zcash_client_backend::keys::{UnifiedSpendingKey, UnifiedFullViewingKey, Era, DecodingError}`
   - `zcash_client_backend::encoding::AddressCodec`
   - `zcash_client_backend::encoding::encode_payment_address`
   - `zcash_client_backend::encoding::encode_transparent_address`
diff --git a/zcash_client_backend/Cargo.toml b/zcash_client_backend/Cargo.toml
index bcd0038e33..144faef43f 100644
--- a/zcash_client_backend/Cargo.toml
+++ b/zcash_client_backend/Cargo.toml
@@ -1,17 +1,18 @@
 [package]
 name = "zcash_client_backend"
 description = "APIs for creating shielded Zcash light clients"
-version = "0.9.0"
+version = "0.15.0"
 authors = [
     "Jack Grigg <jack@z.cash>",
     "Kris Nuttycombe <kris@electriccoin.co>"
 ]
 homepage = "https://github.com/zcash/librustzcash"
-repository = "https://github.com/zcash/librustzcash"
+repository.workspace = true
 readme = "README.md"
-license = "MIT OR Apache-2.0"
-edition = "2021"
-rust-version = "1.65"
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
 
 # Exclude proto files so crates.io consumers don't need protoc.
 exclude = ["*.proto"]
@@ -19,85 +20,213 @@ exclude = ["*.proto"]
 [package.metadata.cargo-udeps.ignore]
 development = ["zcash_proofs"]
 
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
 [dependencies]
-incrementalmerkletree = { version = "0.4", features = ["legacy-api"] }
-zcash_address = { version = "0.3", path = "../components/zcash_address" }
-zcash_encoding = { version = "0.2", path = "../components/zcash_encoding" }
-zcash_note_encryption = "0.4"
-zcash_primitives = { version = "0.12", path = "../zcash_primitives", default-features = false }
+zcash_address.workspace = true
+zcash_encoding.workspace = true
+zcash_keys = { workspace = true, features = ["sapling"] }
+zcash_note_encryption.workspace = true
+zcash_primitives.workspace = true
+zcash_protocol.workspace = true
+zip32.workspace = true
+zip321.workspace = true
 
 # Dependencies exposed in a public API:
 # (Breaking upgrades to these require a breaking upgrade to this crate.)
 # - Data Access API
-time = "0.2"
+time = "0.3.22"
+nonempty.workspace = true
+
+# - CSPRNG
+rand_core.workspace = true
 
 # - Encodings
-base64 = "0.21"
-bech32 = "0.9"
-bs58 = { version = "0.5", features = ["check"] }
+base64.workspace = true
+bech32.workspace = true
+bs58.workspace = true
 
 # - Errors
-hdwallet = { version = "0.4", optional = true }
+bip32 = { workspace = true, optional = true }
 
 # - Logging and metrics
-memuse = "0.2"
-tracing = "0.1"
+memuse.workspace = true
+tracing.workspace = true
 
 # - Protobuf interfaces and gRPC bindings
-prost = "0.11"
-tonic = { version = "0.9", optional = true }
+hex.workspace = true
+prost.workspace = true
+tonic = { workspace = true, optional = true, features = ["prost", "codegen"] }
 
 # - Secret management
-secrecy = "0.8"
-subtle = "2.2.3"
+secrecy.workspace = true
+subtle.workspace = true
 
 # - Shielded protocols
-bls12_381 = "0.8"
-group = "0.13"
-orchard = { version = "0.5", default-features = false }
+bls12_381.workspace = true
+group.workspace = true
+orchard = { workspace = true, optional = true }
+sapling.workspace = true
+
+# - Sync engine
+async-trait = { version = "0.1", optional = true }
+futures-util = { version = "0.3", optional = true }
+
+# - Note commitment trees
+incrementalmerkletree.workspace = true
+shardtree.workspace = true
 
 # - Test dependencies
-proptest = { version = "1.0.0", optional = true }
+ambassador = { workspace = true, optional = true }
+assert_matches = { workspace = true, optional = true }
+pasta_curves = { workspace = true, optional = true }
+proptest = { workspace = true, optional = true }
+jubjub = { workspace = true, optional = true }
+rand_chacha = { workspace = true, optional = true }
+zcash_proofs = { workspace = true, optional = true }
 
 # - ZIP 321
 nom = "7"
 
+# - Tor
+# -- Exposed error types: `arti_client::Error`, `arti_client::config::ConfigBuildError`,
+#    `hyper::Error`, `hyper::http::Error`, `serde_json::Error`. We could avoid this with
+#    changes to error handling.
+arti-client = { workspace = true, optional = true }
+dynosaur = { workspace = true, optional = true }
+hyper = { workspace = true, optional = true, features = ["client", "http1"] }
+serde_json = { workspace = true, optional = true }
+trait-variant = { workspace = true, optional = true }
+
+# - Currency conversion
+rust_decimal = { workspace = true, optional = true }
+
 # Dependencies used internally:
 # (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Documentation
+document-features.workspace = true
+
 # - Encodings
-byteorder = { version = "1", optional = true }
-percent-encoding = "2.1.0"
+byteorder = { workspace = true, optional = true }
+percent-encoding.workspace = true
 
 # - Scanning
-crossbeam-channel = "0.5"
-rayon = "1.5"
+crossbeam-channel.workspace = true
+rayon.workspace = true
+
+# - Tor
+tokio = { workspace = true, optional = true, features = ["fs"] }
+tor-rtcompat = { workspace = true, optional = true }
+tower = { workspace = true, optional = true }
+
+# - HTTP through Tor
+http-body-util = { workspace = true, optional = true }
+hyper-util = { workspace = true, optional = true }
+rand = { workspace = true, optional = true }
+serde = { workspace = true, optional = true }
+tokio-rustls = { workspace = true, optional = true }
+webpki-roots = { workspace = true, optional = true }
 
 [build-dependencies]
-tonic-build = "0.9"
-which = "4"
+tonic-build = { workspace = true, features = ["prost"] }
+which = "6"
 
 [dev-dependencies]
-assert_matches = "1.5"
+ambassador.workspace = true
+assert_matches.workspace = true
 gumdrop = "0.8"
-hex = "0.4"
-jubjub = "0.10"
-proptest = "1.0.0"
-rand_core = "0.6"
-rand_xorshift = "0.3"
-tempfile = "3.5.0"
-zcash_proofs = { version = "0.12", path = "../zcash_proofs", default-features = false }
-zcash_address = { version = "0.3", path = "../components/zcash_address", features = ["test-dependencies"] }
+incrementalmerkletree = { workspace = true, features = ["test-dependencies"] }
+jubjub.workspace = true
+proptest.workspace = true
+rand.workspace = true
+rand_chacha.workspace = true
+shardtree = { workspace = true, features = ["test-dependencies"] }
+tokio = { version = "1.21.0", features = ["rt-multi-thread"] }
+zcash_address = { workspace = true, features = ["test-dependencies"] }
+zcash_keys = { workspace = true, features = ["test-dependencies"] }
+zcash_primitives = { workspace = true, features = ["test-dependencies"] }
+zcash_proofs = { workspace = true, features = ["bundled-prover"] }
+zcash_protocol = { workspace = true, features = ["local-consensus"] }
 
 [features]
-lightwalletd-tonic = ["tonic"]
-transparent-inputs = ["hdwallet", "zcash_primitives/transparent-inputs"]
+## Enables the `tonic` gRPC client bindings for connecting to a `lightwalletd` server.
+lightwalletd-tonic = ["dep:tonic", "hyper-util?/tokio"]
+
+## Enables the `tls-webpki-roots` feature of `tonic`.
+lightwalletd-tonic-tls-webpki-roots = ["lightwalletd-tonic", "tonic?/tls-webpki-roots"]
+
+## Enables the `transport` feature of `tonic` producing a fully-featured client and server implementation
+lightwalletd-tonic-transport = ["lightwalletd-tonic", "tonic?/transport"]
+
+## Enables receiving transparent funds and shielding them.
+transparent-inputs = [
+    "dep:bip32",
+    "zcash_keys/transparent-inputs",
+    "zcash_primitives/transparent-inputs",
+]
+
+## Enables receiving and spending Orchard funds.
+orchard = ["dep:orchard", "dep:pasta_curves", "zcash_keys/orchard"]
+
+## Exposes a wallet synchronization function that implements the necessary state machine.
+sync = [
+    "lightwalletd-tonic",
+    "dep:async-trait",
+    "dep:futures-util",
+]
+
+## Exposes a Tor client for hiding a wallet's IP address while performing certain wallet
+## operations.
+tor = [
+    "dep:arti-client",
+    "dep:dynosaur",
+    "dep:futures-util",
+    "dep:http-body-util",
+    "dep:hyper",
+    "dep:hyper-util",
+    "dep:rand",
+    "dep:rust_decimal",
+    "dep:serde",
+    "dep:serde_json",
+    "dep:tokio",
+    "dep:tokio-rustls",
+    "dep:tor-rtcompat",
+    "dep:trait-variant",
+    "dep:tower",
+    "dep:webpki-roots",
+]
+
+## Exposes APIs that are useful for testing, such as `proptest` strategies.
 test-dependencies = [
-    "proptest",
-    "orchard/test-dependencies",
+    "dep:ambassador",
+    "dep:assert_matches",
+    "dep:proptest",
+    "dep:jubjub",
+    "dep:rand",
+    "dep:rand_chacha",
+    "orchard?/test-dependencies",
+    "zcash_keys/test-dependencies",
     "zcash_primitives/test-dependencies",
-    "incrementalmerkletree/test-dependencies"
+    "zcash_proofs/bundled-prover",
+    "zcash_protocol/local-consensus",
+    "incrementalmerkletree/test-dependencies",
 ]
-unstable = ["byteorder"]
+
+## Exposes APIs that allow calculation of non-standard fees.
+non-standard-fees = ["zcash_primitives/non-standard-fees"]
+
+#! ### Experimental features
+
+## Exposes unstable APIs. Their behaviour may change at any time.
+unstable = ["dep:byteorder", "zcash_keys/unstable"]
+
+## Exposes APIs for unstable serialization formats. These may change at any time.
+unstable-serialization = ["dep:byteorder"]
+
+## Exposes the [`data_api::scanning::spanning_tree`] module.
+unstable-spanning-tree = []
 
 [lib]
 bench = false
diff --git a/zcash_client_backend/README.md b/zcash_client_backend/README.md
index eb8a6cd613..25f3e625cd 100644
--- a/zcash_client_backend/README.md
+++ b/zcash_client_backend/README.md
@@ -3,6 +3,12 @@
 This library contains Rust structs and traits for creating shielded Zcash light
 clients.
 
+## Building
+
+Note that in order to (re)build the GRPC interface, you will need `protoc` on
+your `$PATH`. This is not required unless you make changes to any of the files
+in `./proto/`.
+
 ## License
 
 Licensed under either of
@@ -13,16 +19,6 @@ Licensed under either of
 
 at your option.
 
-Downstream code forks should note that 'zcash_client_backend' depends on the
-'orchard' crate, which is licensed under the
-[Bootstrap Open Source License](https://github.com/zcash/orchard/blob/main/LICENSE-BOSL).
-A license exception is provided allowing some derived works that are linked or
-combined with the 'orchard' crate to be copied or distributed under the original
-licenses (in this case MIT / Apache 2.0), provided that the included portions of
-the 'orchard' code remain subject to BOSL.
-See https://github.com/zcash/orchard/blob/main/COPYING for details of which
-derived works can make use of this exception.
-
 ### Contribution
 
 Unless you explicitly state otherwise, any contribution intentionally
diff --git a/zcash_client_backend/build.rs b/zcash_client_backend/build.rs
index 271b0f781e..396738bdb5 100644
--- a/zcash_client_backend/build.rs
+++ b/zcash_client_backend/build.rs
@@ -5,7 +5,8 @@ use std::path::{Path, PathBuf};
 
 const COMPACT_FORMATS_PROTO: &str = "proto/compact_formats.proto";
 
-#[cfg(feature = "lightwalletd-tonic")]
+const PROPOSAL_PROTO: &str = "proto/proposal.proto";
+
 const SERVICE_PROTO: &str = "proto/service.proto";
 
 fn main() -> io::Result<()> {
@@ -40,38 +41,52 @@ fn build() -> io::Result<()> {
         "src/proto/compact_formats.rs",
     )?;
 
-    #[cfg(feature = "lightwalletd-tonic")]
-    {
-        // Build the gRPC types and client.
-        tonic_build::configure()
-            .build_server(false)
-            .extern_path(
-                ".cash.z.wallet.sdk.rpc.CompactBlock",
-                "crate::proto::compact_formats::CompactBlock",
-            )
-            .extern_path(
-                ".cash.z.wallet.sdk.rpc.CompactTx",
-                "crate::proto::compact_formats::CompactTx",
-            )
-            .extern_path(
-                ".cash.z.wallet.sdk.rpc.CompactSaplingSpend",
-                "crate::proto::compact_formats::CompactSaplingSpend",
-            )
-            .extern_path(
-                ".cash.z.wallet.sdk.rpc.CompactSaplingOutput",
-                "crate::proto::compact_formats::CompactSaplingOutput",
-            )
-            .extern_path(
-                ".cash.z.wallet.sdk.rpc.CompactOrchardAction",
-                "crate::proto::compact_formats::CompactOrchardAction",
-            )
-            .compile(&[SERVICE_PROTO], &["proto/"])?;
+    // Build the gRPC types and client.
+    tonic_build::configure()
+        .build_server(false)
+        .client_mod_attribute(
+            "cash.z.wallet.sdk.rpc",
+            r#"#[cfg(feature = "lightwalletd-tonic")]"#,
+        )
+        .extern_path(
+            ".cash.z.wallet.sdk.rpc.ChainMetadata",
+            "crate::proto::compact_formats::ChainMetadata",
+        )
+        .extern_path(
+            ".cash.z.wallet.sdk.rpc.CompactBlock",
+            "crate::proto::compact_formats::CompactBlock",
+        )
+        .extern_path(
+            ".cash.z.wallet.sdk.rpc.CompactTx",
+            "crate::proto::compact_formats::CompactTx",
+        )
+        .extern_path(
+            ".cash.z.wallet.sdk.rpc.CompactSaplingSpend",
+            "crate::proto::compact_formats::CompactSaplingSpend",
+        )
+        .extern_path(
+            ".cash.z.wallet.sdk.rpc.CompactSaplingOutput",
+            "crate::proto::compact_formats::CompactSaplingOutput",
+        )
+        .extern_path(
+            ".cash.z.wallet.sdk.rpc.CompactOrchardAction",
+            "crate::proto::compact_formats::CompactOrchardAction",
+        )
+        .compile(&[SERVICE_PROTO], &["proto/"])?;
 
-        // Copy the generated types into the source tree so changes can be committed. The
-        // file has the same name as for the compact format types because they have the
-        // same package, but we've set things up so this only contains the service types.
-        fs::copy(out.join("cash.z.wallet.sdk.rpc.rs"), "src/proto/service.rs")?;
-    }
+    // Build the proposal types.
+    tonic_build::compile_protos(PROPOSAL_PROTO)?;
+
+    // Copy the generated types into the source tree so changes can be committed.
+    fs::copy(
+        out.join("cash.z.wallet.sdk.ffi.rs"),
+        "src/proto/proposal.rs",
+    )?;
+
+    // Copy the generated types into the source tree so changes can be committed. The
+    // file has the same name as for the compact format types because they have the
+    // same package, but we've set things up so this only contains the service types.
+    fs::copy(out.join("cash.z.wallet.sdk.rpc.rs"), "src/proto/service.rs")?;
 
     Ok(())
 }
diff --git a/zcash_client_backend/examples/diversify-address.rs b/zcash_client_backend/examples/diversify-address.rs
index aa77e6e9ab..809b109e8c 100644
--- a/zcash_client_backend/examples/diversify-address.rs
+++ b/zcash_client_backend/examples/diversify-address.rs
@@ -1,8 +1,9 @@
 use gumdrop::Options;
+use sapling::zip32::ExtendedFullViewingKey;
 use zcash_client_backend::encoding::{decode_extended_full_viewing_key, encode_payment_address};
 use zcash_primitives::{
     constants::{mainnet, testnet},
-    zip32::{DiversifierIndex, ExtendedFullViewingKey},
+    zip32::DiversifierIndex,
 };
 
 fn parse_viewing_key(s: &str) -> Result<(ExtendedFullViewingKey, bool), &'static str> {
@@ -17,16 +18,11 @@ fn parse_viewing_key(s: &str) -> Result<(ExtendedFullViewingKey, bool), &'static
 
 fn parse_diversifier_index(s: &str) -> Result<DiversifierIndex, &'static str> {
     let i: u128 = s.parse().map_err(|_| "Diversifier index is not a number")?;
-    if i >= (1 << 88) {
-        return Err("Diversifier index too large");
-    }
-    Ok(DiversifierIndex(i.to_le_bytes()[..11].try_into().unwrap()))
+    DiversifierIndex::try_from(i).map_err(|_| "Diversifier index too large")
 }
 
 fn encode_diversifier_index(di: &DiversifierIndex) -> u128 {
-    let mut bytes = [0; 16];
-    bytes[..11].copy_from_slice(&di.0);
-    u128::from_le_bytes(bytes)
+    (*di).into()
 }
 
 #[derive(Debug, Options)]
diff --git a/zcash_client_backend/proto/compact_formats.proto b/zcash_client_backend/proto/compact_formats.proto
index 077537c606..b00ab1291a 100644
--- a/zcash_client_backend/proto/compact_formats.proto
+++ b/zcash_client_backend/proto/compact_formats.proto
@@ -10,20 +10,31 @@ option swift_prefix = "";
 // Remember that proto3 fields are all optional. A field that is not present will be set to its zero value.
 // bytes fields of hashes are in canonical little-endian format.
 
+// Information about the state of the chain as of a given block.
+message ChainMetadata {
+    uint32 saplingCommitmentTreeSize = 1; // the size of the Sapling note commitment tree as of the end of this block
+    uint32 orchardCommitmentTreeSize = 2; // the size of the Orchard note commitment tree as of the end of this block
+}
+
+// A compact representation of the shielded data in a Zcash block.
+//
 // CompactBlock is a packaging of ONLY the data from a block that's needed to:
-//   1. Detect a payment to your shielded Sapling address
-//   2. Detect a spend of your shielded Sapling notes
-//   3. Update your witnesses to generate new Sapling spend proofs.
+//   1. Detect a payment to your Shielded address
+//   2. Detect a spend of your Shielded notes
+//   3. Update your witnesses to generate new spend proofs.
 message CompactBlock {
-    uint32 protoVersion = 1;    // the version of this wire format, for storage
-    uint64 height = 2;          // the height of this block
-    bytes hash = 3;             // the ID (hash) of this block, same as in block explorers
-    bytes prevHash = 4;         // the ID (hash) of this block's predecessor
-    uint32 time = 5;            // Unix epoch time when the block was mined
-    bytes header = 6;           // (hash, prevHash, and time) OR (full header)
-    repeated CompactTx vtx = 7; // zero or more compact transactions from this block
+    uint32 protoVersion = 1;         // the version of this wire format, for storage
+    uint64 height = 2;               // the height of this block
+    bytes hash = 3;                  // the ID (hash) of this block, same as in block explorers
+    bytes prevHash = 4;              // the ID (hash) of this block's predecessor
+    uint32 time = 5;                 // Unix epoch time when the block was mined
+    bytes header = 6;                // (hash, prevHash, and time) OR (full header)
+    repeated CompactTx vtx = 7;      // zero or more compact transactions from this block
+    ChainMetadata chainMetadata = 8; // information about the state of the chain as of this block
 }
 
+// A compact representation of the shielded data in a Zcash transaction.
+//
 // CompactTx contains the minimum information for a wallet to know if this transaction
 // is relevant to it (either pays to it or spends from it) via shielded elements
 // only. This message will not encode a transparent-to-transparent transaction.
@@ -46,25 +57,25 @@ message CompactTx {
     repeated CompactOrchardAction actions = 6;
 }
 
+// A compact representation of a [Sapling Spend](https://zips.z.cash/protocol/protocol.pdf#spendencodingandconsensus).
+//
 // CompactSaplingSpend is a Sapling Spend Description as described in 7.3 of the Zcash
 // protocol specification.
 message CompactSaplingSpend {
-    bytes nf = 1;   // nullifier (see the Zcash protocol specification)
+    bytes nf = 1;   // Nullifier (see the Zcash protocol specification)
 }
 
-// output encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the
-// `encCiphertext` field of a Sapling Output Description. These fields are described in
-// section 7.4 of the Zcash protocol spec:
-// https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus
-// Total size is 116 bytes.
+// A compact representation of a [Sapling Output](https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus).
+//
+// It encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the
+// `encCiphertext` field of a Sapling Output Description. Total size is 116 bytes.
 message CompactSaplingOutput {
-    bytes cmu = 1;          // note commitment u-coordinate
-    bytes ephemeralKey = 2; // ephemeral public key
-    bytes ciphertext = 3;   // first 52 bytes of ciphertext
+    bytes cmu = 1;          // Note commitment u-coordinate.
+    bytes ephemeralKey = 2; // Ephemeral public key.
+    bytes ciphertext = 3;   // First 52 bytes of ciphertext.
 }
 
-// https://github.com/zcash/zips/blob/main/zip-0225.rst#orchard-action-description-orchardaction
-// (but not all fields are needed)
+// A compact representation of an [Orchard Action](https://zips.z.cash/protocol/protocol.pdf#actionencodingandconsensus).
 message CompactOrchardAction {
     bytes nullifier = 1;        // [32] The nullifier of the input note
     bytes cmx = 2;              // [32] The x-coordinate of the note commitment for the output note
diff --git a/zcash_client_backend/proto/proposal.proto b/zcash_client_backend/proto/proposal.proto
new file mode 100644
index 0000000000..db548c6e23
--- /dev/null
+++ b/zcash_client_backend/proto/proposal.proto
@@ -0,0 +1,144 @@
+// Copyright (c) 2023 The Zcash developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://www.opensource.org/licenses/mit-license.php .
+
+syntax = "proto3";
+package cash.z.wallet.sdk.ffi;
+
+// A data structure that describes a series of transactions to be created.
+message Proposal {
+    // The version of this serialization format.
+    uint32 protoVersion = 1;
+    // The fee rule used in constructing this proposal
+    FeeRule feeRule = 2;
+    // The target height for which the proposal was constructed
+    //
+    // The chain must contain at least this many blocks in order for the proposal to
+    // be executed.
+    uint32 minTargetHeight = 3;
+    // The series of transactions to be created.
+    repeated ProposalStep steps = 4;
+}
+
+// A data structure that describes the inputs to be consumed and outputs to
+// be produced in a proposed transaction.
+message ProposalStep {
+    // ZIP 321 serialized transaction request
+    string transactionRequest = 1;
+    // The vector of selected payment index / output pool mappings. Payment index
+    // 0 corresponds to the payment with no explicit index.
+    repeated PaymentOutputPool paymentOutputPools = 2;
+    // The anchor height to be used in creating the transaction, if any.
+    // Setting the anchor height to zero will disallow the use of any shielded
+    // inputs.
+    uint32 anchorHeight = 3;
+    // The inputs to be used in creating the transaction.
+    repeated ProposedInput inputs = 4;
+    // The total value, fee value, and change outputs of the proposed
+    // transaction
+    TransactionBalance balance = 5;
+    // A flag indicating whether the step is for a shielding transaction,
+    // used for determining which OVK to select for wallet-internal outputs.
+    bool isShielding = 6;
+}
+
+enum ValuePool {
+    // Protobuf requires that enums have a zero discriminant as the default
+    // value. However, we need to require that a known value pool is selected,
+    // and we do not want to fall back to any default, so sending the
+    // PoolNotSpecified value will be treated as an error.
+    PoolNotSpecified = 0;
+    // The transparent value pool (P2SH is not distinguished from P2PKH)
+    Transparent = 1;
+    // The Sapling value pool
+    Sapling = 2;
+    // The Orchard value pool
+    Orchard = 3;
+}
+
+// A mapping from ZIP 321 payment index to the output pool that has been chosen
+// for that payment, based upon the payment address and the selected inputs to
+// the transaction.
+message PaymentOutputPool {
+    uint32 paymentIndex = 1;
+    ValuePool valuePool = 2;
+}
+
+// The unique identifier and value for each proposed input that does not
+// require a back-reference to a prior step of the proposal.
+message ReceivedOutput {
+    bytes txid = 1;
+    ValuePool valuePool = 2;
+    uint32 index = 3;
+    uint64 value = 4;
+}
+
+// A reference to a payment in a prior step of the proposal. This payment must
+// belong to the wallet.
+message PriorStepOutput {
+    uint32 stepIndex = 1;
+    uint32 paymentIndex = 2;
+}
+
+// A reference to a change or ephemeral output from a prior step of the proposal.
+message PriorStepChange {
+    uint32 stepIndex = 1;
+    uint32 changeIndex = 2;
+}
+
+// The unique identifier and value for an input to be used in the transaction.
+message ProposedInput {
+    oneof value {
+        ReceivedOutput receivedOutput = 1;
+        PriorStepOutput priorStepOutput = 2;
+        PriorStepChange priorStepChange = 3;
+    }
+}
+
+// The fee rule used in constructing a Proposal
+enum FeeRule {
+    // Protobuf requires that enums have a zero discriminant as the default
+    // value. However, we need to require that a known fee rule is selected,
+    // and we do not want to fall back to any default, so sending the
+    // FeeRuleNotSpecified value will be treated as an error.
+    FeeRuleNotSpecified = 0;
+    // 10000 ZAT
+    PreZip313 = 1;
+    // 1000 ZAT
+    Zip313 = 2;
+    // MAX(10000, 5000 * logical_actions) ZAT
+    Zip317 = 3;
+}
+
+// The proposed change outputs and fee value.
+message TransactionBalance {
+    // A list of change or ephemeral output values.
+    repeated ChangeValue proposedChange = 1;
+    // The fee to be paid by the proposed transaction, in zatoshis.
+    uint64 feeRequired = 2;
+}
+
+// A proposed change or ephemeral output. If the transparent value pool is
+// selected, the `memo` field must be null.
+//
+// When the `isEphemeral` field of a `ChangeValue` is set, it represents
+// an ephemeral output, which must be spent by a subsequent step. This is
+// only supported for transparent outputs. Each ephemeral output will be
+// given a unique t-address.
+message ChangeValue {
+    // The value of a change or ephemeral output to be created, in zatoshis.
+    uint64 value = 1;
+    // The value pool in which the change or ephemeral output should be created.
+    ValuePool valuePool = 2;
+    // The optional memo that should be associated with the newly created output.
+    // Memos must not be present for transparent outputs.
+    MemoBytes memo = 3;
+    // Whether this is to be an ephemeral output.
+    bool isEphemeral = 4;
+}
+
+// An object wrapper for memo bytes, to facilitate representing the
+// `change_memo == None` case.
+message MemoBytes {
+    bytes value = 1;
+}
diff --git a/zcash_client_backend/proto/service.proto b/zcash_client_backend/proto/service.proto
index d7f11dcd69..6559e3433e 100644
--- a/zcash_client_backend/proto/service.proto
+++ b/zcash_client_backend/proto/service.proto
@@ -34,6 +34,9 @@ message TxFilter {
 // RawTransaction contains the complete transaction data. It also optionally includes 
 // the block height in which the transaction was included, or, when returned
 // by GetMempoolStream(), the latest block height.
+//
+// FIXME: the documentation here about mempool status contradicts the documentation
+// for the `height` field. See https://github.com/zcash/librustzcash/issues/1484
 message RawTransaction {
     bytes data = 1;     // exact data returned by Zcash 'getrawtransaction'
     uint64 height = 2;  // height that the transaction was mined (or -1)
@@ -118,6 +121,22 @@ message TreeState {
     string orchardTree = 6; // orchard commitment tree state
 }
 
+enum ShieldedProtocol {
+    sapling = 0;
+    orchard = 1;
+}
+
+message GetSubtreeRootsArg {
+    uint32 startIndex = 1;                  // Index identifying where to start returning subtree roots
+    ShieldedProtocol shieldedProtocol = 2;  // Shielded protocol to return subtree roots for
+    uint32 maxEntries = 3;                  // Maximum number of entries to return, or 0 for all entries.
+}
+message SubtreeRoot {
+    bytes rootHash = 2;                     // The 32-byte Merkle root of the subtree.
+    bytes completingBlockHash = 3;          // The hash of the block that completed this subtree.
+    uint64 completingBlockHeight = 4;       // The height of the block that completed this subtree in the main chain.
+}
+
 // Results are sorted by height, which makes it easy to issue another
 // request that picks up from where the previous left off.
 message GetAddressUtxosArg {
@@ -138,12 +157,16 @@ message GetAddressUtxosReplyList {
 }
 
 service CompactTxStreamer {
-    // Return the height of the tip of the best chain
+    // Return the BlockID of the block at the tip of the best chain
     rpc GetLatestBlock(ChainSpec) returns (BlockID) {}
     // Return the compact block corresponding to the given block identifier
     rpc GetBlock(BlockID) returns (CompactBlock) {}
+    // Same as GetBlock except actions contain only nullifiers
+    rpc GetBlockNullifiers(BlockID) returns (CompactBlock) {}
     // Return a list of consecutive compact blocks
     rpc GetBlockRange(BlockRange) returns (stream CompactBlock) {}
+    // Same as GetBlockRange except actions contain only nullifiers
+    rpc GetBlockRangeNullifiers(BlockRange) returns (stream CompactBlock) {}
 
     // Return the requested full (not compact) transaction (as from zcashd)
     rpc GetTransaction(TxFilter) returns (RawTransaction) {}
@@ -177,6 +200,10 @@ service CompactTxStreamer {
     rpc GetTreeState(BlockID) returns (TreeState) {}
     rpc GetLatestTreeState(Empty) returns (TreeState) {}
 
+    // Returns a stream of information about roots of subtrees of the Sapling and Orchard
+    // note commitment trees.
+    rpc GetSubtreeRoots(GetSubtreeRootsArg) returns (stream SubtreeRoot) {}
+
     rpc GetAddressUtxos(GetAddressUtxosArg) returns (GetAddressUtxosReplyList) {}
     rpc GetAddressUtxosStream(GetAddressUtxosArg) returns (stream GetAddressUtxosReply) {}
 
diff --git a/zcash_client_backend/src/address.rs b/zcash_client_backend/src/address.rs
deleted file mode 100644
index 87e1ac0fe6..0000000000
--- a/zcash_client_backend/src/address.rs
+++ /dev/null
@@ -1,314 +0,0 @@
-//! Structs for handling supported address types.
-
-use std::convert::TryFrom;
-
-use zcash_address::{
-    unified::{self, Container, Encoding},
-    ConversionError, Network, ToAddress, TryFromRawAddress, ZcashAddress,
-};
-use zcash_primitives::{
-    consensus,
-    legacy::TransparentAddress,
-    sapling::PaymentAddress,
-    zip32::{AccountId, DiversifierIndex},
-};
-
-pub struct AddressMetadata {
-    account: AccountId,
-    diversifier_index: DiversifierIndex,
-}
-
-impl AddressMetadata {
-    pub fn new(account: AccountId, diversifier_index: DiversifierIndex) -> Self {
-        Self {
-            account,
-            diversifier_index,
-        }
-    }
-
-    pub fn account(&self) -> AccountId {
-        self.account
-    }
-
-    pub fn diversifier_index(&self) -> &DiversifierIndex {
-        &self.diversifier_index
-    }
-}
-
-/// A Unified Address.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct UnifiedAddress {
-    orchard: Option<orchard::Address>,
-    sapling: Option<PaymentAddress>,
-    transparent: Option<TransparentAddress>,
-    unknown: Vec<(u32, Vec<u8>)>,
-}
-
-impl TryFrom<unified::Address> for UnifiedAddress {
-    type Error = &'static str;
-
-    fn try_from(ua: unified::Address) -> Result<Self, Self::Error> {
-        let mut orchard = None;
-        let mut sapling = None;
-        let mut transparent = None;
-
-        // We can use as-parsed order here for efficiency, because we're breaking out the
-        // receivers we support from the unknown receivers.
-        let unknown = ua
-            .items_as_parsed()
-            .iter()
-            .filter_map(|receiver| match receiver {
-                unified::Receiver::Orchard(data) => {
-                    Option::from(orchard::Address::from_raw_address_bytes(data))
-                        .ok_or("Invalid Orchard receiver in Unified Address")
-                        .map(|addr| {
-                            orchard = Some(addr);
-                            None
-                        })
-                        .transpose()
-                }
-                unified::Receiver::Sapling(data) => PaymentAddress::from_bytes(data)
-                    .ok_or("Invalid Sapling receiver in Unified Address")
-                    .map(|pa| {
-                        sapling = Some(pa);
-                        None
-                    })
-                    .transpose(),
-                unified::Receiver::P2pkh(data) => {
-                    transparent = Some(TransparentAddress::PublicKey(*data));
-                    None
-                }
-                unified::Receiver::P2sh(data) => {
-                    transparent = Some(TransparentAddress::Script(*data));
-                    None
-                }
-                unified::Receiver::Unknown { typecode, data } => {
-                    Some(Ok((*typecode, data.clone())))
-                }
-            })
-            .collect::<Result<_, _>>()?;
-
-        Ok(Self {
-            orchard,
-            sapling,
-            transparent,
-            unknown,
-        })
-    }
-}
-
-impl UnifiedAddress {
-    /// Constructs a Unified Address from a given set of receivers.
-    ///
-    /// Returns `None` if the receivers would produce an invalid Unified Address (namely,
-    /// if no shielded receiver is provided).
-    pub fn from_receivers(
-        orchard: Option<orchard::Address>,
-        sapling: Option<PaymentAddress>,
-        transparent: Option<TransparentAddress>,
-    ) -> Option<Self> {
-        if orchard.is_some() || sapling.is_some() {
-            Some(Self {
-                orchard,
-                sapling,
-                transparent,
-                unknown: vec![],
-            })
-        } else {
-            // UAs require at least one shielded receiver.
-            None
-        }
-    }
-
-    /// Returns the Orchard receiver within this Unified Address, if any.
-    pub fn orchard(&self) -> Option<&orchard::Address> {
-        self.orchard.as_ref()
-    }
-
-    /// Returns the Sapling receiver within this Unified Address, if any.
-    pub fn sapling(&self) -> Option<&PaymentAddress> {
-        self.sapling.as_ref()
-    }
-
-    /// Returns the transparent receiver within this Unified Address, if any.
-    pub fn transparent(&self) -> Option<&TransparentAddress> {
-        self.transparent.as_ref()
-    }
-
-    fn to_address(&self, net: Network) -> ZcashAddress {
-        let ua = unified::Address::try_from_items(
-            self.unknown
-                .iter()
-                .map(|(typecode, data)| unified::Receiver::Unknown {
-                    typecode: *typecode,
-                    data: data.clone(),
-                })
-                .chain(self.transparent.as_ref().map(|taddr| match taddr {
-                    TransparentAddress::PublicKey(data) => unified::Receiver::P2pkh(*data),
-                    TransparentAddress::Script(data) => unified::Receiver::P2sh(*data),
-                }))
-                .chain(
-                    self.sapling
-                        .as_ref()
-                        .map(|pa| pa.to_bytes())
-                        .map(unified::Receiver::Sapling),
-                )
-                .chain(
-                    self.orchard
-                        .as_ref()
-                        .map(|addr| addr.to_raw_address_bytes())
-                        .map(unified::Receiver::Orchard),
-                )
-                .collect(),
-        )
-        .expect("UnifiedAddress should only be constructed safely");
-        ZcashAddress::from_unified(net, ua)
-    }
-
-    /// Returns the string encoding of this `UnifiedAddress` for the given network.
-    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
-        self.to_address(params.address_network().expect("Unrecognized network"))
-            .to_string()
-    }
-}
-
-/// An address that funds can be sent to.
-// TODO: rename to ParsedAddress
-#[derive(Debug, PartialEq, Eq, Clone)]
-pub enum RecipientAddress {
-    Shielded(PaymentAddress),
-    Transparent(TransparentAddress),
-    Unified(UnifiedAddress),
-}
-
-impl From<PaymentAddress> for RecipientAddress {
-    fn from(addr: PaymentAddress) -> Self {
-        RecipientAddress::Shielded(addr)
-    }
-}
-
-impl From<TransparentAddress> for RecipientAddress {
-    fn from(addr: TransparentAddress) -> Self {
-        RecipientAddress::Transparent(addr)
-    }
-}
-
-impl From<UnifiedAddress> for RecipientAddress {
-    fn from(addr: UnifiedAddress) -> Self {
-        RecipientAddress::Unified(addr)
-    }
-}
-
-impl TryFromRawAddress for RecipientAddress {
-    type Error = &'static str;
-
-    fn try_from_raw_sapling(data: [u8; 43]) -> Result<Self, ConversionError<Self::Error>> {
-        let pa = PaymentAddress::from_bytes(&data).ok_or("Invalid Sapling payment address")?;
-        Ok(pa.into())
-    }
-
-    fn try_from_raw_unified(
-        ua: zcash_address::unified::Address,
-    ) -> Result<Self, ConversionError<Self::Error>> {
-        UnifiedAddress::try_from(ua)
-            .map_err(ConversionError::User)
-            .map(RecipientAddress::from)
-    }
-
-    fn try_from_raw_transparent_p2pkh(
-        data: [u8; 20],
-    ) -> Result<Self, ConversionError<Self::Error>> {
-        Ok(TransparentAddress::PublicKey(data).into())
-    }
-
-    fn try_from_raw_transparent_p2sh(data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
-        Ok(TransparentAddress::Script(data).into())
-    }
-}
-
-impl RecipientAddress {
-    pub fn decode<P: consensus::Parameters>(params: &P, s: &str) -> Option<Self> {
-        let addr = ZcashAddress::try_from_encoded(s).ok()?;
-        addr.convert_if_network(params.address_network().expect("Unrecognized network"))
-            .ok()
-    }
-
-    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
-        let net = params.address_network().expect("Unrecognized network");
-
-        match self {
-            RecipientAddress::Shielded(pa) => ZcashAddress::from_sapling(net, pa.to_bytes()),
-            RecipientAddress::Transparent(addr) => match addr {
-                TransparentAddress::PublicKey(data) => {
-                    ZcashAddress::from_transparent_p2pkh(net, *data)
-                }
-                TransparentAddress::Script(data) => ZcashAddress::from_transparent_p2sh(net, *data),
-            },
-            RecipientAddress::Unified(ua) => ua.to_address(net),
-        }
-        .to_string()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use zcash_address::test_vectors;
-    use zcash_primitives::consensus::MAIN_NETWORK;
-
-    use super::{RecipientAddress, UnifiedAddress};
-    use crate::keys::sapling;
-
-    #[test]
-    fn ua_round_trip() {
-        let orchard = {
-            let sk = orchard::keys::SpendingKey::from_zip32_seed(&[0; 32], 0, 0).unwrap();
-            let fvk = orchard::keys::FullViewingKey::from(&sk);
-            Some(fvk.address_at(0u32, orchard::keys::Scope::External))
-        };
-
-        let sapling = {
-            let extsk = sapling::spending_key(&[0; 32], 0, 0.into());
-            let dfvk = extsk.to_diversifiable_full_viewing_key();
-            Some(dfvk.default_address().1)
-        };
-
-        let transparent = { None };
-
-        let ua = UnifiedAddress::from_receivers(orchard, sapling, transparent).unwrap();
-
-        let addr = RecipientAddress::Unified(ua);
-        let addr_str = addr.encode(&MAIN_NETWORK);
-        assert_eq!(
-            RecipientAddress::decode(&MAIN_NETWORK, &addr_str),
-            Some(addr)
-        );
-    }
-
-    #[test]
-    fn ua_parsing() {
-        for tv in test_vectors::UNIFIED {
-            match RecipientAddress::decode(&MAIN_NETWORK, tv.unified_addr) {
-                Some(RecipientAddress::Unified(ua)) => {
-                    assert_eq!(
-                        ua.transparent().is_some(),
-                        tv.p2pkh_bytes.is_some() || tv.p2sh_bytes.is_some()
-                    );
-                    assert_eq!(ua.sapling().is_some(), tv.sapling_raw_addr.is_some());
-                    assert_eq!(ua.orchard().is_some(), tv.orchard_raw_addr.is_some());
-                }
-                Some(_) => {
-                    panic!(
-                        "{} did not decode to a unified address value.",
-                        tv.unified_addr
-                    );
-                }
-                None => {
-                    panic!(
-                        "Failed to decode unified address from test vector: {}",
-                        tv.unified_addr
-                    );
-                }
-            }
-        }
-    }
-}
diff --git a/zcash_client_backend/src/data_api.rs b/zcash_client_backend/src/data_api.rs
index 1b3dff2a7c..3b3ab351b8 100644
--- a/zcash_client_backend/src/data_api.rs
+++ b/zcash_client_backend/src/data_api.rs
@@ -1,37 +1,1169 @@
-//! Interfaces for wallet data persistence & low-level wallet utilities.
+//! # Utilities for Zcash wallet construction
+//!
+//! This module defines a set of APIs for wallet data persistence, and provides a suite of methods
+//! based upon these APIs that can be used to implement a fully functional Zcash wallet. At
+//! present, the interfaces provided here are built primarily around the use of a source of
+//! [`CompactBlock`] data such as the Zcash Light Client Protocol as defined in
+//! [ZIP 307](https://zips.z.cash/zip-0307) but they may be generalized to full-block use cases in
+//! the future.
+//!
+//! ## Important Concepts
+//!
+//! There are several important operations that a Zcash wallet must perform that distinguish Zcash
+//! wallet design from wallets for other cryptocurrencies.
+//!
+//! * Viewing Keys: Wallets based upon this module are built around the capabilities of Zcash
+//!   [`UnifiedFullViewingKey`]s; the wallet backend provides no facilities for the storage
+//!   of spending keys, and spending keys must be provided by the caller in order to perform
+//!   transaction creation operations.
+//! * Blockchain Scanning: A Zcash wallet must download and trial-decrypt each transaction on the
+//!   Zcash blockchain using one or more Viewing Keys in order to find new shielded transaction
+//!   outputs (generally termed "notes") belonging to the wallet. The primary entrypoint for this
+//!   functionality is the [`scan_cached_blocks`] method. See the [`chain`] module for additional
+//!   details.
+//! * Witness Updates: In order to spend a shielded note, the wallet must be able to compute the
+//!   Merkle path to that note in the global note commitment tree. When [`scan_cached_blocks`] is
+//!   used to process a range of blocks, the note commitment tree is updated with the note
+//!   commitments for the blocks in that range.
+//! * Transaction Construction: The [`wallet`] module provides functions for creating Zcash
+//!   transactions that spend funds belonging to the wallet.
+//!
+//! ## Core Traits
+//!
+//! The utility functions described above depend upon four important traits defined in this
+//! module, which between them encompass the data storage requirements of a light wallet.
+//! The relevant traits are [`InputSource`], [`WalletRead`], [`WalletWrite`], and
+//! [`WalletCommitmentTrees`]. A complete implementation of the data storage layer for a wallet
+//! will include an implementation of all four of these traits. See the [`zcash_client_sqlite`]
+//! crate for a complete example of the implementation of these traits.
+//!
+//! ## Accounts
+//!
+//! The operation of the [`InputSource`], [`WalletRead`] and [`WalletWrite`] traits is built around
+//! the concept of a wallet having one or more accounts, with a unique `AccountId` for each
+//! account.
+//!
+//! An account identifier corresponds to at most a single [`UnifiedSpendingKey`]'s worth of spend
+//! authority, with the received and spent notes of that account tracked via the corresponding
+//! [`UnifiedFullViewingKey`]. Both received notes and change spendable by that spending authority
+//! (both the external and internal parts of that key, as defined by
+//! [ZIP 316](https://zips.z.cash/zip-0316)) will be interpreted as belonging to that account.
+//!
+//! [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
+//! [`scan_cached_blocks`]: crate::data_api::chain::scan_cached_blocks
+//! [`zcash_client_sqlite`]: https://crates.io/crates/zcash_client_sqlite
+//! [`TransactionRequest`]: crate::zip321::TransactionRequest
+//! [`propose_shielding`]: crate::data_api::wallet::propose_shielding
+
+use std::{
+    collections::HashMap,
+    fmt::Debug,
+    hash::Hash,
+    io,
+    num::{NonZeroU32, TryFromIntError},
+};
+
+use incrementalmerkletree::{frontier::Frontier, Retention};
+use nonempty::NonEmpty;
+use secrecy::SecretVec;
+use shardtree::{error::ShardTreeError, store::ShardStore, ShardTree};
+use zip32::fingerprint::SeedFingerprint;
+
+use self::{
+    chain::{ChainState, CommitmentTreeRoot},
+    scanning::ScanRange,
+};
+use crate::{
+    address::UnifiedAddress,
+    decrypt::DecryptedOutput,
+    keys::{
+        UnifiedAddressRequest, UnifiedFullViewingKey, UnifiedIncomingViewingKey, UnifiedSpendingKey,
+    },
+    proto::service::TreeState,
+    wallet::{Note, NoteId, ReceivedNote, Recipient, WalletTransparentOutput, WalletTx},
+    ShieldedProtocol,
+};
+use zcash_primitives::{
+    block::BlockHash,
+    consensus::BlockHeight,
+    memo::{Memo, MemoBytes},
+    transaction::{
+        components::{
+            amount::{BalanceError, NonNegativeAmount},
+            OutPoint,
+        },
+        Transaction, TxId,
+    },
+};
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    crate::wallet::TransparentAddressMetadata, std::ops::Range,
+    zcash_primitives::legacy::TransparentAddress,
+};
+
+#[cfg(feature = "test-dependencies")]
+use ambassador::delegatable_trait;
+
+#[cfg(any(test, feature = "test-dependencies"))]
+use {zcash_keys::address::Address, zcash_primitives::consensus::NetworkUpgrade};
+
+pub mod chain;
+pub mod error;
+pub mod scanning;
+pub mod wallet;
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod testing;
+
+/// The height of subtree roots in the Sapling note commitment tree.
+///
+/// This conforms to the structure of subtree data returned by
+/// `lightwalletd` when using the `GetSubtreeRoots` GRPC call.
+pub const SAPLING_SHARD_HEIGHT: u8 = sapling::NOTE_COMMITMENT_TREE_DEPTH / 2;
+
+/// The height of subtree roots in the Orchard note commitment tree.
+///
+/// This conforms to the structure of subtree data returned by
+/// `lightwalletd` when using the `GetSubtreeRoots` GRPC call.
+#[cfg(feature = "orchard")]
+pub const ORCHARD_SHARD_HEIGHT: u8 = { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 } / 2;
+
+/// The number of ephemeral addresses that can be safely reserved without observing any
+/// of them to be mined. This is the same as the gap limit in Bitcoin.
+pub const GAP_LIMIT: u32 = 20;
+
+/// An enumeration of constraints that can be applied when querying for nullifiers for notes
+/// belonging to the wallet.
+pub enum NullifierQuery {
+    Unspent,
+    All,
+}
+
+/// Balance information for a value within a single pool in an account.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Balance {
+    spendable_value: NonNegativeAmount,
+    change_pending_confirmation: NonNegativeAmount,
+    value_pending_spendability: NonNegativeAmount,
+}
+
+impl Balance {
+    /// The [`Balance`] value having zero values for all its fields.
+    pub const ZERO: Self = Self {
+        spendable_value: NonNegativeAmount::ZERO,
+        change_pending_confirmation: NonNegativeAmount::ZERO,
+        value_pending_spendability: NonNegativeAmount::ZERO,
+    };
+
+    fn check_total_adding(
+        &self,
+        value: NonNegativeAmount,
+    ) -> Result<NonNegativeAmount, BalanceError> {
+        (self.spendable_value
+            + self.change_pending_confirmation
+            + self.value_pending_spendability
+            + value)
+            .ok_or(BalanceError::Overflow)
+    }
+
+    /// Returns the value in the account that may currently be spent; it is possible to compute
+    /// witnesses for all the notes that comprise this value, and all of this value is confirmed to
+    /// the required confirmation depth.
+    pub fn spendable_value(&self) -> NonNegativeAmount {
+        self.spendable_value
+    }
+
+    /// Adds the specified value to the spendable total, checking for overflow.
+    pub fn add_spendable_value(&mut self, value: NonNegativeAmount) -> Result<(), BalanceError> {
+        self.check_total_adding(value)?;
+        self.spendable_value = (self.spendable_value + value).unwrap();
+        Ok(())
+    }
+
+    /// Returns the value in the account of shielded change notes that do not yet have sufficient
+    /// confirmations to be spendable.
+    pub fn change_pending_confirmation(&self) -> NonNegativeAmount {
+        self.change_pending_confirmation
+    }
+
+    /// Adds the specified value to the pending change total, checking for overflow.
+    pub fn add_pending_change_value(
+        &mut self,
+        value: NonNegativeAmount,
+    ) -> Result<(), BalanceError> {
+        self.check_total_adding(value)?;
+        self.change_pending_confirmation = (self.change_pending_confirmation + value).unwrap();
+        Ok(())
+    }
+
+    /// Returns the value in the account of all remaining received notes that either do not have
+    /// sufficient confirmations to be spendable, or for which witnesses cannot yet be constructed
+    /// without additional scanning.
+    pub fn value_pending_spendability(&self) -> NonNegativeAmount {
+        self.value_pending_spendability
+    }
+
+    /// Adds the specified value to the pending spendable total, checking for overflow.
+    pub fn add_pending_spendable_value(
+        &mut self,
+        value: NonNegativeAmount,
+    ) -> Result<(), BalanceError> {
+        self.check_total_adding(value)?;
+        self.value_pending_spendability = (self.value_pending_spendability + value).unwrap();
+        Ok(())
+    }
+
+    /// Returns the total value of funds represented by this [`Balance`].
+    pub fn total(&self) -> NonNegativeAmount {
+        (self.spendable_value + self.change_pending_confirmation + self.value_pending_spendability)
+            .expect("Balance cannot overflow MAX_MONEY")
+    }
+}
+
+/// Balance information for a single account. The sum of this struct's fields is the total balance
+/// of the wallet.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AccountBalance {
+    /// The value of unspent Sapling outputs belonging to the account.
+    sapling_balance: Balance,
+
+    /// The value of unspent Orchard outputs belonging to the account.
+    orchard_balance: Balance,
+
+    /// The value of all unspent transparent outputs belonging to the account, irrespective of
+    /// confirmation depth.
+    ///
+    /// Unshielded balances are not subject to confirmation-depth constraints, because the only
+    /// possible operation on a transparent balance is to shield it, it is possible to create a
+    /// zero-conf transaction to perform that shielding, and the resulting shielded notes will be
+    /// subject to normal confirmation rules.
+    unshielded: NonNegativeAmount,
+}
+
+impl AccountBalance {
+    /// The [`Balance`] value having zero values for all its fields.
+    pub const ZERO: Self = Self {
+        sapling_balance: Balance::ZERO,
+        orchard_balance: Balance::ZERO,
+        unshielded: NonNegativeAmount::ZERO,
+    };
+
+    fn check_total(&self) -> Result<NonNegativeAmount, BalanceError> {
+        (self.sapling_balance.total() + self.orchard_balance.total() + self.unshielded)
+            .ok_or(BalanceError::Overflow)
+    }
+
+    /// Returns the [`Balance`] of Sapling funds in the account.
+    pub fn sapling_balance(&self) -> &Balance {
+        &self.sapling_balance
+    }
+
+    /// Provides a `mutable reference to the [`Balance`] of Sapling funds in the account
+    /// to the specified callback, checking invariants after the callback's action has been
+    /// evaluated.
+    pub fn with_sapling_balance_mut<A, E: From<BalanceError>>(
+        &mut self,
+        f: impl FnOnce(&mut Balance) -> Result<A, E>,
+    ) -> Result<A, E> {
+        let result = f(&mut self.sapling_balance)?;
+        self.check_total()?;
+        Ok(result)
+    }
+
+    /// Returns the [`Balance`] of Orchard funds in the account.
+    pub fn orchard_balance(&self) -> &Balance {
+        &self.orchard_balance
+    }
+
+    /// Provides a `mutable reference to the [`Balance`] of Orchard funds in the account
+    /// to the specified callback, checking invariants after the callback's action has been
+    /// evaluated.
+    pub fn with_orchard_balance_mut<A, E: From<BalanceError>>(
+        &mut self,
+        f: impl FnOnce(&mut Balance) -> Result<A, E>,
+    ) -> Result<A, E> {
+        let result = f(&mut self.orchard_balance)?;
+        self.check_total()?;
+        Ok(result)
+    }
+
+    /// Returns the total value of unspent transparent transaction outputs belonging to the wallet.
+    pub fn unshielded(&self) -> NonNegativeAmount {
+        self.unshielded
+    }
+
+    /// Adds the specified value to the unshielded total, checking for overflow of
+    /// the total account balance.
+    pub fn add_unshielded_value(&mut self, value: NonNegativeAmount) -> Result<(), BalanceError> {
+        self.unshielded = (self.unshielded + value).ok_or(BalanceError::Overflow)?;
+        self.check_total()?;
+        Ok(())
+    }
+
+    /// Returns the total value of funds belonging to the account.
+    pub fn total(&self) -> NonNegativeAmount {
+        (self.sapling_balance.total() + self.orchard_balance.total() + self.unshielded)
+            .expect("Account balance cannot overflow MAX_MONEY")
+    }
+
+    /// Returns the total value of shielded (Sapling and Orchard) funds that may immediately be
+    /// spent.
+    pub fn spendable_value(&self) -> NonNegativeAmount {
+        (self.sapling_balance.spendable_value + self.orchard_balance.spendable_value)
+            .expect("Account balance cannot overflow MAX_MONEY")
+    }
+
+    /// Returns the total value of change and/or shielding transaction outputs that are awaiting
+    /// sufficient confirmations for spendability.
+    pub fn change_pending_confirmation(&self) -> NonNegativeAmount {
+        (self.sapling_balance.change_pending_confirmation
+            + self.orchard_balance.change_pending_confirmation)
+            .expect("Account balance cannot overflow MAX_MONEY")
+    }
+
+    /// Returns the value of shielded funds that are not yet spendable because additional scanning
+    /// is required before it will be possible to derive witnesses for the associated notes.
+    pub fn value_pending_spendability(&self) -> NonNegativeAmount {
+        (self.sapling_balance.value_pending_spendability
+            + self.orchard_balance.value_pending_spendability)
+            .expect("Account balance cannot overflow MAX_MONEY")
+    }
+}
+
+/// Source metadata for a ZIP 32-derived key.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub struct Zip32Derivation {
+    seed_fingerprint: SeedFingerprint,
+    account_index: zip32::AccountId,
+}
+
+impl Zip32Derivation {
+    /// Constructs new derivation metadata from its constituent parts.
+    pub fn new(seed_fingerprint: SeedFingerprint, account_index: zip32::AccountId) -> Self {
+        Self {
+            seed_fingerprint,
+            account_index,
+        }
+    }
+
+    /// Returns the seed fingerprint.
+    pub fn seed_fingerprint(&self) -> &SeedFingerprint {
+        &self.seed_fingerprint
+    }
+
+    /// Returns the account-level index in the ZIP 32 derivation path.
+    pub fn account_index(&self) -> zip32::AccountId {
+        self.account_index
+    }
+}
+
+/// An enumeration used to control what information is tracked by the wallet for
+/// notes received by a given account.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub enum AccountPurpose {
+    /// For spending accounts, the wallet will track information needed to spend
+    /// received notes.
+    Spending { derivation: Option<Zip32Derivation> },
+    /// For view-only accounts, the wallet will not track spend information.
+    ViewOnly,
+}
+
+/// The kinds of accounts supported by `zcash_client_backend`.
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
+pub enum AccountSource {
+    /// An account derived from a known seed.
+    Derived {
+        derivation: Zip32Derivation,
+        key_source: Option<String>,
+    },
+
+    /// An account imported from a viewing key.
+    Imported {
+        purpose: AccountPurpose,
+        key_source: Option<String>,
+    },
+}
+
+impl AccountSource {
+    /// Returns the key derivation metadata for the account source, if any is available.
+    pub fn key_derivation(&self) -> Option<&Zip32Derivation> {
+        match self {
+            AccountSource::Derived { derivation, .. } => Some(derivation),
+            AccountSource::Imported {
+                purpose: AccountPurpose::Spending { derivation },
+                ..
+            } => derivation.as_ref(),
+            _ => None,
+        }
+    }
+
+    /// Returns the application-level key source identifier.
+    pub fn key_source(&self) -> Option<&str> {
+        match self {
+            AccountSource::Derived { key_source, .. } => key_source.as_ref().map(|s| s.as_str()),
+            AccountSource::Imported { key_source, .. } => key_source.as_ref().map(|s| s.as_str()),
+        }
+    }
+}
+
+/// A set of capabilities that a client account must provide.
+pub trait Account {
+    type AccountId: Copy;
+
+    /// Returns the unique identifier for the account.
+    fn id(&self) -> Self::AccountId;
+
+    /// Returns the human-readable name for the account, if any has been configured.
+    fn name(&self) -> Option<&str>;
+
+    /// Returns whether this account is derived or imported, and the derivation parameters
+    /// if applicable.
+    fn source(&self) -> &AccountSource;
+
+    /// Returns whether the account is a spending account or a view-only account.
+    fn purpose(&self) -> AccountPurpose {
+        match self.source() {
+            AccountSource::Derived { derivation, .. } => AccountPurpose::Spending {
+                derivation: Some(derivation.clone()),
+            },
+            AccountSource::Imported { purpose, .. } => purpose.clone(),
+        }
+    }
+
+    /// Returns the UFVK that the wallet backend has stored for the account, if any.
+    ///
+    /// Accounts for which this returns `None` cannot be used in wallet contexts, because
+    /// they are unable to maintain an accurate balance.
+    fn ufvk(&self) -> Option<&UnifiedFullViewingKey>;
+
+    /// Returns the UIVK that the wallet backend has stored for the account.
+    ///
+    /// All accounts are required to have at least an incoming viewing key. This gives no
+    /// indication about whether an account can be used in a wallet context; for that, use
+    /// [`Account::ufvk`].
+    fn uivk(&self) -> UnifiedIncomingViewingKey;
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+impl<A: Copy> Account for (A, UnifiedFullViewingKey) {
+    type AccountId = A;
+
+    fn id(&self) -> A {
+        self.0
+    }
+
+    fn source(&self) -> &AccountSource {
+        &AccountSource::Imported {
+            purpose: AccountPurpose::ViewOnly,
+            key_source: None,
+        }
+    }
+
+    fn ufvk(&self) -> Option<&UnifiedFullViewingKey> {
+        Some(&self.1)
+    }
+
+    fn uivk(&self) -> UnifiedIncomingViewingKey {
+        self.1.to_unified_incoming_viewing_key()
+    }
+
+    fn name(&self) -> Option<&str> {
+        None
+    }
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+impl<A: Copy> Account for (A, UnifiedIncomingViewingKey) {
+    type AccountId = A;
+
+    fn id(&self) -> A {
+        self.0
+    }
+
+    fn name(&self) -> Option<&str> {
+        None
+    }
+
+    fn source(&self) -> &AccountSource {
+        &AccountSource::Imported {
+            purpose: AccountPurpose::ViewOnly,
+            key_source: None,
+        }
+    }
+
+    fn ufvk(&self) -> Option<&UnifiedFullViewingKey> {
+        None
+    }
+
+    fn uivk(&self) -> UnifiedIncomingViewingKey {
+        self.1.clone()
+    }
+}
+
+/// A polymorphic ratio type, usually used for rational numbers.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Ratio<T> {
+    numerator: T,
+    denominator: T,
+}
+
+impl<T> Ratio<T> {
+    /// Constructs a new Ratio from a numerator and a denominator.
+    pub fn new(numerator: T, denominator: T) -> Self {
+        Self {
+            numerator,
+            denominator,
+        }
+    }
+
+    /// Returns the numerator of the ratio.
+    pub fn numerator(&self) -> &T {
+        &self.numerator
+    }
+
+    /// Returns the denominator of the ratio.
+    pub fn denominator(&self) -> &T {
+        &self.denominator
+    }
+}
+
+/// A type representing the progress the wallet has made toward detecting all of the funds
+/// belonging to the wallet.
+///
+/// The window over which progress is computed spans from the wallet's birthday to the current
+/// chain tip. It is divided into two regions, the "Scan Window" which covers the region from the
+/// wallet recovery height to the current chain tip, and the "Recovery Window" which covers the
+/// range from the wallet birthday to the wallet recovery height. If no wallet recovery height is
+/// available, the scan window will cover the entire range from the wallet birthday to the chain
+/// tip.
+///
+/// Progress for both scanning and recovery is represented in terms of the ratio between notes
+/// scanned and the total number of notes added to the chain in the relevant window. This ratio
+/// should only be used to compute progress percentages for display, and the numerator and
+/// denominator should not be treated as authoritative note counts. In the case that there are no
+/// notes in a given block range, the denominator of these values will be zero, so callers should always
+/// use checked division when converting the resulting values to percentages.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Progress {
+    scan: Ratio<u64>,
+    recovery: Option<Ratio<u64>>,
+}
+
+impl Progress {
+    /// Constructs a new progress value from its constituent parts.
+    pub fn new(scan: Ratio<u64>, recovery: Option<Ratio<u64>>) -> Self {
+        Self { scan, recovery }
+    }
+
+    /// Returns the progress the wallet has made in scanning blocks for shielded notes belonging to
+    /// the wallet between the wallet recovery height (or the wallet birthday if no recovery height
+    /// is set) and the chain tip.
+    pub fn scan(&self) -> Ratio<u64> {
+        self.scan
+    }
+
+    /// Returns the progress the wallet has made in scanning blocks for shielded notes belonging to
+    /// the wallet between the wallet birthday and the block height at which recovery from seed was
+    /// initiated.
+    ///
+    /// Returns `None` if no recovery height is set for the wallet.
+    pub fn recovery(&self) -> Option<Ratio<u64>> {
+        self.recovery
+    }
+}
+
+/// A type representing the potentially-spendable value of unspent outputs in the wallet.
+///
+/// The balances reported using this data structure may overestimate the total spendable value of
+/// the wallet, in the case that the spend of a previously received shielded note has not yet been
+/// detected by the process of scanning the chain. The balances reported using this data structure
+/// can only be certain to be unspent in the case that [`Self::is_synced`] is true, and even in
+/// this circumstance it is possible that a newly created transaction could conflict with a
+/// not-yet-mined transaction in the mempool.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct WalletSummary<AccountId: Eq + Hash> {
+    account_balances: HashMap<AccountId, AccountBalance>,
+    chain_tip_height: BlockHeight,
+    fully_scanned_height: BlockHeight,
+    progress: Progress,
+    next_sapling_subtree_index: u64,
+    #[cfg(feature = "orchard")]
+    next_orchard_subtree_index: u64,
+}
+
+impl<AccountId: Eq + Hash> WalletSummary<AccountId> {
+    /// Constructs a new [`WalletSummary`] from its constituent parts.
+    pub fn new(
+        account_balances: HashMap<AccountId, AccountBalance>,
+        chain_tip_height: BlockHeight,
+        fully_scanned_height: BlockHeight,
+        progress: Progress,
+        next_sapling_subtree_index: u64,
+        #[cfg(feature = "orchard")] next_orchard_subtree_index: u64,
+    ) -> Self {
+        Self {
+            account_balances,
+            chain_tip_height,
+            fully_scanned_height,
+            progress,
+            next_sapling_subtree_index,
+            #[cfg(feature = "orchard")]
+            next_orchard_subtree_index,
+        }
+    }
+
+    /// Returns the balances of accounts in the wallet, keyed by account ID.
+    pub fn account_balances(&self) -> &HashMap<AccountId, AccountBalance> {
+        &self.account_balances
+    }
+
+    /// Returns the height of the current chain tip.
+    pub fn chain_tip_height(&self) -> BlockHeight {
+        self.chain_tip_height
+    }
+
+    /// Returns the height below which all blocks have been scanned by the wallet, ignoring blocks
+    /// below the wallet birthday.
+    pub fn fully_scanned_height(&self) -> BlockHeight {
+        self.fully_scanned_height
+    }
+
+    /// Returns the progress of scanning the chain to bring the wallet up to date.
+    ///
+    /// This progress metric is intended as an indicator of how close the wallet is to
+    /// general usability, including the ability to spend existing funds that were
+    /// previously spendable.
+    ///
+    /// The window over which progress is computed spans from the wallet's birthday to the current
+    /// chain tip. It is divided into two segments: a "recovery" segment, between the wallet
+    /// birthday and the recovery height (currently the height at which recovery from seed was
+    /// initiated, but how this boundary is computed may change in the future), and a "scan"
+    /// segment, between the recovery height and the current chain tip.
+    ///
+    /// When converting the ratios returned here to percentages, checked division must be used in
+    /// order to avoid divide-by-zero errors. A zero denominator in a returned ratio indicates that
+    /// there are no shielded notes to be scanned in the associated block range.
+    pub fn progress(&self) -> Progress {
+        self.progress
+    }
+
+    /// Returns the Sapling subtree index that should start the next range of subtree
+    /// roots passed to [`WalletCommitmentTrees::put_sapling_subtree_roots`].
+    pub fn next_sapling_subtree_index(&self) -> u64 {
+        self.next_sapling_subtree_index
+    }
+
+    /// Returns the Orchard subtree index that should start the next range of subtree
+    /// roots passed to [`WalletCommitmentTrees::put_orchard_subtree_roots`].
+    #[cfg(feature = "orchard")]
+    pub fn next_orchard_subtree_index(&self) -> u64 {
+        self.next_orchard_subtree_index
+    }
+
+    /// Returns whether or not wallet scanning is complete.
+    pub fn is_synced(&self) -> bool {
+        self.chain_tip_height == self.fully_scanned_height
+    }
+}
+
+/// A predicate that can be used to choose whether or not a particular note is retained in note
+/// selection.
+pub trait NoteRetention<NoteRef> {
+    /// Returns whether the specified Sapling note should be retained.
+    fn should_retain_sapling(&self, note: &ReceivedNote<NoteRef, sapling::Note>) -> bool;
+    /// Returns whether the specified Orchard note should be retained.
+    #[cfg(feature = "orchard")]
+    fn should_retain_orchard(&self, note: &ReceivedNote<NoteRef, orchard::note::Note>) -> bool;
+}
+
+pub(crate) struct SimpleNoteRetention {
+    pub(crate) sapling: bool,
+    #[cfg(feature = "orchard")]
+    pub(crate) orchard: bool,
+}
+
+impl<NoteRef> NoteRetention<NoteRef> for SimpleNoteRetention {
+    fn should_retain_sapling(&self, _: &ReceivedNote<NoteRef, sapling::Note>) -> bool {
+        self.sapling
+    }
+
+    #[cfg(feature = "orchard")]
+    fn should_retain_orchard(&self, _: &ReceivedNote<NoteRef, orchard::note::Note>) -> bool {
+        self.orchard
+    }
+}
+
+/// Spendable shielded outputs controlled by the wallet.
+pub struct SpendableNotes<NoteRef> {
+    sapling: Vec<ReceivedNote<NoteRef, sapling::Note>>,
+    #[cfg(feature = "orchard")]
+    orchard: Vec<ReceivedNote<NoteRef, orchard::note::Note>>,
+}
+
+/// A request for transaction data enhancement, spentness check, or discovery
+/// of spends from a given transparent address within a specific block range.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum TransactionDataRequest {
+    /// Information about the chain's view of a transaction is requested.
+    ///
+    /// The caller evaluating this request on behalf of the wallet backend should respond to this
+    /// request by determining the status of the specified transaction with respect to the main
+    /// chain; if using `lightwalletd` for access to chain data, this may be obtained by
+    /// interpreting the results of the [`GetTransaction`] RPC method. It should then call
+    /// [`WalletWrite::set_transaction_status`] to provide the resulting transaction status
+    /// information to the wallet backend.
+    ///
+    /// [`GetTransaction`]: crate::proto::service::compact_tx_streamer_client::CompactTxStreamerClient::get_transaction
+    GetStatus(TxId),
+    /// Transaction enhancement (download of complete raw transaction data) is requested.
+    ///
+    /// The caller evaluating this request on behalf of the wallet backend should respond to this
+    /// request by providing complete data for the specified transaction to
+    /// [`wallet::decrypt_and_store_transaction`]; if using `lightwalletd` for access to chain
+    /// state, this may be obtained via the [`GetTransaction`] RPC method. If no data is available
+    /// for the specified transaction, this should be reported to the backend using
+    /// [`WalletWrite::set_transaction_status`]. A [`TransactionDataRequest::Enhancement`] request
+    /// subsumes any previously existing [`TransactionDataRequest::GetStatus`] request.
+    ///
+    /// [`GetTransaction`]: crate::proto::service::compact_tx_streamer_client::CompactTxStreamerClient::get_transaction
+    Enhancement(TxId),
+    /// Information about transactions that receive or spend funds belonging to the specified
+    /// transparent address is requested.
+    ///
+    /// Fully transparent transactions, and transactions that do not contain either shielded inputs
+    /// or shielded outputs belonging to the wallet, may not be discovered by the process of chain
+    /// scanning; as a consequence, the wallet must actively query to find transactions that spend
+    /// such funds. Ideally we'd be able to query by [`OutPoint`] but this is not currently
+    /// functionality that is supported by the light wallet server.
+    ///
+    /// The caller evaluating this request on behalf of the wallet backend should respond to this
+    /// request by detecting transactions involving the specified address within the provided block
+    /// range; if using `lightwalletd` for access to chain data, this may be performed using the
+    /// [`GetTaddressTxids`] RPC method. It should then call [`wallet::decrypt_and_store_transaction`]
+    /// for each transaction so detected.
+    ///
+    /// [`GetTaddressTxids`]: crate::proto::service::compact_tx_streamer_client::CompactTxStreamerClient::get_taddress_txids
+    #[cfg(feature = "transparent-inputs")]
+    SpendsFromAddress {
+        address: TransparentAddress,
+        block_range_start: BlockHeight,
+        block_range_end: Option<BlockHeight>,
+    },
+}
+
+/// Metadata about the status of a transaction obtained by inspecting the chain state.
+#[derive(Clone, Copy, Debug)]
+pub enum TransactionStatus {
+    /// The requested transaction ID was not recognized by the node.
+    TxidNotRecognized,
+    /// The requested transaction ID corresponds to a transaction that is recognized by the node,
+    /// but is in the mempool or is otherwise not mined in the main chain (but may have been mined
+    /// on a fork that was reorged away).
+    NotInMainChain,
+    /// The requested transaction ID corresponds to a transaction that has been included in the
+    /// block at the provided height.
+    Mined(BlockHeight),
+}
+
+impl<NoteRef> SpendableNotes<NoteRef> {
+    /// Construct a new empty [`SpendableNotes`].
+    pub fn empty() -> Self {
+        Self::new(
+            vec![],
+            #[cfg(feature = "orchard")]
+            vec![],
+        )
+    }
+
+    /// Construct a new [`SpendableNotes`] from its constituent parts.
+    pub fn new(
+        sapling: Vec<ReceivedNote<NoteRef, sapling::Note>>,
+        #[cfg(feature = "orchard")] orchard: Vec<ReceivedNote<NoteRef, orchard::note::Note>>,
+    ) -> Self {
+        Self {
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        }
+    }
+
+    /// Returns the set of spendable Sapling notes.
+    pub fn sapling(&self) -> &[ReceivedNote<NoteRef, sapling::Note>] {
+        self.sapling.as_ref()
+    }
+
+    /// Consumes this value and returns the Sapling notes contained within it.
+    pub fn take_sapling(self) -> Vec<ReceivedNote<NoteRef, sapling::Note>> {
+        self.sapling
+    }
+
+    /// Returns the set of spendable Orchard notes.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> &[ReceivedNote<NoteRef, orchard::note::Note>] {
+        self.orchard.as_ref()
+    }
+
+    /// Consumes this value and returns the Orchard notes contained within it.
+    #[cfg(feature = "orchard")]
+    pub fn take_orchard(self) -> Vec<ReceivedNote<NoteRef, orchard::note::Note>> {
+        self.orchard
+    }
+
+    /// Computes the total value of Sapling notes.
+    pub fn sapling_value(&self) -> Result<NonNegativeAmount, BalanceError> {
+        self.sapling
+            .iter()
+            .try_fold(NonNegativeAmount::ZERO, |acc, n| {
+                (acc + n.note_value()?).ok_or(BalanceError::Overflow)
+            })
+    }
+
+    /// Computes the total value of Sapling notes.
+    #[cfg(feature = "orchard")]
+    pub fn orchard_value(&self) -> Result<NonNegativeAmount, BalanceError> {
+        self.orchard
+            .iter()
+            .try_fold(NonNegativeAmount::ZERO, |acc, n| {
+                (acc + n.note_value()?).ok_or(BalanceError::Overflow)
+            })
+    }
+
+    /// Computes the total value of spendable inputs
+    pub fn total_value(&self) -> Result<NonNegativeAmount, BalanceError> {
+        #[cfg(not(feature = "orchard"))]
+        return self.sapling_value();
+
+        #[cfg(feature = "orchard")]
+        return (self.sapling_value()? + self.orchard_value()?).ok_or(BalanceError::Overflow);
+    }
+
+    /// Consumes this [`SpendableNotes`] value and produces a vector of
+    /// [`ReceivedNote<NoteRef, Note>`] values.
+    pub fn into_vec(
+        self,
+        retention: &impl NoteRetention<NoteRef>,
+    ) -> Vec<ReceivedNote<NoteRef, Note>> {
+        let iter = self.sapling.into_iter().filter_map(|n| {
+            retention
+                .should_retain_sapling(&n)
+                .then(|| n.map_note(Note::Sapling))
+        });
+
+        #[cfg(feature = "orchard")]
+        let iter = iter.chain(self.orchard.into_iter().filter_map(|n| {
+            retention
+                .should_retain_orchard(&n)
+                .then(|| n.map_note(Note::Orchard))
+        }));
+
+        iter.collect()
+    }
+}
+
+/// Metadata about the structure of unspent outputs in a single pool within a wallet account.
+///
+/// This type is often used to represent a filtered view of outputs in the account that were
+/// selected according to the conditions imposed by a [`NoteFilter`].
+#[derive(Debug, Clone)]
+pub struct PoolMeta {
+    note_count: usize,
+    value: NonNegativeAmount,
+}
+
+impl PoolMeta {
+    /// Constructs a new [`PoolMeta`] value from its constituent parts.
+    pub fn new(note_count: usize, value: NonNegativeAmount) -> Self {
+        Self { note_count, value }
+    }
+
+    /// Returns the number of unspent outputs in the account, potentially selected in accordance
+    /// with some [`NoteFilter`].
+    pub fn note_count(&self) -> usize {
+        self.note_count
+    }
+
+    /// Returns the total value of unspent outputs in the account that are accounted for in
+    /// [`Self::note_count`].
+    pub fn value(&self) -> NonNegativeAmount {
+        self.value
+    }
+}
+
+/// Metadata about the structure of the wallet for a particular account.
+///
+/// At present this just contains counts of unspent outputs in each pool, but it may be extended in
+/// the future to contain note values or other more detailed information about wallet structure.
+///
+/// Values of this type are intended to be used in selection of change output values. A value of
+/// this type may represent filtered data, and may therefore not count all of the unspent notes in
+/// the wallet.
+///
+/// A [`AccountMeta`] value is normally produced by querying the wallet database via passing a
+/// [`NoteFilter`] to [`InputSource::get_account_metadata`].
+#[derive(Debug, Clone)]
+pub struct AccountMeta {
+    sapling: Option<PoolMeta>,
+    orchard: Option<PoolMeta>,
+}
+
+impl AccountMeta {
+    /// Constructs a new [`AccountMeta`] value from its constituent parts.
+    pub fn new(sapling: Option<PoolMeta>, orchard: Option<PoolMeta>) -> Self {
+        Self { sapling, orchard }
+    }
+
+    /// Returns metadata about Sapling notes belonging to the account for which this was generated.
+    ///
+    /// Returns [`None`] if no metadata is available or it was not possible to evaluate the query
+    /// described by a [`NoteFilter`] given the available wallet data.
+    pub fn sapling(&self) -> Option<&PoolMeta> {
+        self.sapling.as_ref()
+    }
+
+    /// Returns metadata about Orchard notes belonging to the account for which this was generated.
+    ///
+    /// Returns [`None`] if no metadata is available or it was not possible to evaluate the query
+    /// described by a [`NoteFilter`] given the available wallet data.
+    pub fn orchard(&self) -> Option<&PoolMeta> {
+        self.orchard.as_ref()
+    }
+
+    fn sapling_note_count(&self) -> Option<usize> {
+        self.sapling.as_ref().map(|m| m.note_count)
+    }
+
+    fn orchard_note_count(&self) -> Option<usize> {
+        self.orchard.as_ref().map(|m| m.note_count)
+    }
+
+    /// Returns the number of unspent notes in the wallet for the given shielded protocol.
+    pub fn note_count(&self, protocol: ShieldedProtocol) -> Option<usize> {
+        match protocol {
+            ShieldedProtocol::Sapling => self.sapling_note_count(),
+            ShieldedProtocol::Orchard => self.orchard_note_count(),
+        }
+    }
+
+    /// Returns the total number of unspent shielded notes belonging to the account for which this
+    /// was generated.
+    ///
+    /// Returns [`None`] if no metadata is available or it was not possible to evaluate the query
+    /// described by a [`NoteFilter`] given the available wallet data. If metadata is available
+    /// only for a single pool, the metadata for that pool will be returned.
+    pub fn total_note_count(&self) -> Option<usize> {
+        let s = self.sapling_note_count();
+        let o = self.orchard_note_count();
+        s.zip(o).map(|(s, o)| s + o).or(s).or(o)
+    }
+
+    fn sapling_value(&self) -> Option<NonNegativeAmount> {
+        self.sapling.as_ref().map(|m| m.value)
+    }
+
+    fn orchard_value(&self) -> Option<NonNegativeAmount> {
+        self.orchard.as_ref().map(|m| m.value)
+    }
+
+    /// Returns the total value of shielded notes represented by [`Self::total_note_count`]
+    ///
+    /// Returns [`None`] if no metadata is available or it was not possible to evaluate the query
+    /// described by a [`NoteFilter`] given the available wallet data. If metadata is available
+    /// only for a single pool, the metadata for that pool will be returned.
+    pub fn total_value(&self) -> Option<NonNegativeAmount> {
+        let s = self.sapling_value();
+        let o = self.orchard_value();
+        s.zip(o)
+            .map(|(s, o)| (s + o).expect("Does not overflow Zcash maximum value."))
+            .or(s)
+            .or(o)
+    }
+}
 
-use std::cmp;
-use std::collections::HashMap;
-use std::fmt::Debug;
+/// A `u8` value in the range 0..=MAX
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct BoundedU8<const MAX: u8>(u8);
 
-use secrecy::SecretVec;
-use zcash_primitives::{
-    block::BlockHash,
-    consensus::BlockHeight,
-    legacy::TransparentAddress,
-    memo::{Memo, MemoBytes},
-    sapling,
-    transaction::{
-        components::{amount::Amount, OutPoint},
-        Transaction, TxId,
+impl<const MAX: u8> BoundedU8<MAX> {
+    /// Creates a constant `BoundedU8` from a [`u8`] value.
+    ///
+    /// Panics: if the value is outside the range `0..=MAX`.
+    pub const fn new_const(value: u8) -> Self {
+        assert!(value <= MAX);
+        Self(value)
+    }
+
+    /// Creates a `BoundedU8` from a [`u8`] value.
+    ///
+    /// Returns `None` if the provided value is outside the range `0..=MAX`.
+    pub fn new(value: u8) -> Option<Self> {
+        if value <= MAX {
+            Some(Self(value))
+        } else {
+            None
+        }
+    }
+
+    /// Returns the wrapped [`u8`] value.
+    pub fn value(&self) -> u8 {
+        self.0
+    }
+}
+
+impl<const MAX: u8> From<BoundedU8<MAX>> for u8 {
+    fn from(value: BoundedU8<MAX>) -> Self {
+        value.0
+    }
+}
+
+impl<const MAX: u8> From<BoundedU8<MAX>> for usize {
+    fn from(value: BoundedU8<MAX>) -> Self {
+        usize::from(value.0)
+    }
+}
+
+/// A small query language for filtering notes belonging to an account.
+///
+/// A filter described using this language is applied to notes individually. It is primarily
+/// intended for retrieval of account metadata in service of making determinations for how to
+/// allocate change notes, and is not currently intended for use in broader note selection
+/// contexts.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum NoteFilter {
+    /// Selects notes having value greater than or equal to the provided value.
+    ExceedsMinValue(NonNegativeAmount),
+    /// Selects notes having value greater than or equal to approximately the n'th percentile of
+    /// previously sent notes in the account, irrespective of pool. The wrapped value must be in
+    /// the range `1..=99`. The value `n` is respected in a best-effort fashion; results are likely
+    /// to be inaccurate if the account has not yet completed scanning or if insufficient send data
+    /// is available to establish a distribution.
+    // TODO: it might be worthwhile to add an optional parameter here that can be used to ignore
+    // low-valued (test/memo-only) sends when constructing the distribution to be drawn from.
+    ExceedsPriorSendPercentile(BoundedU8<99>),
+    /// Selects notes having value greater than or equal to the specified percentage of the account
+    /// balance across all shielded pools. The wrapped value must be in the range `1..=99`
+    ExceedsBalancePercentage(BoundedU8<99>),
+    /// A note will be selected if it satisfies both of the specified conditions.
+    ///
+    /// If it is not possible to evaluate one of the conditions (for example,
+    /// [`NoteFilter::ExceedsPriorSendPercentile`] cannot be evaluated if no sends have been
+    /// performed) then that condition will be ignored. If neither condition can be evaluated,
+    /// then the entire condition cannot be evaluated.
+    Combine(Box<NoteFilter>, Box<NoteFilter>),
+    /// A note will be selected if it satisfies the first condition; if it is not possible to
+    /// evaluate that condition (for example, [`NoteFilter::ExceedsPriorSendPercentile`] cannot
+    /// be evaluated if no sends have been performed) then the second condition will be used for
+    /// evaluation.
+    Attempt {
+        condition: Box<NoteFilter>,
+        fallback: Box<NoteFilter>,
     },
-    zip32::{AccountId, ExtendedFullViewingKey},
-};
+}
 
-use crate::{
-    address::{AddressMetadata, UnifiedAddress},
-    decrypt::DecryptedOutput,
-    keys::{UnifiedFullViewingKey, UnifiedSpendingKey},
-    wallet::{ReceivedSaplingNote, WalletTransparentOutput, WalletTx},
-};
+impl NoteFilter {
+    /// Constructs a [`NoteFilter::Combine`] query node.
+    pub fn combine(l: NoteFilter, r: NoteFilter) -> Self {
+        Self::Combine(Box::new(l), Box::new(r))
+    }
 
-pub mod chain;
-pub mod error;
-pub mod wallet;
+    /// Constructs a [`NoteFilter::Attempt`] query node.
+    pub fn attempt(condition: NoteFilter, fallback: NoteFilter) -> Self {
+        Self::Attempt {
+            condition: Box::new(condition),
+            fallback: Box::new(fallback),
+        }
+    }
+}
 
-pub enum NullifierQuery {
-    Unspent,
-    All,
+/// A trait representing the capability to query a data store for unspent transaction outputs
+/// belonging to a account.
+#[cfg_attr(feature = "test-dependencies", delegatable_trait)]
+pub trait InputSource {
+    /// The type of errors produced by a wallet backend.
+    type Error: Debug;
+
+    /// Backend-specific account identifier.
+    ///
+    /// An account identifier corresponds to at most a single unified spending key's worth of spend
+    /// authority, such that both received notes and change spendable by that spending authority
+    /// will be interpreted as belonging to that account. This might be a database identifier type
+    /// or a UUID.
+    type AccountId: Copy + Debug + Eq + Hash;
+
+    /// Backend-specific note identifier.
+    ///
+    /// For example, this might be a database identifier type or a UUID.
+    type NoteRef: Copy + Debug + Eq + Ord;
+
+    /// Fetches a spendable note by indexing into a transaction's shielded outputs for the
+    /// specified shielded protocol.
+    ///
+    /// Returns `Ok(None)` if the note is not known to belong to the wallet or if the note
+    /// is not spendable.
+    fn get_spendable_note(
+        &self,
+        txid: &TxId,
+        protocol: ShieldedProtocol,
+        index: u32,
+    ) -> Result<Option<ReceivedNote<Self::NoteRef, Note>>, Self::Error>;
+
+    /// Returns a list of spendable notes sufficient to cover the specified target value, if
+    /// possible. Only spendable notes corresponding to the specified shielded protocol will
+    /// be included.
+    fn select_spendable_notes(
+        &self,
+        account: Self::AccountId,
+        target_value: NonNegativeAmount,
+        sources: &[ShieldedProtocol],
+        anchor_height: BlockHeight,
+        exclude: &[Self::NoteRef],
+    ) -> Result<SpendableNotes<Self::NoteRef>, Self::Error>;
+
+    /// Returns metadata describing the structure of the wallet for the specified account.
+    ///
+    /// The returned metadata value must exclude:
+    /// - spent notes;
+    /// - unspent notes excluded by the provided selector;
+    /// - unspent notes identified in the given `exclude` list.
+    ///
+    /// Implementations of this method may limit the complexity of supported queries. Such
+    /// limitations should be clearly documented for the implementing type.
+    fn get_account_metadata(
+        &self,
+        account: Self::AccountId,
+        selector: &NoteFilter,
+        exclude: &[Self::NoteRef],
+    ) -> Result<AccountMeta, Self::Error>;
+
+    /// Fetches the transparent output corresponding to the provided `outpoint`.
+    ///
+    /// Returns `Ok(None)` if the UTXO is not known to belong to the wallet or is not
+    /// spendable as of the chain tip height.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_unspent_transparent_output(
+        &self,
+        _outpoint: &OutPoint,
+    ) -> Result<Option<WalletTransparentOutput>, Self::Error> {
+        Ok(None)
+    }
+
+    /// Returns the list of spendable transparent outputs received by this wallet at `address`
+    /// such that, at height `target_height`:
+    /// * the transaction that produced the output had or will have at least `min_confirmations`
+    ///   confirmations; and
+    /// * the output is unspent as of the current chain tip.
+    ///
+    /// An output that is potentially spent by an unmined transaction in the mempool is excluded
+    /// iff the spending transaction will not be expired at `target_height`.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_spendable_transparent_outputs(
+        &self,
+        _address: &TransparentAddress,
+        _target_height: BlockHeight,
+        _min_confirmations: u32,
+    ) -> Result<Vec<WalletTransparentOutput>, Self::Error> {
+        Ok(vec![])
+    }
 }
 
 /// Read-only operations required for light wallet functions.
@@ -39,219 +1171,714 @@ pub enum NullifierQuery {
 /// This trait defines the read-only portion of the storage interface atop which
 /// higher-level wallet operations are implemented. It serves to allow wallet functions to
 /// be abstracted away from any particular data storage substrate.
+#[cfg_attr(feature = "test-dependencies", delegatable_trait)]
 pub trait WalletRead {
-    /// The type of errors produced by a wallet backend.
-    type Error;
+    /// The type of errors that may be generated when querying a wallet data store.
+    type Error: Debug;
 
-    /// Backend-specific note identifier.
+    /// The type of the account identifier.
     ///
-    /// For example, this might be a database identifier type
-    /// or a UUID.
-    type NoteRef: Copy + Debug + Eq + Ord;
+    /// An account identifier corresponds to at most a single unified spending key's worth of spend
+    /// authority, such that both received notes and change spendable by that spending authority
+    /// will be interpreted as belonging to that account.
+    type AccountId: Copy + Debug + Eq + Hash;
+
+    /// The concrete account type used by this wallet backend.
+    type Account: Account<AccountId = Self::AccountId>;
+
+    /// Returns a vector with the IDs of all accounts known to this wallet.
+    fn get_account_ids(&self) -> Result<Vec<Self::AccountId>, Self::Error>;
+
+    /// Returns the account corresponding to the given ID, if any.
+    fn get_account(
+        &self,
+        account_id: Self::AccountId,
+    ) -> Result<Option<Self::Account>, Self::Error>;
+
+    /// Returns the account corresponding to a given [`SeedFingerprint`] and
+    /// [`zip32::AccountId`], if any.
+    fn get_derived_account(
+        &self,
+        seed: &SeedFingerprint,
+        account_id: zip32::AccountId,
+    ) -> Result<Option<Self::Account>, Self::Error>;
 
-    /// Backend-specific transaction identifier.
+    /// Verifies that the given seed corresponds to the viewing key for the specified account.
     ///
-    /// For example, this might be a database identifier type
-    /// or a TxId if the backend is able to support that type
-    /// directly.
-    type TxRef: Copy + Debug + Eq + Ord;
+    /// Returns:
+    /// - `Ok(true)` if the viewing key for the specified account can be derived from the
+    ///   provided seed.
+    /// - `Ok(false)` if the derived viewing key does not match, or the specified account is not
+    ///   present in the database.
+    /// - `Err(_)` if a Unified Spending Key cannot be derived from the seed for the
+    ///   specified account or the account has no known ZIP-32 derivation.
+    fn validate_seed(
+        &self,
+        account_id: Self::AccountId,
+        seed: &SecretVec<u8>,
+    ) -> Result<bool, Self::Error>;
 
-    /// Returns the minimum and maximum block heights for stored blocks.
+    /// Checks whether the given seed is relevant to any of the derived accounts (where
+    /// [`Account::source`] is [`AccountSource::Derived`]) in the wallet.
     ///
-    /// This will return `Ok(None)` if no block data is present in the database.
-    fn block_height_extrema(&self) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error>;
+    /// This API does not check whether the seed is relevant to any imported account,
+    /// because that would require brute-forcing the ZIP 32 account index space.
+    fn seed_relevance_to_derived_accounts(
+        &self,
+        seed: &SecretVec<u8>,
+    ) -> Result<SeedRelevance<Self::AccountId>, Self::Error>;
 
-    /// Returns the default target height (for the block in which a new
-    /// transaction would be mined) and anchor height (to use for a new
-    /// transaction), given the range of block heights that the backend
-    /// knows about.
+    /// Returns the account corresponding to a given [`UnifiedFullViewingKey`], if any.
+    fn get_account_for_ufvk(
+        &self,
+        ufvk: &UnifiedFullViewingKey,
+    ) -> Result<Option<Self::Account>, Self::Error>;
+
+    /// Returns the most recently generated unified address for the specified account, if the
+    /// account identifier specified refers to a valid account for this wallet.
     ///
-    /// This will return `Ok(None)` if no block data is present in the database.
-    fn get_target_and_anchor_heights(
+    /// This will return `Ok(None)` if the account identifier does not correspond to a known
+    /// account.
+    fn get_current_address(
+        &self,
+        account: Self::AccountId,
+    ) -> Result<Option<UnifiedAddress>, Self::Error>;
+
+    /// Returns the birthday height for the given account, or an error if the account is not known
+    /// to the wallet.
+    fn get_account_birthday(&self, account: Self::AccountId) -> Result<BlockHeight, Self::Error>;
+
+    /// Returns the birthday height for the wallet.
+    ///
+    /// This returns the earliest birthday height among accounts maintained by this wallet,
+    /// or `Ok(None)` if the wallet has no initialized accounts.
+    fn get_wallet_birthday(&self) -> Result<Option<BlockHeight>, Self::Error>;
+
+    /// Returns the wallet balances and sync status for an account given the specified minimum
+    /// number of confirmations, or `Ok(None)` if the wallet has no balance data available.
+    fn get_wallet_summary(
         &self,
         min_confirmations: u32,
-    ) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error> {
-        self.block_height_extrema().map(|heights| {
-            heights.map(|(min_height, max_height)| {
-                let target_height = max_height + 1;
-
-                // Select an anchor min_confirmations back from the target block,
-                // unless that would be before the earliest block we have.
-                let anchor_height = BlockHeight::from(cmp::max(
-                    u32::from(target_height).saturating_sub(min_confirmations),
-                    u32::from(min_height),
-                ));
-
-                (target_height, anchor_height)
-            })
-        })
-    }
+    ) -> Result<Option<WalletSummary<Self::AccountId>>, Self::Error>;
 
-    /// Returns the minimum block height corresponding to an unspent note in the wallet.
-    fn get_min_unspent_height(&self) -> Result<Option<BlockHeight>, Self::Error>;
+    /// Returns the height of the chain as known to the wallet as of the most recent call to
+    /// [`WalletWrite::update_chain_tip`].
+    ///
+    /// This will return `Ok(None)` if the height of the current consensus chain tip is unknown.
+    fn chain_height(&self) -> Result<Option<BlockHeight>, Self::Error>;
 
     /// Returns the block hash for the block at the given height, if the
     /// associated block data is available. Returns `Ok(None)` if the hash
     /// is not found in the database.
     fn get_block_hash(&self, block_height: BlockHeight) -> Result<Option<BlockHash>, Self::Error>;
 
-    /// Returns the block hash for the block at the maximum height known
-    /// in stored data.
+    /// Returns the available block metadata for the block at the specified height, if any.
+    fn block_metadata(&self, height: BlockHeight) -> Result<Option<BlockMetadata>, Self::Error>;
+
+    /// Returns the metadata for the block at the height to which the wallet has been fully
+    /// scanned.
+    ///
+    /// This is the height for which the wallet has fully trial-decrypted this and all preceding
+    /// blocks above the wallet's birthday height. Along with this height, this method returns
+    /// metadata describing the state of the wallet's note commitment trees as of the end of that
+    /// block.
+    fn block_fully_scanned(&self) -> Result<Option<BlockMetadata>, Self::Error>;
+
+    /// Returns the block height and hash for the block at the maximum scanned block height.
+    ///
+    /// This will return `Ok(None)` if no blocks have been scanned.
+    fn get_max_height_hash(&self) -> Result<Option<(BlockHeight, BlockHash)>, Self::Error>;
+
+    /// Returns block metadata for the maximum height that the wallet has scanned.
+    ///
+    /// If the wallet is fully synced, this will be equivalent to `block_fully_scanned`;
+    /// otherwise the maximal scanned height is likely to be greater than the fully scanned height
+    /// due to the fact that out-of-order scanning can leave gaps.
+    fn block_max_scanned(&self) -> Result<Option<BlockMetadata>, Self::Error>;
+
+    /// Returns a vector of suggested scan ranges based upon the current wallet state.
+    ///
+    /// This method should only be used in cases where the [`CompactBlock`] data that will be made
+    /// available to `scan_cached_blocks` for the requested block ranges includes note commitment
+    /// tree size information for each block; or else the scan is likely to fail if notes belonging
+    /// to the wallet are detected.
+    ///
+    /// The returned range(s) may include block heights beyond the current chain tip. Ranges are
+    /// returned in order of descending priority, and higher-priority ranges should always be
+    /// scanned before lower-priority ranges; in particular, ranges with [`ScanPriority::Verify`]
+    /// priority must always be scanned first in order to avoid blockchain continuity errors in the
+    /// case of a reorg.
+    ///
+    /// [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
+    /// [`ScanPriority::Verify`]: crate::data_api::scanning::ScanPriority
+    fn suggest_scan_ranges(&self) -> Result<Vec<ScanRange>, Self::Error>;
+
+    /// Returns the default target height (for the block in which a new
+    /// transaction would be mined) and anchor height (to use for a new
+    /// transaction), given the range of block heights that the backend
+    /// knows about.
     ///
     /// This will return `Ok(None)` if no block data is present in the database.
-    fn get_max_height_hash(&self) -> Result<Option<(BlockHeight, BlockHash)>, Self::Error> {
-        self.block_height_extrema()
-            .and_then(|extrema_opt| {
-                extrema_opt
-                    .map(|(_, max_height)| {
-                        self.get_block_hash(max_height)
-                            .map(|hash_opt| hash_opt.map(move |hash| (max_height, hash)))
-                    })
-                    .transpose()
-            })
-            .map(|oo| oo.flatten())
-    }
+    fn get_target_and_anchor_heights(
+        &self,
+        min_confirmations: NonZeroU32,
+    ) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error>;
 
     /// Returns the block height in which the specified transaction was mined, or `Ok(None)` if the
     /// transaction is not in the main chain.
     fn get_tx_height(&self, txid: TxId) -> Result<Option<BlockHeight>, Self::Error>;
 
-    /// Returns the most recently generated unified address for the specified account, if the
-    /// account identifier specified refers to a valid account for this wallet.
+    /// Returns all unified full viewing keys known to this wallet.
+    fn get_unified_full_viewing_keys(
+        &self,
+    ) -> Result<HashMap<Self::AccountId, UnifiedFullViewingKey>, Self::Error>;
+
+    /// Returns the memo for a note.
     ///
-    /// This will return `Ok(None)` if the account identifier does not correspond to a known
-    /// account.
-    fn get_current_address(
+    /// Returns `Ok(None)` if the note is known to the wallet but memo data has not yet been
+    /// populated for that note, or if the note identifier does not correspond to a note
+    /// that is known to the wallet.
+    fn get_memo(&self, note_id: NoteId) -> Result<Option<Memo>, Self::Error>;
+
+    /// Returns a transaction.
+    fn get_transaction(&self, txid: TxId) -> Result<Option<Transaction>, Self::Error>;
+
+    /// Returns the nullifiers for Sapling notes that the wallet is tracking, along with their
+    /// associated account IDs, that are either unspent or have not yet been confirmed as spent (in
+    /// that a spending transaction known to the wallet has not yet been included in a block).
+    fn get_sapling_nullifiers(
         &self,
-        account: AccountId,
-    ) -> Result<Option<UnifiedAddress>, Self::Error>;
+        query: NullifierQuery,
+    ) -> Result<Vec<(Self::AccountId, sapling::Nullifier)>, Self::Error>;
 
-    /// Returns all unified full viewing keys known to this wallet.
-    fn get_unified_full_viewing_keys(
+    /// Returns the nullifiers for Orchard notes that the wallet is tracking, along with their
+    /// associated account IDs, that are either unspent or have not yet been confirmed as spent (in
+    /// that a spending transaction known to the wallet has not yet been included in a block).
+    #[cfg(feature = "orchard")]
+    fn get_orchard_nullifiers(
         &self,
-    ) -> Result<HashMap<AccountId, UnifiedFullViewingKey>, Self::Error>;
+        query: NullifierQuery,
+    ) -> Result<Vec<(Self::AccountId, orchard::note::Nullifier)>, Self::Error>;
 
-    /// Returns the account id corresponding to a given [`UnifiedFullViewingKey`], if any.
-    fn get_account_for_ufvk(
+    /// Returns the set of non-ephemeral transparent receivers associated with the given
+    /// account controlled by this wallet.
+    ///
+    /// The set contains all non-ephemeral transparent receivers that are known to have
+    /// been derived under this account. Wallets should scan the chain for UTXOs sent to
+    /// these receivers.
+    ///
+    /// Use [`Self::get_known_ephemeral_addresses`] to obtain the ephemeral transparent
+    /// receivers.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_receivers(
         &self,
-        ufvk: &UnifiedFullViewingKey,
-    ) -> Result<Option<AccountId>, Self::Error>;
+        _account: Self::AccountId,
+    ) -> Result<HashMap<TransparentAddress, Option<TransparentAddressMetadata>>, Self::Error> {
+        Ok(HashMap::new())
+    }
+
+    /// Returns a mapping from each transparent receiver associated with the specified account
+    /// to its not-yet-shielded UTXO balance as of the end of the block at the provided
+    /// `max_height`, when that balance is non-zero.
+    ///
+    /// Balances of ephemeral transparent addresses will not be included.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_balances(
+        &self,
+        _account: Self::AccountId,
+        _max_height: BlockHeight,
+    ) -> Result<HashMap<TransparentAddress, NonNegativeAmount>, Self::Error> {
+        Ok(HashMap::new())
+    }
 
-    /// Checks whether the specified extended full viewing key is associated with the account.
-    fn is_valid_account_extfvk(
+    /// Returns the metadata associated with a given transparent receiver in an account
+    /// controlled by this wallet, if available.
+    ///
+    /// This is equivalent to (but may be implemented more efficiently than):
+    /// ```compile_fail
+    /// Ok(
+    ///     if let Some(result) = self.get_transparent_receivers(account)?.get(address) {
+    ///         result.clone()
+    ///     } else {
+    ///         self.get_known_ephemeral_addresses(account, None)?
+    ///             .into_iter()
+    ///             .find(|(known_addr, _)| known_addr == address)
+    ///             .map(|(_, metadata)| metadata)
+    ///     },
+    /// )
+    /// ```
+    ///
+    /// Returns `Ok(None)` if the address is not recognized, or we do not have metadata for it.
+    /// Returns `Ok(Some(metadata))` if we have the metadata.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_address_metadata(
         &self,
-        account: AccountId,
-        extfvk: &ExtendedFullViewingKey,
-    ) -> Result<bool, Self::Error>;
+        account: Self::AccountId,
+        address: &TransparentAddress,
+    ) -> Result<Option<TransparentAddressMetadata>, Self::Error> {
+        // This should be overridden.
+        Ok(
+            if let Some(result) = self.get_transparent_receivers(account)?.get(address) {
+                result.clone()
+            } else {
+                self.get_known_ephemeral_addresses(account, None)?
+                    .into_iter()
+                    .find(|(known_addr, _)| known_addr == address)
+                    .map(|(_, metadata)| metadata)
+            },
+        )
+    }
+
+    /// Returns a vector of ephemeral transparent addresses associated with the given
+    /// account controlled by this wallet, along with their metadata. The result includes
+    /// reserved addresses, and addresses for [`GAP_LIMIT`] additional indices (capped to
+    /// the maximum index).
+    ///
+    /// If `index_range` is some `Range`, it limits the result to addresses with indices
+    /// in that range. An `index_range` of `None` is defined to be equivalent to
+    /// `0..(1u32 << 31)`.
+    ///
+    /// Wallets should scan the chain for UTXOs sent to these ephemeral transparent
+    /// receivers, but do not need to do so regularly. Under expected usage, outputs
+    /// would only be detected with these receivers in the following situations:
+    ///
+    /// - This wallet created a payment to a ZIP 320 (TEX) address, but the second
+    ///   transaction (that spent the output sent to the ephemeral address) did not get
+    ///   mined before it expired.
+    ///   - In this case the output will already be known to the wallet (because it
+    ///     stores the transactions that it creates).
+    ///
+    /// - Another wallet app using the same seed phrase created a payment to a ZIP 320
+    ///   address, and this wallet queried for the ephemeral UTXOs after the first
+    ///   transaction was mined but before the second transaction was mined.
+    ///   - In this case, the output should not be considered unspent until the expiry
+    ///     height of the transaction it was received in has passed. Wallets creating
+    ///     payments to TEX addresses generally set the same expiry height for the first
+    ///     and second transactions, meaning that this wallet does not need to observe
+    ///     the second transaction to determine when it would have expired.
+    ///
+    /// - A TEX address recipient decided to return funds that the wallet had sent to
+    ///   them.
+    ///
+    /// In all cases, the wallet should re-shield the unspent outputs, in a separate
+    /// transaction per ephemeral address, before re-spending the funds.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_known_ephemeral_addresses(
+        &self,
+        _account: Self::AccountId,
+        _index_range: Option<Range<u32>>,
+    ) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, Self::Error> {
+        Ok(vec![])
+    }
 
-    /// Returns the wallet balance for an account as of the specified block height.
+    /// If a given ephemeral address might have been reserved, i.e. would be included in
+    /// the result of `get_known_ephemeral_addresses(account_id, None)` for any of the
+    /// wallet's accounts, then return `Ok(Some(account_id))`. Otherwise return `Ok(None)`.
     ///
-    /// This may be used to obtain a balance that ignores notes that have been received so recently
-    /// that they are not yet deemed spendable.
-    fn get_balance_at(
+    /// This is equivalent to (but may be implemented more efficiently than):
+    /// ```compile_fail
+    /// for account_id in self.get_account_ids()? {
+    ///     if self
+    ///         .get_known_ephemeral_addresses(account_id, None)?
+    ///         .into_iter()
+    ///         .any(|(known_addr, _)| &known_addr == address)
+    ///     {
+    ///         return Ok(Some(account_id));
+    ///     }
+    /// }
+    /// Ok(None)
+    /// ```
+    #[cfg(feature = "transparent-inputs")]
+    fn find_account_for_ephemeral_address(
         &self,
-        account: AccountId,
-        anchor_height: BlockHeight,
-    ) -> Result<Amount, Self::Error>;
+        address: &TransparentAddress,
+    ) -> Result<Option<Self::AccountId>, Self::Error> {
+        for account_id in self.get_account_ids()? {
+            if self
+                .get_known_ephemeral_addresses(account_id, None)?
+                .into_iter()
+                .any(|(known_addr, _)| &known_addr == address)
+            {
+                return Ok(Some(account_id));
+            }
+        }
+        Ok(None)
+    }
+
+    /// Returns a vector of [`TransactionDataRequest`] values that describe information needed by
+    /// the wallet to complete its view of transaction history.
+    ///
+    /// Requests for the same transaction data may be returned repeatedly by successive data
+    /// requests. The caller of this method should consider the latest set of requests returned
+    /// by this method to be authoritative and to subsume that returned by previous calls.
+    ///
+    /// Callers should poll this method on a regular interval, not as part of ordinary chain
+    /// scanning, which already produces requests for transaction data enhancement. Note that
+    /// responding to a set of transaction data requests may result in the creation of new
+    /// transaction data requests, such as when it is necessary to fill in purely-transparent
+    /// transaction history by walking the chain backwards via transparent inputs.
+    fn transaction_data_requests(&self) -> Result<Vec<TransactionDataRequest>, Self::Error>;
+}
+
+/// Read-only operations required for testing light wallet functions.
+///
+/// These methods expose internal details or unstable interfaces, primarily to enable use
+/// of the [`testing`] framework. They should not be used in production software.
+#[cfg(any(test, feature = "test-dependencies"))]
+#[cfg_attr(feature = "test-dependencies", delegatable_trait)]
+pub trait WalletTest: InputSource + WalletRead {
+    /// Returns a vector of transaction summaries.
+    ///
+    /// Currently test-only, as production use could return a very large number of results; either
+    /// pagination or a streaming design will be necessary to stabilize this feature for production
+    /// use.
+    fn get_tx_history(
+        &self,
+    ) -> Result<
+        Vec<testing::TransactionSummary<<Self as WalletRead>::AccountId>>,
+        <Self as WalletRead>::Error,
+    >;
+
+    /// Returns the note IDs for shielded notes sent by the wallet in a particular
+    /// transaction.
+    fn get_sent_note_ids(
+        &self,
+        _txid: &TxId,
+        _protocol: ShieldedProtocol,
+    ) -> Result<Vec<NoteId>, <Self as WalletRead>::Error>;
+
+    /// Returns the outputs for a transaction sent by the wallet.
+    #[allow(clippy::type_complexity)]
+    fn get_sent_outputs(
+        &self,
+        txid: &TxId,
+    ) -> Result<Vec<OutputOfSentTx>, <Self as WalletRead>::Error>;
+
+    #[allow(clippy::type_complexity)]
+    fn get_checkpoint_history(
+        &self,
+        protocol: &ShieldedProtocol,
+    ) -> Result<
+        Vec<(BlockHeight, Option<incrementalmerkletree::Position>)>,
+        <Self as WalletRead>::Error,
+    >;
+
+    /// Fetches the transparent output corresponding to the provided `outpoint`.
+    /// Allows selecting unspendable outputs for testing purposes.
+    ///
+    /// Returns `Ok(None)` if the UTXO is not known to belong to the wallet or is not
+    /// spendable as of the chain tip height.
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_output(
+        &self,
+        outpoint: &OutPoint,
+        allow_unspendable: bool,
+    ) -> Result<Option<WalletTransparentOutput>, <Self as InputSource>::Error>;
+
+    /// Returns all the notes that have been received by the wallet.
+    fn get_notes(
+        &self,
+        protocol: ShieldedProtocol,
+    ) -> Result<Vec<ReceivedNote<Self::NoteRef, Note>>, <Self as InputSource>::Error>;
+}
+
+/// The output of a transaction sent by the wallet.
+///
+/// This type is opaque, and exists for use by tests defined in this crate.
+#[cfg(any(test, feature = "test-dependencies"))]
+#[allow(dead_code)]
+#[derive(Clone, Debug)]
+pub struct OutputOfSentTx {
+    value: NonNegativeAmount,
+    external_recipient: Option<Address>,
+    ephemeral_address: Option<(Address, u32)>,
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+impl OutputOfSentTx {
+    /// Constructs an output from its test-relevant parts.
+    ///
+    /// If the output is to an ephemeral address, `ephemeral_address` should contain the
+    /// address along with the `address_index` it was derived from under the BIP 32 path
+    /// `m/44'/<coin_type>'/<account>'/2/<address_index>`.
+    pub fn from_parts(
+        value: NonNegativeAmount,
+        external_recipient: Option<Address>,
+        ephemeral_address: Option<(Address, u32)>,
+    ) -> Self {
+        Self {
+            value,
+            external_recipient,
+            ephemeral_address,
+        }
+    }
+}
+
+/// The relevance of a seed to a given wallet.
+///
+/// This is the return type for [`WalletRead::seed_relevance_to_derived_accounts`].
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum SeedRelevance<A: Copy> {
+    /// The seed is relevant to at least one derived account within the wallet.
+    Relevant { account_ids: NonEmpty<A> },
+    /// The seed is not relevant to any of the derived accounts within the wallet.
+    NotRelevant,
+    /// The wallet contains no derived accounts.
+    NoDerivedAccounts,
+    /// The wallet contains no accounts.
+    NoAccounts,
+}
+
+/// Metadata describing the sizes of the zcash note commitment trees as of a particular block.
+#[derive(Debug, Clone, Copy)]
+pub struct BlockMetadata {
+    block_height: BlockHeight,
+    block_hash: BlockHash,
+    sapling_tree_size: Option<u32>,
+    #[cfg(feature = "orchard")]
+    orchard_tree_size: Option<u32>,
+}
+
+impl BlockMetadata {
+    /// Constructs a new [`BlockMetadata`] value from its constituent parts.
+    pub fn from_parts(
+        block_height: BlockHeight,
+        block_hash: BlockHash,
+        sapling_tree_size: Option<u32>,
+        #[cfg(feature = "orchard")] orchard_tree_size: Option<u32>,
+    ) -> Self {
+        Self {
+            block_height,
+            block_hash,
+            sapling_tree_size,
+            #[cfg(feature = "orchard")]
+            orchard_tree_size,
+        }
+    }
+
+    /// Returns the block height.
+    pub fn block_height(&self) -> BlockHeight {
+        self.block_height
+    }
+
+    /// Returns the hash of the block
+    pub fn block_hash(&self) -> BlockHash {
+        self.block_hash
+    }
+
+    /// Returns the size of the Sapling note commitment tree for the final treestate of the block
+    /// that this [`BlockMetadata`] describes, if available.
+    pub fn sapling_tree_size(&self) -> Option<u32> {
+        self.sapling_tree_size
+    }
+
+    /// Returns the size of the Orchard note commitment tree for the final treestate of the block
+    /// that this [`BlockMetadata`] describes, if available.
+    #[cfg(feature = "orchard")]
+    pub fn orchard_tree_size(&self) -> Option<u32> {
+        self.orchard_tree_size
+    }
+}
+
+/// The protocol-specific note commitment and nullifier data extracted from the per-transaction
+/// shielded bundles in [`CompactBlock`], used by the wallet for note commitment tree maintenance
+/// and spend detection.
+///
+/// [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
+pub struct ScannedBundles<NoteCommitment, NF> {
+    final_tree_size: u32,
+    commitments: Vec<(NoteCommitment, Retention<BlockHeight>)>,
+    nullifier_map: Vec<(TxId, u16, Vec<NF>)>,
+}
+
+impl<NoteCommitment, NF> ScannedBundles<NoteCommitment, NF> {
+    pub(crate) fn new(
+        final_tree_size: u32,
+        commitments: Vec<(NoteCommitment, Retention<BlockHeight>)>,
+        nullifier_map: Vec<(TxId, u16, Vec<NF>)>,
+    ) -> Self {
+        Self {
+            final_tree_size,
+            nullifier_map,
+            commitments,
+        }
+    }
+
+    /// Returns the size of the note commitment tree as of the end of the scanned block.
+    pub fn final_tree_size(&self) -> u32 {
+        self.final_tree_size
+    }
+
+    /// Returns the vector of nullifiers for each transaction in the block.
+    ///
+    /// The returned tuple is keyed by both transaction ID and the index of the transaction within
+    /// the block, so that either the txid or the combination of the block hash available from
+    /// [`ScannedBlock::block_hash`] and returned transaction index may be used to uniquely
+    /// identify the transaction, depending upon the needs of the caller.
+    pub fn nullifier_map(&self) -> &[(TxId, u16, Vec<NF>)] {
+        &self.nullifier_map
+    }
+
+    /// Returns the ordered list of note commitments to be added to the note commitment
+    /// tree.
+    pub fn commitments(&self) -> &[(NoteCommitment, Retention<BlockHeight>)] {
+        &self.commitments
+    }
+}
 
-    /// Returns the memo for a note.
-    ///
-    /// Implementations of this method must return an error if the note identifier
-    /// does not appear in the backing data store. Returns `Ok(None)` if the note
-    /// is known to the wallet but memo data has not yet been populated for that
-    /// note.
-    fn get_memo(&self, id_note: Self::NoteRef) -> Result<Option<Memo>, Self::Error>;
+/// A struct used to return the vectors of note commitments for a [`ScannedBlock`]
+/// as owned values.
+pub struct ScannedBlockCommitments {
+    /// The ordered vector of note commitments for Sapling outputs of the block.
+    pub sapling: Vec<(sapling::Node, Retention<BlockHeight>)>,
+    /// The ordered vector of note commitments for Orchard outputs of the block.
+    /// Present only when the `orchard` feature is enabled.
+    #[cfg(feature = "orchard")]
+    pub orchard: Vec<(orchard::tree::MerkleHashOrchard, Retention<BlockHeight>)>,
+}
 
-    /// Returns a transaction.
-    fn get_transaction(&self, id_tx: Self::TxRef) -> Result<Transaction, Self::Error>;
+/// The subset of information that is relevant to this wallet that has been
+/// decrypted and extracted from a [`CompactBlock`].
+///
+/// [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
+pub struct ScannedBlock<A> {
+    block_height: BlockHeight,
+    block_hash: BlockHash,
+    block_time: u32,
+    transactions: Vec<WalletTx<A>>,
+    sapling: ScannedBundles<sapling::Node, sapling::Nullifier>,
+    #[cfg(feature = "orchard")]
+    orchard: ScannedBundles<orchard::tree::MerkleHashOrchard, orchard::note::Nullifier>,
+}
 
-    /// Returns the note commitment tree at the specified block height.
-    fn get_commitment_tree(
-        &self,
+impl<A> ScannedBlock<A> {
+    /// Constructs a new `ScannedBlock`
+    pub(crate) fn from_parts(
         block_height: BlockHeight,
-    ) -> Result<Option<sapling::CommitmentTree>, Self::Error>;
+        block_hash: BlockHash,
+        block_time: u32,
+        transactions: Vec<WalletTx<A>>,
+        sapling: ScannedBundles<sapling::Node, sapling::Nullifier>,
+        #[cfg(feature = "orchard")] orchard: ScannedBundles<
+            orchard::tree::MerkleHashOrchard,
+            orchard::note::Nullifier,
+        >,
+    ) -> Self {
+        Self {
+            block_height,
+            block_hash,
+            block_time,
+            transactions,
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        }
+    }
 
-    /// Returns the incremental witnesses as of the specified block height.
-    #[allow(clippy::type_complexity)]
-    fn get_witnesses(
-        &self,
-        block_height: BlockHeight,
-    ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error>;
+    /// Returns the height of the block that was scanned.
+    pub fn height(&self) -> BlockHeight {
+        self.block_height
+    }
 
-    /// Returns the nullifiers for notes that the wallet is tracking, along with their associated
-    /// account IDs, that are either unspent or have not yet been confirmed as spent (in that a
-    /// spending transaction known to the wallet has not yet been included in a block).
-    fn get_sapling_nullifiers(
-        &self,
-        query: NullifierQuery,
-    ) -> Result<Vec<(AccountId, sapling::Nullifier)>, Self::Error>;
+    /// Returns the block hash of the block that was scanned.
+    pub fn block_hash(&self) -> BlockHash {
+        self.block_hash
+    }
 
-    /// Return all unspent Sapling notes.
-    fn get_spendable_sapling_notes(
-        &self,
-        account: AccountId,
-        anchor_height: BlockHeight,
-        exclude: &[Self::NoteRef],
-    ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error>;
+    /// Returns the block time of the block that was scanned, as a Unix timestamp in seconds.
+    pub fn block_time(&self) -> u32 {
+        self.block_time
+    }
 
-    /// Returns a list of spendable Sapling notes sufficient to cover the specified target value,
-    /// if possible.
-    fn select_spendable_sapling_notes(
-        &self,
-        account: AccountId,
-        target_value: Amount,
-        anchor_height: BlockHeight,
-        exclude: &[Self::NoteRef],
-    ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error>;
+    /// Returns the list of transactions from this block that are relevant to the wallet.
+    pub fn transactions(&self) -> &[WalletTx<A>] {
+        &self.transactions
+    }
 
-    /// Returns the set of all transparent receivers associated with the given account.
-    ///
-    /// The set contains all transparent receivers that are known to have been derived
-    /// under this account. Wallets should scan the chain for UTXOs sent to these
-    /// receivers.
-    fn get_transparent_receivers(
-        &self,
-        account: AccountId,
-    ) -> Result<HashMap<TransparentAddress, AddressMetadata>, Self::Error>;
+    /// Returns the Sapling note commitment tree and nullifier data for the block.
+    pub fn sapling(&self) -> &ScannedBundles<sapling::Node, sapling::Nullifier> {
+        &self.sapling
+    }
 
-    /// Returns a list of unspent transparent UTXOs that appear in the chain at heights up to and
-    /// including `max_height`.
-    fn get_unspent_transparent_outputs(
+    /// Returns the Orchard note commitment tree and nullifier data for the block.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(
         &self,
-        address: &TransparentAddress,
-        max_height: BlockHeight,
-        exclude: &[OutPoint],
-    ) -> Result<Vec<WalletTransparentOutput>, Self::Error>;
+    ) -> &ScannedBundles<orchard::tree::MerkleHashOrchard, orchard::note::Nullifier> {
+        &self.orchard
+    }
 
-    /// Returns a mapping from transparent receiver to not-yet-shielded UTXO balance,
-    /// for each address associated with a nonzero balance.
-    fn get_transparent_balances(
-        &self,
-        account: AccountId,
-        max_height: BlockHeight,
-    ) -> Result<HashMap<TransparentAddress, Amount>, Self::Error>;
-}
+    /// Consumes `self` and returns the lists of Sapling and Orchard note commitments associated
+    /// with the scanned block as an owned value.
+    pub fn into_commitments(self) -> ScannedBlockCommitments {
+        ScannedBlockCommitments {
+            sapling: self.sapling.commitments,
+            #[cfg(feature = "orchard")]
+            orchard: self.orchard.commitments,
+        }
+    }
 
-/// The subset of information that is relevant to this wallet that has been
-/// decrypted and extracted from a [`CompactBlock`].
-///
-/// [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
-pub struct PrunedBlock<'a> {
-    pub block_height: BlockHeight,
-    pub block_hash: BlockHash,
-    pub block_time: u32,
-    pub commitment_tree: &'a sapling::CommitmentTree,
-    pub transactions: &'a Vec<WalletTx<sapling::Nullifier>>,
+    /// Returns the [`BlockMetadata`] corresponding to the scanned block.
+    pub fn to_block_metadata(&self) -> BlockMetadata {
+        BlockMetadata {
+            block_height: self.block_height,
+            block_hash: self.block_hash,
+            sapling_tree_size: Some(self.sapling.final_tree_size),
+            #[cfg(feature = "orchard")]
+            orchard_tree_size: Some(self.orchard.final_tree_size),
+        }
+    }
 }
 
 /// A transaction that was detected during scanning of the blockchain,
-/// including its decrypted Sapling outputs.
+/// including its decrypted Sapling and/or Orchard outputs.
 ///
 /// The purpose of this struct is to permit atomic updates of the
 /// wallet database when transactions are successfully decrypted.
-pub struct DecryptedTransaction<'a> {
-    pub tx: &'a Transaction,
-    pub sapling_outputs: &'a Vec<DecryptedOutput<sapling::Note>>,
+pub struct DecryptedTransaction<'a, AccountId> {
+    mined_height: Option<BlockHeight>,
+    tx: &'a Transaction,
+    sapling_outputs: Vec<DecryptedOutput<sapling::Note, AccountId>>,
+    #[cfg(feature = "orchard")]
+    orchard_outputs: Vec<DecryptedOutput<orchard::note::Note, AccountId>>,
+}
+
+impl<'a, AccountId> DecryptedTransaction<'a, AccountId> {
+    /// Constructs a new [`DecryptedTransaction`] from its constituent parts.
+    pub fn new(
+        mined_height: Option<BlockHeight>,
+        tx: &'a Transaction,
+        sapling_outputs: Vec<DecryptedOutput<sapling::Note, AccountId>>,
+        #[cfg(feature = "orchard")] orchard_outputs: Vec<
+            DecryptedOutput<orchard::note::Note, AccountId>,
+        >,
+    ) -> Self {
+        Self {
+            mined_height,
+            tx,
+            sapling_outputs,
+            #[cfg(feature = "orchard")]
+            orchard_outputs,
+        }
+    }
+
+    /// Returns the height at which the transaction was mined, if known.
+    pub fn mined_height(&self) -> Option<BlockHeight> {
+        self.mined_height
+    }
+    /// Returns the raw transaction data.
+    pub fn tx(&self) -> &Transaction {
+        self.tx
+    }
+    /// Returns the Sapling outputs that were decrypted from the transaction.
+    pub fn sapling_outputs(&self) -> &[DecryptedOutput<sapling::Note, AccountId>] {
+        &self.sapling_outputs
+    }
+    /// Returns the Orchard outputs that were decrypted from the transaction.
+    #[cfg(feature = "orchard")]
+    pub fn orchard_outputs(&self) -> &[DecryptedOutput<orchard::note::Note, AccountId>] {
+        &self.orchard_outputs
+    }
 }
 
 /// A transaction that was constructed and sent by the wallet.
@@ -259,63 +1886,116 @@ pub struct DecryptedTransaction<'a> {
 /// The purpose of this struct is to permit atomic updates of the
 /// wallet database when transactions are created and submitted
 /// to the network.
-pub struct SentTransaction<'a> {
-    pub tx: &'a Transaction,
-    pub created: time::OffsetDateTime,
-    pub account: AccountId,
-    pub outputs: Vec<SentTransactionOutput>,
-    pub fee_amount: Amount,
+pub struct SentTransaction<'a, AccountId> {
+    tx: &'a Transaction,
+    created: time::OffsetDateTime,
+    target_height: BlockHeight,
+    account: AccountId,
+    outputs: &'a [SentTransactionOutput<AccountId>],
+    fee_amount: NonNegativeAmount,
     #[cfg(feature = "transparent-inputs")]
-    pub utxos_spent: Vec<OutPoint>,
+    utxos_spent: &'a [OutPoint],
 }
 
-/// A value pool to which the wallet supports sending transaction outputs.
-#[derive(Debug, Copy, Clone, PartialEq, Eq)]
-pub enum PoolType {
-    /// The transparent value pool
-    Transparent,
-    /// The Sapling value pool
-    Sapling,
-    // TODO: Orchard
-}
+impl<'a, AccountId> SentTransaction<'a, AccountId> {
+    /// Constructs a new [`SentTransaction`] from its constituent parts.
+    ///
+    /// ### Parameters
+    /// - `tx`: the raw transaction data
+    /// - `created`: the system time at which the transaction was created
+    /// - `target_height`: the target height that was used in the construction of the transaction
+    /// - `account`: the account that spent funds in creation of the transaction
+    /// - `outputs`: the outputs created by the transaction, including those sent to external
+    ///   recipients which may not otherwise be recoverable
+    /// - `fee_amount`: the fee value paid by the transaction
+    /// - `utxos_spent`: the UTXOs controlled by the wallet that were spent in this transaction
+    pub fn new(
+        tx: &'a Transaction,
+        created: time::OffsetDateTime,
+        target_height: BlockHeight,
+        account: AccountId,
+        outputs: &'a [SentTransactionOutput<AccountId>],
+        fee_amount: NonNegativeAmount,
+        #[cfg(feature = "transparent-inputs")] utxos_spent: &'a [OutPoint],
+    ) -> Self {
+        Self {
+            tx,
+            created,
+            target_height,
+            account,
+            outputs,
+            fee_amount,
+            #[cfg(feature = "transparent-inputs")]
+            utxos_spent,
+        }
+    }
 
-/// A type that represents the recipient of a transaction output; a recipient address (and, for
-/// unified addresses, the pool to which the payment is sent) in the case of outgoing output, or an
-/// internal account ID and the pool to which funds were sent in the case of a wallet-internal
-/// output.
-#[derive(Debug, Clone)]
-pub enum Recipient {
-    Transparent(TransparentAddress),
-    Sapling(sapling::PaymentAddress),
-    Unified(UnifiedAddress, PoolType),
-    InternalAccount(AccountId, PoolType),
+    /// Returns the transaction that was sent.
+    pub fn tx(&self) -> &Transaction {
+        self.tx
+    }
+    /// Returns the timestamp of the transaction's creation.
+    pub fn created(&self) -> time::OffsetDateTime {
+        self.created
+    }
+    /// Returns the id for the account that created the outputs.
+    pub fn account_id(&self) -> &AccountId {
+        &self.account
+    }
+    /// Returns the outputs of the transaction.
+    pub fn outputs(&self) -> &[SentTransactionOutput<AccountId>] {
+        self.outputs
+    }
+    /// Returns the fee paid by the transaction.
+    pub fn fee_amount(&self) -> NonNegativeAmount {
+        self.fee_amount
+    }
+    /// Returns the list of UTXOs spent in the created transaction.
+    #[cfg(feature = "transparent-inputs")]
+    pub fn utxos_spent(&self) -> &[OutPoint] {
+        self.utxos_spent
+    }
+
+    /// Returns the block height that this transaction was created to target.
+    pub fn target_height(&self) -> BlockHeight {
+        self.target_height
+    }
 }
 
-/// A type that represents an output (either Sapling or transparent) that was sent by the wallet.
-pub struct SentTransactionOutput {
+/// An output of a transaction generated by the wallet.
+///
+/// This type is capable of representing both shielded and transparent outputs.
+pub struct SentTransactionOutput<AccountId> {
     output_index: usize,
-    recipient: Recipient,
-    value: Amount,
+    recipient: Recipient<AccountId, Note, OutPoint>,
+    value: NonNegativeAmount,
     memo: Option<MemoBytes>,
-    sapling_change_to: Option<(AccountId, sapling::Note)>,
 }
 
-impl SentTransactionOutput {
+impl<AccountId> SentTransactionOutput<AccountId> {
+    /// Constructs a new [`SentTransactionOutput`] from its constituent parts.
+    ///
+    /// ### Fields:
+    /// * `output_index` - the index of the output or action in the sent transaction
+    /// * `recipient` - the recipient of the output, either a Zcash address or a
+    ///    wallet-internal account and the note belonging to the wallet created by
+    ///    the output
+    /// * `value` - the value of the output, in zatoshis
+    /// * `memo` - the memo that was sent with this output
     pub fn from_parts(
         output_index: usize,
-        recipient: Recipient,
-        value: Amount,
+        recipient: Recipient<AccountId, Note, OutPoint>,
+        value: NonNegativeAmount,
         memo: Option<MemoBytes>,
-        sapling_change_to: Option<(AccountId, sapling::Note)>,
     ) -> Self {
         Self {
             output_index,
             recipient,
             value,
             memo,
-            sapling_change_to,
         }
     }
+
     /// Returns the index within the transaction that contains the recipient output.
     ///
     /// - If `recipient_address` is a Sapling address, this is an index into the Sapling
@@ -325,51 +2005,364 @@ impl SentTransactionOutput {
     pub fn output_index(&self) -> usize {
         self.output_index
     }
-    /// Returns the recipient address of the transaction, or the account id for wallet-internal
-    /// transactions.
-    pub fn recipient(&self) -> &Recipient {
+    /// Returns the recipient address of the transaction, or the account id and
+    /// resulting note/outpoint for wallet-internal outputs.
+    pub fn recipient(&self) -> &Recipient<AccountId, Note, OutPoint> {
         &self.recipient
     }
     /// Returns the value of the newly created output.
-    pub fn value(&self) -> Amount {
+    pub fn value(&self) -> NonNegativeAmount {
         self.value
     }
-    /// Returns the memo that was attached to the output, if any.
+    /// Returns the memo that was attached to the output, if any. This will only be `None`
+    /// for transparent outputs.
     pub fn memo(&self) -> Option<&MemoBytes> {
         self.memo.as_ref()
     }
+}
+
+/// A data structure used to set the birthday height for an account, and ensure that the initial
+/// note commitment tree state is recorded at that height.
+#[derive(Clone, Debug)]
+pub struct AccountBirthday {
+    prior_chain_state: ChainState,
+    recover_until: Option<BlockHeight>,
+}
+
+/// Errors that can occur in the construction of an [`AccountBirthday`] from a [`TreeState`].
+pub enum BirthdayError {
+    HeightInvalid(TryFromIntError),
+    Decode(io::Error),
+}
+
+impl From<TryFromIntError> for BirthdayError {
+    fn from(value: TryFromIntError) -> Self {
+        Self::HeightInvalid(value)
+    }
+}
+
+impl From<io::Error> for BirthdayError {
+    fn from(value: io::Error) -> Self {
+        Self::Decode(value)
+    }
+}
+
+impl AccountBirthday {
+    /// Constructs a new [`AccountBirthday`] from its constituent parts.
+    ///
+    /// * `prior_chain_state`: The chain state prior to the birthday height of the account. The
+    ///    birthday height is defined as the height of the first block to be scanned in wallet
+    ///    recovery.
+    /// * `recover_until`: An optional height at which the wallet should exit "recovery mode". In
+    ///    order to avoid confusing shifts in wallet balance and spendability that may temporarily be
+    ///    visible to a user during the process of recovering from seed, wallets may optionally set a
+    ///    "recover until" height. The wallet is considered to be in "recovery mode" until there
+    ///    exist no unscanned ranges between the wallet's birthday height and the provided
+    ///    `recover_until` height, exclusive.
+    ///
+    /// This API is intended primarily to be used in testing contexts; under normal circumstances,
+    /// [`AccountBirthday::from_treestate`] should be used instead.
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub fn from_parts(prior_chain_state: ChainState, recover_until: Option<BlockHeight>) -> Self {
+        Self {
+            prior_chain_state,
+            recover_until,
+        }
+    }
+
+    /// Constructs a new [`AccountBirthday`] from a [`TreeState`] returned from `lightwalletd`.
+    ///
+    /// * `treestate`: The tree state corresponding to the last block prior to the wallet's
+    ///    birthday height.
+    /// * `recover_until`: An optional height at which the wallet should exit "recovery mode". In
+    ///    order to avoid confusing shifts in wallet balance and spendability that may temporarily be
+    ///    visible to a user during the process of recovering from seed, wallets may optionally set a
+    ///    "recover until" height. The wallet is considered to be in "recovery mode" until there
+    ///    exist no unscanned ranges between the wallet's birthday height and the provided
+    ///    `recover_until` height, exclusive.
+    pub fn from_treestate(
+        treestate: TreeState,
+        recover_until: Option<BlockHeight>,
+    ) -> Result<Self, BirthdayError> {
+        Ok(Self {
+            prior_chain_state: treestate.to_chain_state()?,
+            recover_until,
+        })
+    }
+
+    /// Returns the Sapling note commitment tree frontier as of the end of the block at
+    /// [`Self::height`].
+    pub fn sapling_frontier(
+        &self,
+    ) -> &Frontier<sapling::Node, { sapling::NOTE_COMMITMENT_TREE_DEPTH }> {
+        self.prior_chain_state.final_sapling_tree()
+    }
+
+    /// Returns the Orchard note commitment tree frontier as of the end of the block at
+    /// [`Self::height`].
+    #[cfg(feature = "orchard")]
+    pub fn orchard_frontier(
+        &self,
+    ) -> &Frontier<orchard::tree::MerkleHashOrchard, { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 }>
+    {
+        self.prior_chain_state.final_orchard_tree()
+    }
 
-    /// Returns t decrypted note, if the sent output belongs to this wallet
-    pub fn sapling_change_to(&self) -> Option<&(AccountId, sapling::Note)> {
-        self.sapling_change_to.as_ref()
+    /// Returns the birthday height of the account.
+    pub fn height(&self) -> BlockHeight {
+        self.prior_chain_state.block_height() + 1
+    }
+
+    /// Returns the height at which the wallet should exit "recovery mode".
+    pub fn recover_until(&self) -> Option<BlockHeight> {
+        self.recover_until
+    }
+
+    #[cfg(any(test, feature = "test-dependencies"))]
+    /// Constructs a new [`AccountBirthday`] at the given network upgrade's activation,
+    /// with no "recover until" height.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the activation height for the given network upgrade is not set.
+    pub fn from_activation<P: zcash_primitives::consensus::Parameters>(
+        params: &P,
+        network_upgrade: NetworkUpgrade,
+        prior_block_hash: BlockHash,
+    ) -> AccountBirthday {
+        AccountBirthday::from_parts(
+            ChainState::empty(
+                params.activation_height(network_upgrade).unwrap() - 1,
+                prior_block_hash,
+            ),
+            None,
+        )
+    }
+
+    #[cfg(any(test, feature = "test-dependencies"))]
+    /// Constructs a new [`AccountBirthday`] at Sapling activation, with no
+    /// "recover until" height.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the Sapling activation height is not set.
+    pub fn from_sapling_activation<P: zcash_primitives::consensus::Parameters>(
+        params: &P,
+        prior_block_hash: BlockHash,
+    ) -> AccountBirthday {
+        Self::from_activation(params, NetworkUpgrade::Sapling, prior_block_hash)
     }
 }
 
-/// This trait encapsulates the write capabilities required to update stored
-/// wallet data.
+/// This trait encapsulates the write capabilities required to update stored wallet data.
+///
+/// # Adding accounts
+///
+/// This trait provides several methods for adding accounts to the wallet data:
+/// - [`WalletWrite::create_account`]
+/// - [`WalletWrite::import_account_hd`]
+/// - [`WalletWrite::import_account_ufvk`]
+///
+/// All of these methods take an [`AccountBirthday`]. The birthday height is defined as
+/// the minimum block height that will be scanned for funds belonging to the wallet. If
+/// `birthday.height()` is below the current chain tip, the account addition operation
+/// will trigger a re-scan of the blocks at and above the provided height.
+///
+/// The order in which you call these methods will affect the resulting wallet structure:
+/// - If only [`WalletWrite::create_account`] is used, the resulting accounts will have
+///   sequential [ZIP 32] account indices within each given seed.
+/// - If [`WalletWrite::import_account_hd`] is used to import accounts with non-sequential
+///   ZIP 32 account indices from the same seed, a call to [`WalletWrite::create_account`]
+///   will use the ZIP 32 account index just after the highest-numbered existing account.
+/// - If an account is added to the wallet, and then a later call to one of the methods
+///   would produce a UFVK that collides with that account on any FVK component (i.e.
+///   Sapling, Orchard, or transparent), an error will be returned. This can occur in the
+///   following cases:
+///   - An account is created via [`WalletWrite::create_account`] with an auto-selected
+///     ZIP 32 account index, and that index is later imported explicitly via either
+///     [`WalletWrite::import_account_ufvk`] or [`WalletWrite::import_account_hd`].
+///   - An account is imported via [`WalletWrite::import_account_ufvk`] or
+///     [`WalletWrite::import_account_hd`], and then the ZIP 32 account index
+///     corresponding to that account's UFVK is later imported either implicitly
+///     via [`WalletWrite::create_account`], or explicitly via a call to
+///     [`WalletWrite::import_account_ufvk`] or [`WalletWrite::import_account_hd`].
+///
+/// Note that an error will be returned on an FVK collision even if the UFVKs do not
+/// match exactly, e.g. if they have different subsets of components.
+///
+/// A future change to this trait might introduce a method to "upgrade" an imported
+/// account with derivation information. See [zcash/librustzcash#1284] for details.
+///
+/// Users of the `WalletWrite` trait should generally distinguish in their APIs and wallet
+/// UIs between creating a new account, and importing an account that previously existed.
+/// By convention, wallets should only allow a new account to be generated after confirmed
+/// funds have been received by the newest existing account; this allows automated account
+/// recovery to discover and recover all funds within a particular seed.
+///
+/// # Creating a new wallet
+///
+/// To create a new wallet:
+/// - Generate a new [BIP 39] mnemonic phrase, using a crate like [`bip0039`].
+/// - Derive the corresponding seed from the mnemonic phrase.
+/// - Use [`WalletWrite::create_account`] with the resulting seed.
+///
+/// Callers should construct the [`AccountBirthday`] using [`AccountBirthday::from_treestate`] for
+/// the block at height `chain_tip_height - 100`. Setting the birthday height to a tree state below
+/// the pruning depth ensures that reorgs cannot cause funds intended for the wallet to be missed;
+/// otherwise, if the chain tip height were used for the wallet birthday, a transaction targeted at
+/// a height greater than the chain tip could be mined at a height below that tip as part of a
+/// reorg.
+///
+/// # Restoring a wallet from backup
+///
+/// To restore a backed-up wallet:
+/// - Derive the seed from its BIP 39 mnemonic phrase.
+/// - Use [`WalletWrite::import_account_hd`] once for each ZIP 32 account index that the
+///   user wants to restore.
+/// - If the highest previously-used ZIP 32 account index was _not_ restored by the user,
+///   remember this index separately as `index_max`. The first time the user wants to
+///   generate a new account, use [`WalletWrite::import_account_hd`] to create the account
+///   `index_max + 1`.
+/// - [`WalletWrite::create_account`] can be used to generate subsequent new accounts in
+///   the restored wallet.
+///
+/// Automated account recovery has not yet been implemented by this crate. A wallet app
+/// that supports multiple accounts can implement it manually by tracking account balances
+/// relative to [`WalletSummary::fully_scanned_height`], and creating new accounts as
+/// funds appear in existing accounts.
+///
+/// If the number of accounts is known in advance, the wallet should create all accounts before
+/// scanning the chain so that the scan can be done in a single pass for all accounts.
+///
+/// [ZIP 32]: https://zips.z.cash/zip-0032
+/// [zcash/librustzcash#1284]: https://github.com/zcash/librustzcash/issues/1284
+/// [BIP 39]: https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki
+/// [`bip0039`]: https://crates.io/crates/bip0039
+#[cfg_attr(feature = "test-dependencies", delegatable_trait)]
 pub trait WalletWrite: WalletRead {
     /// The type of identifiers used to look up transparent UTXOs.
     type UtxoRef;
 
-    /// Tells the wallet to track the next available account-level spend authority, given
-    /// the current set of [ZIP 316] account identifiers known to the wallet database.
+    /// Tells the wallet to track the next available account-level spend authority, given the
+    /// current set of [ZIP 316] account identifiers known to the wallet database.
+    ///
+    /// The "next available account" is defined as the ZIP-32 account index immediately following
+    /// the highest existing account index among all accounts in the wallet that share the given
+    /// seed. Users of the [`WalletWrite`] trait that only call this method are guaranteed to have
+    /// accounts with sequential indices.
+    ///
+    /// Returns the account identifier for the newly-created wallet database entry, along with the
+    /// associated [`UnifiedSpendingKey`]. Note that the unique account identifier should *not* be
+    /// assumed equivalent to the ZIP 32 account index. It is an opaque identifier for a pool of
+    /// funds or set of outputs controlled by a single spending authority.
+    ///
+    /// The ZIP-32 account index may be obtained by calling [`WalletRead::get_account`]
+    /// with the returned account identifier.
     ///
-    /// Returns the account identifier for the newly-created wallet database entry, along
-    /// with the associated [`UnifiedSpendingKey`].
+    /// The [`WalletWrite`] trait documentation has more details about account creation and import.
     ///
-    /// If `seed` was imported from a backup and this method is being used to restore a
-    /// previous wallet state, you should use this method to add all of the desired
-    /// accounts before scanning the chain from the seed's birthday height.
+    /// # Arguments
+    /// - `account_name`: A human-readable name for the account.
+    /// - `seed`: The 256-byte (at least) HD seed from which to derive the account UFVK.
+    /// - `birthday`: Metadata about where to start scanning blocks to find transactions intended
+    ///   for the account.
+    /// - `key_source`: A string identifier or other metadata describing the source of the seed.
+    ///   This is treated as opaque metadata by the wallet backend; it is provided for use by
+    ///   applications which need to track additional identifying information for an account.
     ///
-    /// By convention, wallets should only allow a new account to be generated after funds
-    /// have been received by the currently-available account (in order to enable
-    /// automated account recovery).
+    /// # Implementation notes
+    ///
+    /// Implementations of this method **MUST NOT** "fill in gaps" by selecting an account index
+    /// that is lower than any existing account index among all accounts in the wallet that share
+    /// the given seed.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the length of the seed is not between 32 and 252 bytes inclusive.
     ///
     /// [ZIP 316]: https://zips.z.cash/zip-0316
     fn create_account(
         &mut self,
+        account_name: &str,
+        seed: &SecretVec<u8>,
+        birthday: &AccountBirthday,
+        key_source: Option<&str>,
+    ) -> Result<(Self::AccountId, UnifiedSpendingKey), Self::Error>;
+
+    /// Tells the wallet to track a specific account index for a given seed.
+    ///
+    /// Returns details about the imported account, including the unique account identifier for
+    /// the newly-created wallet database entry, along with the associated [`UnifiedSpendingKey`].
+    /// Note that the unique account identifier should *not* be assumed equivalent to the ZIP 32
+    /// account index. It is an opaque identifier for a pool of funds or set of outputs controlled
+    /// by a single spending authority.
+    ///
+    /// Import accounts with indices that are exactly one greater than the highest existing account
+    /// index to ensure account indices are contiguous, thereby facilitating automated account
+    /// recovery.
+    ///
+    /// The [`WalletWrite`] trait documentation has more details about account creation and import.
+    ///
+    /// # Arguments
+    /// - `account_name`: A human-readable name for the account.
+    /// - `seed`: The 256-byte (at least) HD seed from which to derive the account UFVK.
+    /// - `account_index`: The ZIP 32 account-level component of the HD derivation path at
+    ///   which to derive the account's UFVK.
+    /// - `birthday`: Metadata about where to start scanning blocks to find transactions intended
+    ///   for the account.
+    /// - `key_source`: A string identifier or other metadata describing the source of the seed.
+    ///   This is treated as opaque metadata by the wallet backend; it is provided for use by
+    ///   applications which need to track additional identifying information for an account.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the length of the seed is not between 32 and 252 bytes inclusive.
+    ///
+    /// [ZIP 316]: https://zips.z.cash/zip-0316
+    fn import_account_hd(
+        &mut self,
+        account_name: &str,
         seed: &SecretVec<u8>,
-    ) -> Result<(AccountId, UnifiedSpendingKey), Self::Error>;
+        account_index: zip32::AccountId,
+        birthday: &AccountBirthday,
+        key_source: Option<&str>,
+    ) -> Result<(Self::Account, UnifiedSpendingKey), Self::Error>;
+
+    /// Tells the wallet to track an account using a unified full viewing key.
+    ///
+    /// Returns details about the imported account, including the unique account identifier for
+    /// the newly-created wallet database entry. Unlike the other account creation APIs
+    /// ([`Self::create_account`] and [`Self::import_account_hd`]), no spending key is returned
+    /// because the wallet has no information about how the UFVK was derived.
+    ///
+    /// Certain optimizations are possible for accounts which will never be used to spend funds. If
+    /// `spending_key_available` is `false`, the wallet may choose to optimize for this case, in
+    /// which case any attempt to spend funds from the account will result in an error.
+    ///
+    /// The [`WalletWrite`] trait documentation has more details about account creation and import.
+    ///
+    /// # Arguments
+    /// - `account_name`: A human-readable name for the account.
+    /// - `unified_key`: The UFVK used to detect transactions involving the account.
+    /// - `birthday`: Metadata about where to start scanning blocks to find transactions intended
+    ///   for the account.
+    /// - `purpose`: Metadata describing whether or not data required for spending should be
+    ///   tracked by the wallet.
+    /// - `key_source`: A string identifier or other metadata describing the source of the seed.
+    ///   This is treated as opaque metadata by the wallet backend; it is provided for use by
+    ///   applications which need to track additional identifying information for an account.
+    ///
+    /// # Panics
+    ///
+    /// Panics if the length of the seed is not between 32 and 252 bytes inclusive.
+    fn import_account_ufvk(
+        &mut self,
+        account_name: &str,
+        unified_key: &UnifiedFullViewingKey,
+        birthday: &AccountBirthday,
+        purpose: AccountPurpose,
+        key_source: Option<&str>,
+    ) -> Result<Self::Account, Self::Error>;
 
     /// Generates and persists the next available diversified address, given the current
     /// addresses known to the wallet.
@@ -378,271 +2371,183 @@ pub trait WalletWrite: WalletRead {
     /// account.
     fn get_next_available_address(
         &mut self,
-        account: AccountId,
+        account: Self::AccountId,
+        request: UnifiedAddressRequest,
     ) -> Result<Option<UnifiedAddress>, Self::Error>;
 
-    /// Updates the state of the wallet database by persisting the provided
-    /// block information, along with the updated witness data that was
-    /// produced when scanning the block for transactions pertaining to
-    /// this wallet.
-    #[allow(clippy::type_complexity)]
-    fn advance_by_block(
-        &mut self,
-        block: &PrunedBlock,
-        updated_witnesses: &[(Self::NoteRef, sapling::IncrementalWitness)],
-    ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error>;
-
-    /// Caches a decrypted transaction in the persistent wallet store.
-    fn store_decrypted_tx(
-        &mut self,
-        received_tx: DecryptedTransaction,
-    ) -> Result<Self::TxRef, Self::Error>;
-
-    /// Saves information about a transaction that was constructed and sent by the wallet to the
-    /// persistent wallet store.
-    fn store_sent_tx(&mut self, sent_tx: &SentTransaction) -> Result<Self::TxRef, Self::Error>;
-
-    /// Truncates the wallet database to the specified height.
-    ///
-    /// This method assumes that the state of the underlying data store is
-    /// consistent up to a particular block height. Since it is possible that
-    /// a chain reorg might invalidate some stored state, this method must be
-    /// implemented in order to allow users of this API to "reset" the data store
-    /// to correctly represent chainstate as of a specified block height.
+    /// Updates the wallet's view of the blockchain.
     ///
-    /// After calling this method, the block at the given height will be the
-    /// most recent block and all other operations will treat this block
-    /// as the chain tip for balance determination purposes.
+    /// This method is used to provide the wallet with information about the state of the
+    /// blockchain, and detect any previously scanned data that needs to be re-validated
+    /// before proceeding with scanning. It should be called at wallet startup prior to calling
+    /// [`WalletRead::suggest_scan_ranges`] in order to provide the wallet with the information it
+    /// needs to correctly prioritize scanning operations.
+    fn update_chain_tip(&mut self, tip_height: BlockHeight) -> Result<(), Self::Error>;
+
+    /// Updates the state of the wallet database by persisting the provided block information,
+    /// along with the note commitments that were detected when scanning the block for transactions
+    /// pertaining to this wallet.
     ///
-    /// There may be restrictions on heights to which it is possible to truncate.
-    fn truncate_to_height(&mut self, block_height: BlockHeight) -> Result<(), Self::Error>;
+    /// ### Arguments
+    /// - `from_state` must be the chain state for the block height prior to the first
+    ///   block in `blocks`.
+    /// - `blocks` must be sequential, in order of increasing block height.
+    fn put_blocks(
+        &mut self,
+        from_state: &ChainState,
+        blocks: Vec<ScannedBlock<Self::AccountId>>,
+    ) -> Result<(), Self::Error>;
 
     /// Adds a transparent UTXO received by the wallet to the data store.
     fn put_received_transparent_utxo(
         &mut self,
         output: &WalletTransparentOutput,
     ) -> Result<Self::UtxoRef, Self::Error>;
-}
-
-#[cfg(feature = "test-dependencies")]
-pub mod testing {
-    use secrecy::{ExposeSecret, SecretVec};
-    use std::collections::HashMap;
-
-    use zcash_primitives::{
-        block::BlockHash,
-        consensus::{BlockHeight, Network},
-        legacy::TransparentAddress,
-        memo::Memo,
-        sapling,
-        transaction::{
-            components::{Amount, OutPoint},
-            Transaction, TxId,
-        },
-        zip32::{AccountId, ExtendedFullViewingKey},
-    };
-
-    use crate::{
-        address::{AddressMetadata, UnifiedAddress},
-        keys::{UnifiedFullViewingKey, UnifiedSpendingKey},
-        wallet::{ReceivedSaplingNote, WalletTransparentOutput},
-    };
-
-    use super::{
-        DecryptedTransaction, NullifierQuery, PrunedBlock, SentTransaction, WalletRead, WalletWrite,
-    };
-
-    pub struct MockWalletDb {
-        pub network: Network,
-    }
-
-    impl WalletRead for MockWalletDb {
-        type Error = ();
-        type NoteRef = u32;
-        type TxRef = TxId;
-
-        fn block_height_extrema(&self) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error> {
-            Ok(None)
-        }
-
-        fn get_min_unspent_height(&self) -> Result<Option<BlockHeight>, Self::Error> {
-            Ok(None)
-        }
-
-        fn get_block_hash(
-            &self,
-            _block_height: BlockHeight,
-        ) -> Result<Option<BlockHash>, Self::Error> {
-            Ok(None)
-        }
-
-        fn get_tx_height(&self, _txid: TxId) -> Result<Option<BlockHeight>, Self::Error> {
-            Ok(None)
-        }
-
-        fn get_current_address(
-            &self,
-            _account: AccountId,
-        ) -> Result<Option<UnifiedAddress>, Self::Error> {
-            Ok(None)
-        }
-
-        fn get_unified_full_viewing_keys(
-            &self,
-        ) -> Result<HashMap<AccountId, UnifiedFullViewingKey>, Self::Error> {
-            Ok(HashMap::new())
-        }
-
-        fn get_account_for_ufvk(
-            &self,
-            _ufvk: &UnifiedFullViewingKey,
-        ) -> Result<Option<AccountId>, Self::Error> {
-            Ok(None)
-        }
-
-        fn is_valid_account_extfvk(
-            &self,
-            _account: AccountId,
-            _extfvk: &ExtendedFullViewingKey,
-        ) -> Result<bool, Self::Error> {
-            Ok(false)
-        }
-
-        fn get_balance_at(
-            &self,
-            _account: AccountId,
-            _anchor_height: BlockHeight,
-        ) -> Result<Amount, Self::Error> {
-            Ok(Amount::zero())
-        }
-
-        fn get_memo(&self, _id_note: Self::NoteRef) -> Result<Option<Memo>, Self::Error> {
-            Ok(None)
-        }
-
-        fn get_transaction(&self, _id_tx: Self::TxRef) -> Result<Transaction, Self::Error> {
-            Err(())
-        }
-
-        fn get_commitment_tree(
-            &self,
-            _block_height: BlockHeight,
-        ) -> Result<Option<sapling::CommitmentTree>, Self::Error> {
-            Ok(None)
-        }
-
-        #[allow(clippy::type_complexity)]
-        fn get_witnesses(
-            &self,
-            _block_height: BlockHeight,
-        ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error> {
-            Ok(Vec::new())
-        }
-
-        fn get_sapling_nullifiers(
-            &self,
-            _query: NullifierQuery,
-        ) -> Result<Vec<(AccountId, sapling::Nullifier)>, Self::Error> {
-            Ok(Vec::new())
-        }
-
-        fn get_spendable_sapling_notes(
-            &self,
-            _account: AccountId,
-            _anchor_height: BlockHeight,
-            _exclude: &[Self::NoteRef],
-        ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error> {
-            Ok(Vec::new())
-        }
-
-        fn select_spendable_sapling_notes(
-            &self,
-            _account: AccountId,
-            _target_value: Amount,
-            _anchor_height: BlockHeight,
-            _exclude: &[Self::NoteRef],
-        ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error> {
-            Ok(Vec::new())
-        }
 
-        fn get_transparent_receivers(
-            &self,
-            _account: AccountId,
-        ) -> Result<HashMap<TransparentAddress, AddressMetadata>, Self::Error> {
-            Ok(HashMap::new())
-        }
+    /// Caches a decrypted transaction in the persistent wallet store.
+    fn store_decrypted_tx(
+        &mut self,
+        received_tx: DecryptedTransaction<Self::AccountId>,
+    ) -> Result<(), Self::Error>;
 
-        fn get_unspent_transparent_outputs(
-            &self,
-            _address: &TransparentAddress,
-            _anchor_height: BlockHeight,
-            _exclude: &[OutPoint],
-        ) -> Result<Vec<WalletTransparentOutput>, Self::Error> {
-            Ok(Vec::new())
-        }
+    /// Saves information about transactions constructed by the wallet to the persistent
+    /// wallet store.
+    ///
+    /// This must be called before the transactions are sent to the network.
+    ///
+    /// Transactions that have been stored by this method should be retransmitted while it
+    /// is still possible that they could be mined.
+    fn store_transactions_to_be_sent(
+        &mut self,
+        transactions: &[SentTransaction<Self::AccountId>],
+    ) -> Result<(), Self::Error>;
 
-        fn get_transparent_balances(
-            &self,
-            _account: AccountId,
-            _max_height: BlockHeight,
-        ) -> Result<HashMap<TransparentAddress, Amount>, Self::Error> {
-            Ok(HashMap::new())
-        }
+    /// Truncates the wallet database to at most the specified height.
+    ///
+    /// Implementations of this method may choose a lower block height to which the data store will
+    /// be truncated if it is not possible to truncate exactly to the specified height. Upon
+    /// successful truncation, this method returns the height to which the data store was actually
+    /// truncated.
+    ///
+    /// This method assumes that the state of the underlying data store is consistent up to a
+    /// particular block height. Since it is possible that a chain reorg might invalidate some
+    /// stored state, this method must be implemented in order to allow users of this API to
+    /// "reset" the data store to correctly represent chainstate as of at most the requested block
+    /// height.
+    ///
+    /// After calling this method, the block at the returned height will be the most recent block
+    /// and all other operations will treat this block as the chain tip for balance determination
+    /// purposes.
+    ///
+    /// There may be restrictions on heights to which it is possible to truncate. Specifically, it
+    /// will only be possible to truncate to heights at which is is possible to create a witness
+    /// given the current state of the wallet's note commitment tree.
+    fn truncate_to_height(&mut self, max_height: BlockHeight) -> Result<BlockHeight, Self::Error>;
+
+    /// Reserves the next `n` available ephemeral addresses for the given account.
+    /// This cannot be undone, so as far as possible, errors associated with transaction
+    /// construction should have been reported before calling this method.
+    ///
+    /// To ensure that sufficient information is stored on-chain to allow recovering
+    /// funds sent back to any of the used addresses, a "gap limit" of 20 addresses
+    /// should be observed as described in [BIP 44].
+    ///
+    /// Returns an error if there is insufficient space within the gap limit to allocate
+    /// the given number of addresses, or if the account identifier does not correspond
+    /// to a known account.
+    ///
+    /// [BIP 44]: https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki#user-content-Address_gap_limit
+    #[cfg(feature = "transparent-inputs")]
+    fn reserve_next_n_ephemeral_addresses(
+        &mut self,
+        _account_id: Self::AccountId,
+        _n: usize,
+    ) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, Self::Error> {
+        // Default impl is required for feature-flagged trait methods to prevent
+        // breakage due to inadvertent activation of features by transitive dependencies
+        // of the implementing crate.
+        Ok(vec![])
     }
 
-    impl WalletWrite for MockWalletDb {
-        type UtxoRef = u32;
-
-        fn create_account(
-            &mut self,
-            seed: &SecretVec<u8>,
-        ) -> Result<(AccountId, UnifiedSpendingKey), Self::Error> {
-            let account = AccountId::from(0);
-            UnifiedSpendingKey::from_seed(&self.network, seed.expose_secret(), account)
-                .map(|k| (account, k))
-                .map_err(|_| ())
-        }
-
-        fn get_next_available_address(
-            &mut self,
-            _account: AccountId,
-        ) -> Result<Option<UnifiedAddress>, Self::Error> {
-            Ok(None)
-        }
-
-        #[allow(clippy::type_complexity)]
-        fn advance_by_block(
-            &mut self,
-            _block: &PrunedBlock,
-            _updated_witnesses: &[(Self::NoteRef, sapling::IncrementalWitness)],
-        ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error> {
-            Ok(vec![])
-        }
-
-        fn store_decrypted_tx(
-            &mut self,
-            _received_tx: DecryptedTransaction,
-        ) -> Result<Self::TxRef, Self::Error> {
-            Ok(TxId::from_bytes([0u8; 32]))
-        }
-
-        fn store_sent_tx(
-            &mut self,
-            _sent_tx: &SentTransaction,
-        ) -> Result<Self::TxRef, Self::Error> {
-            Ok(TxId::from_bytes([0u8; 32]))
-        }
-
-        fn truncate_to_height(&mut self, _block_height: BlockHeight) -> Result<(), Self::Error> {
-            Ok(())
-        }
+    /// Updates the wallet backend with respect to the status of a specific transaction, from the
+    /// perspective of the main chain.
+    ///
+    /// Fully transparent transactions, and transactions that do not contain either shielded inputs
+    /// or shielded outputs belonging to the wallet, may not be discovered by the process of chain
+    /// scanning; as a consequence, the wallet must actively query to determine whether such
+    /// transactions have been mined.
+    fn set_transaction_status(
+        &mut self,
+        _txid: TxId,
+        _status: TransactionStatus,
+    ) -> Result<(), Self::Error>;
+}
 
-        /// Adds a transparent UTXO received by the wallet to the data store.
-        fn put_received_transparent_utxo(
-            &mut self,
-            _output: &WalletTransparentOutput,
-        ) -> Result<Self::UtxoRef, Self::Error> {
-            Ok(0)
-        }
-    }
+/// This trait describes a capability for manipulating wallet note commitment trees.
+#[cfg_attr(feature = "test-dependencies", delegatable_trait)]
+pub trait WalletCommitmentTrees {
+    type Error: Debug;
+
+    /// The type of the backing [`ShardStore`] for the Sapling note commitment tree.
+    type SaplingShardStore<'a>: ShardStore<
+        H = sapling::Node,
+        CheckpointId = BlockHeight,
+        Error = Self::Error,
+    >;
+
+    /// Evaluates the given callback function with a reference to the Sapling
+    /// note commitment tree maintained by the wallet.
+    fn with_sapling_tree_mut<F, A, E>(&mut self, callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::SaplingShardStore<'a>,
+                { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+                SAPLING_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Self::Error>>;
+
+    /// Adds a sequence of Sapling note commitment tree subtree roots to the data store.
+    ///
+    /// Each such value should be the Merkle root of a subtree of the Sapling note commitment tree
+    /// containing 2^[`SAPLING_SHARD_HEIGHT`] note commitments.
+    fn put_sapling_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<sapling::Node>],
+    ) -> Result<(), ShardTreeError<Self::Error>>;
+
+    /// The type of the backing [`ShardStore`] for the Orchard note commitment tree.
+    #[cfg(feature = "orchard")]
+    type OrchardShardStore<'a>: ShardStore<
+        H = orchard::tree::MerkleHashOrchard,
+        CheckpointId = BlockHeight,
+        Error = Self::Error,
+    >;
+
+    /// Evaluates the given callback function with a reference to the Orchard
+    /// note commitment tree maintained by the wallet.
+    #[cfg(feature = "orchard")]
+    fn with_orchard_tree_mut<F, A, E>(&mut self, callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::OrchardShardStore<'a>,
+                { ORCHARD_SHARD_HEIGHT * 2 },
+                ORCHARD_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Self::Error>>;
+
+    /// Adds a sequence of Orchard note commitment tree subtree roots to the data store.
+    ///
+    /// Each such value should be the Merkle root of a subtree of the Orchard note commitment tree
+    /// containing 2^[`ORCHARD_SHARD_HEIGHT`] note commitments.
+    #[cfg(feature = "orchard")]
+    fn put_orchard_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<orchard::tree::MerkleHashOrchard>],
+    ) -> Result<(), ShardTreeError<Self::Error>>;
 }
diff --git a/zcash_client_backend/src/data_api/chain.rs b/zcash_client_backend/src/data_api/chain.rs
index 44736228df..f05394fe42 100644
--- a/zcash_client_backend/src/data_api/chain.rs
+++ b/zcash_client_backend/src/data_api/chain.rs
@@ -7,19 +7,20 @@
 //! # #[cfg(feature = "test-dependencies")]
 //! # {
 //! use zcash_primitives::{
-//!     consensus::{BlockHeight, Network, Parameters}
+//!     consensus::{BlockHeight, Network, Parameters},
 //! };
 //!
 //! use zcash_client_backend::{
 //!     data_api::{
-//!         WalletRead, WalletWrite,
+//!         WalletRead, WalletWrite, WalletCommitmentTrees,
 //!         chain::{
 //!             BlockSource,
+//!             CommitmentTreeRoot,
 //!             error::Error,
 //!             scan_cached_blocks,
-//!             validate_chain,
 //!             testing as chain_testing,
 //!         },
+//!         scanning::ScanPriority,
 //!         testing,
 //!     },
 //! };
@@ -30,81 +31,184 @@
 //! #   test();
 //! # }
 //! #
-//! # fn test() -> Result<(), Error<(), Infallible, u32>> {
+//! # fn test() -> Result<(), Error<(), Infallible>> {
 //! let network = Network::TestNetwork;
 //! let block_source = chain_testing::MockBlockSource;
-//! let mut db_data = testing::MockWalletDb {
-//!     network: Network::TestNetwork
-//! };
+//! let mut wallet_db = testing::MockWalletDb::new(Network::TestNetwork);
 //!
-//! // 1) Download new CompactBlocks into block_source.
+//! // 1) Download note commitment tree data from lightwalletd
+//! let roots: Vec<CommitmentTreeRoot<sapling::Node>> = unimplemented!();
 //!
-//! // 2) Run the chain validator on the received blocks.
-//! //
-//! // Given that we assume the server always gives us correct-at-the-time blocks, any
-//! // errors are in the blocks we have previously cached or scanned.
-//! let max_height_hash = db_data.get_max_height_hash().map_err(Error::Wallet)?;
-//! if let Err(e) = validate_chain(&block_source, max_height_hash, None) {
-//!     match e {
-//!         Error::Chain(e) => {
-//!             // a) Pick a height to rewind to.
-//!             //
-//!             // This might be informed by some external chain reorg information, or
-//!             // heuristics such as the platform, available bandwidth, size of recent
-//!             // CompactBlocks, etc.
-//!             let rewind_height = e.at_height() - 10;
+//! // 2) Pass the commitment tree data to the database.
+//! wallet_db.put_sapling_subtree_roots(0, &roots).unwrap();
 //!
-//!             // b) Rewind scanned block information.
-//!             db_data.truncate_to_height(rewind_height);
+//! // 3) Download chain tip metadata from lightwalletd
+//! let tip_height: BlockHeight = unimplemented!();
 //!
-//!             // c) Delete cached blocks from rewind_height onwards.
-//!             //
-//!             // This does imply that assumed-valid blocks will be re-downloaded, but it
-//!             // is also possible that in the intervening time, a chain reorg has
-//!             // occurred that orphaned some of those blocks.
+//! // 4) Notify the wallet of the updated chain tip.
+//! wallet_db.update_chain_tip(tip_height).map_err(Error::Wallet)?;
 //!
-//!             // d) If there is some separate thread or service downloading
-//!             // CompactBlocks, tell it to go back and download from rewind_height
-//!             // onwards.
-//!         },
-//!         e => {
-//!             // handle or return other errors
+//! // 5) Get the suggested scan ranges from the wallet database
+//! let mut scan_ranges = wallet_db.suggest_scan_ranges().map_err(Error::Wallet)?;
+//!
+//! // 6) Run the following loop until the wallet's view of the chain tip as of the previous wallet
+//! //    session is valid.
+//! loop {
+//!     // If there is a range of blocks that needs to be verified, it will always be returned as
+//!     // the first element of the vector of suggested ranges.
+//!     match scan_ranges.first() {
+//!         Some(scan_range) if scan_range.priority() == ScanPriority::Verify => {
+//!             // Download the chain state for the block prior to the start of the range you want
+//!             // to scan.
+//!             let chain_state = unimplemented!("get_chain_state(scan_range.block_range().start - 1)?;");
+//!             // Download the blocks in `scan_range` into the block source, overwriting any
+//!             // existing blocks in this range.
+//!             unimplemented!("cache_blocks(scan_range)?;");
+//!
+//!             // Scan the downloaded blocks
+//!             let scan_result = scan_cached_blocks(
+//!                 &network,
+//!                 &block_source,
+//!                 &mut wallet_db,
+//!                 scan_range.block_range().start,
+//!                 chain_state,
+//!                 scan_range.len()
+//!             );
+//!
+//!             // Check for scanning errors that indicate that the wallet's chain tip is out of
+//!             // sync with blockchain history.
+//!             match scan_result {
+//!                 Ok(_) => {
+//!                     // At this point, the cache and scanned data are locally consistent (though
+//!                     // not necessarily consistent with the latest chain tip - this would be
+//!                     // discovered the next time this codepath is executed after new blocks are
+//!                     // received) so we can break out of the loop.
+//!                     break;
+//!                 }
+//!                 Err(Error::Scan(err)) if err.is_continuity_error() => {
+//!                     // Pick a height to rewind to, which must be at least one block before
+//!                     // the height at which the error occurred, but may be an earlier height
+//!                     // determined based on heuristics such as the platform, available bandwidth,
+//!                     // size of recent CompactBlocks, etc.
+//!                     let rewind_height = err.at_height().saturating_sub(10);
+//!
+//!                     // Rewind to the chosen height.
+//!                     wallet_db.truncate_to_height(rewind_height).map_err(Error::Wallet)?;
+//!
+//!                     // Delete cached blocks from rewind_height onwards.
+//!                     //
+//!                     // This does imply that assumed-valid blocks will be re-downloaded, but it
+//!                     // is also possible that in the intervening time, a chain reorg has
+//!                     // occurred that orphaned some of those blocks.
+//!                     unimplemented!();
+//!                 }
+//!                 Err(other) => {
+//!                     // Handle or return other errors
+//!                 }
+//!             }
 //!
+//!             // In case we updated the suggested scan ranges, now re-request.
+//!             scan_ranges = wallet_db.suggest_scan_ranges().map_err(Error::Wallet)?;
+//!         }
+//!         _ => {
+//!             // Nothing to verify; break out of the loop
+//!             break;
 //!         }
 //!     }
 //! }
 //!
-//! // 3) Scan (any remaining) cached blocks.
-//! //
-//! // At this point, the cache and scanned data are locally consistent (though not
-//! // necessarily consistent with the latest chain tip - this would be discovered the
-//! // next time this codepath is executed after new blocks are received).
-//! scan_cached_blocks(&network, &block_source, &mut db_data, None)
+//! // 7) Loop over the remaining suggested scan ranges, retrieving the requested data and calling
+//! //    `scan_cached_blocks` on each range. Periodically, or if a continuity error is
+//! //    encountered, this process should be repeated starting at step (3).
+//! let scan_ranges = wallet_db.suggest_scan_ranges().map_err(Error::Wallet)?;
+//! for scan_range in scan_ranges {
+//!     // Download the chain state for the block prior to the start of the range you want
+//!     // to scan.
+//!     let chain_state = unimplemented!("get_chain_state(scan_range.block_range().start - 1)?;");
+//!     // Download the blocks in `scan_range` into the block source. While in this example this
+//!     // step is performed in-line, it's fine for the download of scan ranges to be asynchronous
+//!     // and for the scanner to process the downloaded ranges as they become available in a
+//!     // separate thread. The scan ranges should also be broken down into smaller chunks as
+//!     // appropriate, and for ranges with priority `Historic` it can be useful to download and
+//!     // scan the range in reverse order (to discover more recent unspent notes sooner), or from
+//!     // the start and end of the range inwards.
+//!     unimplemented!("cache_blocks(scan_range)?;");
+//!
+//!     // Scan the downloaded blocks.
+//!     let scan_result = scan_cached_blocks(
+//!         &network,
+//!         &block_source,
+//!         &mut wallet_db,
+//!         scan_range.block_range().start,
+//!         chain_state,
+//!         scan_range.len()
+//!     )?;
+//!
+//!     // Handle scan errors, etc.
+//! }
+//! # Ok(())
 //! # }
 //! # }
 //! ```
 
-use std::convert::Infallible;
+use std::ops::Range;
 
+use incrementalmerkletree::frontier::Frontier;
+use subtle::ConditionallySelectable;
 use zcash_primitives::{
     block::BlockHash,
     consensus::{self, BlockHeight},
-    sapling::{self, note_encryption::PreparedIncomingViewingKey, Nullifier},
-    zip32::Scope,
 };
 
 use crate::{
-    data_api::{PrunedBlock, WalletWrite},
+    data_api::{NullifierQuery, WalletWrite},
     proto::compact_formats::CompactBlock,
-    scan::BatchRunner,
-    wallet::WalletTx,
-    welding_rig::{add_block_to_runner, scan_block_with_runner},
+    scanning::{scan_block_with_runners, BatchRunners, Nullifiers, ScanningKeys},
+};
+
+#[cfg(feature = "sync")]
+use {
+    super::scanning::ScanPriority, crate::data_api::scanning::ScanRange, async_trait::async_trait,
 };
 
 pub mod error;
-use error::{ChainError, Error};
+use error::Error;
+
+use super::WalletRead;
 
-use super::NullifierQuery;
+/// A struct containing metadata about a subtree root of the note commitment tree.
+///
+/// This stores the block height at which the leaf that completed the subtree was
+/// added, and the root hash of the complete subtree.
+#[derive(Debug)]
+pub struct CommitmentTreeRoot<H> {
+    subtree_end_height: BlockHeight,
+    root_hash: H,
+}
+
+impl<H> CommitmentTreeRoot<H> {
+    /// Construct a new `CommitmentTreeRoot` from its constituent parts.
+    ///
+    /// - `subtree_end_height`: The height of the block containing the note commitment that
+    ///   completed the subtree.
+    /// - `root_hash`: The Merkle root of the completed subtree.
+    pub fn from_parts(subtree_end_height: BlockHeight, root_hash: H) -> Self {
+        Self {
+            subtree_end_height,
+            root_hash,
+        }
+    }
+
+    /// Returns the block height at which the leaf that completed the subtree was added.
+    pub fn subtree_end_height(&self) -> BlockHeight {
+        self.subtree_end_height
+    }
+
+    /// Returns the root of the complete subtree.
+    pub fn root_hash(&self) -> &H {
+        &self.root_hash
+    }
+}
 
 /// This trait provides sequential access to raw blockchain data via a callback-oriented
 /// API.
@@ -119,260 +223,479 @@ pub trait BlockSource {
     ///   as part of processing each row.
     /// * `NoteRefT`: the type of note identifiers in the wallet data store, for use in
     ///   reporting errors related to specific notes.
-    fn with_blocks<F, WalletErrT, NoteRefT>(
+    fn with_blocks<F, WalletErrT>(
         &self,
         from_height: Option<BlockHeight>,
-        limit: Option<u32>,
-        with_row: F,
-    ) -> Result<(), error::Error<WalletErrT, Self::Error, NoteRefT>>
+        limit: Option<usize>,
+        with_block: F,
+    ) -> Result<(), error::Error<WalletErrT, Self::Error>>
     where
-        F: FnMut(CompactBlock) -> Result<(), error::Error<WalletErrT, Self::Error, NoteRefT>>;
+        F: FnMut(CompactBlock) -> Result<(), error::Error<WalletErrT, Self::Error>>;
 }
 
-/// Checks that the scanned blocks in the data database, when combined with the recent
-/// `CompactBlock`s in the block_source database, form a valid chain.
+/// `BlockCache` is a trait that extends `BlockSource` and defines methods for managing
+/// a cache of compact blocks.
 ///
-/// This function is built on the core assumption that the information provided in the
-/// block source is more likely to be accurate than the previously-scanned information.
-/// This follows from the design (and trust) assumption that the `lightwalletd` server
-/// provides accurate block information as of the time it was requested.
+/// # Examples
 ///
-/// Arguments:
-/// - `block_source` Source of compact blocks
-/// - `validate_from` Height & hash of last validated block;
-/// - `limit` specified number of blocks that will be valididated. Callers providing
-/// a `limit` argument are responsible of making subsequent calls to `validate_chain()`
-/// to complete validating the remaining blocks stored on the `block_source`. If `none`
-/// is provided, there will be no limit set to the validation and upper bound of the
-/// validation range will be the latest height present in the `block_source`.
+/// ```
+///    use async_trait::async_trait;
+///    use std::sync::{Arc, Mutex};
+///    use zcash_client_backend::data_api::{
+///        chain::{error, BlockCache, BlockSource},
+///        scanning::{ScanPriority, ScanRange},
+///    };
+///    use zcash_client_backend::proto::compact_formats::CompactBlock;
+///    use zcash_primitives::consensus::BlockHeight;
 ///
-/// Returns:
-/// - `Ok(())` if the combined chain is valid up to the given height
-/// and block hash.
-/// - `Err(Error::Chain(cause))` if the combined chain is invalid.
-/// - `Err(e)` if there was an error during validation unrelated to chain validity.
-pub fn validate_chain<BlockSourceT>(
-    block_source: &BlockSourceT,
-    mut validate_from: Option<(BlockHeight, BlockHash)>,
-    limit: Option<u32>,
-) -> Result<(), Error<Infallible, BlockSourceT::Error, Infallible>>
+///    struct ExampleBlockCache {
+///        cached_blocks: Arc<Mutex<Vec<CompactBlock>>>,
+///    }
+///
+/// #    impl BlockSource for ExampleBlockCache {
+/// #        type Error = ();
+/// #
+/// #        fn with_blocks<F, WalletErrT>(
+/// #            &self,
+/// #            _from_height: Option<BlockHeight>,
+/// #            _limit: Option<usize>,
+/// #            _with_block: F,
+/// #        ) -> Result<(), error::Error<WalletErrT, Self::Error>>
+/// #        where
+/// #            F: FnMut(CompactBlock) -> Result<(), error::Error<WalletErrT, Self::Error>>,
+/// #        {
+/// #            Ok(())
+/// #        }
+/// #    }
+/// #
+///    #[async_trait]
+///    impl BlockCache for ExampleBlockCache {
+///        fn get_tip_height(&self, range: Option<&ScanRange>) -> Result<Option<BlockHeight>, Self::Error> {
+///            let cached_blocks = self.cached_blocks.lock().unwrap();
+///            let blocks: Vec<&CompactBlock> = match range {
+///                Some(range) => cached_blocks
+///                    .iter()
+///                    .filter(|&block| {
+///                        let block_height = BlockHeight::from_u32(block.height as u32);
+///                        range.block_range().contains(&block_height)
+///                    })
+///                    .collect(),
+///                None => cached_blocks.iter().collect(),
+///            };
+///            let highest_block = blocks.iter().max_by_key(|&&block| block.height);
+///            Ok(highest_block.map(|&block| BlockHeight::from_u32(block.height as u32)))
+///        }
+///
+///        async fn read(&self, range: &ScanRange) -> Result<Vec<CompactBlock>, Self::Error> {
+///            Ok(self
+///                .cached_blocks
+///                .lock()
+///                .unwrap()
+///                .iter()
+///                .filter(|block| {
+///                    let block_height = BlockHeight::from_u32(block.height as u32);
+///                    range.block_range().contains(&block_height)
+///                })
+///                .cloned()
+///                .collect())
+///        }
+///
+///        async fn insert(&self, mut compact_blocks: Vec<CompactBlock>) -> Result<(), Self::Error> {
+///            self.cached_blocks
+///                .lock()
+///                .unwrap()
+///                .append(&mut compact_blocks);
+///            Ok(())
+///        }
+///
+///        async fn delete(&self, range: ScanRange) -> Result<(), Self::Error> {
+///            self.cached_blocks
+///                .lock()
+///                .unwrap()
+///                .retain(|block| !range.block_range().contains(&BlockHeight::from_u32(block.height as u32)));
+///            Ok(())
+///        }
+///    }
+///
+///    // Example usage
+///    let rt = tokio::runtime::Runtime::new().unwrap();
+///    let mut block_cache = ExampleBlockCache {
+///        cached_blocks: Arc::new(Mutex::new(Vec::new())),
+///    };
+///    let range = ScanRange::from_parts(
+///        BlockHeight::from_u32(1)..BlockHeight::from_u32(3),
+///        ScanPriority::Historic,
+///    );
+/// #    let extsk = sapling::zip32::ExtendedSpendingKey::master(&[]);
+/// #    let dfvk = extsk.to_diversifiable_full_viewing_key();
+/// #    let compact_block1 = zcash_client_backend::scanning::testing::fake_compact_block(
+/// #        1u32.into(),
+/// #        zcash_primitives::block::BlockHash([0; 32]),
+/// #        sapling::Nullifier([0; 32]),
+/// #        &dfvk,
+/// #        zcash_primitives::transaction::components::amount::NonNegativeAmount::const_from_u64(5),
+/// #        false,
+/// #        None,
+/// #    );
+/// #    let compact_block2 = zcash_client_backend::scanning::testing::fake_compact_block(
+/// #        2u32.into(),
+/// #        zcash_primitives::block::BlockHash([0; 32]),
+/// #        sapling::Nullifier([0; 32]),
+/// #        &dfvk,
+/// #        zcash_primitives::transaction::components::amount::NonNegativeAmount::const_from_u64(5),
+/// #        false,
+/// #        None,
+/// #    );
+///    let compact_blocks = vec![compact_block1, compact_block2];
+///
+///    // Insert blocks into the block cache
+///    rt.block_on(async {
+///        block_cache.insert(compact_blocks.clone()).await.unwrap();
+///    });
+///    assert_eq!(block_cache.cached_blocks.lock().unwrap().len(), 2);
+///
+///    // Find highest block in the block cache
+///    let get_tip_height = block_cache.get_tip_height(None).unwrap();
+///    assert_eq!(get_tip_height, Some(BlockHeight::from_u32(2)));
+///
+///    // Read from the block cache
+///    rt.block_on(async {
+///        let blocks_from_cache = block_cache.read(&range).await.unwrap();
+///        assert_eq!(blocks_from_cache, compact_blocks);
+///    });
+///
+///    // Truncate the block cache
+///    rt.block_on(async {
+///        block_cache.truncate(BlockHeight::from_u32(1)).await.unwrap();
+///    });
+///    assert_eq!(block_cache.cached_blocks.lock().unwrap().len(), 1);
+///    assert_eq!(
+///        block_cache.get_tip_height(None).unwrap(),
+///        Some(BlockHeight::from_u32(1))
+///    );
+///
+///    // Delete blocks from the block cache
+///    rt.block_on(async {
+///        block_cache.delete(range).await.unwrap();
+///    });
+///    assert_eq!(block_cache.cached_blocks.lock().unwrap().len(), 0);
+///    assert_eq!(block_cache.get_tip_height(None).unwrap(), None);
+/// ```
+#[cfg(feature = "sync")]
+#[async_trait]
+pub trait BlockCache: BlockSource + Send + Sync
 where
-    BlockSourceT: BlockSource,
+    Self::Error: Send,
 {
-    // The block source will contain blocks above the `validate_from` height.  Validate from that
-    // maximum height up to the chain tip, returning the hash of the block found in the block
-    // source at the `validate_from` height, which can then be used to verify chain integrity by
-    // comparing against the `validate_from` hash.
-
-    block_source.with_blocks::<_, Infallible, Infallible>(
-        validate_from.map(|(h, _)| h),
-        limit,
-        move |block| {
-            if let Some((valid_height, valid_hash)) = validate_from {
-                if block.height() != valid_height + 1 {
-                    return Err(ChainError::block_height_discontinuity(
-                        valid_height + 1,
-                        block.height(),
-                    )
-                    .into());
-                } else if block.prev_hash() != valid_hash {
-                    return Err(ChainError::prev_hash_mismatch(block.height()).into());
-                }
-            }
+    /// Finds the height of the highest block known to the block cache within a specified range.
+    ///
+    /// If `range` is `None`, returns the tip of the entire cache.
+    /// If no blocks are found in the cache, returns Ok(`None`).
+    fn get_tip_height(&self, range: Option<&ScanRange>)
+        -> Result<Option<BlockHeight>, Self::Error>;
 
-            validate_from = Some((block.height(), block.hash()));
-            Ok(())
-        },
-    )
+    /// Retrieves contiguous compact blocks specified by the given `range` from the block cache.
+    ///
+    /// Short reads are allowed, meaning that this method may return fewer blocks than requested
+    /// provided that all returned blocks are contiguous and start from `range.block_range().start`.
+    ///
+    /// # Errors
+    ///
+    /// This method should return an error if contiguous blocks cannot be read from the cache,
+    /// indicating there are blocks missing.
+    async fn read(&self, range: &ScanRange) -> Result<Vec<CompactBlock>, Self::Error>;
+
+    /// Inserts a vec of compact blocks into the block cache.
+    ///
+    /// This method permits insertion of non-contiguous compact blocks.
+    async fn insert(&self, compact_blocks: Vec<CompactBlock>) -> Result<(), Self::Error>;
+
+    /// Removes all cached blocks above a specified block height.
+    async fn truncate(&self, block_height: BlockHeight) -> Result<(), Self::Error> {
+        if let Some(latest) = self.get_tip_height(None)? {
+            self.delete(ScanRange::from_parts(
+                Range {
+                    start: block_height + 1,
+                    end: latest + 1,
+                },
+                ScanPriority::Ignored,
+            ))
+            .await?;
+        }
+        Ok(())
+    }
+
+    /// Deletes a range of compact blocks from the block cache.
+    ///
+    /// # Errors
+    ///
+    /// In the case of an error, some blocks requested for deletion may remain in the block cache.
+    async fn delete(&self, range: ScanRange) -> Result<(), Self::Error>;
 }
 
-/// Scans at most `limit` new blocks added to the block source for any transactions received by the
-/// tracked accounts.
-///
-/// This function will return without error after scanning at most `limit` new blocks, to enable
-/// the caller to update their UI with scanning progress. Repeatedly calling this function will
-/// process sequential ranges of blocks, and is equivalent to calling `scan_cached_blocks` and
-/// passing `None` for the optional `limit` value.
+/// Metadata about modifications to the wallet state made in the course of scanning a set of
+/// blocks.
+#[derive(Clone, Debug)]
+pub struct ScanSummary {
+    pub(crate) scanned_range: Range<BlockHeight>,
+    pub(crate) spent_sapling_note_count: usize,
+    pub(crate) received_sapling_note_count: usize,
+    #[cfg(feature = "orchard")]
+    pub(crate) spent_orchard_note_count: usize,
+    #[cfg(feature = "orchard")]
+    pub(crate) received_orchard_note_count: usize,
+}
+
+impl ScanSummary {
+    /// Constructs a new [`ScanSummary`] for the provided block range.
+    pub(crate) fn for_range(scanned_range: Range<BlockHeight>) -> Self {
+        Self {
+            scanned_range,
+            spent_sapling_note_count: 0,
+            received_sapling_note_count: 0,
+            #[cfg(feature = "orchard")]
+            spent_orchard_note_count: 0,
+            #[cfg(feature = "orchard")]
+            received_orchard_note_count: 0,
+        }
+    }
+
+    /// Returns the range of blocks successfully scanned.
+    pub fn scanned_range(&self) -> Range<BlockHeight> {
+        self.scanned_range.clone()
+    }
+
+    /// Returns the number of our previously-detected Sapling notes that were spent in transactions
+    /// in blocks in the scanned range. If we have not yet detected a particular note as ours, for
+    /// example because we are scanning the chain in reverse height order, we will not detect it
+    /// being spent at this time.
+    pub fn spent_sapling_note_count(&self) -> usize {
+        self.spent_sapling_note_count
+    }
+
+    /// Returns the number of Sapling notes belonging to the wallet that were received in blocks in
+    /// the scanned range. Note that depending upon the scanning order, it is possible that some of
+    /// the received notes counted here may already have been spent in later blocks closer to the
+    /// chain tip.
+    pub fn received_sapling_note_count(&self) -> usize {
+        self.received_sapling_note_count
+    }
+
+    /// Returns the number of our previously-detected Orchard notes that were spent in transactions
+    /// in blocks in the scanned range. If we have not yet detected a particular note as ours, for
+    /// example because we are scanning the chain in reverse height order, we will not detect it
+    /// being spent at this time.
+    #[cfg(feature = "orchard")]
+    pub fn spent_orchard_note_count(&self) -> usize {
+        self.spent_orchard_note_count
+    }
+
+    /// Returns the number of Orchard notes belonging to the wallet that were received in blocks in
+    /// the scanned range. Note that depending upon the scanning order, it is possible that some of
+    /// the received notes counted here may already have been spent in later blocks closer to the
+    /// chain tip.
+    #[cfg(feature = "orchard")]
+    pub fn received_orchard_note_count(&self) -> usize {
+        self.received_orchard_note_count
+    }
+}
+
+/// The final note commitment tree state for each shielded pool, as of a particular block height.
+#[derive(Debug, Clone)]
+pub struct ChainState {
+    block_height: BlockHeight,
+    block_hash: BlockHash,
+    final_sapling_tree: Frontier<sapling::Node, { sapling::NOTE_COMMITMENT_TREE_DEPTH }>,
+    #[cfg(feature = "orchard")]
+    final_orchard_tree:
+        Frontier<orchard::tree::MerkleHashOrchard, { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 }>,
+}
+
+impl ChainState {
+    /// Construct a new empty chain state.
+    pub fn empty(block_height: BlockHeight, block_hash: BlockHash) -> Self {
+        Self {
+            block_height,
+            block_hash,
+            final_sapling_tree: Frontier::empty(),
+            #[cfg(feature = "orchard")]
+            final_orchard_tree: Frontier::empty(),
+        }
+    }
+
+    /// Construct a new [`ChainState`] from its constituent parts.
+    pub fn new(
+        block_height: BlockHeight,
+        block_hash: BlockHash,
+        final_sapling_tree: Frontier<sapling::Node, { sapling::NOTE_COMMITMENT_TREE_DEPTH }>,
+        #[cfg(feature = "orchard")] final_orchard_tree: Frontier<
+            orchard::tree::MerkleHashOrchard,
+            { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 },
+        >,
+    ) -> Self {
+        Self {
+            block_height,
+            block_hash,
+            final_sapling_tree,
+            #[cfg(feature = "orchard")]
+            final_orchard_tree,
+        }
+    }
+
+    /// Returns the block height to which this chain state applies.
+    pub fn block_height(&self) -> BlockHeight {
+        self.block_height
+    }
+
+    /// Return the hash of the block.
+    pub fn block_hash(&self) -> BlockHash {
+        self.block_hash
+    }
+
+    /// Returns the frontier of the Sapling note commitment tree as of the end of the block at
+    /// [`Self::block_height`].
+    pub fn final_sapling_tree(
+        &self,
+    ) -> &Frontier<sapling::Node, { sapling::NOTE_COMMITMENT_TREE_DEPTH }> {
+        &self.final_sapling_tree
+    }
+
+    /// Returns the frontier of the Orchard note commitment tree as of the end of the block at
+    /// [`Self::block_height`].
+    #[cfg(feature = "orchard")]
+    pub fn final_orchard_tree(
+        &self,
+    ) -> &Frontier<orchard::tree::MerkleHashOrchard, { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 }>
+    {
+        &self.final_orchard_tree
+    }
+}
+
+/// Scans at most `limit` blocks from the provided block source for in order to find transactions
+/// received by the accounts tracked in the provided wallet database.
 ///
-/// This function pays attention only to cached blocks with heights greater than the highest
-/// scanned block in `data`. Cached blocks with lower heights are not verified against
-/// previously-scanned blocks. In particular, this function **assumes** that the caller is handling
-/// rollbacks.
+/// This function will return after scanning at most `limit` new blocks, to enable the caller to
+/// update their UI with scanning progress. Repeatedly calling this function with `from_height ==
+/// None` will process sequential ranges of blocks.
 ///
-/// For brand-new light client databases, this function starts scanning from the Sapling activation
-/// height. This height can be fast-forwarded to a more recent block by initializing the client
-/// database with a starting block (for example, calling `init_blocks_table` before this function
-/// if using `zcash_client_sqlite`).
+/// ## Panics
 ///
-/// Scanned blocks are required to be height-sequential. If a block is missing from the block
-/// source, an error will be returned with cause [`error::Cause::BlockHeightDiscontinuity`].
-#[tracing::instrument(skip(params, block_source, data_db))]
+/// This method will panic if `from_height != from_state.block_height() + 1`.
+#[tracing::instrument(skip(params, block_source, data_db, from_state))]
 #[allow(clippy::type_complexity)]
 pub fn scan_cached_blocks<ParamsT, DbT, BlockSourceT>(
     params: &ParamsT,
     block_source: &BlockSourceT,
     data_db: &mut DbT,
-    limit: Option<u32>,
-) -> Result<(), Error<DbT::Error, BlockSourceT::Error, DbT::NoteRef>>
+    from_height: BlockHeight,
+    from_state: &ChainState,
+    limit: usize,
+) -> Result<ScanSummary, Error<DbT::Error, BlockSourceT::Error>>
 where
     ParamsT: consensus::Parameters + Send + 'static,
     BlockSourceT: BlockSource,
     DbT: WalletWrite,
+    <DbT as WalletRead>::AccountId: ConditionallySelectable + Default + Send + 'static,
 {
-    // Recall where we synced up to previously.
-    let mut last_height = data_db
-        .block_height_extrema()
-        .map_err(Error::Wallet)?
-        .map(|(_, max)| max);
+    assert_eq!(from_height, from_state.block_height + 1);
 
     // Fetch the UnifiedFullViewingKeys we are tracking
-    let ufvks = data_db
+    let account_ufvks = data_db
         .get_unified_full_viewing_keys()
         .map_err(Error::Wallet)?;
-    // TODO: Change `scan_block` to also scan Orchard.
-    // https://github.com/zcash/librustzcash/issues/403
-    let dfvks: Vec<_> = ufvks
-        .iter()
-        .filter_map(|(account, ufvk)| ufvk.sapling().map(move |k| (account, k)))
-        .collect();
-
-    // Get the most recent CommitmentTree
-    let mut tree = last_height.map_or_else(
-        || Ok(sapling::CommitmentTree::empty()),
-        |h| {
-            data_db
-                .get_commitment_tree(h)
-                .map(|t| t.unwrap_or_else(sapling::CommitmentTree::empty))
-                .map_err(Error::Wallet)
-        },
-    )?;
-
-    // Get most recent incremental witnesses for the notes we are tracking
-    let mut witnesses = last_height.map_or_else(
-        || Ok(vec![]),
-        |h| data_db.get_witnesses(h).map_err(Error::Wallet),
-    )?;
-
-    // Get the nullifiers for the notes we are tracking
-    let mut nullifiers = data_db
-        .get_sapling_nullifiers(NullifierQuery::Unspent)
-        .map_err(Error::Wallet)?;
-
-    let mut batch_runner = BatchRunner::<_, _, _, ()>::new(
-        100,
-        dfvks
-            .iter()
-            .flat_map(|(account, dfvk)| {
-                [
-                    ((**account, Scope::External), dfvk.to_ivk(Scope::External)),
-                    ((**account, Scope::Internal), dfvk.to_ivk(Scope::Internal)),
-                ]
-            })
-            .map(|(tag, ivk)| (tag, PreparedIncomingViewingKey::new(&ivk))),
+    let scanning_keys = ScanningKeys::from_account_ufvks(account_ufvks);
+    let mut runners = BatchRunners::<_, (), ()>::for_keys(100, &scanning_keys);
+
+    block_source.with_blocks::<_, DbT::Error>(Some(from_height), Some(limit), |block| {
+        runners.add_block(params, block).map_err(|e| e.into())
+    })?;
+    runners.flush();
+
+    let mut prior_block_metadata = if from_height > BlockHeight::from(0) {
+        data_db
+            .block_metadata(from_height - 1)
+            .map_err(Error::Wallet)?
+    } else {
+        None
+    };
+
+    // Get the nullifiers for the unspent notes we are tracking
+    let mut nullifiers = Nullifiers::new(
+        data_db
+            .get_sapling_nullifiers(NullifierQuery::Unspent)
+            .map_err(Error::Wallet)?,
+        #[cfg(feature = "orchard")]
+        data_db
+            .get_orchard_nullifiers(NullifierQuery::Unspent)
+            .map_err(Error::Wallet)?,
     );
 
-    block_source.with_blocks::<_, DbT::Error, DbT::NoteRef>(
-        last_height,
-        limit,
+    let mut scanned_blocks = vec![];
+    let mut scan_summary = ScanSummary::for_range(from_height..from_height);
+    block_source.with_blocks::<_, DbT::Error>(
+        Some(from_height),
+        Some(limit),
         |block: CompactBlock| {
-            add_block_to_runner(params, block, &mut batch_runner);
-            Ok(())
-        },
-    )?;
-
-    batch_runner.flush();
-
-    block_source.with_blocks::<_, DbT::Error, DbT::NoteRef>(
-        last_height,
-        limit,
-        |block: CompactBlock| {
-            let current_height = block.height();
-
-            // Scanned blocks MUST be height-sequential.
-            if let Some(h) = last_height {
-                if current_height != (h + 1) {
-                    return Err(
-                        ChainError::block_height_discontinuity(h + 1, current_height).into(),
-                    );
+            scan_summary.scanned_range.end = block.height() + 1;
+            let scanned_block = scan_block_with_runners::<_, _, _, (), ()>(
+                params,
+                block,
+                &scanning_keys,
+                &nullifiers,
+                prior_block_metadata.as_ref(),
+                Some(&mut runners),
+            )
+            .map_err(Error::Scan)?;
+
+            for wtx in &scanned_block.transactions {
+                scan_summary.spent_sapling_note_count += wtx.sapling_spends().len();
+                scan_summary.received_sapling_note_count += wtx.sapling_outputs().len();
+                #[cfg(feature = "orchard")]
+                {
+                    scan_summary.spent_orchard_note_count += wtx.orchard_spends().len();
+                    scan_summary.received_orchard_note_count += wtx.orchard_outputs().len();
                 }
             }
 
-            let block_hash = BlockHash::from_slice(&block.hash);
-            let block_time = block.time;
-
-            let txs: Vec<WalletTx<Nullifier>> = {
-                let mut witness_refs: Vec<_> = witnesses.iter_mut().map(|w| &mut w.1).collect();
-
-                scan_block_with_runner(
-                    params,
-                    block,
-                    &dfvks,
-                    &nullifiers,
-                    &mut tree,
-                    &mut witness_refs[..],
-                    Some(&mut batch_runner),
-                )
-            };
-
-            // Enforce that all roots match. This is slow, so only include in debug builds.
-            #[cfg(debug_assertions)]
-            {
-                let cur_root = tree.root();
-                for row in &witnesses {
-                    if row.1.root() != cur_root {
-                        return Err(
-                            ChainError::invalid_witness_anchor(current_height, row.0).into()
-                        );
-                    }
-                }
-                for tx in &txs {
-                    for output in tx.sapling_outputs.iter() {
-                        if output.witness().root() != cur_root {
-                            return Err(ChainError::invalid_new_witness_anchor(
-                                current_height,
-                                tx.txid,
-                                output.index(),
-                                output.witness().root(),
-                            )
-                            .into());
-                        }
-                    }
-                }
-            }
-
-            let new_witnesses = data_db
-                .advance_by_block(
-                    &(PrunedBlock {
-                        block_height: current_height,
-                        block_hash,
-                        block_time,
-                        commitment_tree: &tree,
-                        transactions: &txs,
-                    }),
-                    &witnesses,
-                )
-                .map_err(Error::Wallet)?;
-
-            let spent_nf: Vec<&Nullifier> = txs
+            let sapling_spent_nf: Vec<&sapling::Nullifier> = scanned_block
+                .transactions
                 .iter()
-                .flat_map(|tx| tx.sapling_spends.iter().map(|spend| spend.nf()))
+                .flat_map(|tx| tx.sapling_spends().iter().map(|spend| spend.nf()))
                 .collect();
-            nullifiers.retain(|(_, nf)| !spent_nf.contains(&nf));
-            nullifiers.extend(txs.iter().flat_map(|tx| {
-                tx.sapling_outputs
+            nullifiers.retain_sapling(|(_, nf)| !sapling_spent_nf.contains(&nf));
+            nullifiers.extend_sapling(scanned_block.transactions.iter().flat_map(|tx| {
+                tx.sapling_outputs()
                     .iter()
-                    .map(|out| (out.account(), *out.nf()))
+                    .flat_map(|out| out.nf().into_iter().map(|nf| (*out.account_id(), *nf)))
             }));
 
-            witnesses.extend(new_witnesses);
+            #[cfg(feature = "orchard")]
+            {
+                let orchard_spent_nf: Vec<&orchard::note::Nullifier> = scanned_block
+                    .transactions
+                    .iter()
+                    .flat_map(|tx| tx.orchard_spends().iter().map(|spend| spend.nf()))
+                    .collect();
+
+                nullifiers.retain_orchard(|(_, nf)| !orchard_spent_nf.contains(&nf));
+                nullifiers.extend_orchard(scanned_block.transactions.iter().flat_map(|tx| {
+                    tx.orchard_outputs()
+                        .iter()
+                        .flat_map(|out| out.nf().into_iter().map(|nf| (*out.account_id(), *nf)))
+                }));
+            }
 
-            last_height = Some(current_height);
+            prior_block_metadata = Some(scanned_block.to_block_metadata());
+            scanned_blocks.push(scanned_block);
 
             Ok(())
         },
     )?;
 
-    Ok(())
+    data_db
+        .put_blocks(from_state, scanned_blocks)
+        .map_err(Error::Wallet)?;
+    Ok(scan_summary)
 }
 
 #[cfg(feature = "test-dependencies")]
@@ -389,14 +712,14 @@ pub mod testing {
     impl BlockSource for MockBlockSource {
         type Error = Infallible;
 
-        fn with_blocks<F, DbErrT, NoteRef>(
+        fn with_blocks<F, DbErrT>(
             &self,
             _from_height: Option<BlockHeight>,
-            _limit: Option<u32>,
+            _limit: Option<usize>,
             _with_row: F,
-        ) -> Result<(), Error<DbErrT, Infallible, NoteRef>>
+        ) -> Result<(), Error<DbErrT, Infallible>>
         where
-            F: FnMut(CompactBlock) -> Result<(), Error<DbErrT, Infallible, NoteRef>>,
+            F: FnMut(CompactBlock) -> Result<(), Error<DbErrT, Infallible>>,
         {
             Ok(())
         }
diff --git a/zcash_client_backend/src/data_api/chain/error.rs b/zcash_client_backend/src/data_api/chain/error.rs
index b35334c6ac..3a21884bc6 100644
--- a/zcash_client_backend/src/data_api/chain/error.rs
+++ b/zcash_client_backend/src/data_api/chain/error.rs
@@ -3,134 +3,11 @@
 use std::error;
 use std::fmt::{self, Debug, Display};
 
-use zcash_primitives::{consensus::BlockHeight, sapling, transaction::TxId};
-
-/// The underlying cause of a [`ChainError`].
-#[derive(Copy, Clone, Debug)]
-pub enum Cause<NoteRef> {
-    /// The hash of the parent block given by a proposed new chain tip does not match the hash of
-    /// the current chain tip.
-    PrevHashMismatch,
-
-    /// The block height field of the proposed new chain tip is not equal to the height of the
-    /// previous chain tip + 1. This variant stores a copy of the incorrect height value for
-    /// reporting purposes.
-    BlockHeightDiscontinuity(BlockHeight),
-
-    /// The root of an output's witness tree in a newly arrived transaction does not correspond to
-    /// root of the stored commitment tree at the recorded height.
-    ///
-    /// This error is currently only produced when performing the slow checks that are enabled by
-    /// compiling with `-C debug-assertions`.
-    InvalidNewWitnessAnchor {
-        /// The id of the transaction containing the mismatched witness.
-        txid: TxId,
-        /// The index of the shielded output within the transaction where the witness root does not
-        /// match.
-        index: usize,
-        /// The root of the witness that failed to match the root of the current note commitment
-        /// tree.
-        node: sapling::Node,
-    },
-
-    /// The root of an output's witness tree in a previously stored transaction does not correspond
-    /// to root of the current commitment tree.
-    ///
-    /// This error is currently only produced when performing the slow checks that are enabled by
-    /// compiling with `-C debug-assertions`.
-    InvalidWitnessAnchor(NoteRef),
-}
-
-/// Errors that may occur in chain scanning or validation.
-#[derive(Copy, Clone, Debug)]
-pub struct ChainError<NoteRef> {
-    at_height: BlockHeight,
-    cause: Cause<NoteRef>,
-}
-
-impl<N: Display> fmt::Display for ChainError<N> {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match &self.cause {
-            Cause::PrevHashMismatch => write!(
-                f,
-                "The parent hash of proposed block does not correspond to the block hash at height {}.",
-                self.at_height
-            ),
-            Cause::BlockHeightDiscontinuity(h) => {
-                write!(f, "Block height discontinuity at height {}; next height is : {}", self.at_height, h)
-            }
-            Cause::InvalidNewWitnessAnchor { txid, index, node } => write!(
-                f,
-                "New witness for output {} in tx {} at height {} has incorrect anchor: {:?}",
-                index, txid, self.at_height, node,
-            ),
-            Cause::InvalidWitnessAnchor(id_note) => {
-                write!(f, "Witness for note {} has incorrect anchor for height {}", id_note, self.at_height)
-            }
-        }
-    }
-}
-
-impl<NoteRef> ChainError<NoteRef> {
-    /// Constructs an error that indicates block hashes failed to chain.
-    ///
-    /// * `at_height` the height of the block whose parent hash does not match the hash of the
-    ///   previous block
-    pub fn prev_hash_mismatch(at_height: BlockHeight) -> Self {
-        ChainError {
-            at_height,
-            cause: Cause::PrevHashMismatch,
-        }
-    }
-
-    /// Constructs an error that indicates a gap in block heights.
-    ///
-    /// * `at_height` the height of the block being added to the chain.
-    /// * `prev_chain_tip` the height of the previous chain tip.
-    pub fn block_height_discontinuity(at_height: BlockHeight, prev_chain_tip: BlockHeight) -> Self {
-        ChainError {
-            at_height,
-            cause: Cause::BlockHeightDiscontinuity(prev_chain_tip),
-        }
-    }
-
-    /// Constructs an error that indicates a mismatch between an updated note's witness and the
-    /// root of the current note commitment tree.
-    pub fn invalid_witness_anchor(at_height: BlockHeight, note_ref: NoteRef) -> Self {
-        ChainError {
-            at_height,
-            cause: Cause::InvalidWitnessAnchor(note_ref),
-        }
-    }
-
-    /// Constructs an error that indicates a mismatch between a new note's witness and the root of
-    /// the current note commitment tree.
-    pub fn invalid_new_witness_anchor(
-        at_height: BlockHeight,
-        txid: TxId,
-        index: usize,
-        node: sapling::Node,
-    ) -> Self {
-        ChainError {
-            at_height,
-            cause: Cause::InvalidNewWitnessAnchor { txid, index, node },
-        }
-    }
-
-    /// Returns the block height at which this error was discovered.
-    pub fn at_height(&self) -> BlockHeight {
-        self.at_height
-    }
-
-    /// Returns the cause of this error.
-    pub fn cause(&self) -> &Cause<NoteRef> {
-        &self.cause
-    }
-}
+use crate::scanning::ScanError;
 
 /// Errors related to chain validation and scanning.
 #[derive(Debug)]
-pub enum Error<WalletError, BlockSourceError, NoteRef> {
+pub enum Error<WalletError, BlockSourceError> {
     /// An error that was produced by wallet operations in the course of scanning the chain.
     Wallet(WalletError),
 
@@ -141,10 +18,10 @@ pub enum Error<WalletError, BlockSourceError, NoteRef> {
     /// A block that was received violated rules related to chain continuity or contained note
     /// commitments that could not be reconciled with the note commitment tree(s) maintained by the
     /// wallet.
-    Chain(ChainError<NoteRef>),
+    Scan(ScanError),
 }
 
-impl<WE: fmt::Display, BE: fmt::Display, N: Display> fmt::Display for Error<WE, BE, N> {
+impl<WE: fmt::Display, BE: fmt::Display> fmt::Display for Error<WE, BE> {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match &self {
             Error::Wallet(e) => {
@@ -161,18 +38,17 @@ impl<WE: fmt::Display, BE: fmt::Display, N: Display> fmt::Display for Error<WE,
                     e
                 )
             }
-            Error::Chain(err) => {
-                write!(f, "{}", err)
+            Error::Scan(e) => {
+                write!(f, "Scanning produced the following error: {}", e)
             }
         }
     }
 }
 
-impl<WE, BE, N> error::Error for Error<WE, BE, N>
+impl<WE, BE> error::Error for Error<WE, BE>
 where
     WE: Debug + Display + error::Error + 'static,
     BE: Debug + Display + error::Error + 'static,
-    N: Debug + Display,
 {
     fn source(&self) -> Option<&(dyn error::Error + 'static)> {
         match &self {
@@ -183,8 +59,8 @@ where
     }
 }
 
-impl<WE, BSE, N> From<ChainError<N>> for Error<WE, BSE, N> {
-    fn from(e: ChainError<N>) -> Self {
-        Error::Chain(e)
+impl<WE, BSE> From<ScanError> for Error<WE, BSE> {
+    fn from(e: ScanError) -> Self {
+        Error::Scan(e)
     }
 }
diff --git a/zcash_client_backend/src/data_api/error.rs b/zcash_client_backend/src/data_api/error.rs
index 0614a612d6..443b220ab2 100644
--- a/zcash_client_backend/src/data_api/error.rs
+++ b/zcash_client_backend/src/data_api/error.rs
@@ -2,42 +2,62 @@
 
 use std::error;
 use std::fmt::{self, Debug, Display};
-use zcash_primitives::{
-    transaction::{
-        builder,
-        components::{
-            amount::{Amount, BalanceError},
-            sapling, transparent,
-        },
-    },
-    zip32::AccountId,
+
+use shardtree::error::ShardTreeError;
+use zcash_address::ConversionError;
+use zcash_primitives::transaction::components::amount::NonNegativeAmount;
+use zcash_primitives::transaction::{
+    builder,
+    components::{amount::BalanceError, transparent},
 };
 
+use crate::address::UnifiedAddress;
 use crate::data_api::wallet::input_selection::InputSelectorError;
+use crate::fees::ChangeError;
+use crate::proposal::ProposalError;
+use crate::PoolType;
 
 #[cfg(feature = "transparent-inputs")]
-use zcash_primitives::{legacy::TransparentAddress, zip32::DiversifierIndex};
+use zcash_primitives::legacy::TransparentAddress;
+
+use crate::wallet::NoteId;
 
 /// Errors that can occur as a consequence of wallet operations.
 #[derive(Debug)]
-pub enum Error<DataSourceError, SelectionError, FeeError, NoteRef> {
+pub enum Error<DataSourceError, CommitmentTreeError, SelectionError, FeeError, ChangeErrT, NoteRefT>
+{
     /// An error occurred retrieving data from the underlying data source
     DataSource(DataSourceError),
 
+    /// An error in computations involving the note commitment trees.
+    CommitmentTree(ShardTreeError<CommitmentTreeError>),
+
     /// An error in note selection
     NoteSelection(SelectionError),
 
+    /// An error in change selection during transaction proposal construction
+    Change(ChangeError<ChangeErrT, NoteRefT>),
+
+    /// An error in transaction proposal construction
+    Proposal(ProposalError),
+
+    /// The proposal was structurally valid, but tried to do one of these unsupported things:
+    /// * spend a prior shielded output;
+    /// * pay to an output pool for which the corresponding feature is not enabled;
+    /// * pay to a TEX address if the "transparent-inputs" feature is not enabled.
+    ProposalNotSupported,
+
     /// No account could be found corresponding to a provided spending key.
     KeyNotRecognized,
 
-    /// No account with the given identifier was found in the wallet.
-    AccountNotFound(AccountId),
-
     /// Zcash amount computation encountered an overflow or underflow.
     BalanceError(BalanceError),
 
     /// Unable to create a new spend because the wallet balance is not sufficient.
-    InsufficientFunds { available: Amount, required: Amount },
+    InsufficientFunds {
+        available: NonNegativeAmount,
+        required: NonNegativeAmount,
+    },
 
     /// The wallet must first perform a scan of the blockchain before other
     /// operations can be performed.
@@ -49,26 +69,53 @@ pub enum Error<DataSourceError, SelectionError, FeeError, NoteRef> {
     /// It is forbidden to provide a memo when constructing a transparent output.
     MemoForbidden,
 
+    /// Attempted to send change to an unsupported pool.
+    ///
+    /// This is indicative of a programming error; execution of a transaction proposal that
+    /// presumes support for the specified pool was performed using an application that does not
+    /// provide such support.
+    UnsupportedChangeType(PoolType),
+
+    /// Attempted to create a spend to an unsupported Unified Address receiver
+    NoSupportedReceivers(Box<UnifiedAddress>),
+
+    /// A proposed transaction cannot be built because it requires spending an input
+    /// for which no spending key is available.
+    ///
+    /// The argument is the address of the note or UTXO being spent.
+    NoSpendingKey(String),
+
     /// A note being spent does not correspond to either the internal or external
     /// full viewing key for an account.
-    NoteMismatch(NoteRef),
+    NoteMismatch(NoteId),
 
+    /// An error occurred parsing the address from a payment request.
+    Address(ConversionError<&'static str>),
+
+    /// The address associated with a record being inserted was not recognized as
+    /// belonging to the wallet.
     #[cfg(feature = "transparent-inputs")]
     AddressNotRecognized(TransparentAddress),
 
+    /// The wallet tried to pay to an ephemeral transparent address as a normal
+    /// output.
     #[cfg(feature = "transparent-inputs")]
-    ChildIndexOutOfRange(DiversifierIndex),
+    PaysEphemeralTransparentAddress(String),
 }
 
-impl<DE, SE, FE, N> fmt::Display for Error<DE, SE, FE, N>
+impl<DE, TE, SE, FE, CE, N> fmt::Display for Error<DE, TE, SE, FE, CE, N>
 where
     DE: fmt::Display,
+    TE: fmt::Display,
     SE: fmt::Display,
     FE: fmt::Display,
+    CE: fmt::Display,
     N: fmt::Display,
 {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match &self {
+        use fmt::Write;
+
+        match self {
             Error::DataSource(e) => {
                 write!(
                     f,
@@ -76,18 +123,30 @@ where
                     e
                 )
             }
+            Error::CommitmentTree(e) => {
+                write!(f, "An error occurred in querying or updating a note commitment tree: {}", e)
+            }
             Error::NoteSelection(e) => {
                 write!(f, "Note selection encountered the following error: {}", e)
             }
+            Error::Change(e) => {
+                write!(f, "Change output generation failed: {}", e)
+            }
+            Error::Proposal(e) => {
+                write!(f, "Input selection attempted to construct an invalid proposal: {}", e)
+            }
+            Error::ProposalNotSupported => write!(
+                f,
+                "The proposal was valid but tried to do something that is not supported \
+                 (spend shielded outputs of prior transaction steps or use a feature that \
+                 is not enabled).",
+            ),
             Error::KeyNotRecognized => {
                 write!(
                     f,
                     "Wallet does not contain an account corresponding to the provided spending key"
                 )
             }
-            Error::AccountNotFound(account) => {
-                write!(f, "Wallet does not contain account {}", u32::from(*account))
-            }
             Error::BalanceError(e) => write!(
                 f,
                 "The value lies outside the valid range of Zcash amounts: {:?}.",
@@ -96,64 +155,93 @@ where
             Error::InsufficientFunds { available, required } => write!(
                 f,
                 "Insufficient balance (have {}, need {} including fee)",
-                i64::from(*available),
-                i64::from(*required)
+                u64::from(*available),
+                u64::from(*required)
             ),
             Error::ScanRequired => write!(f, "Must scan blocks first"),
             Error::Builder(e) => write!(f, "An error occurred building the transaction: {}", e),
             Error::MemoForbidden => write!(f, "It is not possible to send a memo to a transparent address."),
-            Error::NoteMismatch(n) => write!(f, "A note being spent ({}) does not correspond to either the internal or external full viewing key for the provided spending key.", n),
+            Error::UnsupportedChangeType(t) => write!(f, "Attempted to send change to an unsupported pool type: {}", t),
+            Error::NoSupportedReceivers(ua) => write!(
+                f,
+                "A recipient's unified address does not contain any receivers to which the wallet can send funds; required one of {}",
+                ua.receiver_types().iter().enumerate().fold(String::new(), |mut acc, (i, tc)| {
+                    let _ = write!(acc, "{}{:?}", if i > 0 { ", " } else { "" }, tc);
+                    acc
+                })
+            ),
+            Error::NoSpendingKey(addr) => write!(f, "No spending key available for address: {}", addr),
+            Error::NoteMismatch(n) => write!(f, "A note being spent ({:?}) does not correspond to either the internal or external full viewing key for the provided spending key.", n),
 
+            Error::Address(e) => {
+                write!(f, "An error occurred decoding the address from a payment request: {}.", e)
+            }
             #[cfg(feature = "transparent-inputs")]
             Error::AddressNotRecognized(_) => {
                 write!(f, "The specified transparent address was not recognized as belonging to the wallet.")
             }
             #[cfg(feature = "transparent-inputs")]
-            Error::ChildIndexOutOfRange(i) => {
-                write!(
-                    f,
-                    "The diversifier index {:?} is out of range for transparent addresses.",
-                    i
-                )
+            Error::PaysEphemeralTransparentAddress(addr) => {
+                write!(f, "The wallet tried to pay to an ephemeral transparent address as a normal output: {}", addr)
             }
         }
     }
 }
 
-impl<DE, SE, FE, N> error::Error for Error<DE, SE, FE, N>
+impl<DE, TE, SE, FE, CE, N> error::Error for Error<DE, TE, SE, FE, CE, N>
 where
     DE: Debug + Display + error::Error + 'static,
+    TE: Debug + Display + error::Error + 'static,
     SE: Debug + Display + error::Error + 'static,
     FE: Debug + Display + 'static,
-    N: Debug + Display,
+    CE: Debug + Display + error::Error + 'static,
+    N: Debug + Display + 'static,
 {
     fn source(&self) -> Option<&(dyn error::Error + 'static)> {
         match &self {
             Error::DataSource(e) => Some(e),
+            Error::CommitmentTree(e) => Some(e),
             Error::NoteSelection(e) => Some(e),
+            Error::Proposal(e) => Some(e),
             Error::Builder(e) => Some(e),
             _ => None,
         }
     }
 }
 
-impl<DE, SE, FE, N> From<builder::Error<FE>> for Error<DE, SE, FE, N> {
+impl<DE, TE, SE, FE, CE, N> From<builder::Error<FE>> for Error<DE, TE, SE, FE, CE, N> {
     fn from(e: builder::Error<FE>) -> Self {
         Error::Builder(e)
     }
 }
 
-impl<DE, SE, FE, N> From<BalanceError> for Error<DE, SE, FE, N> {
+impl<DE, TE, SE, FE, CE, N> From<ProposalError> for Error<DE, TE, SE, FE, CE, N> {
+    fn from(e: ProposalError) -> Self {
+        Error::Proposal(e)
+    }
+}
+
+impl<DE, TE, SE, FE, CE, N> From<BalanceError> for Error<DE, TE, SE, FE, CE, N> {
     fn from(e: BalanceError) -> Self {
         Error::BalanceError(e)
     }
 }
 
-impl<DE, SE, FE, N> From<InputSelectorError<DE, SE>> for Error<DE, SE, FE, N> {
-    fn from(e: InputSelectorError<DE, SE>) -> Self {
+impl<DE, TE, SE, FE, CE, N> From<ConversionError<&'static str>> for Error<DE, TE, SE, FE, CE, N> {
+    fn from(value: ConversionError<&'static str>) -> Self {
+        Error::Address(value)
+    }
+}
+
+impl<DE, TE, SE, FE, CE, N> From<InputSelectorError<DE, SE, CE, N>>
+    for Error<DE, TE, SE, FE, CE, N>
+{
+    fn from(e: InputSelectorError<DE, SE, CE, N>) -> Self {
         match e {
             InputSelectorError::DataSource(e) => Error::DataSource(e),
             InputSelectorError::Selection(e) => Error::NoteSelection(e),
+            InputSelectorError::Change(e) => Error::Change(e),
+            InputSelectorError::Proposal(e) => Error::Proposal(e),
             InputSelectorError::InsufficientFunds {
                 available,
                 required,
@@ -161,18 +249,26 @@ impl<DE, SE, FE, N> From<InputSelectorError<DE, SE>> for Error<DE, SE, FE, N> {
                 available,
                 required,
             },
+            InputSelectorError::SyncRequired => Error::ScanRequired,
+            InputSelectorError::Address(e) => Error::Address(e),
         }
     }
 }
 
-impl<DE, SE, FE, N> From<sapling::builder::Error> for Error<DE, SE, FE, N> {
+impl<DE, TE, SE, FE, CE, N> From<sapling::builder::Error> for Error<DE, TE, SE, FE, CE, N> {
     fn from(e: sapling::builder::Error) -> Self {
         Error::Builder(builder::Error::SaplingBuild(e))
     }
 }
 
-impl<DE, SE, FE, N> From<transparent::builder::Error> for Error<DE, SE, FE, N> {
+impl<DE, TE, SE, FE, CE, N> From<transparent::builder::Error> for Error<DE, TE, SE, FE, CE, N> {
     fn from(e: transparent::builder::Error) -> Self {
         Error::Builder(builder::Error::TransparentBuild(e))
     }
 }
+
+impl<DE, TE, SE, FE, CE, N> From<ShardTreeError<TE>> for Error<DE, TE, SE, FE, CE, N> {
+    fn from(e: ShardTreeError<TE>) -> Self {
+        Error::CommitmentTree(e)
+    }
+}
diff --git a/zcash_client_backend/src/data_api/scanning.rs b/zcash_client_backend/src/data_api/scanning.rs
new file mode 100644
index 0000000000..a03abd62f8
--- /dev/null
+++ b/zcash_client_backend/src/data_api/scanning.rs
@@ -0,0 +1,193 @@
+//! Common types used for managing a queue of scanning ranges.
+
+use std::fmt;
+use std::ops::Range;
+
+use zcash_primitives::consensus::BlockHeight;
+
+#[cfg(feature = "unstable-spanning-tree")]
+pub mod spanning_tree;
+
+/// Scanning range priority levels.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum ScanPriority {
+    /// Block ranges that are ignored have lowest priority.
+    Ignored,
+    /// Block ranges that have already been scanned will not be re-scanned.
+    Scanned,
+    /// Block ranges to be scanned to advance the fully-scanned height.
+    Historic,
+    /// Block ranges adjacent to heights at which the user opened the wallet.
+    OpenAdjacent,
+    /// Blocks that must be scanned to complete note commitment tree shards adjacent to found notes.
+    FoundNote,
+    /// Blocks that must be scanned to complete the latest note commitment tree shard.
+    ChainTip,
+    /// A previously scanned range that must be verified to check it is still in the
+    /// main chain, has highest priority.
+    Verify,
+}
+
+/// A range of blocks to be scanned, along with its associated priority.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScanRange {
+    block_range: Range<BlockHeight>,
+    priority: ScanPriority,
+}
+
+impl fmt::Display for ScanRange {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "{:?}({}..{})",
+            self.priority, self.block_range.start, self.block_range.end,
+        )
+    }
+}
+
+impl ScanRange {
+    /// Constructs a scan range from its constituent parts.
+    pub fn from_parts(block_range: Range<BlockHeight>, priority: ScanPriority) -> Self {
+        assert!(
+            block_range.end >= block_range.start,
+            "{:?} is invalid for ScanRange({:?})",
+            block_range,
+            priority,
+        );
+        ScanRange {
+            block_range,
+            priority,
+        }
+    }
+
+    /// Returns the range of block heights to be scanned.
+    pub fn block_range(&self) -> &Range<BlockHeight> {
+        &self.block_range
+    }
+
+    /// Returns the priority with which the scan range should be scanned.
+    pub fn priority(&self) -> ScanPriority {
+        self.priority
+    }
+
+    /// Returns whether or not the scan range is empty.
+    pub fn is_empty(&self) -> bool {
+        self.block_range.is_empty()
+    }
+
+    /// Returns the number of blocks in the scan range.
+    pub fn len(&self) -> usize {
+        usize::try_from(u32::from(self.block_range.end) - u32::from(self.block_range.start))
+            .unwrap()
+    }
+
+    /// Shifts the start of the block range to the right if `block_height >
+    /// self.block_range().start`. Returns `None` if the resulting range would
+    /// be empty (or the range was already empty).
+    pub fn truncate_start(&self, block_height: BlockHeight) -> Option<Self> {
+        if block_height >= self.block_range.end || self.is_empty() {
+            None
+        } else {
+            Some(ScanRange {
+                block_range: self.block_range.start.max(block_height)..self.block_range.end,
+                priority: self.priority,
+            })
+        }
+    }
+
+    /// Shifts the end of the block range to the left if `block_height <
+    /// self.block_range().end`. Returns `None` if the resulting range would
+    /// be empty (or the range was already empty).
+    pub fn truncate_end(&self, block_height: BlockHeight) -> Option<Self> {
+        if block_height <= self.block_range.start || self.is_empty() {
+            None
+        } else {
+            Some(ScanRange {
+                block_range: self.block_range.start..self.block_range.end.min(block_height),
+                priority: self.priority,
+            })
+        }
+    }
+
+    /// Splits this scan range at the specified height, such that the provided height becomes the
+    /// end of the first range returned and the start of the second. Returns `None` if
+    /// `p <= self.block_range().start || p >= self.block_range().end`.
+    pub fn split_at(&self, p: BlockHeight) -> Option<(Self, Self)> {
+        (p > self.block_range.start && p < self.block_range.end).then_some((
+            ScanRange {
+                block_range: self.block_range.start..p,
+                priority: self.priority,
+            },
+            ScanRange {
+                block_range: p..self.block_range.end,
+                priority: self.priority,
+            },
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{ScanPriority, ScanRange};
+
+    fn scan_range(start: u32, end: u32) -> ScanRange {
+        ScanRange::from_parts((start.into())..(end.into()), ScanPriority::Scanned)
+    }
+
+    #[test]
+    fn truncate_start() {
+        let r = scan_range(5, 8);
+
+        assert_eq!(r.truncate_start(4.into()), Some(scan_range(5, 8)));
+        assert_eq!(r.truncate_start(5.into()), Some(scan_range(5, 8)));
+        assert_eq!(r.truncate_start(6.into()), Some(scan_range(6, 8)));
+        assert_eq!(r.truncate_start(7.into()), Some(scan_range(7, 8)));
+        assert_eq!(r.truncate_start(8.into()), None);
+        assert_eq!(r.truncate_start(9.into()), None);
+
+        let empty = scan_range(5, 5);
+        assert_eq!(empty.truncate_start(4.into()), None);
+        assert_eq!(empty.truncate_start(5.into()), None);
+        assert_eq!(empty.truncate_start(6.into()), None);
+    }
+
+    #[test]
+    fn truncate_end() {
+        let r = scan_range(5, 8);
+
+        assert_eq!(r.truncate_end(9.into()), Some(scan_range(5, 8)));
+        assert_eq!(r.truncate_end(8.into()), Some(scan_range(5, 8)));
+        assert_eq!(r.truncate_end(7.into()), Some(scan_range(5, 7)));
+        assert_eq!(r.truncate_end(6.into()), Some(scan_range(5, 6)));
+        assert_eq!(r.truncate_end(5.into()), None);
+        assert_eq!(r.truncate_end(4.into()), None);
+
+        let empty = scan_range(5, 5);
+        assert_eq!(empty.truncate_end(4.into()), None);
+        assert_eq!(empty.truncate_end(5.into()), None);
+        assert_eq!(empty.truncate_end(6.into()), None);
+    }
+
+    #[test]
+    fn split_at() {
+        let r = scan_range(5, 8);
+
+        assert_eq!(r.split_at(4.into()), None);
+        assert_eq!(r.split_at(5.into()), None);
+        assert_eq!(
+            r.split_at(6.into()),
+            Some((scan_range(5, 6), scan_range(6, 8)))
+        );
+        assert_eq!(
+            r.split_at(7.into()),
+            Some((scan_range(5, 7), scan_range(7, 8)))
+        );
+        assert_eq!(r.split_at(8.into()), None);
+        assert_eq!(r.split_at(9.into()), None);
+
+        let empty = scan_range(5, 5);
+        assert_eq!(empty.split_at(4.into()), None);
+        assert_eq!(empty.split_at(5.into()), None);
+        assert_eq!(empty.split_at(6.into()), None);
+    }
+}
diff --git a/zcash_client_backend/src/data_api/scanning/spanning_tree.rs b/zcash_client_backend/src/data_api/scanning/spanning_tree.rs
new file mode 100644
index 0000000000..58631de8fb
--- /dev/null
+++ b/zcash_client_backend/src/data_api/scanning/spanning_tree.rs
@@ -0,0 +1,811 @@
+use std::cmp::{max, Ordering};
+use std::ops::{Not, Range};
+
+use zcash_primitives::consensus::BlockHeight;
+
+use super::{ScanPriority, ScanRange};
+
+#[derive(Debug, Clone, Copy)]
+enum InsertOn {
+    Left,
+    Right,
+}
+
+struct Insert {
+    on: InsertOn,
+    force_rescan: bool,
+}
+
+impl Insert {
+    fn left(force_rescan: bool) -> Self {
+        Insert {
+            on: InsertOn::Left,
+            force_rescan,
+        }
+    }
+
+    fn right(force_rescan: bool) -> Self {
+        Insert {
+            on: InsertOn::Right,
+            force_rescan,
+        }
+    }
+}
+
+impl Not for Insert {
+    type Output = Self;
+
+    fn not(self) -> Self::Output {
+        Insert {
+            on: match self.on {
+                InsertOn::Left => InsertOn::Right,
+                InsertOn::Right => InsertOn::Left,
+            },
+            force_rescan: self.force_rescan,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Dominance {
+    Left,
+    Right,
+    Equal,
+}
+
+impl From<Insert> for Dominance {
+    fn from(value: Insert) -> Self {
+        match value.on {
+            InsertOn::Left => Dominance::Left,
+            InsertOn::Right => Dominance::Right,
+        }
+    }
+}
+
+// This implements the dominance rule for range priority. If the inserted range's priority is
+// `Verify`, this replaces any existing priority. Otherwise, if the current priority is
+// `Scanned`, it remains as `Scanned`; and if the new priority is `Scanned`, it
+// overrides any existing priority.
+fn dominance(current: &ScanPriority, inserted: &ScanPriority, insert: Insert) -> Dominance {
+    match (current.cmp(inserted), (current, inserted)) {
+        (Ordering::Equal, _) => Dominance::Equal,
+        (_, (_, ScanPriority::Verify | ScanPriority::Scanned)) => Dominance::from(insert),
+        (_, (ScanPriority::Scanned, _)) if !insert.force_rescan => Dominance::from(!insert),
+        (Ordering::Less, _) => Dominance::from(insert),
+        (Ordering::Greater, _) => Dominance::from(!insert),
+    }
+}
+
+/// In the comments for each alternative, `()` represents the left range and `[]` represents the right range.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum RangeOrdering {
+    /// `(   ) [   ]`
+    LeftFirstDisjoint,
+    /// `( [   ) ]`
+    LeftFirstOverlap,
+    /// `[ (   ) ]`
+    LeftContained,
+    /// ```text
+    /// (   )
+    /// [   ]
+    /// ```
+    Equal,
+    /// `( [   ] )`
+    RightContained,
+    /// `[ (   ] )`
+    RightFirstOverlap,
+    /// `[   ] (   )`
+    RightFirstDisjoint,
+}
+
+impl RangeOrdering {
+    fn cmp<A: Ord>(a: &Range<A>, b: &Range<A>) -> Self {
+        use Ordering::*;
+        assert!(a.start <= a.end && b.start <= b.end);
+        match (a.start.cmp(&b.start), a.end.cmp(&b.end)) {
+            _ if a.end <= b.start => RangeOrdering::LeftFirstDisjoint,
+            _ if b.end <= a.start => RangeOrdering::RightFirstDisjoint,
+            (Less, Less) => RangeOrdering::LeftFirstOverlap,
+            (Equal, Less) | (Greater, Less) | (Greater, Equal) => RangeOrdering::LeftContained,
+            (Equal, Equal) => RangeOrdering::Equal,
+            (Equal, Greater) | (Less, Greater) | (Less, Equal) => RangeOrdering::RightContained,
+            (Greater, Greater) => RangeOrdering::RightFirstOverlap,
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum Joined {
+    One(ScanRange),
+    Two(ScanRange, ScanRange),
+    Three(ScanRange, ScanRange, ScanRange),
+}
+
+fn join_nonoverlapping(left: ScanRange, right: ScanRange) -> Joined {
+    assert!(left.block_range().end <= right.block_range().start);
+
+    if left.block_range().end == right.block_range().start {
+        if left.priority() == right.priority() {
+            Joined::One(ScanRange::from_parts(
+                left.block_range().start..right.block_range().end,
+                left.priority(),
+            ))
+        } else {
+            Joined::Two(left, right)
+        }
+    } else {
+        // there is a gap that will need to be filled
+        let gap = ScanRange::from_parts(
+            left.block_range().end..right.block_range().start,
+            ScanPriority::Historic,
+        );
+
+        match join_nonoverlapping(left, gap) {
+            Joined::One(merged) => join_nonoverlapping(merged, right),
+            Joined::Two(left, gap) => match join_nonoverlapping(gap, right) {
+                Joined::One(merged) => Joined::Two(left, merged),
+                Joined::Two(gap, right) => Joined::Three(left, gap, right),
+                _ => unreachable!(),
+            },
+            _ => unreachable!(),
+        }
+    }
+}
+
+fn insert(current: ScanRange, to_insert: ScanRange, force_rescans: bool) -> Joined {
+    fn join_overlapping(left: ScanRange, right: ScanRange, insert: Insert) -> Joined {
+        assert!(
+            left.block_range().start <= right.block_range().start
+                && left.block_range().end > right.block_range().start
+        );
+
+        // recompute the range dominance based upon the queue entry priorities
+        let dominance = match insert.on {
+            InsertOn::Left => dominance(&right.priority(), &left.priority(), insert),
+            InsertOn::Right => dominance(&left.priority(), &right.priority(), insert),
+        };
+
+        match dominance {
+            Dominance::Left => {
+                if let Some(right) = right.truncate_start(left.block_range().end) {
+                    Joined::Two(left, right)
+                } else {
+                    Joined::One(left)
+                }
+            }
+            Dominance::Equal => Joined::One(ScanRange::from_parts(
+                left.block_range().start..max(left.block_range().end, right.block_range().end),
+                left.priority(),
+            )),
+            Dominance::Right => match (
+                left.truncate_end(right.block_range().start),
+                left.truncate_start(right.block_range().end),
+            ) {
+                (Some(before), Some(after)) => Joined::Three(before, right, after),
+                (Some(before), None) => Joined::Two(before, right),
+                (None, Some(after)) => Joined::Two(right, after),
+                (None, None) => Joined::One(right),
+            },
+        }
+    }
+
+    use RangeOrdering::*;
+    match RangeOrdering::cmp(to_insert.block_range(), current.block_range()) {
+        LeftFirstDisjoint => join_nonoverlapping(to_insert, current),
+        LeftFirstOverlap | RightContained => {
+            join_overlapping(to_insert, current, Insert::left(force_rescans))
+        }
+        Equal => Joined::One(ScanRange::from_parts(
+            to_insert.block_range().clone(),
+            match dominance(
+                &current.priority(),
+                &to_insert.priority(),
+                Insert::right(force_rescans),
+            ) {
+                Dominance::Left | Dominance::Equal => current.priority(),
+                Dominance::Right => to_insert.priority(),
+            },
+        )),
+        RightFirstOverlap | LeftContained => {
+            join_overlapping(current, to_insert, Insert::right(force_rescans))
+        }
+        RightFirstDisjoint => join_nonoverlapping(current, to_insert),
+    }
+}
+
+#[derive(Debug, Clone)]
+#[cfg(feature = "unstable-spanning-tree")]
+pub enum SpanningTree {
+    Leaf(ScanRange),
+    Parent {
+        span: Range<BlockHeight>,
+        left: Box<SpanningTree>,
+        right: Box<SpanningTree>,
+    },
+}
+
+#[cfg(feature = "unstable-spanning-tree")]
+impl SpanningTree {
+    fn span(&self) -> Range<BlockHeight> {
+        match self {
+            SpanningTree::Leaf(entry) => entry.block_range().clone(),
+            SpanningTree::Parent { span, .. } => span.clone(),
+        }
+    }
+
+    fn from_joined(joined: Joined) -> Self {
+        match joined {
+            Joined::One(entry) => SpanningTree::Leaf(entry),
+            Joined::Two(left, right) => SpanningTree::Parent {
+                span: left.block_range().start..right.block_range().end,
+                left: Box::new(SpanningTree::Leaf(left)),
+                right: Box::new(SpanningTree::Leaf(right)),
+            },
+            Joined::Three(left, mid, right) => SpanningTree::Parent {
+                span: left.block_range().start..right.block_range().end,
+                left: Box::new(SpanningTree::Leaf(left)),
+                right: Box::new(SpanningTree::Parent {
+                    span: mid.block_range().start..right.block_range().end,
+                    left: Box::new(SpanningTree::Leaf(mid)),
+                    right: Box::new(SpanningTree::Leaf(right)),
+                }),
+            },
+        }
+    }
+
+    fn from_insert(
+        left: Box<Self>,
+        right: Box<Self>,
+        to_insert: ScanRange,
+        insert: Insert,
+    ) -> Self {
+        let (left, right) = match insert.on {
+            InsertOn::Left => (Box::new(left.insert(to_insert, insert.force_rescan)), right),
+            InsertOn::Right => (left, Box::new(right.insert(to_insert, insert.force_rescan))),
+        };
+        SpanningTree::Parent {
+            span: left.span().start..right.span().end,
+            left,
+            right,
+        }
+    }
+
+    fn from_split(
+        left: Self,
+        right: Self,
+        to_insert: ScanRange,
+        split_point: BlockHeight,
+        force_rescans: bool,
+    ) -> Self {
+        let (l_insert, r_insert) = to_insert
+            .split_at(split_point)
+            .expect("Split point is within the range of to_insert");
+        let left = Box::new(left.insert(l_insert, force_rescans));
+        let right = Box::new(right.insert(r_insert, force_rescans));
+        SpanningTree::Parent {
+            span: left.span().start..right.span().end,
+            left,
+            right,
+        }
+    }
+
+    pub fn insert(self, to_insert: ScanRange, force_rescans: bool) -> Self {
+        match self {
+            SpanningTree::Leaf(cur) => Self::from_joined(insert(cur, to_insert, force_rescans)),
+            SpanningTree::Parent { span, left, right } => {
+                // This algorithm always preserves the existing partition point, and does not do
+                // any rebalancing or unification of ranges within the tree. This should be okay
+                // because `into_vec` performs such unification, and the tree being unbalanced
+                // should be fine given the relatively small number of ranges we should ordinarily
+                // be concerned with.
+                use RangeOrdering::*;
+                match RangeOrdering::cmp(&span, to_insert.block_range()) {
+                    LeftFirstDisjoint => {
+                        // extend the right-hand branch
+                        Self::from_insert(left, right, to_insert, Insert::right(force_rescans))
+                    }
+                    LeftFirstOverlap => {
+                        let split_point = left.span().end;
+                        if split_point > to_insert.block_range().start {
+                            Self::from_split(*left, *right, to_insert, split_point, force_rescans)
+                        } else {
+                            // to_insert is fully contained in or equals the right child
+                            Self::from_insert(left, right, to_insert, Insert::right(force_rescans))
+                        }
+                    }
+                    RightContained => {
+                        // to_insert is fully contained within the current span, so we will insert
+                        // into one or both sides
+                        let split_point = left.span().end;
+                        if to_insert.block_range().start >= split_point {
+                            // to_insert is fully contained in the right
+                            Self::from_insert(left, right, to_insert, Insert::right(force_rescans))
+                        } else if to_insert.block_range().end <= split_point {
+                            // to_insert is fully contained in the left
+                            Self::from_insert(left, right, to_insert, Insert::left(force_rescans))
+                        } else {
+                            // to_insert must be split.
+                            Self::from_split(*left, *right, to_insert, split_point, force_rescans)
+                        }
+                    }
+                    Equal => {
+                        let split_point = left.span().end;
+                        if split_point > to_insert.block_range().start {
+                            Self::from_split(*left, *right, to_insert, split_point, force_rescans)
+                        } else {
+                            // to_insert is fully contained in the right subtree
+                            right.insert(to_insert, force_rescans)
+                        }
+                    }
+                    LeftContained => {
+                        // the current span is fully contained within to_insert, so we will extend
+                        // or overwrite both sides
+                        let split_point = left.span().end;
+                        Self::from_split(*left, *right, to_insert, split_point, force_rescans)
+                    }
+                    RightFirstOverlap => {
+                        let split_point = left.span().end;
+                        if split_point < to_insert.block_range().end {
+                            Self::from_split(*left, *right, to_insert, split_point, force_rescans)
+                        } else {
+                            // to_insert is fully contained in or equals the left child
+                            Self::from_insert(left, right, to_insert, Insert::left(force_rescans))
+                        }
+                    }
+                    RightFirstDisjoint => {
+                        // extend the left-hand branch
+                        Self::from_insert(left, right, to_insert, Insert::left(force_rescans))
+                    }
+                }
+            }
+        }
+    }
+
+    pub fn into_vec(self) -> Vec<ScanRange> {
+        fn go(acc: &mut Vec<ScanRange>, tree: SpanningTree) {
+            match tree {
+                SpanningTree::Leaf(entry) => {
+                    if !entry.is_empty() {
+                        if let Some(top) = acc.pop() {
+                            match join_nonoverlapping(top, entry) {
+                                Joined::One(merged) => acc.push(merged),
+                                Joined::Two(l, r) => {
+                                    acc.push(l);
+                                    acc.push(r);
+                                }
+                                _ => unreachable!(),
+                            }
+                        } else {
+                            acc.push(entry);
+                        }
+                    }
+                }
+                SpanningTree::Parent { left, right, .. } => {
+                    go(acc, *left);
+                    go(acc, *right);
+                }
+            }
+        }
+
+        let mut acc = vec![];
+        go(&mut acc, self);
+        acc
+    }
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod testing {
+    use std::ops::Range;
+
+    use zcash_primitives::consensus::BlockHeight;
+
+    use crate::data_api::scanning::{ScanPriority, ScanRange};
+
+    pub fn scan_range(range: Range<u32>, priority: ScanPriority) -> ScanRange {
+        ScanRange::from_parts(
+            BlockHeight::from(range.start)..BlockHeight::from(range.end),
+            priority,
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::ops::Range;
+
+    use zcash_primitives::consensus::BlockHeight;
+
+    use super::{join_nonoverlapping, testing::scan_range, Joined, RangeOrdering, SpanningTree};
+    use crate::data_api::scanning::{ScanPriority, ScanRange};
+
+    #[test]
+    fn test_join_nonoverlapping() {
+        fn test_range(left: ScanRange, right: ScanRange, expected_joined: Joined) {
+            let joined = join_nonoverlapping(left, right);
+
+            assert_eq!(joined, expected_joined);
+        }
+
+        macro_rules! range {
+            ( $start:expr, $end:expr; $priority:ident ) => {
+                ScanRange::from_parts(
+                    BlockHeight::from($start)..BlockHeight::from($end),
+                    ScanPriority::$priority,
+                )
+            };
+        }
+
+        macro_rules! joined {
+            (
+                ($a_start:expr, $a_end:expr; $a_priority:ident)
+            ) => {
+                Joined::One(
+                    range!($a_start, $a_end; $a_priority)
+                )
+            };
+            (
+                ($a_start:expr, $a_end:expr; $a_priority:ident),
+                ($b_start:expr, $b_end:expr; $b_priority:ident)
+            ) => {
+                Joined::Two(
+                    range!($a_start, $a_end; $a_priority),
+                    range!($b_start, $b_end; $b_priority)
+                )
+            };
+            (
+                ($a_start:expr, $a_end:expr; $a_priority:ident),
+                ($b_start:expr, $b_end:expr; $b_priority:ident),
+                ($c_start:expr, $c_end:expr; $c_priority:ident)
+
+            ) => {
+                Joined::Three(
+                    range!($a_start, $a_end; $a_priority),
+                    range!($b_start, $b_end; $b_priority),
+                    range!($c_start, $c_end; $c_priority)
+                )
+            };
+        }
+
+        // Scan ranges have the same priority and
+        // line up.
+        test_range(
+            range!(1, 9; OpenAdjacent),
+            range!(9, 15; OpenAdjacent),
+            joined!(
+                (1, 15; OpenAdjacent)
+            ),
+        );
+
+        // Scan ranges have different priorities,
+        // so we cannot merge them even though they
+        // line up.
+        test_range(
+            range!(1, 9; OpenAdjacent),
+            range!(9, 15; ChainTip),
+            joined!(
+                (1, 9; OpenAdjacent),
+                (9, 15; ChainTip)
+            ),
+        );
+
+        // Scan ranges have the same priority but
+        // do not line up.
+        test_range(
+            range!(1, 9; OpenAdjacent),
+            range!(13, 15; OpenAdjacent),
+            joined!(
+                (1, 9; OpenAdjacent),
+                (9, 13; Historic),
+                (13, 15; OpenAdjacent)
+            ),
+        );
+
+        test_range(
+            range!(1, 9; Historic),
+            range!(13, 15; OpenAdjacent),
+            joined!(
+                (1, 13; Historic),
+                (13, 15; OpenAdjacent)
+            ),
+        );
+
+        test_range(
+            range!(1, 9; OpenAdjacent),
+            range!(13, 15; Historic),
+            joined!(
+                (1, 9; OpenAdjacent),
+                (9, 15; Historic)
+            ),
+        );
+    }
+
+    #[test]
+    fn range_ordering() {
+        use super::RangeOrdering::*;
+        // Equal
+        assert_eq!(RangeOrdering::cmp(&(0..1), &(0..1)), Equal);
+
+        // Disjoint or contiguous
+        assert_eq!(RangeOrdering::cmp(&(0..1), &(1..2)), LeftFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(1..2), &(0..1)), RightFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(0..1), &(2..3)), LeftFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(2..3), &(0..1)), RightFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(1..2), &(2..2)), LeftFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(2..2), &(1..2)), RightFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(1..1), &(1..2)), LeftFirstDisjoint);
+        assert_eq!(RangeOrdering::cmp(&(1..2), &(1..1)), RightFirstDisjoint);
+
+        // Contained
+        assert_eq!(RangeOrdering::cmp(&(1..2), &(0..3)), LeftContained);
+        assert_eq!(RangeOrdering::cmp(&(0..3), &(1..2)), RightContained);
+        assert_eq!(RangeOrdering::cmp(&(0..1), &(0..3)), LeftContained);
+        assert_eq!(RangeOrdering::cmp(&(0..3), &(0..1)), RightContained);
+        assert_eq!(RangeOrdering::cmp(&(2..3), &(0..3)), LeftContained);
+        assert_eq!(RangeOrdering::cmp(&(0..3), &(2..3)), RightContained);
+
+        // Overlap
+        assert_eq!(RangeOrdering::cmp(&(0..2), &(1..3)), LeftFirstOverlap);
+        assert_eq!(RangeOrdering::cmp(&(1..3), &(0..2)), RightFirstOverlap);
+    }
+
+    fn spanning_tree(to_insert: &[(Range<u32>, ScanPriority)]) -> Option<SpanningTree> {
+        to_insert.iter().fold(None, |acc, (range, priority)| {
+            let scan_range = scan_range(range.clone(), *priority);
+            match acc {
+                None => Some(SpanningTree::Leaf(scan_range)),
+                Some(t) => Some(t.insert(scan_range, false)),
+            }
+        })
+    }
+
+    #[test]
+    fn spanning_tree_insert_adjacent() {
+        use ScanPriority::*;
+
+        let t = spanning_tree(&[
+            (0..3, Historic),
+            (3..6, Scanned),
+            (6..8, ChainTip),
+            (8..10, ChainTip),
+        ])
+        .unwrap();
+
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..3, Historic),
+                scan_range(3..6, Scanned),
+                scan_range(6..10, ChainTip),
+            ]
+        );
+    }
+
+    #[test]
+    fn spanning_tree_insert_overlaps() {
+        use ScanPriority::*;
+
+        let t = spanning_tree(&[
+            (0..3, Historic),
+            (2..5, Scanned),
+            (6..8, ChainTip),
+            (7..10, Scanned),
+        ])
+        .unwrap();
+
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..2, Historic),
+                scan_range(2..5, Scanned),
+                scan_range(5..6, Historic),
+                scan_range(6..7, ChainTip),
+                scan_range(7..10, Scanned),
+            ]
+        );
+    }
+
+    #[test]
+    fn spanning_tree_insert_empty() {
+        use ScanPriority::*;
+
+        let t = spanning_tree(&[
+            (0..3, Historic),
+            (3..6, Scanned),
+            (6..6, FoundNote),
+            (6..8, Scanned),
+            (8..10, ChainTip),
+        ])
+        .unwrap();
+
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..3, Historic),
+                scan_range(3..8, Scanned),
+                scan_range(8..10, ChainTip),
+            ]
+        );
+    }
+
+    #[test]
+    fn spanning_tree_insert_gaps() {
+        use ScanPriority::*;
+
+        let t = spanning_tree(&[(0..3, Historic), (6..8, ChainTip)]).unwrap();
+
+        assert_eq!(
+            t.into_vec(),
+            vec![scan_range(0..6, Historic), scan_range(6..8, ChainTip),]
+        );
+
+        let t = spanning_tree(&[(0..3, Historic), (3..4, Verify), (6..8, ChainTip)]).unwrap();
+
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..3, Historic),
+                scan_range(3..4, Verify),
+                scan_range(4..6, Historic),
+                scan_range(6..8, ChainTip),
+            ]
+        );
+    }
+
+    #[test]
+    fn spanning_tree_insert_rfd_span() {
+        use ScanPriority::*;
+
+        // This sequence of insertions causes a RightFirstDisjoint on the last insertion,
+        // which originally had a bug that caused the parent's span to only cover its left
+        // child. The bug was otherwise unobservable as the insertion logic was able to
+        // heal this specific kind of bug.
+        let t = spanning_tree(&[
+            // 6..8
+            (6..8, Scanned),
+            //       6..12
+            // 6..8        8..12
+            //         8..10  10..12
+            (10..12, ChainTip),
+            //          3..12
+            //    3..8        8..12
+            // 3..6  6..8  8..10  10..12
+            (3..6, Historic),
+        ])
+        .unwrap();
+
+        assert_eq!(t.span(), (3.into())..(12.into()));
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(3..6, Historic),
+                scan_range(6..8, Scanned),
+                scan_range(8..10, Historic),
+                scan_range(10..12, ChainTip),
+            ]
+        );
+    }
+
+    #[test]
+    fn spanning_tree_dominance() {
+        use ScanPriority::*;
+
+        let t = spanning_tree(&[(0..3, Verify), (2..8, Scanned), (6..10, Verify)]).unwrap();
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..2, Verify),
+                scan_range(2..6, Scanned),
+                scan_range(6..10, Verify),
+            ]
+        );
+
+        let t = spanning_tree(&[(0..3, Verify), (2..8, Historic), (6..10, Verify)]).unwrap();
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..3, Verify),
+                scan_range(3..6, Historic),
+                scan_range(6..10, Verify),
+            ]
+        );
+
+        let t = spanning_tree(&[(0..3, Scanned), (2..8, Verify), (6..10, Scanned)]).unwrap();
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..2, Scanned),
+                scan_range(2..6, Verify),
+                scan_range(6..10, Scanned),
+            ]
+        );
+
+        let t = spanning_tree(&[(0..3, Scanned), (2..8, Historic), (6..10, Scanned)]).unwrap();
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..3, Scanned),
+                scan_range(3..6, Historic),
+                scan_range(6..10, Scanned),
+            ]
+        );
+
+        // a `ChainTip` insertion should not overwrite a scanned range.
+        let mut t = spanning_tree(&[(0..3, ChainTip), (3..5, Scanned), (5..7, ChainTip)]).unwrap();
+        t = t.insert(scan_range(0..7, ChainTip), false);
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(0..3, ChainTip),
+                scan_range(3..5, Scanned),
+                scan_range(5..7, ChainTip),
+            ]
+        );
+
+        let mut t =
+            spanning_tree(&[(280300..280310, FoundNote), (280310..280320, Scanned)]).unwrap();
+        assert_eq!(
+            t.clone().into_vec(),
+            vec![
+                scan_range(280300..280310, FoundNote),
+                scan_range(280310..280320, Scanned)
+            ]
+        );
+        t = t.insert(scan_range(280300..280340, ChainTip), false);
+        assert_eq!(
+            t.into_vec(),
+            vec![
+                scan_range(280300..280310, ChainTip),
+                scan_range(280310..280320, Scanned),
+                scan_range(280320..280340, ChainTip)
+            ]
+        );
+    }
+
+    #[test]
+    fn spanning_tree_insert_coalesce_scanned() {
+        use ScanPriority::*;
+
+        let mut t = spanning_tree(&[
+            (0..3, Historic),
+            (2..5, Scanned),
+            (6..8, ChainTip),
+            (7..10, Scanned),
+        ])
+        .unwrap();
+
+        t = t.insert(scan_range(0..3, Scanned), false);
+        t = t.insert(scan_range(5..8, Scanned), false);
+
+        assert_eq!(t.into_vec(), vec![scan_range(0..10, Scanned)]);
+    }
+
+    #[test]
+    fn spanning_tree_force_rescans() {
+        use ScanPriority::*;
+
+        let mut t = spanning_tree(&[
+            (0..3, Historic),
+            (3..5, Scanned),
+            (5..7, ChainTip),
+            (7..10, Scanned),
+        ])
+        .unwrap();
+
+        t = t.insert(scan_range(4..9, OpenAdjacent), true);
+
+        let expected = vec![
+            scan_range(0..3, Historic),
+            scan_range(3..4, Scanned),
+            scan_range(4..5, OpenAdjacent),
+            scan_range(5..7, ChainTip),
+            scan_range(7..9, OpenAdjacent),
+            scan_range(9..10, Scanned),
+        ];
+        assert_eq!(t.clone().into_vec(), expected);
+
+        // An insert of an ignored range should not override a scanned range; the existing
+        // priority should prevail, and so the expected state of the tree is unchanged.
+        t = t.insert(scan_range(2..5, Ignored), true);
+        assert_eq!(t.into_vec(), expected);
+    }
+}
diff --git a/zcash_client_backend/src/data_api/testing.rs b/zcash_client_backend/src/data_api/testing.rs
new file mode 100644
index 0000000000..cfe9183c17
--- /dev/null
+++ b/zcash_client_backend/src/data_api/testing.rs
@@ -0,0 +1,2782 @@
+//! Utilities for testing wallets based upon the [`crate::data_api`] traits.
+
+use std::{
+    collections::{BTreeMap, HashMap},
+    convert::Infallible,
+    fmt,
+    hash::Hash,
+    num::NonZeroU32,
+};
+
+use ::sapling::{
+    note_encryption::{sapling_note_encryption, SaplingDomain},
+    util::generate_random_rseed,
+    zip32::DiversifiableFullViewingKey,
+};
+use assert_matches::assert_matches;
+use group::ff::Field;
+use incrementalmerkletree::{Marking, Retention};
+use nonempty::NonEmpty;
+use rand::{CryptoRng, Rng, RngCore, SeedableRng};
+use rand_chacha::ChaChaRng;
+use secrecy::{ExposeSecret, Secret, SecretVec};
+use shardtree::{error::ShardTreeError, store::memory::MemoryShardStore, ShardTree};
+use subtle::ConditionallySelectable;
+
+use zcash_address::ZcashAddress;
+use zcash_keys::address::Address;
+use zcash_note_encryption::Domain;
+use zcash_primitives::{
+    block::BlockHash,
+    consensus::{BlockHeight, Network},
+    memo::Memo,
+    transaction::{
+        components::{amount::NonNegativeAmount, sapling::zip212_enforcement},
+        fees::FeeRule,
+        Transaction, TxId,
+    },
+};
+use zcash_proofs::prover::LocalTxProver;
+use zcash_protocol::{
+    consensus::{self, NetworkUpgrade, Parameters as _},
+    local_consensus::LocalNetwork,
+    memo::MemoBytes,
+    value::{ZatBalance, Zatoshis},
+};
+use zip32::{fingerprint::SeedFingerprint, DiversifierIndex};
+use zip321::Payment;
+
+use crate::{
+    address::UnifiedAddress,
+    fees::{
+        standard::{self, SingleOutputChangeStrategy},
+        ChangeStrategy, DustOutputPolicy, StandardFeeRule,
+    },
+    keys::{UnifiedAddressRequest, UnifiedFullViewingKey, UnifiedSpendingKey},
+    proposal::Proposal,
+    proto::compact_formats::{
+        self, CompactBlock, CompactSaplingOutput, CompactSaplingSpend, CompactTx,
+    },
+    wallet::{Note, NoteId, OvkPolicy, ReceivedNote, WalletTransparentOutput},
+    ShieldedProtocol,
+};
+
+use super::{
+    chain::{scan_cached_blocks, BlockSource, ChainState, CommitmentTreeRoot, ScanSummary},
+    scanning::ScanRange,
+    wallet::{
+        create_proposed_transactions,
+        input_selection::{GreedyInputSelector, InputSelector},
+        propose_standard_transfer_to_address, propose_transfer,
+    },
+    Account, AccountBalance, AccountBirthday, AccountMeta, AccountPurpose, AccountSource,
+    BlockMetadata, DecryptedTransaction, InputSource, NullifierQuery, ScannedBlock, SeedRelevance,
+    SentTransaction, SpendableNotes, TransactionDataRequest, TransactionStatus,
+    WalletCommitmentTrees, WalletRead, WalletSummary, WalletTest, WalletWrite,
+    SAPLING_SHARD_HEIGHT,
+};
+use super::{error::Error, NoteFilter};
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    super::wallet::input_selection::ShieldingSelector, crate::wallet::TransparentAddressMetadata,
+    std::ops::Range, zcash_primitives::legacy::TransparentAddress,
+};
+
+#[cfg(feature = "orchard")]
+use {
+    super::ORCHARD_SHARD_HEIGHT, crate::proto::compact_formats::CompactOrchardAction,
+    ::orchard::tree::MerkleHashOrchard, group::ff::PrimeField, pasta_curves::pallas,
+};
+
+#[cfg(feature = "orchard")]
+pub mod orchard;
+pub mod pool;
+pub mod sapling;
+#[cfg(feature = "transparent-inputs")]
+pub mod transparent;
+
+/// Information about a transaction that the wallet is interested in.
+pub struct TransactionSummary<AccountId> {
+    account_id: AccountId,
+    txid: TxId,
+    expiry_height: Option<BlockHeight>,
+    mined_height: Option<BlockHeight>,
+    account_value_delta: ZatBalance,
+    fee_paid: Option<Zatoshis>,
+    spent_note_count: usize,
+    has_change: bool,
+    sent_note_count: usize,
+    received_note_count: usize,
+    memo_count: usize,
+    expired_unmined: bool,
+    is_shielding: bool,
+}
+
+impl<AccountId> TransactionSummary<AccountId> {
+    /// Constructs a `TransactionSummary` from its parts.
+    ///
+    /// See the documentation for each getter method below to determine how each method
+    /// argument should be prepared.
+    #[allow(clippy::too_many_arguments)]
+    pub fn from_parts(
+        account_id: AccountId,
+        txid: TxId,
+        expiry_height: Option<BlockHeight>,
+        mined_height: Option<BlockHeight>,
+        account_value_delta: ZatBalance,
+        fee_paid: Option<Zatoshis>,
+        spent_note_count: usize,
+        has_change: bool,
+        sent_note_count: usize,
+        received_note_count: usize,
+        memo_count: usize,
+        expired_unmined: bool,
+        is_shielding: bool,
+    ) -> Self {
+        Self {
+            account_id,
+            txid,
+            expiry_height,
+            mined_height,
+            account_value_delta,
+            fee_paid,
+            spent_note_count,
+            has_change,
+            sent_note_count,
+            received_note_count,
+            memo_count,
+            expired_unmined,
+            is_shielding,
+        }
+    }
+
+    /// Returns the wallet-internal ID for the account that this transaction was received
+    /// by or sent from.
+    pub fn account_id(&self) -> &AccountId {
+        &self.account_id
+    }
+
+    /// Returns the transaction's ID.
+    pub fn txid(&self) -> TxId {
+        self.txid
+    }
+
+    /// Returns the expiry height of the transaction, if known.
+    ///
+    /// - `None` means that the expiry height is unknown.
+    /// - `Some(0)` means that the transaction does not expire.
+    pub fn expiry_height(&self) -> Option<BlockHeight> {
+        self.expiry_height
+    }
+
+    /// Returns the height of the mined block containing this transaction, or `None` if
+    /// the wallet has not yet observed the transaction to be mined.
+    pub fn mined_height(&self) -> Option<BlockHeight> {
+        self.mined_height
+    }
+
+    /// Returns the net change in balance that this transaction caused to the account.
+    ///
+    /// For example, an account-internal transaction (such as a shielding operation) would
+    /// show `-fee_paid` as the account value delta.
+    pub fn account_value_delta(&self) -> ZatBalance {
+        self.account_value_delta
+    }
+
+    /// Returns the fee paid by this transaction, if known.
+    pub fn fee_paid(&self) -> Option<Zatoshis> {
+        self.fee_paid
+    }
+
+    /// Returns the number of notes spent by the account in this transaction.
+    pub fn spent_note_count(&self) -> usize {
+        self.spent_note_count
+    }
+
+    /// Returns `true` if the account received a change note as part of this transaction.
+    ///
+    /// This implies that the transaction was (at least in part) sent from the account.
+    pub fn has_change(&self) -> bool {
+        self.has_change
+    }
+
+    /// Returns the number of notes created in this transaction that were sent to a
+    /// wallet-external address.
+    pub fn sent_note_count(&self) -> usize {
+        self.sent_note_count
+    }
+
+    /// Returns the number of notes created in this transaction that were received by the
+    /// account.
+    pub fn received_note_count(&self) -> usize {
+        self.received_note_count
+    }
+
+    /// Returns `true` if, from the wallet's current view of the chain, this transaction
+    /// expired before it was mined.
+    pub fn expired_unmined(&self) -> bool {
+        self.expired_unmined
+    }
+
+    /// Returns the number of non-empty memos viewable by the account in this transaction.
+    pub fn memo_count(&self) -> usize {
+        self.memo_count
+    }
+
+    /// Returns `true` if this is detectably a shielding transaction.
+    ///
+    /// Specifically, `true` means that at a minimum:
+    /// - All of the wallet-spent and wallet-received notes are consistent with a
+    ///   shielding transaction.
+    /// - The transaction contains at least one wallet-spent output.
+    /// - The transaction contains at least one wallet-received note.
+    /// - We do not know about any external outputs of the transaction.
+    ///
+    /// There may be some shielding transactions for which this method returns `false`,
+    /// due to them not being detectable by the wallet as shielding transactions under the
+    /// above metrics.
+    pub fn is_shielding(&self) -> bool {
+        self.is_shielding
+    }
+}
+
+/// Metadata about a block generated by [`TestState`].
+#[derive(Clone, Debug)]
+pub struct CachedBlock {
+    chain_state: ChainState,
+    sapling_end_size: u32,
+    orchard_end_size: u32,
+}
+
+impl CachedBlock {
+    /// Produces metadata for a block "before shielded time", when the Sapling and Orchard
+    /// trees were (by definition) empty.
+    ///
+    /// `block_height` must be a height before Sapling activation (and therefore also
+    /// before NU5 activation).
+    pub fn none(block_height: BlockHeight) -> Self {
+        Self {
+            chain_state: ChainState::empty(block_height, BlockHash([0; 32])),
+            sapling_end_size: 0,
+            orchard_end_size: 0,
+        }
+    }
+
+    /// Produces metadata for a block as of the given chain state.
+    pub fn at(chain_state: ChainState, sapling_end_size: u32, orchard_end_size: u32) -> Self {
+        assert_eq!(
+            chain_state.final_sapling_tree().tree_size() as u32,
+            sapling_end_size
+        );
+        #[cfg(feature = "orchard")]
+        assert_eq!(
+            chain_state.final_orchard_tree().tree_size() as u32,
+            orchard_end_size
+        );
+
+        Self {
+            chain_state,
+            sapling_end_size,
+            orchard_end_size,
+        }
+    }
+
+    fn roll_forward(&self, cb: &CompactBlock) -> Self {
+        assert_eq!(self.chain_state.block_height() + 1, cb.height());
+
+        let sapling_final_tree = cb.vtx.iter().flat_map(|tx| tx.outputs.iter()).fold(
+            self.chain_state.final_sapling_tree().clone(),
+            |mut acc, c_out| {
+                acc.append(::sapling::Node::from_cmu(&c_out.cmu().unwrap()));
+                acc
+            },
+        );
+        let sapling_end_size = sapling_final_tree.tree_size() as u32;
+
+        #[cfg(feature = "orchard")]
+        let orchard_final_tree = cb.vtx.iter().flat_map(|tx| tx.actions.iter()).fold(
+            self.chain_state.final_orchard_tree().clone(),
+            |mut acc, c_act| {
+                acc.append(MerkleHashOrchard::from_cmx(&c_act.cmx().unwrap()));
+                acc
+            },
+        );
+        #[cfg(feature = "orchard")]
+        let orchard_end_size = orchard_final_tree.tree_size() as u32;
+        #[cfg(not(feature = "orchard"))]
+        let orchard_end_size = cb.vtx.iter().fold(self.orchard_end_size, |sz, tx| {
+            sz + (tx.actions.len() as u32)
+        });
+
+        Self {
+            chain_state: ChainState::new(
+                cb.height(),
+                cb.hash(),
+                sapling_final_tree,
+                #[cfg(feature = "orchard")]
+                orchard_final_tree,
+            ),
+            sapling_end_size,
+            orchard_end_size,
+        }
+    }
+
+    /// Returns the height of this block.
+    pub fn height(&self) -> BlockHeight {
+        self.chain_state.block_height()
+    }
+
+    /// Returns the size of the Sapling note commitment tree as of the end of this block.
+    pub fn sapling_end_size(&self) -> u32 {
+        self.sapling_end_size
+    }
+
+    /// Returns the size of the Orchard note commitment tree as of the end of this block.
+    pub fn orchard_end_size(&self) -> u32 {
+        self.orchard_end_size
+    }
+}
+
+/// The test account configured for a [`TestState`].
+///
+/// Create this by calling either [`TestBuilder::with_account_from_sapling_activation`] or
+/// [`TestBuilder::with_account_having_current_birthday`] while setting up a test, and
+/// then access it with [`TestState::test_account`].
+#[derive(Clone)]
+pub struct TestAccount<A> {
+    account: A,
+    usk: UnifiedSpendingKey,
+    birthday: AccountBirthday,
+}
+
+impl<A> TestAccount<A> {
+    /// Returns the underlying wallet account.
+    pub fn account(&self) -> &A {
+        &self.account
+    }
+
+    /// Returns the account's unified spending key.
+    pub fn usk(&self) -> &UnifiedSpendingKey {
+        &self.usk
+    }
+
+    /// Returns the birthday that was configured for the account.
+    pub fn birthday(&self) -> &AccountBirthday {
+        &self.birthday
+    }
+}
+
+impl<A: Account> Account for TestAccount<A> {
+    type AccountId = A::AccountId;
+
+    fn id(&self) -> Self::AccountId {
+        self.account.id()
+    }
+
+    fn name(&self) -> Option<&str> {
+        self.account.name()
+    }
+
+    fn source(&self) -> &AccountSource {
+        self.account.source()
+    }
+
+    fn ufvk(&self) -> Option<&zcash_keys::keys::UnifiedFullViewingKey> {
+        self.account.ufvk()
+    }
+
+    fn uivk(&self) -> zcash_keys::keys::UnifiedIncomingViewingKey {
+        self.account.uivk()
+    }
+}
+
+/// Trait method exposing the ability to reset the wallet within a test.
+// TODO: Does this need to exist separately from DataStoreFactory?
+pub trait Reset: WalletTest + Sized {
+    /// A handle that confers ownership of a specific wallet instance.
+    type Handle;
+
+    /// Replaces the wallet in `st` (via [`TestState::wallet_mut`]) with a new wallet
+    /// database.
+    ///
+    /// This does not recreate accounts. The resulting wallet in `st` has no test account.
+    ///
+    /// Returns the old wallet.
+    fn reset<C>(st: &mut TestState<C, Self, LocalNetwork>) -> Self::Handle;
+}
+
+/// The state for a `zcash_client_backend` test.
+pub struct TestState<Cache, DataStore: WalletTest, Network> {
+    cache: Cache,
+    cached_blocks: BTreeMap<BlockHeight, CachedBlock>,
+    latest_block_height: Option<BlockHeight>,
+    wallet_data: DataStore,
+    network: Network,
+    test_account: Option<(SecretVec<u8>, TestAccount<DataStore::Account>)>,
+    rng: ChaChaRng,
+}
+
+impl<Cache, DataStore: WalletTest, Network> TestState<Cache, DataStore, Network> {
+    /// Exposes an immutable reference to the test's `DataStore`.
+    pub fn wallet(&self) -> &DataStore {
+        &self.wallet_data
+    }
+
+    /// Exposes a mutable reference to the test's `DataStore`.
+    pub fn wallet_mut(&mut self) -> &mut DataStore {
+        &mut self.wallet_data
+    }
+
+    /// Exposes the test framework's source of randomness.
+    pub fn rng_mut(&mut self) -> &mut ChaChaRng {
+        &mut self.rng
+    }
+
+    /// Exposes the network in use.
+    pub fn network(&self) -> &Network {
+        &self.network
+    }
+}
+
+impl<Cache, DataStore: WalletTest, Network: consensus::Parameters>
+    TestState<Cache, DataStore, Network>
+{
+    /// Convenience method for obtaining the Sapling activation height for the network under test.
+    pub fn sapling_activation_height(&self) -> BlockHeight {
+        self.network
+            .activation_height(NetworkUpgrade::Sapling)
+            .expect("Sapling activation height must be known.")
+    }
+
+    /// Convenience method for obtaining the NU5 activation height for the network under test.
+    #[allow(dead_code)]
+    pub fn nu5_activation_height(&self) -> BlockHeight {
+        self.network
+            .activation_height(NetworkUpgrade::Nu5)
+            .expect("NU5 activation height must be known.")
+    }
+
+    /// Exposes the seed for the test wallet.
+    pub fn test_seed(&self) -> Option<&SecretVec<u8>> {
+        self.test_account.as_ref().map(|(seed, _)| seed)
+    }
+
+    /// Returns a reference to the test account, if one was configured.
+    pub fn test_account(&self) -> Option<&TestAccount<<DataStore as WalletRead>::Account>> {
+        self.test_account.as_ref().map(|(_, acct)| acct)
+    }
+
+    /// Returns the test account's Sapling DFVK, if one was configured.
+    pub fn test_account_sapling(&self) -> Option<&DiversifiableFullViewingKey> {
+        let (_, acct) = self.test_account.as_ref()?;
+        let ufvk = acct.ufvk()?;
+        ufvk.sapling()
+    }
+
+    /// Returns the test account's Orchard FVK, if one was configured.
+    #[cfg(feature = "orchard")]
+    pub fn test_account_orchard(&self) -> Option<&::orchard::keys::FullViewingKey> {
+        let (_, acct) = self.test_account.as_ref()?;
+        let ufvk = acct.ufvk()?;
+        ufvk.orchard()
+    }
+}
+
+impl<Cache: TestCache, DataStore, Network> TestState<Cache, DataStore, Network>
+where
+    Network: consensus::Parameters,
+    DataStore: WalletTest + WalletWrite,
+    <Cache::BlockSource as BlockSource>::Error: fmt::Debug,
+{
+    /// Exposes an immutable reference to the test's [`BlockSource`].
+    #[cfg(feature = "unstable")]
+    pub fn cache(&self) -> &Cache::BlockSource {
+        self.cache.block_source()
+    }
+
+    /// Returns the cached chain state corresponding to the latest block generated by this
+    /// `TestState`.
+    pub fn latest_cached_block(&self) -> Option<&CachedBlock> {
+        self.latest_block_height
+            .as_ref()
+            .and_then(|h| self.cached_blocks.get(h))
+    }
+
+    fn latest_cached_block_below_height(&self, height: BlockHeight) -> Option<&CachedBlock> {
+        self.cached_blocks.range(..height).last().map(|(_, b)| b)
+    }
+
+    fn cache_block(
+        &mut self,
+        prev_block: &CachedBlock,
+        compact_block: CompactBlock,
+    ) -> Cache::InsertResult {
+        self.cached_blocks.insert(
+            compact_block.height(),
+            prev_block.roll_forward(&compact_block),
+        );
+        self.cache.insert(&compact_block)
+    }
+
+    /// Creates a fake block at the expected next height containing a single output of the
+    /// given value, and inserts it into the cache.
+    pub fn generate_next_block<Fvk: TestFvk>(
+        &mut self,
+        fvk: &Fvk,
+        address_type: AddressType,
+        value: NonNegativeAmount,
+    ) -> (BlockHeight, Cache::InsertResult, Fvk::Nullifier) {
+        let pre_activation_block = CachedBlock::none(self.sapling_activation_height() - 1);
+        let prior_cached_block = self.latest_cached_block().unwrap_or(&pre_activation_block);
+        let height = prior_cached_block.height() + 1;
+
+        let (res, nfs) = self.generate_block_at(
+            height,
+            prior_cached_block.chain_state.block_hash(),
+            &[FakeCompactOutput::new(fvk, address_type, value)],
+            prior_cached_block.sapling_end_size,
+            prior_cached_block.orchard_end_size,
+            false,
+        );
+
+        (height, res, nfs[0])
+    }
+
+    /// Creates a fake block at the expected next height containing multiple outputs
+    /// and inserts it into the cache.
+    #[allow(dead_code)]
+    pub fn generate_next_block_multi<Fvk: TestFvk>(
+        &mut self,
+        outputs: &[FakeCompactOutput<Fvk>],
+    ) -> (BlockHeight, Cache::InsertResult, Vec<Fvk::Nullifier>) {
+        let pre_activation_block = CachedBlock::none(self.sapling_activation_height() - 1);
+        let prior_cached_block = self.latest_cached_block().unwrap_or(&pre_activation_block);
+        let height = prior_cached_block.height() + 1;
+
+        let (res, nfs) = self.generate_block_at(
+            height,
+            prior_cached_block.chain_state.block_hash(),
+            outputs,
+            prior_cached_block.sapling_end_size,
+            prior_cached_block.orchard_end_size,
+            false,
+        );
+
+        (height, res, nfs)
+    }
+
+    /// Adds an empty block to the cache, advancing the simulated chain height.
+    #[allow(dead_code)] // used only for tests that are flagged off by default
+    pub fn generate_empty_block(&mut self) -> (BlockHeight, Cache::InsertResult) {
+        let new_hash = {
+            let mut hash = vec![0; 32];
+            self.rng.fill_bytes(&mut hash);
+            hash
+        };
+
+        let pre_activation_block = CachedBlock::none(self.sapling_activation_height() - 1);
+        let prior_cached_block = self
+            .latest_cached_block()
+            .unwrap_or(&pre_activation_block)
+            .clone();
+        let new_height = prior_cached_block.height() + 1;
+
+        let mut cb = CompactBlock {
+            hash: new_hash,
+            height: new_height.into(),
+            ..Default::default()
+        };
+        cb.prev_hash
+            .extend_from_slice(&prior_cached_block.chain_state.block_hash().0);
+
+        cb.chain_metadata = Some(compact_formats::ChainMetadata {
+            sapling_commitment_tree_size: prior_cached_block.sapling_end_size,
+            orchard_commitment_tree_size: prior_cached_block.orchard_end_size,
+        });
+
+        let res = self.cache_block(&prior_cached_block, cb);
+        self.latest_block_height = Some(new_height);
+
+        (new_height, res)
+    }
+
+    /// Creates a fake block with the given height and hash containing the requested outputs, and
+    /// inserts it into the cache.
+    ///
+    /// This generated block will be treated as the latest block, and subsequent calls to
+    /// [`Self::generate_next_block`] will build on it.
+    #[allow(clippy::too_many_arguments)]
+    pub fn generate_block_at<Fvk: TestFvk>(
+        &mut self,
+        height: BlockHeight,
+        prev_hash: BlockHash,
+        outputs: &[FakeCompactOutput<Fvk>],
+        initial_sapling_tree_size: u32,
+        initial_orchard_tree_size: u32,
+        allow_broken_hash_chain: bool,
+    ) -> (Cache::InsertResult, Vec<Fvk::Nullifier>) {
+        let mut prior_cached_block = self
+            .latest_cached_block_below_height(height)
+            .cloned()
+            .unwrap_or_else(|| CachedBlock::none(self.sapling_activation_height() - 1));
+        assert!(prior_cached_block.chain_state.block_height() < height);
+        assert!(prior_cached_block.sapling_end_size <= initial_sapling_tree_size);
+        assert!(prior_cached_block.orchard_end_size <= initial_orchard_tree_size);
+
+        // If the block height has increased or the Sapling and/or Orchard tree sizes have changed,
+        // we need to generate a new prior cached block that the block to be generated can
+        // successfully chain from, with the provided tree sizes.
+        if prior_cached_block.chain_state.block_height() == height - 1 {
+            if !allow_broken_hash_chain {
+                assert_eq!(prev_hash, prior_cached_block.chain_state.block_hash());
+            }
+        } else {
+            let final_sapling_tree =
+                (prior_cached_block.sapling_end_size..initial_sapling_tree_size).fold(
+                    prior_cached_block.chain_state.final_sapling_tree().clone(),
+                    |mut acc, _| {
+                        acc.append(::sapling::Node::from_scalar(bls12_381::Scalar::random(
+                            &mut self.rng,
+                        )));
+                        acc
+                    },
+                );
+
+            #[cfg(feature = "orchard")]
+            let final_orchard_tree =
+                (prior_cached_block.orchard_end_size..initial_orchard_tree_size).fold(
+                    prior_cached_block.chain_state.final_orchard_tree().clone(),
+                    |mut acc, _| {
+                        acc.append(MerkleHashOrchard::random(&mut self.rng));
+                        acc
+                    },
+                );
+
+            prior_cached_block = CachedBlock::at(
+                ChainState::new(
+                    height - 1,
+                    prev_hash,
+                    final_sapling_tree,
+                    #[cfg(feature = "orchard")]
+                    final_orchard_tree,
+                ),
+                initial_sapling_tree_size,
+                initial_orchard_tree_size,
+            );
+
+            self.cached_blocks
+                .insert(height - 1, prior_cached_block.clone());
+        }
+
+        let (cb, nfs) = fake_compact_block(
+            &self.network,
+            height,
+            prev_hash,
+            outputs,
+            initial_sapling_tree_size,
+            initial_orchard_tree_size,
+            &mut self.rng,
+        );
+        assert_eq!(cb.height(), height);
+
+        let res = self.cache_block(&prior_cached_block, cb);
+        self.latest_block_height = Some(height);
+
+        (res, nfs)
+    }
+
+    /// Creates a fake block at the expected next height spending the given note, and
+    /// inserts it into the cache.
+    pub fn generate_next_block_spending<Fvk: TestFvk>(
+        &mut self,
+        fvk: &Fvk,
+        note: (Fvk::Nullifier, NonNegativeAmount),
+        to: impl Into<Address>,
+        value: NonNegativeAmount,
+    ) -> (BlockHeight, Cache::InsertResult) {
+        let prior_cached_block = self
+            .latest_cached_block()
+            .cloned()
+            .unwrap_or_else(|| CachedBlock::none(self.sapling_activation_height() - 1));
+        let height = prior_cached_block.height() + 1;
+
+        let cb = fake_compact_block_spending(
+            &self.network,
+            height,
+            prior_cached_block.chain_state.block_hash(),
+            note,
+            fvk,
+            to.into(),
+            value,
+            prior_cached_block.sapling_end_size,
+            prior_cached_block.orchard_end_size,
+            &mut self.rng,
+        );
+        assert_eq!(cb.height(), height);
+
+        let res = self.cache_block(&prior_cached_block, cb);
+        self.latest_block_height = Some(height);
+
+        (height, res)
+    }
+
+    /// Creates a fake block at the expected next height containing only the wallet
+    /// transaction with the given txid, and inserts it into the cache.
+    ///
+    /// This generated block will be treated as the latest block, and subsequent calls to
+    /// [`Self::generate_next_block`] (or similar) will build on it.
+    pub fn generate_next_block_including(
+        &mut self,
+        txid: TxId,
+    ) -> (BlockHeight, Cache::InsertResult) {
+        let tx = self
+            .wallet()
+            .get_transaction(txid)
+            .unwrap()
+            .expect("TxId should exist in the wallet");
+
+        // Index 0 is by definition a coinbase transaction, and the wallet doesn't
+        // construct coinbase transactions. So we pretend here that the block has a
+        // coinbase transaction that does not have shielded coinbase outputs.
+        self.generate_next_block_from_tx(1, &tx)
+    }
+
+    /// Creates a fake block at the expected next height containing only the given
+    /// transaction, and inserts it into the cache.
+    ///
+    /// This generated block will be treated as the latest block, and subsequent calls to
+    /// [`Self::generate_next_block`] will build on it.
+    pub fn generate_next_block_from_tx(
+        &mut self,
+        tx_index: usize,
+        tx: &Transaction,
+    ) -> (BlockHeight, Cache::InsertResult) {
+        let prior_cached_block = self
+            .latest_cached_block()
+            .cloned()
+            .unwrap_or_else(|| CachedBlock::none(self.sapling_activation_height() - 1));
+        let height = prior_cached_block.height() + 1;
+
+        let cb = fake_compact_block_from_tx(
+            height,
+            prior_cached_block.chain_state.block_hash(),
+            tx_index,
+            tx,
+            prior_cached_block.sapling_end_size,
+            prior_cached_block.orchard_end_size,
+            &mut self.rng,
+        );
+        assert_eq!(cb.height(), height);
+
+        let res = self.cache_block(&prior_cached_block, cb);
+        self.latest_block_height = Some(height);
+
+        (height, res)
+    }
+
+    /// Truncates the test wallet and block cache to the specified height, discarding all data from
+    /// blocks at heights greater than the specified height, excluding transaction data that may
+    /// not be recoverable from the chain.
+    pub fn truncate_to_height(&mut self, height: BlockHeight) {
+        self.wallet_mut().truncate_to_height(height).unwrap();
+        self.cache.truncate_to_height(height);
+        self.cached_blocks.split_off(&(height + 1));
+        self.latest_block_height = Some(height);
+    }
+
+    /// Truncates the test wallet to the specified height, and resets the cache's latest block
+    /// height but does not truncate the block cache. This is useful for circumstances when you
+    /// want to re-scan a set of cached blocks.
+    pub fn truncate_to_height_retaining_cache(&mut self, height: BlockHeight) {
+        self.wallet_mut().truncate_to_height(height).unwrap();
+        self.latest_block_height = Some(height);
+    }
+}
+
+impl<Cache, DbT, ParamsT> TestState<Cache, DbT, ParamsT>
+where
+    Cache: TestCache,
+    <Cache::BlockSource as BlockSource>::Error: fmt::Debug,
+    ParamsT: consensus::Parameters + Send + 'static,
+    DbT: InputSource + WalletTest + WalletWrite + WalletCommitmentTrees,
+    <DbT as WalletRead>::AccountId:
+        std::fmt::Debug + ConditionallySelectable + Default + Send + 'static,
+{
+    /// Invokes [`scan_cached_blocks`] with the given arguments, expecting success.
+    pub fn scan_cached_blocks(&mut self, from_height: BlockHeight, limit: usize) -> ScanSummary {
+        let result = self.try_scan_cached_blocks(from_height, limit);
+        assert_matches!(result, Ok(_));
+        result.unwrap()
+    }
+
+    /// Invokes [`scan_cached_blocks`] with the given arguments.
+    pub fn try_scan_cached_blocks(
+        &mut self,
+        from_height: BlockHeight,
+        limit: usize,
+    ) -> Result<
+        ScanSummary,
+        super::chain::error::Error<
+            <DbT as WalletRead>::Error,
+            <Cache::BlockSource as BlockSource>::Error,
+        >,
+    > {
+        let prior_cached_block = self
+            .latest_cached_block_below_height(from_height)
+            .cloned()
+            .unwrap_or_else(|| CachedBlock::none(from_height - 1));
+
+        let result = scan_cached_blocks(
+            &self.network,
+            self.cache.block_source(),
+            &mut self.wallet_data,
+            from_height,
+            &prior_cached_block.chain_state,
+            limit,
+        );
+        result
+    }
+
+    /// Insert shard roots for both trees.
+    pub fn put_subtree_roots(
+        &mut self,
+        sapling_start_index: u64,
+        sapling_roots: &[CommitmentTreeRoot<::sapling::Node>],
+        #[cfg(feature = "orchard")] orchard_start_index: u64,
+        #[cfg(feature = "orchard")] orchard_roots: &[CommitmentTreeRoot<MerkleHashOrchard>],
+    ) -> Result<(), ShardTreeError<<DbT as WalletCommitmentTrees>::Error>> {
+        self.wallet_mut()
+            .put_sapling_subtree_roots(sapling_start_index, sapling_roots)?;
+
+        #[cfg(feature = "orchard")]
+        self.wallet_mut()
+            .put_orchard_subtree_roots(orchard_start_index, orchard_roots)?;
+
+        Ok(())
+    }
+}
+
+impl<Cache, DbT, ParamsT, AccountIdT, ErrT> TestState<Cache, DbT, ParamsT>
+where
+    ParamsT: consensus::Parameters + Send + 'static,
+    AccountIdT: std::fmt::Debug + std::cmp::Eq + std::hash::Hash,
+    ErrT: std::fmt::Debug,
+    DbT: InputSource<AccountId = AccountIdT, Error = ErrT>
+        + WalletTest
+        + WalletWrite<AccountId = AccountIdT, Error = ErrT>
+        + WalletCommitmentTrees,
+    <DbT as WalletRead>::AccountId: ConditionallySelectable + Default + Send + 'static,
+{
+    // Creates a transaction that sends the specified value from the given account to
+    // the provided recipient address, using a greedy input selector and the default
+    // mutli-output change strategy.
+    pub fn create_standard_transaction(
+        &mut self,
+        from_account: &TestAccount<DbT::Account>,
+        to: ZcashAddress,
+        value: NonNegativeAmount,
+    ) -> Result<
+        NonEmpty<TxId>,
+        super::wallet::TransferErrT<
+            DbT,
+            GreedyInputSelector<DbT>,
+            standard::MultiOutputChangeStrategy<DbT>,
+        >,
+    > {
+        let input_selector = GreedyInputSelector::new();
+
+        #[cfg(not(feature = "orchard"))]
+        let fallback_change_pool = ShieldedProtocol::Sapling;
+        #[cfg(feature = "orchard")]
+        let fallback_change_pool = ShieldedProtocol::Orchard;
+
+        let change_strategy = standard::SingleOutputChangeStrategy::new(
+            StandardFeeRule::Zip317,
+            None,
+            fallback_change_pool,
+            DustOutputPolicy::default(),
+        );
+
+        let request =
+            zip321::TransactionRequest::new(vec![Payment::without_memo(to, value)]).unwrap();
+
+        self.spend(
+            &input_selector,
+            &change_strategy,
+            from_account.usk(),
+            request,
+            OvkPolicy::Sender,
+            NonZeroU32::MIN,
+        )
+    }
+
+    /// Prepares and executes the given [`zip321::TransactionRequest`] in a single step.
+    #[allow(clippy::type_complexity)]
+    pub fn spend<InputsT, ChangeT>(
+        &mut self,
+        input_selector: &InputsT,
+        change_strategy: &ChangeT,
+        usk: &UnifiedSpendingKey,
+        request: zip321::TransactionRequest,
+        ovk_policy: OvkPolicy,
+        min_confirmations: NonZeroU32,
+    ) -> Result<NonEmpty<TxId>, super::wallet::TransferErrT<DbT, InputsT, ChangeT>>
+    where
+        InputsT: InputSelector<InputSource = DbT>,
+        ChangeT: ChangeStrategy<MetaSource = DbT>,
+    {
+        let prover = LocalTxProver::bundled();
+        let network = self.network().clone();
+
+        let account = self
+            .wallet()
+            .get_account_for_ufvk(&usk.to_unified_full_viewing_key())
+            .map_err(Error::DataSource)?
+            .ok_or(Error::KeyNotRecognized)?;
+
+        let proposal = propose_transfer(
+            self.wallet_mut(),
+            &network,
+            account.id(),
+            input_selector,
+            change_strategy,
+            request,
+            min_confirmations,
+        )?;
+
+        create_proposed_transactions(
+            self.wallet_mut(),
+            &network,
+            &prover,
+            &prover,
+            usk,
+            ovk_policy,
+            &proposal,
+        )
+    }
+
+    /// Invokes [`propose_transfer`] with the given arguments.
+    #[allow(clippy::type_complexity)]
+    pub fn propose_transfer<InputsT, ChangeT>(
+        &mut self,
+        spend_from_account: <DbT as InputSource>::AccountId,
+        input_selector: &InputsT,
+        change_strategy: &ChangeT,
+        request: zip321::TransactionRequest,
+        min_confirmations: NonZeroU32,
+    ) -> Result<
+        Proposal<ChangeT::FeeRule, <DbT as InputSource>::NoteRef>,
+        super::wallet::ProposeTransferErrT<DbT, Infallible, InputsT, ChangeT>,
+    >
+    where
+        InputsT: InputSelector<InputSource = DbT>,
+        ChangeT: ChangeStrategy<MetaSource = DbT>,
+    {
+        let network = self.network().clone();
+        propose_transfer::<_, _, _, _, Infallible>(
+            self.wallet_mut(),
+            &network,
+            spend_from_account,
+            input_selector,
+            change_strategy,
+            request,
+            min_confirmations,
+        )
+    }
+
+    /// Invokes [`propose_standard_transfer_to_address`] with the given arguments.
+    #[allow(clippy::type_complexity)]
+    #[allow(clippy::too_many_arguments)]
+    pub fn propose_standard_transfer<CommitmentTreeErrT>(
+        &mut self,
+        spend_from_account: <DbT as InputSource>::AccountId,
+        fee_rule: StandardFeeRule,
+        min_confirmations: NonZeroU32,
+        to: &Address,
+        amount: NonNegativeAmount,
+        memo: Option<MemoBytes>,
+        change_memo: Option<MemoBytes>,
+        fallback_change_pool: ShieldedProtocol,
+    ) -> Result<
+        Proposal<StandardFeeRule, <DbT as InputSource>::NoteRef>,
+        super::wallet::ProposeTransferErrT<
+            DbT,
+            CommitmentTreeErrT,
+            GreedyInputSelector<DbT>,
+            SingleOutputChangeStrategy<DbT>,
+        >,
+    > {
+        let network = self.network().clone();
+        let result = propose_standard_transfer_to_address::<_, _, CommitmentTreeErrT>(
+            self.wallet_mut(),
+            &network,
+            fee_rule,
+            spend_from_account,
+            min_confirmations,
+            to,
+            amount,
+            memo,
+            change_memo,
+            fallback_change_pool,
+        );
+
+        if let Ok(proposal) = &result {
+            check_proposal_serialization_roundtrip(self.wallet(), proposal);
+        }
+
+        result
+    }
+
+    /// Invokes [`propose_shielding`] with the given arguments.
+    ///
+    /// [`propose_shielding`]: crate::data_api::wallet::propose_shielding
+    #[cfg(feature = "transparent-inputs")]
+    #[allow(clippy::type_complexity)]
+    #[allow(dead_code)]
+    pub fn propose_shielding<InputsT, ChangeT>(
+        &mut self,
+        input_selector: &InputsT,
+        change_strategy: &ChangeT,
+        shielding_threshold: NonNegativeAmount,
+        from_addrs: &[TransparentAddress],
+        to_account: <InputsT::InputSource as InputSource>::AccountId,
+        min_confirmations: u32,
+    ) -> Result<
+        Proposal<ChangeT::FeeRule, Infallible>,
+        super::wallet::ProposeShieldingErrT<DbT, Infallible, InputsT, ChangeT>,
+    >
+    where
+        InputsT: ShieldingSelector<InputSource = DbT>,
+        ChangeT: ChangeStrategy<MetaSource = DbT>,
+    {
+        use super::wallet::propose_shielding;
+
+        let network = self.network().clone();
+        propose_shielding::<_, _, _, _, Infallible>(
+            self.wallet_mut(),
+            &network,
+            input_selector,
+            change_strategy,
+            shielding_threshold,
+            from_addrs,
+            to_account,
+            min_confirmations,
+        )
+    }
+
+    /// Invokes [`create_proposed_transactions`] with the given arguments.
+    #[allow(clippy::type_complexity)]
+    pub fn create_proposed_transactions<InputsErrT, FeeRuleT, ChangeErrT>(
+        &mut self,
+        usk: &UnifiedSpendingKey,
+        ovk_policy: OvkPolicy,
+        proposal: &Proposal<FeeRuleT, <DbT as InputSource>::NoteRef>,
+    ) -> Result<
+        NonEmpty<TxId>,
+        super::wallet::CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, DbT::NoteRef>,
+    >
+    where
+        FeeRuleT: FeeRule,
+    {
+        let prover = LocalTxProver::bundled();
+        let network = self.network().clone();
+        create_proposed_transactions(
+            self.wallet_mut(),
+            &network,
+            &prover,
+            &prover,
+            usk,
+            ovk_policy,
+            proposal,
+        )
+    }
+
+    /// Invokes [`shield_transparent_funds`] with the given arguments.
+    ///
+    /// [`shield_transparent_funds`]: crate::data_api::wallet::shield_transparent_funds
+    #[cfg(feature = "transparent-inputs")]
+    #[allow(clippy::type_complexity)]
+    #[allow(clippy::too_many_arguments)]
+    pub fn shield_transparent_funds<InputsT, ChangeT>(
+        &mut self,
+        input_selector: &InputsT,
+        change_strategy: &ChangeT,
+        shielding_threshold: NonNegativeAmount,
+        usk: &UnifiedSpendingKey,
+        from_addrs: &[TransparentAddress],
+        to_account: <DbT as InputSource>::AccountId,
+        min_confirmations: u32,
+    ) -> Result<NonEmpty<TxId>, super::wallet::ShieldErrT<DbT, InputsT, ChangeT>>
+    where
+        InputsT: ShieldingSelector<InputSource = DbT>,
+        ChangeT: ChangeStrategy<MetaSource = DbT>,
+    {
+        use crate::data_api::wallet::shield_transparent_funds;
+
+        let prover = LocalTxProver::bundled();
+        let network = self.network().clone();
+        shield_transparent_funds(
+            self.wallet_mut(),
+            &network,
+            &prover,
+            &prover,
+            input_selector,
+            change_strategy,
+            shielding_threshold,
+            usk,
+            from_addrs,
+            to_account,
+            min_confirmations,
+        )
+    }
+
+    fn with_account_balance<T, F: FnOnce(&AccountBalance) -> T>(
+        &self,
+        account: AccountIdT,
+        min_confirmations: u32,
+        f: F,
+    ) -> T {
+        let binding = self
+            .wallet()
+            .get_wallet_summary(min_confirmations)
+            .unwrap()
+            .unwrap();
+        f(binding.account_balances().get(&account).unwrap())
+    }
+
+    /// Returns the total balance in the given account at this point in the test.
+    pub fn get_total_balance(&self, account: AccountIdT) -> NonNegativeAmount {
+        self.with_account_balance(account, 0, |balance| balance.total())
+    }
+
+    /// Returns the balance in the given account that is spendable with the given number
+    /// of confirmations at this point in the test.
+    pub fn get_spendable_balance(
+        &self,
+        account: AccountIdT,
+        min_confirmations: u32,
+    ) -> NonNegativeAmount {
+        self.with_account_balance(account, min_confirmations, |balance| {
+            balance.spendable_value()
+        })
+    }
+
+    /// Returns the balance in the given account that is detected but not yet spendable
+    /// with the given number of confirmations at this point in the test.
+    pub fn get_pending_shielded_balance(
+        &self,
+        account: AccountIdT,
+        min_confirmations: u32,
+    ) -> NonNegativeAmount {
+        self.with_account_balance(account, min_confirmations, |balance| {
+            balance.value_pending_spendability() + balance.change_pending_confirmation()
+        })
+        .unwrap()
+    }
+
+    /// Returns the amount of change in the given account that is not yet spendable with
+    /// the given number of confirmations at this point in the test.
+    #[allow(dead_code)]
+    pub fn get_pending_change(
+        &self,
+        account: AccountIdT,
+        min_confirmations: u32,
+    ) -> NonNegativeAmount {
+        self.with_account_balance(account, min_confirmations, |balance| {
+            balance.change_pending_confirmation()
+        })
+    }
+
+    /// Returns a summary of the wallet at this point in the test.
+    pub fn get_wallet_summary(&self, min_confirmations: u32) -> Option<WalletSummary<AccountIdT>> {
+        self.wallet().get_wallet_summary(min_confirmations).unwrap()
+    }
+}
+
+impl<Cache, DbT, ParamsT, AccountIdT, ErrT> TestState<Cache, DbT, ParamsT>
+where
+    ParamsT: consensus::Parameters + Send + 'static,
+    AccountIdT: std::cmp::Eq + std::hash::Hash,
+    ErrT: std::fmt::Debug,
+    DbT: InputSource<AccountId = AccountIdT, Error = ErrT>
+        + WalletTest
+        + WalletWrite<AccountId = AccountIdT, Error = ErrT>
+        + WalletCommitmentTrees,
+    <DbT as WalletRead>::AccountId: ConditionallySelectable + Default + Send + 'static,
+{
+    /// Returns a transaction from the history.
+    #[allow(dead_code)]
+    pub fn get_tx_from_history(
+        &self,
+        txid: TxId,
+    ) -> Result<Option<TransactionSummary<AccountIdT>>, ErrT> {
+        let history = self.wallet().get_tx_history()?;
+        Ok(history.into_iter().find(|tx| tx.txid() == txid))
+    }
+}
+
+impl<Cache, DbT: WalletRead + Reset> TestState<Cache, DbT, LocalNetwork> {
+    /// Resets the wallet using a new wallet database but with the same cache of blocks,
+    /// and returns the old wallet database file.
+    ///
+    /// This does not recreate accounts, nor does it rescan the cached blocks.
+    /// The resulting wallet has no test account.
+    /// Before using any `generate_*` method on the reset state, call `reset_latest_cached_block()`.
+    pub fn reset(&mut self) -> DbT::Handle {
+        self.latest_block_height = None;
+        self.test_account = None;
+        DbT::reset(self)
+    }
+
+    //    /// Reset the latest cached block to the most recent one in the cache database.
+    //    #[allow(dead_code)]
+    //    pub fn reset_latest_cached_block(&mut self) {
+    //        self.cache
+    //            .block_source()
+    //            .with_blocks::<_, Infallible>(None, None, |block: CompactBlock| {
+    //                let chain_metadata = block.chain_metadata.unwrap();
+    //                self.latest_cached_block = Some(CachedBlock::at(
+    //                    BlockHash::from_slice(block.hash.as_slice()),
+    //                    BlockHeight::from_u32(block.height.try_into().unwrap()),
+    //                    chain_metadata.sapling_commitment_tree_size,
+    //                    chain_metadata.orchard_commitment_tree_size,
+    //                ));
+    //                Ok(())
+    //            })
+    //            .unwrap();
+    //    }
+}
+
+pub fn single_output_change_strategy<DbT: InputSource>(
+    fee_rule: StandardFeeRule,
+    change_memo: Option<&str>,
+    fallback_change_pool: ShieldedProtocol,
+) -> standard::SingleOutputChangeStrategy<DbT> {
+    let change_memo = change_memo.map(|m| MemoBytes::from(m.parse::<Memo>().unwrap()));
+    standard::SingleOutputChangeStrategy::new(
+        fee_rule,
+        change_memo,
+        fallback_change_pool,
+        DustOutputPolicy::default(),
+    )
+}
+
+// Checks that a protobuf proposal serialized from the provided proposal value correctly parses to
+// the same proposal value.
+fn check_proposal_serialization_roundtrip<DbT: InputSource>(
+    wallet_data: &DbT,
+    proposal: &Proposal<StandardFeeRule, DbT::NoteRef>,
+) {
+    let proposal_proto = crate::proto::proposal::Proposal::from_standard_proposal(proposal);
+    let deserialized_proposal = proposal_proto.try_into_standard_proposal(wallet_data);
+    assert_matches!(deserialized_proposal, Ok(r) if &r == proposal);
+}
+
+/// The initial chain state for a test.
+///
+/// This is returned from the closure passed to [`TestBuilder::with_initial_chain_state`]
+/// to configure the test state with a starting chain position, to which subsequent test
+/// activity is applied.
+pub struct InitialChainState {
+    /// Information about the chain's state as of the chain tip.
+    pub chain_state: ChainState,
+    /// Roots of the completed Sapling subtrees as of this chain state.
+    pub prior_sapling_roots: Vec<CommitmentTreeRoot<::sapling::Node>>,
+    /// Roots of the completed Orchard subtrees as of this chain state.
+    #[cfg(feature = "orchard")]
+    pub prior_orchard_roots: Vec<CommitmentTreeRoot<MerkleHashOrchard>>,
+}
+
+/// Trait representing the ability to construct a new data store for use in a test.
+pub trait DataStoreFactory {
+    type Error: core::fmt::Debug;
+    type AccountId: std::fmt::Debug + ConditionallySelectable + Default + Hash + Eq + Send + 'static;
+    type Account: Account<AccountId = Self::AccountId> + Clone;
+    type DsError: core::fmt::Debug;
+    type DataStore: InputSource<AccountId = Self::AccountId, Error = Self::DsError>
+        + WalletRead<AccountId = Self::AccountId, Account = Self::Account, Error = Self::DsError>
+        + WalletTest
+        + WalletWrite
+        + WalletCommitmentTrees;
+
+    /// Constructs a new data store.
+    fn new_data_store(&self, network: LocalNetwork) -> Result<Self::DataStore, Self::Error>;
+}
+
+/// A [`TestState`] builder, that configures the environment for a test.
+pub struct TestBuilder<Cache, DataStoreFactory> {
+    rng: ChaChaRng,
+    network: LocalNetwork,
+    cache: Cache,
+    ds_factory: DataStoreFactory,
+    initial_chain_state: Option<InitialChainState>,
+    account_birthday: Option<AccountBirthday>,
+    account_index: Option<zip32::AccountId>,
+}
+
+impl TestBuilder<(), ()> {
+    /// The default network used by [`TestBuilder::new`].
+    ///
+    /// This is a fake network where Sapling through NU5 activate at the same height. We
+    /// pick height 100,000 to be large enough to handle any hard-coded test offsets.
+    pub const DEFAULT_NETWORK: LocalNetwork = LocalNetwork {
+        overwinter: Some(BlockHeight::from_u32(1)),
+        sapling: Some(BlockHeight::from_u32(100_000)),
+        blossom: Some(BlockHeight::from_u32(100_000)),
+        heartwood: Some(BlockHeight::from_u32(100_000)),
+        canopy: Some(BlockHeight::from_u32(100_000)),
+        nu5: Some(BlockHeight::from_u32(100_000)),
+        nu6: None,
+        nu7: None,
+        #[cfg(zcash_unstable = "zfuture")]
+        z_future: None,
+    };
+
+    /// Constructs a new test environment builder.
+    pub fn new() -> Self {
+        TestBuilder {
+            rng: ChaChaRng::seed_from_u64(0),
+            network: Self::DEFAULT_NETWORK,
+            cache: (),
+            ds_factory: (),
+            initial_chain_state: None,
+            account_birthday: None,
+            account_index: None,
+        }
+    }
+}
+
+impl Default for TestBuilder<(), ()> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<A> TestBuilder<(), A> {
+    /// Adds a block cache to the test environment.
+    pub fn with_block_cache<C: TestCache>(self, cache: C) -> TestBuilder<C, A> {
+        TestBuilder {
+            rng: self.rng,
+            network: self.network,
+            cache,
+            ds_factory: self.ds_factory,
+            initial_chain_state: self.initial_chain_state,
+            account_birthday: self.account_birthday,
+            account_index: self.account_index,
+        }
+    }
+}
+
+impl<A> TestBuilder<A, ()> {
+    /// Adds a wallet data store to the test environment.
+    pub fn with_data_store_factory<DsFactory>(
+        self,
+        ds_factory: DsFactory,
+    ) -> TestBuilder<A, DsFactory> {
+        TestBuilder {
+            rng: self.rng,
+            network: self.network,
+            cache: self.cache,
+            ds_factory,
+            initial_chain_state: self.initial_chain_state,
+            account_birthday: self.account_birthday,
+            account_index: self.account_index,
+        }
+    }
+}
+
+impl<Cache, DsFactory> TestBuilder<Cache, DsFactory> {
+    /// Configures the test to start with the given initial chain state.
+    ///
+    /// # Panics
+    ///
+    /// - Must not be called twice.
+    /// - Must be called before [`Self::with_account_from_sapling_activation`] or
+    /// [`Self::with_account_having_current_birthday`].
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use std::num::NonZeroU8;
+    ///
+    /// use incrementalmerkletree::frontier::Frontier;
+    /// use zcash_primitives::{block::BlockHash, consensus::Parameters};
+    /// use zcash_protocol::consensus::NetworkUpgrade;
+    /// use zcash_client_backend::data_api::{
+    ///     chain::{ChainState, CommitmentTreeRoot},
+    ///     testing::{InitialChainState, TestBuilder},
+    /// };
+    ///
+    /// // For this test, we'll start inserting leaf notes 5 notes after the end of the
+    /// // third subtree, with a gap of 10 blocks. After `scan_cached_blocks`, the scan
+    /// // queue should have a requested scan range of 300..310 with `FoundNote` priority,
+    /// // 310..320 with `Scanned` priority. We set both Sapling and Orchard to the same
+    /// // initial tree size for simplicity.
+    /// let prior_block_hash = BlockHash([0; 32]);
+    /// let initial_sapling_tree_size: u32 = (0x1 << 16) * 3 + 5;
+    /// let initial_orchard_tree_size: u32 = (0x1 << 16) * 3 + 5;
+    /// let initial_height_offset = 310;
+    ///
+    /// let mut st = TestBuilder::new()
+    ///     .with_initial_chain_state(|rng, network| {
+    ///         // For simplicity, assume Sapling and NU5 activated at the same height.
+    ///         let sapling_activation_height =
+    ///             network.activation_height(NetworkUpgrade::Sapling).unwrap();
+    ///
+    ///         // Construct a fake chain state for the end of block 300
+    ///         let (prior_sapling_roots, sapling_initial_tree) =
+    ///             Frontier::random_with_prior_subtree_roots(
+    ///                 rng,
+    ///                 initial_sapling_tree_size.into(),
+    ///                 NonZeroU8::new(16).unwrap(),
+    ///             );
+    ///         let prior_sapling_roots = prior_sapling_roots
+    ///             .into_iter()
+    ///             .zip(1u32..)
+    ///             .map(|(root, i)| {
+    ///                 CommitmentTreeRoot::from_parts(sapling_activation_height + (100 * i), root)
+    ///             })
+    ///             .collect::<Vec<_>>();
+    ///
+    ///         #[cfg(feature = "orchard")]
+    ///         let (prior_orchard_roots, orchard_initial_tree) =
+    ///             Frontier::random_with_prior_subtree_roots(
+    ///                 rng,
+    ///                 initial_orchard_tree_size.into(),
+    ///                 NonZeroU8::new(16).unwrap(),
+    ///             );
+    ///         #[cfg(feature = "orchard")]
+    ///         let prior_orchard_roots = prior_orchard_roots
+    ///             .into_iter()
+    ///             .zip(1u32..)
+    ///             .map(|(root, i)| {
+    ///                 CommitmentTreeRoot::from_parts(sapling_activation_height + (100 * i), root)
+    ///             })
+    ///             .collect::<Vec<_>>();
+    ///
+    ///         InitialChainState {
+    ///             chain_state: ChainState::new(
+    ///                 sapling_activation_height + initial_height_offset - 1,
+    ///                 prior_block_hash,
+    ///                 sapling_initial_tree,
+    ///                 #[cfg(feature = "orchard")]
+    ///                 orchard_initial_tree,
+    ///             ),
+    ///             prior_sapling_roots,
+    ///             #[cfg(feature = "orchard")]
+    ///             prior_orchard_roots,
+    ///         }
+    ///     });
+    /// ```
+    pub fn with_initial_chain_state(
+        mut self,
+        chain_state: impl FnOnce(&mut ChaChaRng, &LocalNetwork) -> InitialChainState,
+    ) -> Self {
+        assert!(self.initial_chain_state.is_none());
+        assert!(self.account_birthday.is_none());
+        self.initial_chain_state = Some(chain_state(&mut self.rng, &self.network));
+        self
+    }
+
+    /// Configures the environment with a [`TestAccount`] that has a birthday at Sapling
+    /// activation.
+    ///
+    /// # Panics
+    ///
+    /// - Must not be called twice.
+    /// - Do not call both [`Self::with_account_having_current_birthday`] and this method.
+    pub fn with_account_from_sapling_activation(mut self, prev_hash: BlockHash) -> Self {
+        assert!(self.account_birthday.is_none());
+        self.account_birthday = Some(AccountBirthday::from_parts(
+            ChainState::empty(
+                self.network
+                    .activation_height(NetworkUpgrade::Sapling)
+                    .unwrap()
+                    - 1,
+                prev_hash,
+            ),
+            None,
+        ));
+        self
+    }
+
+    /// Configures the environment with a [`TestAccount`] that has a birthday one block
+    /// after the initial chain state.
+    ///
+    /// # Panics
+    ///
+    /// - Must not be called twice.
+    /// - Must call [`Self::with_initial_chain_state`] before calling this method.
+    /// - Do not call both [`Self::with_account_from_sapling_activation`] and this method.
+    pub fn with_account_having_current_birthday(mut self) -> Self {
+        assert!(self.account_birthday.is_none());
+        assert!(self.initial_chain_state.is_some());
+        self.account_birthday = Some(AccountBirthday::from_parts(
+            self.initial_chain_state
+                .as_ref()
+                .unwrap()
+                .chain_state
+                .clone(),
+            None,
+        ));
+        self
+    }
+
+    /// Sets the account index for the test account.
+    ///
+    /// Does nothing unless either [`Self::with_account_from_sapling_activation`] or
+    /// [`Self::with_account_having_current_birthday`] is also called.
+    ///
+    /// # Panics
+    ///
+    /// - Must not be called twice.
+    pub fn set_account_index(mut self, index: zip32::AccountId) -> Self {
+        assert!(self.account_index.is_none());
+        self.account_index = Some(index);
+        self
+    }
+}
+
+impl<Cache, DsFactory: DataStoreFactory> TestBuilder<Cache, DsFactory> {
+    /// Builds the state for this test.
+    pub fn build(self) -> TestState<Cache, DsFactory::DataStore, LocalNetwork> {
+        let mut cached_blocks = BTreeMap::new();
+        let mut wallet_data = self.ds_factory.new_data_store(self.network).unwrap();
+
+        if let Some(initial_state) = &self.initial_chain_state {
+            wallet_data
+                .put_sapling_subtree_roots(0, &initial_state.prior_sapling_roots)
+                .unwrap();
+            wallet_data
+                .with_sapling_tree_mut(|t| {
+                    t.insert_frontier(
+                        initial_state.chain_state.final_sapling_tree().clone(),
+                        Retention::Checkpoint {
+                            id: initial_state.chain_state.block_height(),
+                            marking: Marking::Reference,
+                        },
+                    )
+                })
+                .unwrap();
+
+            #[cfg(feature = "orchard")]
+            {
+                wallet_data
+                    .put_orchard_subtree_roots(0, &initial_state.prior_orchard_roots)
+                    .unwrap();
+                wallet_data
+                    .with_orchard_tree_mut(|t| {
+                        t.insert_frontier(
+                            initial_state.chain_state.final_orchard_tree().clone(),
+                            Retention::Checkpoint {
+                                id: initial_state.chain_state.block_height(),
+                                marking: Marking::Reference,
+                            },
+                        )
+                    })
+                    .unwrap();
+            }
+
+            let final_sapling_tree_size =
+                initial_state.chain_state.final_sapling_tree().tree_size() as u32;
+            let _final_orchard_tree_size = 0;
+            #[cfg(feature = "orchard")]
+            let _final_orchard_tree_size =
+                initial_state.chain_state.final_orchard_tree().tree_size() as u32;
+
+            cached_blocks.insert(
+                initial_state.chain_state.block_height(),
+                CachedBlock {
+                    chain_state: initial_state.chain_state.clone(),
+                    sapling_end_size: final_sapling_tree_size,
+                    orchard_end_size: _final_orchard_tree_size,
+                },
+            );
+        };
+
+        let test_account = self.account_birthday.map(|birthday| {
+            let seed = Secret::new(vec![0u8; 32]);
+            let (account, usk) = match self.account_index {
+                Some(index) => wallet_data
+                    .import_account_hd("", &seed, index, &birthday, None)
+                    .unwrap(),
+                None => {
+                    let result = wallet_data
+                        .create_account("", &seed, &birthday, None)
+                        .unwrap();
+                    (
+                        wallet_data.get_account(result.0).unwrap().unwrap(),
+                        result.1,
+                    )
+                }
+            };
+            (
+                seed,
+                TestAccount {
+                    account,
+                    usk,
+                    birthday,
+                },
+            )
+        });
+
+        TestState {
+            cache: self.cache,
+            cached_blocks,
+            latest_block_height: self
+                .initial_chain_state
+                .map(|s| s.chain_state.block_height()),
+            wallet_data,
+            network: self.network,
+            test_account,
+            rng: self.rng,
+        }
+    }
+}
+
+/// Trait used by tests that require a full viewing key.
+pub trait TestFvk: Clone {
+    /// The type of nullifier corresponding to the kind of note that this full viewing key
+    /// can detect (and that its corresponding spending key can spend).
+    type Nullifier: Copy;
+
+    /// Returns the Sapling outgoing viewing key corresponding to this full viewing key,
+    /// if any.
+    fn sapling_ovk(&self) -> Option<::sapling::keys::OutgoingViewingKey>;
+
+    /// Returns the Orchard outgoing viewing key corresponding to this full viewing key,
+    /// if any.
+    #[cfg(feature = "orchard")]
+    fn orchard_ovk(&self, scope: zip32::Scope) -> Option<::orchard::keys::OutgoingViewingKey>;
+
+    /// Adds a single spend to the given [`CompactTx`] of a note previously received by
+    /// this full viewing key.
+    fn add_spend<R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        nf: Self::Nullifier,
+        rng: &mut R,
+    );
+
+    /// Adds a single output to the given [`CompactTx`] that will be received by this full
+    /// viewing key.
+    ///
+    /// `req` allows configuring how the full viewing key will detect the output.
+    #[allow(clippy::too_many_arguments)]
+    fn add_output<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        params: &P,
+        height: BlockHeight,
+        req: AddressType,
+        value: NonNegativeAmount,
+        initial_sapling_tree_size: u32,
+        // we don't require an initial Orchard tree size because we don't need it to compute
+        // the nullifier.
+        rng: &mut R,
+    ) -> Self::Nullifier;
+
+    /// Adds both a spend and an output to the given [`CompactTx`].
+    ///
+    /// - If this is a Sapling full viewing key, the transaction will gain both a Spend
+    ///   and an Output.
+    /// - If this is an Orchard full viewing key, the transaction will gain an Action.
+    ///
+    /// `req` allows configuring how the full viewing key will detect the output.
+    #[allow(clippy::too_many_arguments)]
+    fn add_logical_action<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        params: &P,
+        height: BlockHeight,
+        nf: Self::Nullifier,
+        req: AddressType,
+        value: NonNegativeAmount,
+        initial_sapling_tree_size: u32,
+        // we don't require an initial Orchard tree size because we don't need it to compute
+        // the nullifier.
+        rng: &mut R,
+    ) -> Self::Nullifier;
+}
+
+impl<'a, A: TestFvk> TestFvk for &'a A {
+    type Nullifier = A::Nullifier;
+
+    fn sapling_ovk(&self) -> Option<::sapling::keys::OutgoingViewingKey> {
+        (*self).sapling_ovk()
+    }
+
+    #[cfg(feature = "orchard")]
+    fn orchard_ovk(&self, scope: zip32::Scope) -> Option<::orchard::keys::OutgoingViewingKey> {
+        (*self).orchard_ovk(scope)
+    }
+
+    fn add_spend<R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        nf: Self::Nullifier,
+        rng: &mut R,
+    ) {
+        (*self).add_spend(ctx, nf, rng)
+    }
+
+    fn add_output<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        params: &P,
+        height: BlockHeight,
+        req: AddressType,
+        value: Zatoshis,
+        initial_sapling_tree_size: u32,
+        // we don't require an initial Orchard tree size because we don't need it to compute
+        // the nullifier.
+        rng: &mut R,
+    ) -> Self::Nullifier {
+        (*self).add_output(
+            ctx,
+            params,
+            height,
+            req,
+            value,
+            initial_sapling_tree_size,
+            rng,
+        )
+    }
+
+    fn add_logical_action<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        params: &P,
+        height: BlockHeight,
+        nf: Self::Nullifier,
+        req: AddressType,
+        value: Zatoshis,
+        initial_sapling_tree_size: u32,
+        // we don't require an initial Orchard tree size because we don't need it to compute
+        // the nullifier.
+        rng: &mut R,
+    ) -> Self::Nullifier {
+        (*self).add_logical_action(
+            ctx,
+            params,
+            height,
+            nf,
+            req,
+            value,
+            initial_sapling_tree_size,
+            rng,
+        )
+    }
+}
+
+impl TestFvk for DiversifiableFullViewingKey {
+    type Nullifier = ::sapling::Nullifier;
+
+    fn sapling_ovk(&self) -> Option<::sapling::keys::OutgoingViewingKey> {
+        Some(self.fvk().ovk)
+    }
+
+    #[cfg(feature = "orchard")]
+    fn orchard_ovk(&self, _: zip32::Scope) -> Option<::orchard::keys::OutgoingViewingKey> {
+        None
+    }
+
+    fn add_spend<R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        nf: Self::Nullifier,
+        _: &mut R,
+    ) {
+        let cspend = CompactSaplingSpend { nf: nf.to_vec() };
+        ctx.spends.push(cspend);
+    }
+
+    fn add_output<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        params: &P,
+        height: BlockHeight,
+        req: AddressType,
+        value: NonNegativeAmount,
+        initial_sapling_tree_size: u32,
+        rng: &mut R,
+    ) -> Self::Nullifier {
+        let recipient = match req {
+            AddressType::DefaultExternal => self.default_address().1,
+            AddressType::DiversifiedExternal(idx) => self.find_address(idx).unwrap().1,
+            AddressType::Internal => self.change_address().1,
+        };
+
+        let position = initial_sapling_tree_size + ctx.outputs.len() as u32;
+
+        let (cout, note) =
+            compact_sapling_output(params, height, recipient, value, self.sapling_ovk(), rng);
+        ctx.outputs.push(cout);
+
+        note.nf(&self.fvk().vk.nk, position as u64)
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn add_logical_action<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        params: &P,
+        height: BlockHeight,
+        nf: Self::Nullifier,
+        req: AddressType,
+        value: NonNegativeAmount,
+        initial_sapling_tree_size: u32,
+        rng: &mut R,
+    ) -> Self::Nullifier {
+        self.add_spend(ctx, nf, rng);
+        self.add_output(
+            ctx,
+            params,
+            height,
+            req,
+            value,
+            initial_sapling_tree_size,
+            rng,
+        )
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl TestFvk for ::orchard::keys::FullViewingKey {
+    type Nullifier = ::orchard::note::Nullifier;
+
+    fn sapling_ovk(&self) -> Option<::sapling::keys::OutgoingViewingKey> {
+        None
+    }
+
+    fn orchard_ovk(&self, scope: zip32::Scope) -> Option<::orchard::keys::OutgoingViewingKey> {
+        Some(self.to_ovk(scope))
+    }
+
+    fn add_spend<R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        revealed_spent_note_nullifier: Self::Nullifier,
+        rng: &mut R,
+    ) {
+        // Generate a dummy recipient.
+        let recipient = loop {
+            let mut bytes = [0; 32];
+            rng.fill_bytes(&mut bytes);
+            let sk = ::orchard::keys::SpendingKey::from_bytes(bytes);
+            if sk.is_some().into() {
+                break ::orchard::keys::FullViewingKey::from(&sk.unwrap())
+                    .address_at(0u32, zip32::Scope::External);
+            }
+        };
+
+        let (cact, _) = compact_orchard_action(
+            revealed_spent_note_nullifier,
+            recipient,
+            NonNegativeAmount::ZERO,
+            self.orchard_ovk(zip32::Scope::Internal),
+            rng,
+        );
+        ctx.actions.push(cact);
+    }
+
+    fn add_output<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        _: &P,
+        _: BlockHeight,
+        req: AddressType,
+        value: NonNegativeAmount,
+        _: u32, // the position is not required for computing the Orchard nullifier
+        mut rng: &mut R,
+    ) -> Self::Nullifier {
+        // Generate a dummy nullifier for the spend
+        let revealed_spent_note_nullifier =
+            ::orchard::note::Nullifier::from_bytes(&pallas::Base::random(&mut rng).to_repr())
+                .unwrap();
+
+        let (j, scope) = match req {
+            AddressType::DefaultExternal => (0u32.into(), zip32::Scope::External),
+            AddressType::DiversifiedExternal(idx) => (idx, zip32::Scope::External),
+            AddressType::Internal => (0u32.into(), zip32::Scope::Internal),
+        };
+
+        let (cact, note) = compact_orchard_action(
+            revealed_spent_note_nullifier,
+            self.address_at(j, scope),
+            value,
+            self.orchard_ovk(scope),
+            rng,
+        );
+        ctx.actions.push(cact);
+
+        note.nullifier(self)
+    }
+
+    // Override so we can merge the spend and output into a single action.
+    fn add_logical_action<P: consensus::Parameters, R: RngCore + CryptoRng>(
+        &self,
+        ctx: &mut CompactTx,
+        _: &P,
+        _: BlockHeight,
+        revealed_spent_note_nullifier: Self::Nullifier,
+        address_type: AddressType,
+        value: NonNegativeAmount,
+        _: u32, // the position is not required for computing the Orchard nullifier
+        rng: &mut R,
+    ) -> Self::Nullifier {
+        let (j, scope) = match address_type {
+            AddressType::DefaultExternal => (0u32.into(), zip32::Scope::External),
+            AddressType::DiversifiedExternal(idx) => (idx, zip32::Scope::External),
+            AddressType::Internal => (0u32.into(), zip32::Scope::Internal),
+        };
+
+        let (cact, note) = compact_orchard_action(
+            revealed_spent_note_nullifier,
+            self.address_at(j, scope),
+            value,
+            self.orchard_ovk(scope),
+            rng,
+        );
+        ctx.actions.push(cact);
+
+        // Return the nullifier of the newly created output note
+        note.nullifier(self)
+    }
+}
+
+/// Configures how a [`TestFvk`] receives a particular output.
+///
+/// Used with [`TestFvk::add_output`] and [`TestFvk::add_logical_action`].
+#[derive(Clone, Copy)]
+pub enum AddressType {
+    /// The output will be sent to the default address of the full viewing key.
+    DefaultExternal,
+    /// The output will be sent to the specified diversified address of the full viewing
+    /// key.
+    #[allow(dead_code)]
+    DiversifiedExternal(DiversifierIndex),
+    /// The output will be sent to the internal receiver of the full viewing key.
+    ///
+    /// Such outputs are treated as "wallet-internal". A "recipient address" is **NEVER**
+    /// exposed to users.
+    Internal,
+}
+
+/// Creates a `CompactSaplingOutput` at the given height paying the given recipient.
+///
+/// Returns the `CompactSaplingOutput` and the new note.
+fn compact_sapling_output<P: consensus::Parameters, R: RngCore + CryptoRng>(
+    params: &P,
+    height: BlockHeight,
+    recipient: ::sapling::PaymentAddress,
+    value: NonNegativeAmount,
+    ovk: Option<::sapling::keys::OutgoingViewingKey>,
+    rng: &mut R,
+) -> (CompactSaplingOutput, ::sapling::Note) {
+    let rseed = generate_random_rseed(zip212_enforcement(params, height), rng);
+    let note = ::sapling::Note::from_parts(
+        recipient,
+        ::sapling::value::NoteValue::from_raw(value.into_u64()),
+        rseed,
+    );
+    let encryptor = sapling_note_encryption(ovk, note.clone(), *MemoBytes::empty().as_array(), rng);
+    let cmu = note.cmu().to_bytes().to_vec();
+    let ephemeral_key = SaplingDomain::epk_bytes(encryptor.epk()).0.to_vec();
+    let enc_ciphertext = encryptor.encrypt_note_plaintext();
+
+    (
+        CompactSaplingOutput {
+            cmu,
+            ephemeral_key,
+            ciphertext: enc_ciphertext.as_ref()[..52].to_vec(),
+        },
+        note,
+    )
+}
+
+/// Creates a `CompactOrchardAction` at the given height paying the given recipient.
+///
+/// Returns the `CompactOrchardAction` and the new note.
+#[cfg(feature = "orchard")]
+fn compact_orchard_action<R: RngCore + CryptoRng>(
+    nf_old: ::orchard::note::Nullifier,
+    recipient: ::orchard::Address,
+    value: NonNegativeAmount,
+    ovk: Option<::orchard::keys::OutgoingViewingKey>,
+    rng: &mut R,
+) -> (CompactOrchardAction, ::orchard::Note) {
+    use zcash_note_encryption::ShieldedOutput;
+
+    let (compact_action, note) = ::orchard::note_encryption::testing::fake_compact_action(
+        rng,
+        nf_old,
+        recipient,
+        ::orchard::value::NoteValue::from_raw(value.into_u64()),
+        ovk,
+    );
+
+    (
+        CompactOrchardAction {
+            nullifier: compact_action.nullifier().to_bytes().to_vec(),
+            cmx: compact_action.cmx().to_bytes().to_vec(),
+            ephemeral_key: compact_action.ephemeral_key().0.to_vec(),
+            ciphertext: compact_action.enc_ciphertext().as_ref()[..52].to_vec(),
+        },
+        note,
+    )
+}
+
+/// Creates a fake `CompactTx` with a random transaction ID and no spends or outputs.
+fn fake_compact_tx<R: RngCore + CryptoRng>(rng: &mut R) -> CompactTx {
+    let mut ctx = CompactTx::default();
+    let mut txid = vec![0; 32];
+    rng.fill_bytes(&mut txid);
+    ctx.hash = txid;
+
+    ctx
+}
+
+/// A fake output of a [`CompactTx`].
+///
+/// Used with the following block generators:
+/// - [`TestState::generate_next_block_multi`]
+/// - [`TestState::generate_block_at`]
+#[derive(Clone)]
+pub struct FakeCompactOutput<Fvk> {
+    fvk: Fvk,
+    address_type: AddressType,
+    value: NonNegativeAmount,
+}
+
+impl<Fvk> FakeCompactOutput<Fvk> {
+    /// Constructs a new fake output with the given properties.
+    pub fn new(fvk: Fvk, address_type: AddressType, value: NonNegativeAmount) -> Self {
+        Self {
+            fvk,
+            address_type,
+            value,
+        }
+    }
+
+    /// Constructs a new random fake external output to the given FVK with a value in the range
+    /// 10000..1000000 ZAT.
+    pub fn random<R: RngCore>(rng: &mut R, fvk: Fvk) -> Self {
+        Self {
+            fvk,
+            address_type: AddressType::DefaultExternal,
+            value: Zatoshis::const_from_u64(rng.gen_range(10000..1000000)),
+        }
+    }
+}
+
+/// Create a fake CompactBlock at the given height, containing the specified fake compact outputs.
+///
+/// Returns the newly created compact block, along with the nullifier for each note created in that
+/// block.
+#[allow(clippy::too_many_arguments)]
+fn fake_compact_block<P: consensus::Parameters, Fvk: TestFvk>(
+    params: &P,
+    height: BlockHeight,
+    prev_hash: BlockHash,
+    outputs: &[FakeCompactOutput<Fvk>],
+    initial_sapling_tree_size: u32,
+    initial_orchard_tree_size: u32,
+    mut rng: impl RngCore + CryptoRng,
+) -> (CompactBlock, Vec<Fvk::Nullifier>) {
+    // Create a fake CompactBlock containing the note
+    let mut ctx = fake_compact_tx(&mut rng);
+    let mut nfs = vec![];
+    for output in outputs {
+        let nf = output.fvk.add_output(
+            &mut ctx,
+            params,
+            height,
+            output.address_type,
+            output.value,
+            initial_sapling_tree_size,
+            &mut rng,
+        );
+        nfs.push(nf);
+    }
+
+    let cb = fake_compact_block_from_compact_tx(
+        ctx,
+        height,
+        prev_hash,
+        initial_sapling_tree_size,
+        initial_orchard_tree_size,
+        rng,
+    );
+    (cb, nfs)
+}
+
+/// Create a fake CompactBlock at the given height containing only the given transaction.
+fn fake_compact_block_from_tx(
+    height: BlockHeight,
+    prev_hash: BlockHash,
+    tx_index: usize,
+    tx: &Transaction,
+    initial_sapling_tree_size: u32,
+    initial_orchard_tree_size: u32,
+    rng: impl RngCore,
+) -> CompactBlock {
+    // Create a fake CompactTx containing the transaction.
+    let mut ctx = CompactTx {
+        index: tx_index as u64,
+        hash: tx.txid().as_ref().to_vec(),
+        ..Default::default()
+    };
+
+    if let Some(bundle) = tx.sapling_bundle() {
+        for spend in bundle.shielded_spends() {
+            ctx.spends.push(spend.into());
+        }
+        for output in bundle.shielded_outputs() {
+            ctx.outputs.push(output.into());
+        }
+    }
+
+    #[cfg(feature = "orchard")]
+    if let Some(bundle) = tx.orchard_bundle() {
+        for action in bundle.actions() {
+            ctx.actions.push(action.into());
+        }
+    }
+
+    fake_compact_block_from_compact_tx(
+        ctx,
+        height,
+        prev_hash,
+        initial_sapling_tree_size,
+        initial_orchard_tree_size,
+        rng,
+    )
+}
+
+/// Create a fake CompactBlock at the given height, spending a single note from the
+/// given address.
+#[allow(clippy::too_many_arguments)]
+fn fake_compact_block_spending<P: consensus::Parameters, Fvk: TestFvk>(
+    params: &P,
+    height: BlockHeight,
+    prev_hash: BlockHash,
+    (nf, in_value): (Fvk::Nullifier, NonNegativeAmount),
+    fvk: &Fvk,
+    to: Address,
+    value: NonNegativeAmount,
+    initial_sapling_tree_size: u32,
+    initial_orchard_tree_size: u32,
+    mut rng: impl RngCore + CryptoRng,
+) -> CompactBlock {
+    let mut ctx = fake_compact_tx(&mut rng);
+
+    // Create a fake spend and a fake Note for the change
+    fvk.add_logical_action(
+        &mut ctx,
+        params,
+        height,
+        nf,
+        AddressType::Internal,
+        (in_value - value).unwrap(),
+        initial_sapling_tree_size,
+        &mut rng,
+    );
+
+    // Create a fake Note for the payment
+    match to {
+        Address::Sapling(recipient) => ctx.outputs.push(
+            compact_sapling_output(
+                params,
+                height,
+                recipient,
+                value,
+                fvk.sapling_ovk(),
+                &mut rng,
+            )
+            .0,
+        ),
+        Address::Transparent(_) | Address::Tex(_) => {
+            panic!("transparent addresses not supported in compact blocks")
+        }
+        Address::Unified(ua) => {
+            // This is annoying to implement, because the protocol-aware UA type has no
+            // concept of ZIP 316 preference order.
+            let mut done = false;
+
+            #[cfg(feature = "orchard")]
+            if let Some(recipient) = ua.orchard() {
+                // Generate a dummy nullifier
+                let nullifier = ::orchard::note::Nullifier::from_bytes(
+                    &pallas::Base::random(&mut rng).to_repr(),
+                )
+                .unwrap();
+
+                ctx.actions.push(
+                    compact_orchard_action(
+                        nullifier,
+                        *recipient,
+                        value,
+                        fvk.orchard_ovk(zip32::Scope::External),
+                        &mut rng,
+                    )
+                    .0,
+                );
+                done = true;
+            }
+
+            if !done {
+                if let Some(recipient) = ua.sapling() {
+                    ctx.outputs.push(
+                        compact_sapling_output(
+                            params,
+                            height,
+                            *recipient,
+                            value,
+                            fvk.sapling_ovk(),
+                            &mut rng,
+                        )
+                        .0,
+                    );
+                    done = true;
+                }
+            }
+            if !done {
+                panic!("No supported shielded receiver to send funds to");
+            }
+        }
+    }
+
+    fake_compact_block_from_compact_tx(
+        ctx,
+        height,
+        prev_hash,
+        initial_sapling_tree_size,
+        initial_orchard_tree_size,
+        rng,
+    )
+}
+
+fn fake_compact_block_from_compact_tx(
+    ctx: CompactTx,
+    height: BlockHeight,
+    prev_hash: BlockHash,
+    initial_sapling_tree_size: u32,
+    initial_orchard_tree_size: u32,
+    mut rng: impl RngCore,
+) -> CompactBlock {
+    let mut cb = CompactBlock {
+        hash: {
+            let mut hash = vec![0; 32];
+            rng.fill_bytes(&mut hash);
+            hash
+        },
+        height: height.into(),
+        ..Default::default()
+    };
+    cb.prev_hash.extend_from_slice(&prev_hash.0);
+    cb.vtx.push(ctx);
+    cb.chain_metadata = Some(compact_formats::ChainMetadata {
+        sapling_commitment_tree_size: initial_sapling_tree_size
+            + cb.vtx.iter().map(|tx| tx.outputs.len() as u32).sum::<u32>(),
+        orchard_commitment_tree_size: initial_orchard_tree_size
+            + cb.vtx.iter().map(|tx| tx.actions.len() as u32).sum::<u32>(),
+    });
+    cb
+}
+
+/// Trait used by tests that require a block cache.
+pub trait TestCache {
+    type BsError: core::fmt::Debug;
+    type BlockSource: BlockSource<Error = Self::BsError>;
+    type InsertResult;
+
+    /// Exposes the block cache as a [`BlockSource`].
+    fn block_source(&self) -> &Self::BlockSource;
+
+    /// Inserts a CompactBlock into the cache DB.
+    fn insert(&mut self, cb: &CompactBlock) -> Self::InsertResult;
+
+    /// Deletes block data from the cache, retaining blocks at heights less than or equal to the
+    /// specified height.
+    fn truncate_to_height(&mut self, height: BlockHeight);
+}
+
+/// A convenience type for the note commitments contained within a [`CompactBlock`].
+///
+/// Indended for use as (part of) the [`TestCache::InsertResult`] associated type.
+pub struct NoteCommitments {
+    sapling: Vec<::sapling::Node>,
+    #[cfg(feature = "orchard")]
+    orchard: Vec<MerkleHashOrchard>,
+}
+
+impl NoteCommitments {
+    /// Extracts the note commitments from the given compact block.
+    pub fn from_compact_block(cb: &CompactBlock) -> Self {
+        NoteCommitments {
+            sapling: cb
+                .vtx
+                .iter()
+                .flat_map(|tx| {
+                    tx.outputs
+                        .iter()
+                        .map(|out| ::sapling::Node::from_cmu(&out.cmu().unwrap()))
+                })
+                .collect(),
+            #[cfg(feature = "orchard")]
+            orchard: cb
+                .vtx
+                .iter()
+                .flat_map(|tx| {
+                    tx.actions
+                        .iter()
+                        .map(|act| MerkleHashOrchard::from_cmx(&act.cmx().unwrap()))
+                })
+                .collect(),
+        }
+    }
+
+    /// Returns the Sapling note commitments.
+    #[allow(dead_code)]
+    pub fn sapling(&self) -> &[::sapling::Node] {
+        self.sapling.as_ref()
+    }
+
+    /// Returns the Orchard note commitments.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> &[MerkleHashOrchard] {
+        self.orchard.as_ref()
+    }
+}
+
+/// A mock wallet data source that implements the bare minimum necessary to function.
+pub struct MockWalletDb {
+    pub network: Network,
+    pub sapling_tree: ShardTree<
+        MemoryShardStore<::sapling::Node, BlockHeight>,
+        { SAPLING_SHARD_HEIGHT * 2 },
+        SAPLING_SHARD_HEIGHT,
+    >,
+    #[cfg(feature = "orchard")]
+    pub orchard_tree: ShardTree<
+        MemoryShardStore<::orchard::tree::MerkleHashOrchard, BlockHeight>,
+        { ORCHARD_SHARD_HEIGHT * 2 },
+        ORCHARD_SHARD_HEIGHT,
+    >,
+}
+
+impl MockWalletDb {
+    /// Constructs a new mock wallet data source.
+    pub fn new(network: Network) -> Self {
+        Self {
+            network,
+            sapling_tree: ShardTree::new(MemoryShardStore::empty(), 100),
+            #[cfg(feature = "orchard")]
+            orchard_tree: ShardTree::new(MemoryShardStore::empty(), 100),
+        }
+    }
+}
+
+impl InputSource for MockWalletDb {
+    type Error = ();
+    type NoteRef = u32;
+    type AccountId = u32;
+
+    fn get_spendable_note(
+        &self,
+        _txid: &TxId,
+        _protocol: ShieldedProtocol,
+        _index: u32,
+    ) -> Result<Option<ReceivedNote<Self::NoteRef, Note>>, Self::Error> {
+        Ok(None)
+    }
+
+    fn select_spendable_notes(
+        &self,
+        _account: Self::AccountId,
+        _target_value: NonNegativeAmount,
+        _sources: &[ShieldedProtocol],
+        _anchor_height: BlockHeight,
+        _exclude: &[Self::NoteRef],
+    ) -> Result<SpendableNotes<Self::NoteRef>, Self::Error> {
+        Ok(SpendableNotes::empty())
+    }
+
+    fn get_account_metadata(
+        &self,
+        _account: Self::AccountId,
+        _selector: &NoteFilter,
+        _exclude: &[Self::NoteRef],
+    ) -> Result<AccountMeta, Self::Error> {
+        Err(())
+    }
+}
+
+impl WalletRead for MockWalletDb {
+    type Error = ();
+    type AccountId = u32;
+    type Account = (Self::AccountId, UnifiedFullViewingKey);
+
+    fn get_account_ids(&self) -> Result<Vec<Self::AccountId>, Self::Error> {
+        Ok(Vec::new())
+    }
+
+    fn get_account(
+        &self,
+        _account_id: Self::AccountId,
+    ) -> Result<Option<Self::Account>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_derived_account(
+        &self,
+        _seed: &SeedFingerprint,
+        _account_id: zip32::AccountId,
+    ) -> Result<Option<Self::Account>, Self::Error> {
+        Ok(None)
+    }
+
+    fn validate_seed(
+        &self,
+        _account_id: Self::AccountId,
+        _seed: &SecretVec<u8>,
+    ) -> Result<bool, Self::Error> {
+        Ok(false)
+    }
+
+    fn seed_relevance_to_derived_accounts(
+        &self,
+        _seed: &SecretVec<u8>,
+    ) -> Result<SeedRelevance<Self::AccountId>, Self::Error> {
+        Ok(SeedRelevance::NoAccounts)
+    }
+
+    fn get_account_for_ufvk(
+        &self,
+        _ufvk: &UnifiedFullViewingKey,
+    ) -> Result<Option<Self::Account>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_current_address(
+        &self,
+        _account: Self::AccountId,
+    ) -> Result<Option<UnifiedAddress>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_account_birthday(&self, _account: Self::AccountId) -> Result<BlockHeight, Self::Error> {
+        Err(())
+    }
+
+    fn get_wallet_birthday(&self) -> Result<Option<BlockHeight>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_wallet_summary(
+        &self,
+        _min_confirmations: u32,
+    ) -> Result<Option<WalletSummary<Self::AccountId>>, Self::Error> {
+        Ok(None)
+    }
+
+    fn chain_height(&self) -> Result<Option<BlockHeight>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_block_hash(&self, _block_height: BlockHeight) -> Result<Option<BlockHash>, Self::Error> {
+        Ok(None)
+    }
+
+    fn block_metadata(&self, _height: BlockHeight) -> Result<Option<BlockMetadata>, Self::Error> {
+        Ok(None)
+    }
+
+    fn block_fully_scanned(&self) -> Result<Option<BlockMetadata>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_max_height_hash(&self) -> Result<Option<(BlockHeight, BlockHash)>, Self::Error> {
+        Ok(None)
+    }
+
+    fn block_max_scanned(&self) -> Result<Option<BlockMetadata>, Self::Error> {
+        Ok(None)
+    }
+
+    fn suggest_scan_ranges(&self) -> Result<Vec<ScanRange>, Self::Error> {
+        Ok(vec![])
+    }
+
+    fn get_target_and_anchor_heights(
+        &self,
+        _min_confirmations: NonZeroU32,
+    ) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_tx_height(&self, _txid: TxId) -> Result<Option<BlockHeight>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_unified_full_viewing_keys(
+        &self,
+    ) -> Result<HashMap<Self::AccountId, UnifiedFullViewingKey>, Self::Error> {
+        Ok(HashMap::new())
+    }
+
+    fn get_memo(&self, _id_note: NoteId) -> Result<Option<Memo>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_transaction(&self, _txid: TxId) -> Result<Option<Transaction>, Self::Error> {
+        Ok(None)
+    }
+
+    fn get_sapling_nullifiers(
+        &self,
+        _query: NullifierQuery,
+    ) -> Result<Vec<(Self::AccountId, ::sapling::Nullifier)>, Self::Error> {
+        Ok(Vec::new())
+    }
+
+    #[cfg(feature = "orchard")]
+    fn get_orchard_nullifiers(
+        &self,
+        _query: NullifierQuery,
+    ) -> Result<Vec<(Self::AccountId, ::orchard::note::Nullifier)>, Self::Error> {
+        Ok(Vec::new())
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_receivers(
+        &self,
+        _account: Self::AccountId,
+    ) -> Result<HashMap<TransparentAddress, Option<TransparentAddressMetadata>>, Self::Error> {
+        Ok(HashMap::new())
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_balances(
+        &self,
+        _account: Self::AccountId,
+        _max_height: BlockHeight,
+    ) -> Result<HashMap<TransparentAddress, NonNegativeAmount>, Self::Error> {
+        Ok(HashMap::new())
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_address_metadata(
+        &self,
+        _account: Self::AccountId,
+        _address: &TransparentAddress,
+    ) -> Result<Option<TransparentAddressMetadata>, Self::Error> {
+        Ok(None)
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn get_known_ephemeral_addresses(
+        &self,
+        _account: Self::AccountId,
+        _index_range: Option<Range<u32>>,
+    ) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, Self::Error> {
+        Ok(vec![])
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn find_account_for_ephemeral_address(
+        &self,
+        _address: &TransparentAddress,
+    ) -> Result<Option<Self::AccountId>, Self::Error> {
+        Ok(None)
+    }
+
+    fn transaction_data_requests(&self) -> Result<Vec<TransactionDataRequest>, Self::Error> {
+        Ok(vec![])
+    }
+}
+
+impl WalletWrite for MockWalletDb {
+    type UtxoRef = u32;
+
+    fn create_account(
+        &mut self,
+        _account_name: &str,
+        seed: &SecretVec<u8>,
+        _birthday: &AccountBirthday,
+        _key_source: Option<&str>,
+    ) -> Result<(Self::AccountId, UnifiedSpendingKey), Self::Error> {
+        let account = zip32::AccountId::ZERO;
+        UnifiedSpendingKey::from_seed(&self.network, seed.expose_secret(), account)
+            .map(|k| (u32::from(account), k))
+            .map_err(|_| ())
+    }
+
+    fn import_account_hd(
+        &mut self,
+        _account_name: &str,
+        _seed: &SecretVec<u8>,
+        _account_index: zip32::AccountId,
+        _birthday: &AccountBirthday,
+        _key_source: Option<&str>,
+    ) -> Result<(Self::Account, UnifiedSpendingKey), Self::Error> {
+        todo!()
+    }
+
+    fn import_account_ufvk(
+        &mut self,
+        _account_name: &str,
+        _unified_key: &UnifiedFullViewingKey,
+        _birthday: &AccountBirthday,
+        _purpose: AccountPurpose,
+        _key_source: Option<&str>,
+    ) -> Result<Self::Account, Self::Error> {
+        todo!()
+    }
+
+    fn get_next_available_address(
+        &mut self,
+        _account: Self::AccountId,
+        _request: UnifiedAddressRequest,
+    ) -> Result<Option<UnifiedAddress>, Self::Error> {
+        Ok(None)
+    }
+
+    #[allow(clippy::type_complexity)]
+    fn put_blocks(
+        &mut self,
+        _from_state: &ChainState,
+        _blocks: Vec<ScannedBlock<Self::AccountId>>,
+    ) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    fn update_chain_tip(&mut self, _tip_height: BlockHeight) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    fn store_decrypted_tx(
+        &mut self,
+        _received_tx: DecryptedTransaction<Self::AccountId>,
+    ) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    fn store_transactions_to_be_sent(
+        &mut self,
+        _transactions: &[SentTransaction<Self::AccountId>],
+    ) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    fn truncate_to_height(
+        &mut self,
+        _block_height: BlockHeight,
+    ) -> Result<BlockHeight, Self::Error> {
+        Err(())
+    }
+
+    /// Adds a transparent UTXO received by the wallet to the data store.
+    fn put_received_transparent_utxo(
+        &mut self,
+        _output: &WalletTransparentOutput,
+    ) -> Result<Self::UtxoRef, Self::Error> {
+        Ok(0)
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn reserve_next_n_ephemeral_addresses(
+        &mut self,
+        _account_id: Self::AccountId,
+        _n: usize,
+    ) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, Self::Error> {
+        Err(())
+    }
+
+    fn set_transaction_status(
+        &mut self,
+        _txid: TxId,
+        _status: TransactionStatus,
+    ) -> Result<(), Self::Error> {
+        Ok(())
+    }
+}
+
+impl WalletCommitmentTrees for MockWalletDb {
+    type Error = Infallible;
+    type SaplingShardStore<'a> = MemoryShardStore<::sapling::Node, BlockHeight>;
+
+    fn with_sapling_tree_mut<F, A, E>(&mut self, mut callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::SaplingShardStore<'a>,
+                { ::sapling::NOTE_COMMITMENT_TREE_DEPTH },
+                SAPLING_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Infallible>>,
+    {
+        callback(&mut self.sapling_tree)
+    }
+
+    fn put_sapling_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<::sapling::Node>],
+    ) -> Result<(), ShardTreeError<Self::Error>> {
+        self.with_sapling_tree_mut(|t| {
+            for (root, i) in roots.iter().zip(0u64..) {
+                let root_addr = incrementalmerkletree::Address::from_parts(
+                    SAPLING_SHARD_HEIGHT.into(),
+                    start_index + i,
+                );
+                t.insert(root_addr, *root.root_hash())?;
+            }
+            Ok::<_, ShardTreeError<Self::Error>>(())
+        })?;
+
+        Ok(())
+    }
+
+    #[cfg(feature = "orchard")]
+    type OrchardShardStore<'a> = MemoryShardStore<::orchard::tree::MerkleHashOrchard, BlockHeight>;
+
+    #[cfg(feature = "orchard")]
+    fn with_orchard_tree_mut<F, A, E>(&mut self, mut callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::OrchardShardStore<'a>,
+                { ORCHARD_SHARD_HEIGHT * 2 },
+                ORCHARD_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Self::Error>>,
+    {
+        callback(&mut self.orchard_tree)
+    }
+
+    /// Adds a sequence of note commitment tree subtree roots to the data store.
+    #[cfg(feature = "orchard")]
+    fn put_orchard_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<::orchard::tree::MerkleHashOrchard>],
+    ) -> Result<(), ShardTreeError<Self::Error>> {
+        self.with_orchard_tree_mut(|t| {
+            for (root, i) in roots.iter().zip(0u64..) {
+                let root_addr = incrementalmerkletree::Address::from_parts(
+                    ORCHARD_SHARD_HEIGHT.into(),
+                    start_index + i,
+                );
+                t.insert(root_addr, *root.root_hash())?;
+            }
+            Ok::<_, ShardTreeError<Self::Error>>(())
+        })?;
+
+        Ok(())
+    }
+}
diff --git a/zcash_client_backend/src/data_api/testing/orchard.rs b/zcash_client_backend/src/data_api/testing/orchard.rs
new file mode 100644
index 0000000000..d076a6d7e9
--- /dev/null
+++ b/zcash_client_backend/src/data_api/testing/orchard.rs
@@ -0,0 +1,173 @@
+use std::hash::Hash;
+
+use ::orchard::{
+    keys::{FullViewingKey, SpendingKey},
+    note_encryption::OrchardDomain,
+    tree::MerkleHashOrchard,
+};
+use incrementalmerkletree::{Hashable, Level};
+use shardtree::error::ShardTreeError;
+
+use zcash_keys::{
+    address::{Address, UnifiedAddress},
+    keys::UnifiedSpendingKey,
+};
+use zcash_note_encryption::try_output_recovery_with_ovk;
+use zcash_primitives::transaction::Transaction;
+use zcash_protocol::{
+    consensus::{self, BlockHeight},
+    memo::MemoBytes,
+    value::Zatoshis,
+    ShieldedProtocol,
+};
+
+use crate::{
+    data_api::{
+        chain::{CommitmentTreeRoot, ScanSummary},
+        testing::{pool::ShieldedPoolTester, TestState},
+        DecryptedTransaction, InputSource, WalletCommitmentTrees, WalletSummary, WalletTest,
+    },
+    wallet::{Note, ReceivedNote},
+};
+
+/// Type for running pool-agnostic tests on the Orchard pool.
+pub struct OrchardPoolTester;
+impl ShieldedPoolTester for OrchardPoolTester {
+    const SHIELDED_PROTOCOL: ShieldedProtocol = ShieldedProtocol::Orchard;
+    // const MERKLE_TREE_DEPTH: u8 = {orchard::NOTE_COMMITMENT_TREE_DEPTH as u8};
+
+    type Sk = SpendingKey;
+    type Fvk = FullViewingKey;
+    type MerkleTreeHash = MerkleHashOrchard;
+    type Note = orchard::note::Note;
+
+    fn test_account_fvk<Cache, DbT: WalletTest, P: consensus::Parameters>(
+        st: &TestState<Cache, DbT, P>,
+    ) -> Self::Fvk {
+        st.test_account_orchard().unwrap().clone()
+    }
+
+    fn usk_to_sk(usk: &UnifiedSpendingKey) -> &Self::Sk {
+        usk.orchard()
+    }
+
+    fn sk(seed: &[u8]) -> Self::Sk {
+        let mut account = zip32::AccountId::ZERO;
+        loop {
+            if let Ok(sk) = SpendingKey::from_zip32_seed(seed, 1, account) {
+                break sk;
+            }
+            account = account.next().unwrap();
+        }
+    }
+
+    fn sk_to_fvk(sk: &Self::Sk) -> Self::Fvk {
+        sk.into()
+    }
+
+    fn sk_default_address(sk: &Self::Sk) -> Address {
+        Self::fvk_default_address(&Self::sk_to_fvk(sk))
+    }
+
+    fn fvk_default_address(fvk: &Self::Fvk) -> Address {
+        UnifiedAddress::from_receivers(
+            Some(fvk.address_at(0u32, zip32::Scope::External)),
+            None,
+            None,
+        )
+        .unwrap()
+        .into()
+    }
+
+    fn fvks_equal(a: &Self::Fvk, b: &Self::Fvk) -> bool {
+        a == b
+    }
+
+    fn empty_tree_leaf() -> Self::MerkleTreeHash {
+        MerkleHashOrchard::empty_leaf()
+    }
+
+    fn empty_tree_root(level: Level) -> Self::MerkleTreeHash {
+        MerkleHashOrchard::empty_root(level)
+    }
+
+    fn put_subtree_roots<Cache, DbT: WalletTest + WalletCommitmentTrees, P>(
+        st: &mut TestState<Cache, DbT, P>,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<Self::MerkleTreeHash>],
+    ) -> Result<(), ShardTreeError<<DbT as WalletCommitmentTrees>::Error>> {
+        st.wallet_mut()
+            .put_orchard_subtree_roots(start_index, roots)
+    }
+
+    fn next_subtree_index<A: Hash + Eq>(s: &WalletSummary<A>) -> u64 {
+        s.next_orchard_subtree_index()
+    }
+
+    fn select_spendable_notes<Cache, DbT: InputSource + WalletTest, P>(
+        st: &TestState<Cache, DbT, P>,
+        account: <DbT as InputSource>::AccountId,
+        target_value: Zatoshis,
+        anchor_height: BlockHeight,
+        exclude: &[DbT::NoteRef],
+    ) -> Result<Vec<ReceivedNote<DbT::NoteRef, Self::Note>>, <DbT as InputSource>::Error> {
+        st.wallet()
+            .select_spendable_notes(
+                account,
+                target_value,
+                &[ShieldedProtocol::Orchard],
+                anchor_height,
+                exclude,
+            )
+            .map(|n| n.take_orchard())
+    }
+
+    fn decrypted_pool_outputs_count<A>(d_tx: &DecryptedTransaction<'_, A>) -> usize {
+        d_tx.orchard_outputs().len()
+    }
+
+    fn with_decrypted_pool_memos<A>(
+        d_tx: &DecryptedTransaction<'_, A>,
+        mut f: impl FnMut(&MemoBytes),
+    ) {
+        for output in d_tx.orchard_outputs() {
+            f(output.memo());
+        }
+    }
+
+    fn try_output_recovery<P: consensus::Parameters>(
+        _params: &P,
+        _: BlockHeight,
+        tx: &Transaction,
+        fvk: &Self::Fvk,
+    ) -> Option<(Note, Address, MemoBytes)> {
+        for action in tx.orchard_bundle().unwrap().actions() {
+            // Find the output that decrypts with the external OVK
+            let result = try_output_recovery_with_ovk(
+                &OrchardDomain::for_action(action),
+                &fvk.to_ovk(zip32::Scope::External),
+                action,
+                action.cv_net(),
+                &action.encrypted_note().out_ciphertext,
+            );
+
+            if result.is_some() {
+                return result.map(|(note, addr, memo)| {
+                    (
+                        Note::Orchard(note),
+                        UnifiedAddress::from_receivers(Some(addr), None, None)
+                            .unwrap()
+                            .into(),
+                        MemoBytes::from_bytes(&memo).expect("correct length"),
+                    )
+                });
+            }
+        }
+
+        None
+    }
+
+    fn received_note_count(summary: &ScanSummary) -> usize {
+        summary.received_orchard_note_count()
+    }
+}
diff --git a/zcash_client_backend/src/data_api/testing/pool.rs b/zcash_client_backend/src/data_api/testing/pool.rs
new file mode 100644
index 0000000000..ba1ae57726
--- /dev/null
+++ b/zcash_client_backend/src/data_api/testing/pool.rs
@@ -0,0 +1,3072 @@
+use std::{
+    cmp::Eq,
+    convert::Infallible,
+    hash::Hash,
+    num::{NonZeroU32, NonZeroU64, NonZeroU8, NonZeroUsize},
+};
+
+use assert_matches::assert_matches;
+use incrementalmerkletree::{frontier::Frontier, Level, Position};
+use rand::{Rng, RngCore};
+use secrecy::Secret;
+use shardtree::error::ShardTreeError;
+
+use zcash_keys::{address::Address, keys::UnifiedSpendingKey};
+use zcash_primitives::{
+    block::BlockHash,
+    legacy::TransparentAddress,
+    transaction::{
+        components::amount::NonNegativeAmount,
+        fees::zip317::{FeeRule as Zip317FeeRule, MARGINAL_FEE, MINIMUM_FEE},
+        Transaction,
+    },
+};
+use zcash_protocol::{
+    consensus::{self, BlockHeight, NetworkUpgrade, Parameters},
+    local_consensus::LocalNetwork,
+    memo::{Memo, MemoBytes},
+    value::Zatoshis,
+    ShieldedProtocol,
+};
+use zip32::Scope;
+use zip321::{Payment, TransactionRequest};
+
+use crate::{
+    data_api::{
+        self,
+        chain::{self, ChainState, CommitmentTreeRoot, ScanSummary},
+        error::Error,
+        testing::{
+            single_output_change_strategy, AddressType, FakeCompactOutput, InitialChainState,
+            TestBuilder,
+        },
+        wallet::{
+            decrypt_and_store_transaction, input_selection::GreedyInputSelector, TransferErrT,
+        },
+        Account as _, AccountBirthday, BoundedU8, DecryptedTransaction, InputSource, NoteFilter,
+        Ratio, WalletCommitmentTrees, WalletRead, WalletSummary, WalletTest, WalletWrite,
+    },
+    decrypt_transaction,
+    fees::{
+        self,
+        standard::{self, SingleOutputChangeStrategy},
+        DustOutputPolicy, SplitPolicy, StandardFeeRule,
+    },
+    scanning::ScanError,
+    wallet::{Note, NoteId, OvkPolicy, ReceivedNote},
+};
+
+use super::{DataStoreFactory, Reset, TestCache, TestFvk, TestState};
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    crate::{
+        data_api::{TransactionDataRequest, TransactionStatus},
+        fees::ChangeValue,
+        proposal::{Proposal, ProposalError, StepOutput, StepOutputIndex},
+        wallet::{TransparentAddressMetadata, WalletTransparentOutput},
+    },
+    nonempty::NonEmpty,
+    rand_core::OsRng,
+    std::{collections::HashSet, str::FromStr},
+    zcash_primitives::{
+        legacy::keys::{NonHardenedChildIndex, TransparentKeyScope},
+        transaction::{
+            builder::{BuildConfig, Builder},
+            components::{OutPoint, TxOut},
+            fees::zip317,
+        },
+    },
+    zcash_proofs::prover::LocalTxProver,
+    zcash_protocol::value::ZatBalance,
+};
+
+#[cfg(feature = "orchard")]
+use crate::PoolType;
+
+/// Trait that exposes the pool-specific types and operations necessary to run the
+/// single-shielded-pool tests on a given pool.
+///
+/// You should not need to implement this yourself; instead use [`SaplingPoolTester`] or
+/// [`OrchardPoolTester`] as appropriate.
+///
+/// [`SaplingPoolTester`]: super::sapling::SaplingPoolTester
+#[cfg_attr(
+    feature = "orchard",
+    doc = "[`OrchardPoolTester`]: super::orchard::OrchardPoolTester"
+)]
+#[cfg_attr(
+    not(feature = "orchard"),
+    doc = "[`OrchardPoolTester`]: https://github.com/zcash/librustzcash/blob/0777cbc2def6ba6b99f96333eaf96c314c1f3a37/zcash_client_backend/src/data_api/testing/orchard.rs#L33"
+)]
+pub trait ShieldedPoolTester {
+    const SHIELDED_PROTOCOL: ShieldedProtocol;
+
+    type Sk;
+    type Fvk: TestFvk;
+    type MerkleTreeHash;
+    type Note;
+
+    fn test_account_fvk<Cache, DbT: WalletTest, P: consensus::Parameters>(
+        st: &TestState<Cache, DbT, P>,
+    ) -> Self::Fvk;
+    fn usk_to_sk(usk: &UnifiedSpendingKey) -> &Self::Sk;
+    fn sk(seed: &[u8]) -> Self::Sk;
+    fn sk_to_fvk(sk: &Self::Sk) -> Self::Fvk;
+    fn sk_default_address(sk: &Self::Sk) -> Address;
+    fn fvk_default_address(fvk: &Self::Fvk) -> Address;
+    fn fvks_equal(a: &Self::Fvk, b: &Self::Fvk) -> bool;
+
+    fn random_fvk(mut rng: impl RngCore) -> Self::Fvk {
+        let sk = {
+            let mut sk_bytes = vec![0; 32];
+            rng.fill_bytes(&mut sk_bytes);
+            Self::sk(&sk_bytes)
+        };
+
+        Self::sk_to_fvk(&sk)
+    }
+    fn random_address(rng: impl RngCore) -> Address {
+        Self::fvk_default_address(&Self::random_fvk(rng))
+    }
+
+    fn empty_tree_leaf() -> Self::MerkleTreeHash;
+    fn empty_tree_root(level: Level) -> Self::MerkleTreeHash;
+
+    fn put_subtree_roots<Cache, DbT: WalletTest + WalletCommitmentTrees, P>(
+        st: &mut TestState<Cache, DbT, P>,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<Self::MerkleTreeHash>],
+    ) -> Result<(), ShardTreeError<<DbT as WalletCommitmentTrees>::Error>>;
+
+    fn next_subtree_index<A: Hash + Eq>(s: &WalletSummary<A>) -> u64;
+
+    #[allow(clippy::type_complexity)]
+    fn select_spendable_notes<Cache, DbT: InputSource + WalletTest, P>(
+        st: &TestState<Cache, DbT, P>,
+        account: <DbT as InputSource>::AccountId,
+        target_value: Zatoshis,
+        anchor_height: BlockHeight,
+        exclude: &[DbT::NoteRef],
+    ) -> Result<Vec<ReceivedNote<DbT::NoteRef, Self::Note>>, <DbT as InputSource>::Error>;
+
+    fn decrypted_pool_outputs_count<A>(d_tx: &DecryptedTransaction<'_, A>) -> usize;
+
+    fn with_decrypted_pool_memos<A>(d_tx: &DecryptedTransaction<'_, A>, f: impl FnMut(&MemoBytes));
+
+    fn try_output_recovery<P: consensus::Parameters>(
+        params: &P,
+        height: BlockHeight,
+        tx: &Transaction,
+        fvk: &Self::Fvk,
+    ) -> Option<(Note, Address, MemoBytes)>;
+
+    fn received_note_count(summary: &ScanSummary) -> usize;
+}
+
+/// Tests sending funds within the given shielded pool in a single transaction.
+///
+/// The test:
+/// - Adds funds to the wallet in a single note.
+/// - Checks that the wallet balances are correct.
+/// - Constructs a request to spend part of that balance to an external address in the
+///   same pool.
+/// - Builds the transaction.
+/// - Checks that the transaction was stored, and that the outputs are decryptable and
+///   have the expected details.
+pub fn send_single_step_proposed_transfer<T: ShieldedPoolTester>(
+    dsf: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(dsf)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet in a single note
+    let value = Zatoshis::const_from_u64(60000);
+    let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h, 1);
+
+    // Spendable balance matches total balance
+    assert_eq!(st.get_total_balance(account.id()), value);
+    assert_eq!(st.get_spendable_balance(account.id(), 1), value);
+
+    assert_eq!(
+        st.wallet()
+            .block_max_scanned()
+            .unwrap()
+            .unwrap()
+            .block_height(),
+        h
+    );
+
+    let to_extsk = T::sk(&[0xf5; 32]);
+    let to: Address = T::sk_default_address(&to_extsk);
+    let request = zip321::TransactionRequest::new(vec![Payment::without_memo(
+        to.to_zcash_address(st.network()),
+        Zatoshis::const_from_u64(10000),
+    )])
+    .unwrap();
+
+    let fee_rule = StandardFeeRule::Zip317;
+
+    let change_memo = "Test change memo".parse::<Memo>().unwrap();
+    let change_strategy = standard::SingleOutputChangeStrategy::new(
+        fee_rule,
+        Some(change_memo.clone().into()),
+        T::SHIELDED_PROTOCOL,
+        DustOutputPolicy::default(),
+    );
+    let input_selector = GreedyInputSelector::new();
+
+    let proposal = st
+        .propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            request,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal,
+    );
+    assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 1);
+
+    let sent_tx_id = create_proposed_result.unwrap()[0];
+
+    // Verify that the sent transaction was stored and that we can decrypt the memos
+    let tx = st
+        .wallet()
+        .get_transaction(sent_tx_id)
+        .unwrap()
+        .expect("Created transaction was stored.");
+    let ufvks = [(account.id(), account.usk().to_unified_full_viewing_key())]
+        .into_iter()
+        .collect();
+    let d_tx = decrypt_transaction(st.network(), h + 1, &tx, &ufvks);
+    assert_eq!(T::decrypted_pool_outputs_count(&d_tx), 2);
+
+    let mut found_tx_change_memo = false;
+    let mut found_tx_empty_memo = false;
+    T::with_decrypted_pool_memos(&d_tx, |memo| {
+        if Memo::try_from(memo).unwrap() == change_memo {
+            found_tx_change_memo = true
+        }
+        if Memo::try_from(memo).unwrap() == Memo::Empty {
+            found_tx_empty_memo = true
+        }
+    });
+    assert!(found_tx_change_memo);
+    assert!(found_tx_empty_memo);
+
+    // Verify that the stored sent notes match what we're expecting
+    let sent_note_ids = st
+        .wallet()
+        .get_sent_note_ids(&sent_tx_id, T::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(sent_note_ids.len(), 2);
+
+    // The sent memo should be the empty memo for the sent output, and the
+    // change output's memo should be as specified.
+    let mut found_sent_change_memo = false;
+    let mut found_sent_empty_memo = false;
+    for sent_note_id in sent_note_ids {
+        match st
+            .wallet()
+            .get_memo(sent_note_id)
+            .expect("Note id is valid")
+            .as_ref()
+        {
+            Some(m) if m == &change_memo => {
+                found_sent_change_memo = true;
+            }
+            Some(m) if m == &Memo::Empty => {
+                found_sent_empty_memo = true;
+            }
+            Some(other) => panic!("Unexpected memo value: {:?}", other),
+            None => panic!("Memo should not be stored as NULL"),
+        }
+    }
+    assert!(found_sent_change_memo);
+    assert!(found_sent_empty_memo);
+
+    // Check that querying for a nonexistent sent note returns None
+    assert_matches!(
+        st.wallet()
+            .get_memo(NoteId::new(sent_tx_id, T::SHIELDED_PROTOCOL, 12345)),
+        Ok(None)
+    );
+
+    let tx_history = st.wallet().get_tx_history().unwrap();
+    assert_eq!(tx_history.len(), 2);
+
+    let network = *st.network();
+    assert_matches!(
+        decrypt_and_store_transaction(&network, st.wallet_mut(), &tx, None),
+        Ok(_)
+    );
+}
+
+pub fn send_with_multiple_change_outputs<T: ShieldedPoolTester>(
+    dsf: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(dsf)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet in a single note
+    let value = Zatoshis::const_from_u64(650_0000);
+    let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h, 1);
+
+    // Spendable balance matches total balance
+    assert_eq!(st.get_total_balance(account.id()), value);
+    assert_eq!(st.get_spendable_balance(account.id(), 1), value);
+
+    assert_eq!(
+        st.wallet()
+            .block_max_scanned()
+            .unwrap()
+            .unwrap()
+            .block_height(),
+        h
+    );
+
+    let to_extsk = T::sk(&[0xf5; 32]);
+    let to: Address = T::sk_default_address(&to_extsk);
+    let request = zip321::TransactionRequest::new(vec![Payment::without_memo(
+        to.to_zcash_address(st.network()),
+        Zatoshis::const_from_u64(100_0000),
+    )])
+    .unwrap();
+
+    let input_selector = GreedyInputSelector::new();
+    let change_memo = "Test change memo".parse::<Memo>().unwrap();
+    let change_strategy = fees::zip317::MultiOutputChangeStrategy::new(
+        Zip317FeeRule::standard(),
+        Some(change_memo.clone().into()),
+        T::SHIELDED_PROTOCOL,
+        DustOutputPolicy::default(),
+        SplitPolicy::with_min_output_value(
+            NonZeroUsize::new(2).unwrap(),
+            NonNegativeAmount::const_from_u64(100_0000),
+        ),
+    );
+
+    let proposal = st
+        .propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            request.clone(),
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+
+    let step = &proposal.steps().head;
+    assert_eq!(step.balance().proposed_change().len(), 2);
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal,
+    );
+    assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 1);
+
+    let sent_tx_id = create_proposed_result.unwrap()[0];
+
+    // Verify that the sent transaction was stored and that we can decrypt the memos
+    let tx = st
+        .wallet()
+        .get_transaction(sent_tx_id)
+        .unwrap()
+        .expect("Created transaction was stored.");
+    let ufvks = [(account.id(), account.usk().to_unified_full_viewing_key())]
+        .into_iter()
+        .collect();
+    let d_tx = decrypt_transaction(st.network(), h + 1, &tx, &ufvks);
+    assert_eq!(T::decrypted_pool_outputs_count(&d_tx), 3);
+
+    let mut found_tx_change_memo = false;
+    let mut found_tx_empty_memo = false;
+    T::with_decrypted_pool_memos(&d_tx, |memo| {
+        if Memo::try_from(memo).unwrap() == change_memo {
+            found_tx_change_memo = true
+        }
+        if Memo::try_from(memo).unwrap() == Memo::Empty {
+            found_tx_empty_memo = true
+        }
+    });
+    assert!(found_tx_change_memo);
+    assert!(found_tx_empty_memo);
+
+    // Verify that the stored sent notes match what we're expecting
+    let sent_note_ids = st
+        .wallet()
+        .get_sent_note_ids(&sent_tx_id, T::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(sent_note_ids.len(), 3);
+
+    // The sent memo should be the empty memo for the sent output, and each
+    // change output's memo should be as specified.
+    let mut change_memo_count = 0;
+    let mut found_sent_empty_memo = false;
+    for sent_note_id in sent_note_ids {
+        match st
+            .wallet()
+            .get_memo(sent_note_id)
+            .expect("Note id is valid")
+            .as_ref()
+        {
+            Some(m) if m == &change_memo => {
+                change_memo_count += 1;
+            }
+            Some(m) if m == &Memo::Empty => {
+                found_sent_empty_memo = true;
+            }
+            Some(other) => panic!("Unexpected memo value: {:?}", other),
+            None => panic!("Memo should not be stored as NULL"),
+        }
+    }
+    assert_eq!(change_memo_count, 2);
+    assert!(found_sent_empty_memo);
+
+    let tx_history = st.wallet().get_tx_history().unwrap();
+    assert_eq!(tx_history.len(), 2);
+
+    let network = *st.network();
+    assert_matches!(
+        decrypt_and_store_transaction(&network, st.wallet_mut(), &tx, None),
+        Ok(_)
+    );
+
+    let (h, _) = st.generate_next_block_including(sent_tx_id);
+    st.scan_cached_blocks(h, 1);
+
+    // Now, create another proposal with more outputs requested. We have two change notes;
+    // we'll spend one of them, and then we'll generate 7 splits.
+    let change_strategy = fees::zip317::MultiOutputChangeStrategy::new(
+        Zip317FeeRule::standard(),
+        Some(change_memo.into()),
+        T::SHIELDED_PROTOCOL,
+        DustOutputPolicy::default(),
+        SplitPolicy::with_min_output_value(
+            NonZeroUsize::new(8).unwrap(),
+            NonNegativeAmount::const_from_u64(10_0000),
+        ),
+    );
+
+    let proposal = st
+        .propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            request,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+
+    let step = &proposal.steps().head;
+    assert_eq!(step.balance().proposed_change().len(), 7);
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub fn send_multi_step_proposed_transfer<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+    is_reached_gap_limit: impl Fn(&<DSF::DataStore as WalletRead>::Error, DSF::AccountId, u32) -> bool,
+) where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+{
+    use crate::data_api::{OutputOfSentTx, GAP_LIMIT};
+
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let (default_addr, default_index) = account.usk().default_transparent_address();
+    let dfvk = T::test_account_fvk(&st);
+
+    let add_funds = |st: &mut TestState<_, DSF::DataStore, _>, value| {
+        let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+        st.scan_cached_blocks(h, 1);
+
+        assert_eq!(
+            st.wallet()
+                .block_max_scanned()
+                .unwrap()
+                .unwrap()
+                .block_height(),
+            h
+        );
+        assert_eq!(st.get_spendable_balance(account_id, 1), value);
+        h
+    };
+
+    let value = NonNegativeAmount::const_from_u64(100000);
+    let transfer_amount = NonNegativeAmount::const_from_u64(50000);
+
+    let run_test = |st: &mut TestState<_, DSF::DataStore, _>, expected_index| {
+        // Add funds to the wallet.
+        add_funds(st, value);
+
+        let expected_step0_fee = (zip317::MARGINAL_FEE * 3u64).unwrap();
+        let expected_step1_fee = zip317::MINIMUM_FEE;
+        let expected_ephemeral = (transfer_amount + expected_step1_fee).unwrap();
+        let expected_step0_change =
+            (value - expected_ephemeral - expected_step0_fee).expect("sufficient funds");
+        assert!(expected_step0_change.is_positive());
+
+        // Generate a ZIP 320 proposal, sending to the wallet's default transparent address
+        // expressed as a TEX address.
+        let tex_addr = match default_addr {
+            TransparentAddress::PublicKeyHash(data) => Address::Tex(data),
+            _ => unreachable!(),
+        };
+        let change_memo = Some(Memo::from_str("change").expect("valid memo").encode());
+
+        // We use `st.propose_standard_transfer` here in order to also test round-trip
+        // serialization of the proposal.
+        let proposal = st
+            .propose_standard_transfer::<Infallible>(
+                account_id,
+                StandardFeeRule::Zip317,
+                NonZeroU32::new(1).unwrap(),
+                &tex_addr,
+                transfer_amount,
+                None,
+                change_memo.clone(),
+                T::SHIELDED_PROTOCOL,
+            )
+            .unwrap();
+
+        let steps: Vec<_> = proposal.steps().iter().cloned().collect();
+        assert_eq!(steps.len(), 2);
+
+        assert_eq!(steps[0].balance().fee_required(), expected_step0_fee);
+        assert_eq!(steps[1].balance().fee_required(), expected_step1_fee);
+        assert_eq!(
+            steps[0].balance().proposed_change(),
+            [
+                ChangeValue::shielded(T::SHIELDED_PROTOCOL, expected_step0_change, change_memo),
+                ChangeValue::ephemeral_transparent(expected_ephemeral),
+            ]
+        );
+        assert_eq!(steps[1].balance().proposed_change(), []);
+
+        let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+            account.usk(),
+            OvkPolicy::Sender,
+            &proposal,
+        );
+        assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 2);
+        let txids = create_proposed_result.unwrap();
+
+        // Check that there are sent outputs with the correct values.
+        let confirmed_sent: Vec<Vec<_>> = txids
+            .iter()
+            .map(|sent_txid| st.wallet().get_sent_outputs(sent_txid).unwrap())
+            .collect();
+
+        // Verify that a status request has been generated for the second transaction of
+        // the ZIP 320 pair.
+        let tx_data_requests = st.wallet().transaction_data_requests().unwrap();
+        assert!(tx_data_requests.contains(&TransactionDataRequest::GetStatus(*txids.last())));
+
+        assert!(expected_step0_change < expected_ephemeral);
+        assert_eq!(confirmed_sent.len(), 2);
+        assert_eq!(confirmed_sent[0].len(), 2);
+        assert_eq!(confirmed_sent[0][0].value, expected_step0_change);
+        let OutputOfSentTx {
+            value: ephemeral_v,
+            external_recipient: to_addr,
+            ephemeral_address,
+        } = confirmed_sent[0][1].clone();
+        assert_eq!(ephemeral_v, expected_ephemeral);
+        assert!(to_addr.is_some());
+        assert_eq!(
+            ephemeral_address,
+            to_addr.map(|addr| (addr, expected_index)),
+        );
+
+        assert_eq!(confirmed_sent[1].len(), 1);
+        assert_matches!(
+            &confirmed_sent[1][0],
+            OutputOfSentTx { value: sent_v, external_recipient: sent_to_addr, ephemeral_address: None }
+            if sent_v == &transfer_amount && sent_to_addr == &Some(tex_addr));
+
+        // Check that the transaction history matches what we expect.
+        let tx_history = st.wallet().get_tx_history().unwrap();
+
+        let tx_0 = tx_history
+            .iter()
+            .find(|tx| tx.txid() == *txids.first())
+            .unwrap();
+        let tx_1 = tx_history
+            .iter()
+            .find(|tx| tx.txid() == *txids.last())
+            .unwrap();
+
+        assert_eq!(tx_0.account_id(), &account_id);
+        assert!(!tx_0.expired_unmined());
+        assert_eq!(tx_0.has_change(), expected_step0_change.is_positive());
+        assert!(!tx_0.is_shielding());
+        assert_eq!(
+            tx_0.account_value_delta(),
+            -ZatBalance::from(expected_step0_fee),
+        );
+
+        assert_eq!(tx_1.account_id(), &account_id);
+        assert!(!tx_1.expired_unmined());
+        assert!(!tx_1.has_change());
+        assert!(!tx_0.is_shielding());
+        assert_eq!(
+            tx_1.account_value_delta(),
+            -ZatBalance::from(expected_ephemeral),
+        );
+
+        (ephemeral_address.unwrap().0, txids)
+    };
+
+    // Each transfer should use a different ephemeral address.
+    let (ephemeral0, txids0) = run_test(&mut st, 0);
+    let (ephemeral1, txids1) = run_test(&mut st, 1);
+    assert_ne!(ephemeral0, ephemeral1);
+
+    let height = add_funds(&mut st, value);
+
+    assert_matches!(
+        ephemeral0,
+        Address::Transparent(TransparentAddress::PublicKeyHash(_))
+    );
+
+    // Attempting to pay to an ephemeral address should cause an error.
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            StandardFeeRule::Zip317,
+            NonZeroU32::new(1).unwrap(),
+            &ephemeral0,
+            transfer_amount,
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal,
+    );
+    assert_matches!(
+        &create_proposed_result,
+        Err(Error::PaysEphemeralTransparentAddress(address_str)) if address_str == &ephemeral0.encode(st.network()));
+
+    // Simulate another wallet sending to an ephemeral address with an index
+    // within the current gap limit. The `PaysEphemeralTransparentAddress` error
+    // prevents us from doing so straightforwardly, so we'll do it by building
+    // a transaction and calling `store_decrypted_tx` with it.
+    let known_addrs = st
+        .wallet()
+        .get_known_ephemeral_addresses(account_id, None)
+        .unwrap();
+    assert_eq!(known_addrs.len(), (GAP_LIMIT as usize) + 2);
+
+    // Check that the addresses are all distinct.
+    let known_set: HashSet<_> = known_addrs.iter().map(|(addr, _)| addr).collect();
+    assert_eq!(known_set.len(), known_addrs.len());
+    // Check that the metadata is as expected.
+    for (i, (_, meta)) in known_addrs.iter().enumerate() {
+        assert_eq!(
+            meta,
+            &TransparentAddressMetadata::new(
+                TransparentKeyScope::EPHEMERAL,
+                NonHardenedChildIndex::from_index(i.try_into().unwrap()).unwrap()
+            )
+        );
+    }
+
+    let mut builder = Builder::new(
+        *st.network(),
+        height + 1,
+        BuildConfig::Standard {
+            sapling_anchor: None,
+            orchard_anchor: None,
+        },
+    );
+    let (colliding_addr, _) = &known_addrs[10];
+    let utxo_value = (value - zip317::MINIMUM_FEE).unwrap();
+    assert_matches!(
+        builder.add_transparent_output(colliding_addr, utxo_value),
+        Ok(_)
+    );
+    let sk = account
+        .usk()
+        .transparent()
+        .derive_secret_key(Scope::External.into(), default_index)
+        .unwrap();
+    let outpoint = OutPoint::fake();
+    let txout = TxOut {
+        script_pubkey: default_addr.script(),
+        value,
+    };
+    // Add the fake input to our UTXO set so that we can ensure we recognize the outpoint.
+    st.wallet_mut()
+        .put_received_transparent_utxo(
+            &WalletTransparentOutput::from_parts(outpoint.clone(), txout.clone(), None).unwrap(),
+        )
+        .unwrap();
+
+    assert_matches!(builder.add_transparent_input(sk, outpoint, txout), Ok(_));
+    let test_prover = LocalTxProver::bundled();
+    let build_result = builder
+        .build(
+            OsRng,
+            &test_prover,
+            &test_prover,
+            &zip317::FeeRule::standard(),
+        )
+        .unwrap();
+    let txid = build_result.transaction().txid();
+    st.wallet_mut()
+        .store_decrypted_tx(DecryptedTransaction::new(
+            None,
+            build_result.transaction(),
+            vec![],
+            #[cfg(feature = "orchard")]
+            vec![],
+        ))
+        .unwrap();
+
+    // Verify that storing the fully transparent transaction causes a transaction
+    // status request to be generated.
+    let tx_data_requests = st.wallet().transaction_data_requests().unwrap();
+    assert!(tx_data_requests.contains(&TransactionDataRequest::GetStatus(txid)));
+
+    // We call get_transparent_output with `allow_unspendable = true` to verify
+    // storage because the decrypted transaction has not yet been mined.
+    let utxo = st
+        .wallet()
+        .get_transparent_output(&OutPoint::new(txid.into(), 0), true)
+        .unwrap();
+    assert_matches!(utxo, Some(v) if v.value() == utxo_value);
+
+    // That should have advanced the start of the gap to index 11.
+    let new_known_addrs = st
+        .wallet()
+        .get_known_ephemeral_addresses(account_id, None)
+        .unwrap();
+    assert_eq!(new_known_addrs.len(), (GAP_LIMIT as usize) + 11);
+    assert!(new_known_addrs.starts_with(&known_addrs));
+
+    let reservation_should_succeed = |st: &mut TestState<_, DSF::DataStore, _>, n| {
+        let reserved = st
+            .wallet_mut()
+            .reserve_next_n_ephemeral_addresses(account_id, n)
+            .unwrap();
+        assert_eq!(reserved.len(), n);
+        reserved
+    };
+    let reservation_should_fail =
+        |st: &mut TestState<_, DSF::DataStore, _>, n, expected_bad_index| {
+            assert_matches!(st
+            .wallet_mut()
+            .reserve_next_n_ephemeral_addresses(account_id, n),
+            Err(e) if is_reached_gap_limit(&e, account_id, expected_bad_index));
+        };
+
+    let next_reserved = reservation_should_succeed(&mut st, 1);
+    assert_eq!(next_reserved[0], known_addrs[11]);
+
+    // Calling `reserve_next_n_ephemeral_addresses(account_id, 1)` will have advanced
+    // the start of the gap to index 12. This also tests the `index_range` parameter.
+    let newer_known_addrs = st
+        .wallet()
+        .get_known_ephemeral_addresses(account_id, Some(5..100))
+        .unwrap();
+    assert_eq!(newer_known_addrs.len(), (GAP_LIMIT as usize) + 12 - 5);
+    assert!(newer_known_addrs.starts_with(&new_known_addrs[5..]));
+
+    // None of the five transactions created above (two from each proposal and the
+    // one built manually) have been mined yet. So, the range of address indices
+    // that are safe to reserve is still 0..20, and we have already reserved 12
+    // addresses, so trying to reserve another 9 should fail.
+    reservation_should_fail(&mut st, 9, 20);
+    reservation_should_succeed(&mut st, 8);
+    reservation_should_fail(&mut st, 1, 20);
+
+    // Now mine the transaction with the ephemeral output at index 1.
+    // We already reserved 20 addresses, so this should allow 2 more (..22).
+    // It does not matter that the transaction with ephemeral output at index 0
+    // remains unmined.
+    let (h, _) = st.generate_next_block_including(txids1.head);
+    st.scan_cached_blocks(h, 1);
+    reservation_should_succeed(&mut st, 2);
+    reservation_should_fail(&mut st, 1, 22);
+
+    // Mining the transaction with the ephemeral output at index 0 at this point
+    // should make no difference.
+    let (h, _) = st.generate_next_block_including(txids0.head);
+    st.scan_cached_blocks(h, 1);
+    reservation_should_fail(&mut st, 1, 22);
+
+    // Now mine the transaction with the ephemeral output at index 10.
+    let tx = build_result.transaction();
+    let tx_index = 1;
+    let (h, _) = st.generate_next_block_from_tx(tx_index, tx);
+    st.scan_cached_blocks(h, 1);
+
+    // The above `scan_cached_blocks` does not detect `tx` as interesting to the
+    // wallet. If a transaction is in the database with a null `mined_height`,
+    // as in this case, its `mined_height` will remain null unless either
+    // `put_tx_meta` or `set_transaction_status` is called on it. The former
+    // is normally called internally via `put_blocks` as a result of scanning,
+    // but not for the case of a fully transparent transaction. The latter is
+    // called by the wallet implementation in response to processing the
+    // `transaction_data_requests` queue.
+
+    // The reservation should fail because `tx` is not yet seen as mined.
+    reservation_should_fail(&mut st, 1, 22);
+
+    // Simulate the wallet processing the `transaction_data_requests` queue.
+    let tx_data_requests = st.wallet().transaction_data_requests().unwrap();
+    assert!(tx_data_requests.contains(&TransactionDataRequest::GetStatus(tx.txid())));
+
+    // Respond to the GetStatus request.
+    st.wallet_mut()
+        .set_transaction_status(tx.txid(), TransactionStatus::Mined(h))
+        .unwrap();
+
+    // We already reserved 22 addresses, so mining the transaction with the
+    // ephemeral output at index 10 should allow 9 more (..31).
+    reservation_should_succeed(&mut st, 9);
+    reservation_should_fail(&mut st, 1, 31);
+
+    let newest_known_addrs = st
+        .wallet()
+        .get_known_ephemeral_addresses(account_id, None)
+        .unwrap();
+    assert_eq!(newest_known_addrs.len(), (GAP_LIMIT as usize) + 31);
+    assert!(newest_known_addrs.starts_with(&known_addrs));
+    assert!(newest_known_addrs[5..].starts_with(&newer_known_addrs));
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub fn proposal_fails_if_not_all_ephemeral_outputs_consumed<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) where
+    DSF: DataStoreFactory,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    let add_funds = |st: &mut TestState<_, DSF::DataStore, _>, value| {
+        let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+        st.scan_cached_blocks(h, 1);
+
+        assert_eq!(
+            st.wallet()
+                .block_max_scanned()
+                .unwrap()
+                .unwrap()
+                .block_height(),
+            h
+        );
+        assert_eq!(st.get_spendable_balance(account_id, 1), value);
+    };
+
+    let value = NonNegativeAmount::const_from_u64(100000);
+    let transfer_amount = NonNegativeAmount::const_from_u64(50000);
+
+    // Add funds to the wallet.
+    add_funds(&mut st, value);
+
+    // Generate a ZIP 320 proposal, sending to the wallet's default transparent address
+    // expressed as a TEX address.
+    let tex_addr = match account.usk().default_transparent_address().0 {
+        TransparentAddress::PublicKeyHash(data) => Address::Tex(data),
+        _ => unreachable!(),
+    };
+
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            StandardFeeRule::Zip317,
+            NonZeroU32::new(1).unwrap(),
+            &tex_addr,
+            transfer_amount,
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    // This is somewhat redundant with `send_multi_step_proposed_transfer`,
+    // but tests the case with no change memo and ensures we haven't messed
+    // up the test setup.
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal,
+    );
+    assert_matches!(create_proposed_result, Ok(_));
+
+    // Frobnicate the proposal to make it invalid because it does not consume
+    // the ephemeral output, by truncating it to the first step.
+    let frobbed_proposal = Proposal::multi_step(
+        *proposal.fee_rule(),
+        proposal.min_target_height(),
+        NonEmpty::singleton(proposal.steps().first().clone()),
+    )
+    .unwrap();
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &frobbed_proposal,
+    );
+    assert_matches!(
+        create_proposed_result,
+        Err(Error::Proposal(ProposalError::EphemeralOutputLeftUnspent(so)))
+        if so == StepOutput::new(0, StepOutputIndex::Change(1))
+    );
+}
+
+pub fn create_to_address_fails_on_incorrect_usk<T: ShieldedPoolTester, DSF: DataStoreFactory>(
+    ds_factory: DSF,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+    let dfvk = T::test_account_fvk(&st);
+    let to = T::fvk_default_address(&dfvk);
+
+    // Create a USK that doesn't exist in the wallet
+    let acct1 = zip32::AccountId::try_from(1).unwrap();
+    let usk1 = UnifiedSpendingKey::from_seed(st.network(), &[1u8; 32], acct1).unwrap();
+
+    let input_selector = GreedyInputSelector::<DSF::DataStore>::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, T::SHIELDED_PROTOCOL);
+
+    let req = TransactionRequest::new(vec![Payment::without_memo(
+        to.to_zcash_address(st.network()),
+        NonNegativeAmount::const_from_u64(1),
+    )])
+    .unwrap();
+
+    // Attempting to spend with a USK that is not in the wallet results in an error
+    assert_matches!(
+        st.spend(
+            &input_selector,
+            &change_strategy,
+            &usk1,
+            req,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        ),
+        Err(data_api::error::Error::KeyNotRecognized)
+    );
+}
+
+pub fn proposal_fails_with_no_blocks<T: ShieldedPoolTester, DSF>(ds_factory: DSF)
+where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account_id = st.test_account().unwrap().id();
+    let dfvk = T::test_account_fvk(&st);
+    let to = T::fvk_default_address(&dfvk);
+
+    // Wallet summary is not yet available
+    assert_eq!(st.get_wallet_summary(0), None);
+
+    // We cannot do anything if we aren't synchronised
+    assert_matches!(
+        st.propose_standard_transfer::<Infallible>(
+            account_id,
+            StandardFeeRule::Zip317,
+            NonZeroU32::new(1).unwrap(),
+            &to,
+            NonNegativeAmount::const_from_u64(1),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        ),
+        Err(data_api::error::Error::ScanRequired)
+    );
+}
+
+pub fn spend_fails_on_unverified_notes<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet in a single note
+    let value = NonNegativeAmount::const_from_u64(50000);
+    let (h1, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h1, 1);
+
+    // Spendable balance matches total balance at 1 confirmation.
+    assert_eq!(st.get_total_balance(account_id), value);
+    assert_eq!(st.get_spendable_balance(account_id, 1), value);
+
+    // Value is considered pending at 10 confirmations.
+    assert_eq!(st.get_pending_shielded_balance(account_id, 10), value);
+    assert_eq!(
+        st.get_spendable_balance(account_id, 10),
+        NonNegativeAmount::ZERO
+    );
+
+    // If none of the wallet's accounts have a recover-until height, then there
+    // is no recovery phase for the wallet, and therefore the denominator in the
+    // resulting ratio (the number of notes in the recovery range) is zero.
+    let no_recovery = Some(Ratio::new(0, 0));
+
+    // Wallet is fully scanned
+    let summary = st.get_wallet_summary(1);
+    assert_eq!(
+        summary.as_ref().and_then(|s| s.progress().recovery()),
+        no_recovery,
+    );
+    assert_eq!(summary.map(|s| s.progress().scan()), Some(Ratio::new(1, 1)));
+
+    // Add more funds to the wallet in a second note
+    let (h2, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h2, 1);
+
+    // Verified balance does not include the second note
+    let total = (value + value).unwrap();
+    assert_eq!(st.get_spendable_balance(account_id, 2), value);
+    assert_eq!(st.get_pending_shielded_balance(account_id, 2), value);
+    assert_eq!(st.get_total_balance(account_id), total);
+
+    // Wallet is still fully scanned
+    let summary = st.get_wallet_summary(1);
+    assert_eq!(
+        summary.as_ref().and_then(|s| s.progress().recovery()),
+        no_recovery
+    );
+    assert_eq!(summary.map(|s| s.progress().scan()), Some(Ratio::new(2, 2)));
+
+    // Spend fails because there are insufficient verified notes
+    let extsk2 = T::sk(&[0xf5; 32]);
+    let to = T::sk_default_address(&extsk2);
+    assert_matches!(
+        st.propose_standard_transfer::<Infallible>(
+            account_id,
+            StandardFeeRule::Zip317,
+            NonZeroU32::new(2).unwrap(),
+            &to,
+            NonNegativeAmount::const_from_u64(70000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        ),
+        Err(data_api::error::Error::InsufficientFunds {
+            available,
+            required
+        })
+        if available == NonNegativeAmount::const_from_u64(50000)
+            && required == NonNegativeAmount::const_from_u64(80000)
+    );
+
+    // Mine blocks SAPLING_ACTIVATION_HEIGHT + 2 to 9 until just before the second
+    // note is verified
+    for _ in 2..10 {
+        st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    }
+    st.scan_cached_blocks(h2 + 1, 8);
+
+    // Total balance is value * number of blocks scanned (10).
+    assert_eq!(st.get_total_balance(account_id), (value * 10u64).unwrap());
+
+    // Spend still fails
+    assert_matches!(
+        st.propose_standard_transfer::<Infallible>(
+            account_id,
+            StandardFeeRule::Zip317,
+            NonZeroU32::new(10).unwrap(),
+            &to,
+            NonNegativeAmount::const_from_u64(70000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        ),
+        Err(data_api::error::Error::InsufficientFunds {
+            available,
+            required
+        })
+        if available == NonNegativeAmount::const_from_u64(50000)
+            && required == NonNegativeAmount::const_from_u64(80000)
+    );
+
+    // Mine block 11 so that the second note becomes verified
+    let (h11, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h11, 1);
+
+    // Total balance is value * number of blocks scanned (11).
+    assert_eq!(st.get_total_balance(account_id), (value * 11u64).unwrap());
+    // Spendable balance at 10 confirmations is value * 2.
+    assert_eq!(
+        st.get_spendable_balance(account_id, 10),
+        (value * 2u64).unwrap()
+    );
+    assert_eq!(
+        st.get_pending_shielded_balance(account_id, 10),
+        (value * 9u64).unwrap()
+    );
+
+    // Should now be able to generate a proposal
+    let amount_sent = NonNegativeAmount::from_u64(70000).unwrap();
+    let min_confirmations = NonZeroU32::new(10).unwrap();
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            StandardFeeRule::Zip317,
+            min_confirmations,
+            &to,
+            amount_sent,
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    // Executing the proposal should succeed
+    let txid = st
+        .create_proposed_transactions::<Infallible, _, Infallible>(
+            account.usk(),
+            OvkPolicy::Sender,
+            &proposal,
+        )
+        .unwrap()[0];
+
+    let (h, _) = st.generate_next_block_including(txid);
+    st.scan_cached_blocks(h, 1);
+
+    // TODO: send to an account so that we can check its balance.
+    assert_eq!(
+        st.get_total_balance(account_id),
+        ((value * 11u64).unwrap()
+            - (amount_sent + NonNegativeAmount::from_u64(10000).unwrap()).unwrap())
+        .unwrap()
+    );
+}
+
+pub fn spend_fails_on_locked_notes<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    let fee_rule = StandardFeeRule::Zip317;
+
+    // Add funds to the wallet in a single note
+    let value = NonNegativeAmount::const_from_u64(50000);
+    let (h1, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h1, 1);
+
+    // Spendable balance matches total balance at 1 confirmation.
+    assert_eq!(st.get_total_balance(account_id), value);
+    assert_eq!(st.get_spendable_balance(account_id, 1), value);
+
+    // Send some of the funds to another address, but don't mine the tx.
+    let extsk2 = T::sk(&[0xf5; 32]);
+    let to = T::sk_default_address(&extsk2);
+    let min_confirmations = NonZeroU32::new(1).unwrap();
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            fee_rule,
+            min_confirmations,
+            &to,
+            NonNegativeAmount::const_from_u64(15000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    // Executing the proposal should succeed
+    assert_matches!(
+        st.create_proposed_transactions::<Infallible, _, Infallible>(account.usk(), OvkPolicy::Sender, &proposal,),
+        Ok(txids) if txids.len() == 1
+    );
+
+    // A second proposal fails because there are no usable notes
+    assert_matches!(
+        st.propose_standard_transfer::<Infallible>(
+            account_id,
+            fee_rule,
+            NonZeroU32::new(1).unwrap(),
+            &to,
+            NonNegativeAmount::const_from_u64(2000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        ),
+        Err(data_api::error::Error::InsufficientFunds {
+            available,
+            required
+        })
+        if available == NonNegativeAmount::ZERO && required == NonNegativeAmount::const_from_u64(12000)
+    );
+
+    // Mine blocks SAPLING_ACTIVATION_HEIGHT + 1 to 41 (that don't send us funds)
+    // until just before the first transaction expires
+    for i in 1..42 {
+        st.generate_next_block(
+            &T::sk_to_fvk(&T::sk(&[i as u8; 32])),
+            AddressType::DefaultExternal,
+            value,
+        );
+    }
+    st.scan_cached_blocks(h1 + 1, 40);
+
+    // Second proposal still fails
+    assert_matches!(
+        st.propose_standard_transfer::<Infallible>(
+            account_id,
+            fee_rule,
+            NonZeroU32::new(1).unwrap(),
+            &to,
+            NonNegativeAmount::const_from_u64(2000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        ),
+        Err(data_api::error::Error::InsufficientFunds {
+            available,
+            required
+        })
+        if available == NonNegativeAmount::ZERO && required == NonNegativeAmount::const_from_u64(12000)
+    );
+
+    // Mine block SAPLING_ACTIVATION_HEIGHT + 42 so that the first transaction expires
+    let (h43, _, _) = st.generate_next_block(
+        &T::sk_to_fvk(&T::sk(&[42; 32])),
+        AddressType::DefaultExternal,
+        value,
+    );
+    st.scan_cached_blocks(h43, 1);
+
+    // Spendable balance matches total balance at 1 confirmation.
+    assert_eq!(st.get_total_balance(account_id), value);
+    assert_eq!(st.get_spendable_balance(account_id, 1), value);
+
+    // Second spend should now succeed
+    let amount_sent2 = NonNegativeAmount::const_from_u64(2000);
+    let min_confirmations = NonZeroU32::new(1).unwrap();
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            fee_rule,
+            min_confirmations,
+            &to,
+            amount_sent2,
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    let txid2 = st
+        .create_proposed_transactions::<Infallible, _, Infallible>(
+            account.usk(),
+            OvkPolicy::Sender,
+            &proposal,
+        )
+        .unwrap()[0];
+
+    let (h, _) = st.generate_next_block_including(txid2);
+    st.scan_cached_blocks(h, 1);
+
+    // TODO: send to an account so that we can check its balance.
+    assert_eq!(
+        st.get_total_balance(account_id),
+        (value - (amount_sent2 + NonNegativeAmount::from_u64(10000).unwrap()).unwrap()).unwrap()
+    );
+}
+
+pub fn ovk_policy_prevents_recovery_from_chain<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) where
+    DSF: DataStoreFactory,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet in a single note
+    let value = NonNegativeAmount::const_from_u64(50000);
+    let (h1, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h1, 1);
+
+    // Spendable balance matches total balance at 1 confirmation.
+    assert_eq!(st.get_total_balance(account_id), value);
+    assert_eq!(st.get_spendable_balance(account_id, 1), value);
+
+    let extsk2 = T::sk(&[0xf5; 32]);
+    let addr2 = T::sk_default_address(&extsk2);
+
+    let fee_rule = StandardFeeRule::Zip317;
+
+    #[allow(clippy::type_complexity)]
+    let send_and_recover_with_policy = |st: &mut TestState<_, DSF::DataStore, _>,
+                                        ovk_policy|
+     -> Result<
+        Option<(Note, Address, MemoBytes)>,
+        TransferErrT<
+            DSF::DataStore,
+            GreedyInputSelector<DSF::DataStore>,
+            SingleOutputChangeStrategy<DSF::DataStore>,
+        >,
+    > {
+        let min_confirmations = NonZeroU32::new(1).unwrap();
+        let proposal = st.propose_standard_transfer(
+            account_id,
+            fee_rule,
+            min_confirmations,
+            &addr2,
+            NonNegativeAmount::const_from_u64(15000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )?;
+
+        // Executing the proposal should succeed
+        let txid = st.create_proposed_transactions(account.usk(), ovk_policy, &proposal)?[0];
+
+        // Fetch the transaction from the database
+        let tx = st
+            .wallet()
+            .get_transaction(txid)
+            .map_err(Error::DataSource)?
+            .unwrap();
+
+        Ok(T::try_output_recovery(st.network(), h1, &tx, &dfvk))
+    };
+
+    // Send some of the funds to another address, keeping history.
+    // The recipient output is decryptable by the sender.
+    assert_matches!(
+        send_and_recover_with_policy(&mut st, OvkPolicy::Sender),
+        Ok(Some((_, recovered_to, _))) if recovered_to == addr2
+    );
+
+    // Mine blocks SAPLING_ACTIVATION_HEIGHT + 1 to 42 (that don't send us funds)
+    // so that the first transaction expires
+    for i in 1..=42 {
+        st.generate_next_block(
+            &T::sk_to_fvk(&T::sk(&[i as u8; 32])),
+            AddressType::DefaultExternal,
+            value,
+        );
+    }
+    st.scan_cached_blocks(h1 + 1, 42);
+
+    // Send the funds again, discarding history.
+    // Neither transaction output is decryptable by the sender.
+    assert_matches!(
+        send_and_recover_with_policy(&mut st, OvkPolicy::Discard),
+        Ok(None)
+    );
+}
+
+pub fn spend_succeeds_to_t_addr_zero_change<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet in a single note
+    let value = NonNegativeAmount::const_from_u64(70000);
+    let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h, 1);
+
+    // Spendable balance matches total balance at 1 confirmation.
+    assert_eq!(st.get_total_balance(account_id), value);
+    assert_eq!(st.get_spendable_balance(account_id, 1), value);
+
+    let fee_rule = StandardFeeRule::Zip317;
+
+    // TODO: generate_next_block_from_tx does not currently support transparent outputs.
+    let to = TransparentAddress::PublicKeyHash([7; 20]).into();
+    let min_confirmations = NonZeroU32::new(1).unwrap();
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            fee_rule,
+            min_confirmations,
+            &to,
+            NonNegativeAmount::const_from_u64(50000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    // Executing the proposal should succeed
+    assert_matches!(
+        st.create_proposed_transactions::<Infallible, _, Infallible>(account.usk(), OvkPolicy::Sender, &proposal),
+        Ok(txids) if txids.len() == 1
+    );
+}
+
+pub fn change_note_spends_succeed<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet in a single note owned by the internal spending key
+    let value = NonNegativeAmount::const_from_u64(70000);
+    let (h, _, _) = st.generate_next_block(&dfvk, AddressType::Internal, value);
+    st.scan_cached_blocks(h, 1);
+
+    // Spendable balance matches total balance at 1 confirmation.
+    assert_eq!(st.get_total_balance(account_id), value);
+    assert_eq!(st.get_spendable_balance(account_id, 1), value);
+
+    // Value is considered pending at 10 confirmations.
+    assert_eq!(st.get_pending_shielded_balance(account_id, 10), value);
+    assert_eq!(
+        st.get_spendable_balance(account_id, 10),
+        NonNegativeAmount::ZERO
+    );
+
+    let change_note_scope = st
+        .wallet()
+        .get_notes(T::SHIELDED_PROTOCOL)
+        .unwrap()
+        .iter()
+        .find_map(|note| (note.note().value() == value).then_some(note.spending_key_scope()));
+    assert_matches!(change_note_scope, Some(Scope::Internal));
+
+    let fee_rule = StandardFeeRule::Zip317;
+
+    // TODO: generate_next_block_from_tx does not currently support transparent outputs.
+    let to = TransparentAddress::PublicKeyHash([7; 20]).into();
+    let min_confirmations = NonZeroU32::new(1).unwrap();
+    let proposal = st
+        .propose_standard_transfer::<Infallible>(
+            account_id,
+            fee_rule,
+            min_confirmations,
+            &to,
+            NonNegativeAmount::const_from_u64(50000),
+            None,
+            None,
+            T::SHIELDED_PROTOCOL,
+        )
+        .unwrap();
+
+    // Executing the proposal should succeed
+    assert_matches!(
+        st.create_proposed_transactions::<Infallible, _, Infallible>(account.usk(), OvkPolicy::Sender, &proposal),
+        Ok(txids) if txids.len() == 1
+    );
+}
+
+pub fn external_address_change_spends_detected_in_restore_from_seed<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::DataStore: Reset,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .build();
+
+    // Add two accounts to the wallet.
+    let seed = Secret::new([0u8; 32].to_vec());
+    let birthday = AccountBirthday::from_sapling_activation(st.network(), BlockHash([0; 32]));
+    let (account1, usk) = st
+        .wallet_mut()
+        .create_account("account1", &seed, &birthday, None)
+        .unwrap();
+    let dfvk = T::sk_to_fvk(T::usk_to_sk(&usk));
+
+    let (account2, usk2) = st
+        .wallet_mut()
+        .create_account("account2", &seed, &birthday, None)
+        .unwrap();
+    let dfvk2 = T::sk_to_fvk(T::usk_to_sk(&usk2));
+
+    // Add funds to the wallet in a single note
+    let value = NonNegativeAmount::from_u64(100000).unwrap();
+    let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h, 1);
+
+    // Spendable balance matches total balance
+    assert_eq!(st.get_total_balance(account1), value);
+    assert_eq!(st.get_spendable_balance(account1, 1), value);
+    assert_eq!(st.get_total_balance(account2), NonNegativeAmount::ZERO);
+
+    let amount_sent = NonNegativeAmount::from_u64(20000).unwrap();
+    let amount_legacy_change = NonNegativeAmount::from_u64(30000).unwrap();
+    let addr = T::fvk_default_address(&dfvk);
+    let addr2 = T::fvk_default_address(&dfvk2);
+    let req = TransactionRequest::new(vec![
+        // payment to an external recipient
+        Payment::without_memo(addr2.to_zcash_address(st.network()), amount_sent),
+        // payment back to the originating wallet, simulating legacy change
+        Payment::without_memo(addr.to_zcash_address(st.network()), amount_legacy_change),
+    ])
+    .unwrap();
+
+    let change_strategy = fees::standard::SingleOutputChangeStrategy::new(
+        StandardFeeRule::Zip317,
+        None,
+        T::SHIELDED_PROTOCOL,
+        DustOutputPolicy::default(),
+    );
+    let input_selector = GreedyInputSelector::new();
+
+    let txid = st
+        .spend(
+            &input_selector,
+            &change_strategy,
+            &usk,
+            req,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap()[0];
+
+    let amount_left = (value - (amount_sent + MINIMUM_FEE + MARGINAL_FEE).unwrap()).unwrap();
+    let pending_change = (amount_left - amount_legacy_change).unwrap();
+
+    // The "legacy change" is not counted by get_pending_change().
+    assert_eq!(st.get_pending_change(account1, 1), pending_change);
+    // We spent the only note so we only have pending change.
+    assert_eq!(st.get_total_balance(account1), pending_change);
+
+    let (h, _) = st.generate_next_block_including(txid);
+    st.scan_cached_blocks(h, 1);
+
+    assert_eq!(st.get_total_balance(account2), amount_sent,);
+    assert_eq!(st.get_total_balance(account1), amount_left);
+
+    st.reset();
+
+    // Account creation and DFVK derivation should be deterministic.
+    let (account1, restored_usk) = st
+        .wallet_mut()
+        .create_account("account1_restored", &seed, &birthday, None)
+        .unwrap();
+    assert!(T::fvks_equal(
+        &T::sk_to_fvk(T::usk_to_sk(&restored_usk)),
+        &dfvk,
+    ));
+
+    let (account2, restored_usk2) = st
+        .wallet_mut()
+        .create_account("account2_restored", &seed, &birthday, None)
+        .unwrap();
+    assert!(T::fvks_equal(
+        &T::sk_to_fvk(T::usk_to_sk(&restored_usk2)),
+        &dfvk2,
+    ));
+
+    st.scan_cached_blocks(st.sapling_activation_height(), 2);
+
+    assert_eq!(st.get_total_balance(account2), amount_sent);
+    assert_eq!(st.get_total_balance(account1), amount_left);
+}
+
+#[allow(dead_code)]
+pub fn zip317_spend<T: ShieldedPoolTester, DSF: DataStoreFactory>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let account_id = account.id();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Add funds to the wallet
+    let (h1, _, _) = st.generate_next_block(
+        &dfvk,
+        AddressType::Internal,
+        NonNegativeAmount::const_from_u64(50000),
+    );
+
+    // Add 10 dust notes to the wallet
+    for _ in 1..=10 {
+        st.generate_next_block(
+            &dfvk,
+            AddressType::DefaultExternal,
+            NonNegativeAmount::const_from_u64(1000),
+        );
+    }
+
+    st.scan_cached_blocks(h1, 11);
+
+    // Spendable balance matches total balance
+    let total = NonNegativeAmount::const_from_u64(60000);
+    assert_eq!(st.get_total_balance(account_id), total);
+    assert_eq!(st.get_spendable_balance(account_id, 1), total);
+
+    let input_selector = GreedyInputSelector::<DSF::DataStore>::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, T::SHIELDED_PROTOCOL);
+
+    // This first request will fail due to insufficient non-dust funds
+    let req = TransactionRequest::new(vec![Payment::without_memo(
+        T::fvk_default_address(&dfvk).to_zcash_address(st.network()),
+        NonNegativeAmount::const_from_u64(50000),
+    )])
+    .unwrap();
+
+    assert_matches!(
+        st.spend(
+            &input_selector,
+            &change_strategy,
+            account.usk(),
+            req,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        ),
+        Err(Error::InsufficientFunds { available, required })
+            if available == NonNegativeAmount::const_from_u64(51000)
+            && required == NonNegativeAmount::const_from_u64(60000)
+    );
+
+    // This request will succeed, spending a single dust input to pay the 10000
+    // ZAT fee in addition to the 41000 ZAT output to the recipient
+    let req = TransactionRequest::new(vec![Payment::without_memo(
+        T::fvk_default_address(&dfvk).to_zcash_address(st.network()),
+        NonNegativeAmount::const_from_u64(41000),
+    )])
+    .unwrap();
+
+    let txid = st
+        .spend(
+            &input_selector,
+            &change_strategy,
+            account.usk(),
+            req,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap()[0];
+
+    let (h, _) = st.generate_next_block_including(txid);
+    st.scan_cached_blocks(h, 1);
+
+    // TODO: send to an account so that we can check its balance.
+    // We sent back to the same account so the amount_sent should be included
+    // in the total balance.
+    assert_eq!(
+        st.get_total_balance(account_id),
+        (total - NonNegativeAmount::const_from_u64(10000)).unwrap()
+    );
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub fn shield_transparent<T: ShieldedPoolTester, DSF>(ds_factory: DSF, cache: impl TestCache)
+where
+    DSF: DataStoreFactory,
+    <<DSF as DataStoreFactory>::DataStore as WalletWrite>::UtxoRef: std::fmt::Debug,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    let uaddr = st
+        .wallet()
+        .get_current_address(account.id())
+        .unwrap()
+        .unwrap();
+    let taddr = uaddr.transparent().unwrap();
+
+    // Ensure that the wallet has at least one block
+    let (h, _, _) = st.generate_next_block(
+        &dfvk,
+        AddressType::Internal,
+        NonNegativeAmount::const_from_u64(50000),
+    );
+    st.scan_cached_blocks(h, 1);
+
+    let utxo = WalletTransparentOutput::from_parts(
+        OutPoint::fake(),
+        TxOut {
+            value: NonNegativeAmount::const_from_u64(100000),
+            script_pubkey: taddr.script(),
+        },
+        Some(h),
+    )
+    .unwrap();
+
+    let res0 = st.wallet_mut().put_received_transparent_utxo(&utxo);
+    assert_matches!(res0, Ok(_));
+
+    let input_selector = GreedyInputSelector::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, T::SHIELDED_PROTOCOL);
+
+    let txids = st
+        .shield_transparent_funds(
+            &input_selector,
+            &change_strategy,
+            NonNegativeAmount::from_u64(10000).unwrap(),
+            account.usk(),
+            &[*taddr],
+            account.id(),
+            1,
+        )
+        .unwrap();
+    assert_eq!(txids.len(), 1);
+
+    let tx = st.get_tx_from_history(*txids.first()).unwrap().unwrap();
+    assert_eq!(tx.spent_note_count(), 1);
+    assert!(tx.has_change());
+    assert_eq!(tx.received_note_count(), 0);
+    assert_eq!(tx.sent_note_count(), 0);
+    assert!(tx.is_shielding());
+
+    // Generate and scan the block including the transaction
+    let (h, _) = st.generate_next_block_including(*txids.first());
+    st.scan_cached_blocks(h, 1);
+
+    // Ensure that the transaction metadata is still correct after the update produced by scanning.
+    let tx = st.get_tx_from_history(*txids.first()).unwrap().unwrap();
+    assert_eq!(tx.spent_note_count(), 1);
+    assert!(tx.has_change());
+    assert_eq!(tx.received_note_count(), 0);
+    assert_eq!(tx.sent_note_count(), 0);
+    assert!(tx.is_shielding());
+}
+
+// FIXME: This requires fixes to the test framework.
+#[allow(dead_code)]
+pub fn birthday_in_anchor_shard<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    // Set up the following situation:
+    //
+    //        |<------ 500 ------->|<--- 10 --->|<--- 10 --->|
+    // last_shard_start   wallet_birthday  received_tx  anchor_height
+    //
+    // We set the Sapling and Orchard frontiers at the birthday block initial state to 1234
+    // notes beyond the end of the first shard.
+    let frontier_tree_size: u32 = (0x1 << 16) + 1234;
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_initial_chain_state(|rng, network| {
+            let birthday_height = network.activation_height(NetworkUpgrade::Nu5).unwrap() + 1000;
+
+            // Construct a fake chain state for the end of the block with the given
+            // birthday_offset from the Nu5 birthday.
+            let (prior_sapling_roots, sapling_initial_tree) =
+                Frontier::random_with_prior_subtree_roots(
+                    rng,
+                    frontier_tree_size.into(),
+                    NonZeroU8::new(16).unwrap(),
+                );
+            // There will only be one prior root
+            let prior_sapling_roots = prior_sapling_roots
+                .into_iter()
+                .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 500, root))
+                .collect::<Vec<_>>();
+
+            #[cfg(feature = "orchard")]
+            let (prior_orchard_roots, orchard_initial_tree) =
+                Frontier::random_with_prior_subtree_roots(
+                    rng,
+                    frontier_tree_size.into(),
+                    NonZeroU8::new(16).unwrap(),
+                );
+            // There will only be one prior root
+            #[cfg(feature = "orchard")]
+            let prior_orchard_roots = prior_orchard_roots
+                .into_iter()
+                .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 500, root))
+                .collect::<Vec<_>>();
+
+            InitialChainState {
+                chain_state: ChainState::new(
+                    birthday_height - 1,
+                    BlockHash([5; 32]),
+                    sapling_initial_tree,
+                    #[cfg(feature = "orchard")]
+                    orchard_initial_tree,
+                ),
+                prior_sapling_roots,
+                #[cfg(feature = "orchard")]
+                prior_orchard_roots,
+            }
+        })
+        .with_account_having_current_birthday()
+        .build();
+
+    // Generate 9 blocks that have no value for us, starting at the birthday height.
+    let not_our_value = NonNegativeAmount::const_from_u64(10000);
+    let not_our_key = T::random_fvk(st.rng_mut());
+    let (initial_height, _, _) =
+        st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
+    for _ in 1..9 {
+        st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
+    }
+
+    // Now, generate a block that belongs to our wallet
+    let (received_tx_height, _, _) = st.generate_next_block(
+        &T::test_account_fvk(&st),
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(500000),
+    );
+
+    // Generate some more blocks to get above our anchor height
+    for _ in 0..15 {
+        st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
+    }
+
+    // Scan a block range that includes our received note, but skips some blocks we need to
+    // make it spendable.
+    st.scan_cached_blocks(initial_height + 5, 20);
+
+    // Verify that the received note is not considered spendable
+    let account = st.test_account().unwrap();
+    let account_id = account.id();
+    let spendable = T::select_spendable_notes(
+        &st,
+        account_id,
+        NonNegativeAmount::const_from_u64(300000),
+        received_tx_height + 10,
+        &[],
+    )
+    .unwrap();
+
+    assert_eq!(spendable.len(), 0);
+
+    // Scan the blocks we skipped
+    st.scan_cached_blocks(initial_height, 5);
+
+    // Verify that the received note is now considered spendable
+    let spendable = T::select_spendable_notes(
+        &st,
+        account_id,
+        NonNegativeAmount::const_from_u64(300000),
+        received_tx_height + 10,
+        &[],
+    )
+    .unwrap();
+
+    assert_eq!(spendable.len(), 1);
+}
+
+pub fn checkpoint_gaps<T: ShieldedPoolTester, DSF: DataStoreFactory>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Generate a block with funds belonging to our wallet.
+    st.generate_next_block(
+        &dfvk,
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(500000),
+    );
+    st.scan_cached_blocks(account.birthday().height(), 1);
+
+    // Create a gap of 10 blocks having no shielded outputs, then add a block that doesn't
+    // belong to us so that we can get a checkpoint in the tree.
+    let not_our_key = T::sk_to_fvk(&T::sk(&[0xf5; 32]));
+    let not_our_value = NonNegativeAmount::const_from_u64(10000);
+    st.generate_block_at(
+        account.birthday().height() + 10,
+        BlockHash([0; 32]),
+        &[FakeCompactOutput::new(
+            &not_our_key,
+            AddressType::DefaultExternal,
+            not_our_value,
+        )],
+        st.latest_cached_block().unwrap().sapling_end_size(),
+        st.latest_cached_block().unwrap().orchard_end_size(),
+        false,
+    );
+
+    // Scan the block
+    st.scan_cached_blocks(account.birthday().height() + 10, 1);
+
+    // Verify that our note is considered spendable
+    let spendable = T::select_spendable_notes(
+        &st,
+        account.id(),
+        NonNegativeAmount::const_from_u64(300000),
+        account.birthday().height() + 5,
+        &[],
+    )
+    .unwrap();
+    assert_eq!(spendable.len(), 1);
+
+    let input_selector = GreedyInputSelector::<DSF::DataStore>::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, T::SHIELDED_PROTOCOL);
+
+    let to = T::fvk_default_address(&not_our_key);
+    let req = TransactionRequest::new(vec![Payment::without_memo(
+        to.to_zcash_address(st.network()),
+        NonNegativeAmount::const_from_u64(10000),
+    )])
+    .unwrap();
+
+    // Attempt to spend the note with 5 confirmations
+    assert_matches!(
+        st.spend(
+            &input_selector,
+            &change_strategy,
+            account.usk(),
+            req,
+            OvkPolicy::Sender,
+            NonZeroU32::new(5).unwrap(),
+        ),
+        Ok(_)
+    );
+}
+
+#[cfg(feature = "orchard")]
+pub fn pool_crossing_required<P0: ShieldedPoolTester, P1: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32])) // TODO: Allow for Orchard
+        // activation after Sapling
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+
+    let p0_fvk = P0::test_account_fvk(&st);
+
+    let p1_fvk = P1::test_account_fvk(&st);
+    let p1_to = P1::fvk_default_address(&p1_fvk);
+
+    let note_value = NonNegativeAmount::const_from_u64(350000);
+    st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+    st.scan_cached_blocks(account.birthday().height(), 2);
+
+    let initial_balance = note_value;
+    assert_eq!(st.get_total_balance(account.id()), initial_balance);
+    assert_eq!(st.get_spendable_balance(account.id(), 1), initial_balance);
+
+    let transfer_amount = NonNegativeAmount::const_from_u64(200000);
+    let p0_to_p1 = TransactionRequest::new(vec![Payment::without_memo(
+        p1_to.to_zcash_address(st.network()),
+        transfer_amount,
+    )])
+    .unwrap();
+
+    let input_selector = GreedyInputSelector::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, P1::SHIELDED_PROTOCOL);
+    let proposal0 = st
+        .propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            p0_to_p1,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+
+    let _min_target_height = proposal0.min_target_height();
+    assert_eq!(proposal0.steps().len(), 1);
+    let step0 = &proposal0.steps().head;
+
+    // We expect 4 logical actions, two per pool (due to padding).
+    let expected_fee = NonNegativeAmount::const_from_u64(20000);
+    assert_eq!(step0.balance().fee_required(), expected_fee);
+
+    let expected_change = (note_value - transfer_amount - expected_fee).unwrap();
+    let proposed_change = step0.balance().proposed_change();
+    assert_eq!(proposed_change.len(), 1);
+    let change_output = proposed_change.first().unwrap();
+    // Since this is a cross-pool transfer, change will be sent to the preferred pool.
+    assert_eq!(
+        change_output.output_pool(),
+        PoolType::Shielded(std::cmp::max(
+            ShieldedProtocol::Sapling,
+            ShieldedProtocol::Orchard
+        ))
+    );
+    assert_eq!(change_output.value(), expected_change);
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal0,
+    );
+    assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 1);
+
+    let (h, _) = st.generate_next_block_including(create_proposed_result.unwrap()[0]);
+    st.scan_cached_blocks(h, 1);
+
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (initial_balance - expected_fee).unwrap()
+    );
+    assert_eq!(
+        st.get_spendable_balance(account.id(), 1),
+        (initial_balance - expected_fee).unwrap()
+    );
+}
+
+#[cfg(feature = "orchard")]
+pub fn fully_funded_fully_private<P0: ShieldedPoolTester, P1: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32])) // TODO: Allow for Orchard
+        // activation after Sapling
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+
+    let p0_fvk = P0::test_account_fvk(&st);
+
+    let p1_fvk = P1::test_account_fvk(&st);
+    let p1_to = P1::fvk_default_address(&p1_fvk);
+
+    let note_value = NonNegativeAmount::const_from_u64(350000);
+    st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+    st.generate_next_block(&p1_fvk, AddressType::DefaultExternal, note_value);
+    st.scan_cached_blocks(account.birthday().height(), 2);
+
+    let initial_balance = (note_value * 2u64).unwrap();
+    assert_eq!(st.get_total_balance(account.id()), initial_balance);
+    assert_eq!(st.get_spendable_balance(account.id(), 1), initial_balance);
+
+    let transfer_amount = NonNegativeAmount::const_from_u64(200000);
+    let p0_to_p1 = TransactionRequest::new(vec![Payment::without_memo(
+        p1_to.to_zcash_address(st.network()),
+        transfer_amount,
+    )])
+    .unwrap();
+
+    let input_selector = GreedyInputSelector::new();
+    // We set the default change output pool to P0, because we want to verify later that
+    // change is actually sent to P1 (as the transaction is fully fundable from P1).
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, P0::SHIELDED_PROTOCOL);
+    let proposal0 = st
+        .propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            p0_to_p1,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+
+    let _min_target_height = proposal0.min_target_height();
+    assert_eq!(proposal0.steps().len(), 1);
+    let step0 = &proposal0.steps().head;
+
+    // We expect 2 logical actions, since either pool can pay the full balance required
+    // and note selection should choose the fully-private path.
+    let expected_fee = NonNegativeAmount::const_from_u64(10000);
+    assert_eq!(step0.balance().fee_required(), expected_fee);
+
+    let expected_change = (note_value - transfer_amount - expected_fee).unwrap();
+    let proposed_change = step0.balance().proposed_change();
+    assert_eq!(proposed_change.len(), 1);
+    let change_output = proposed_change.first().unwrap();
+    // Since there are sufficient funds in either pool, change is kept in the same pool as
+    // the source note (the target pool), and does not necessarily follow preference order.
+    assert_eq!(
+        change_output.output_pool(),
+        PoolType::Shielded(P1::SHIELDED_PROTOCOL)
+    );
+    assert_eq!(change_output.value(), expected_change);
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal0,
+    );
+    assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 1);
+
+    let (h, _) = st.generate_next_block_including(create_proposed_result.unwrap()[0]);
+    st.scan_cached_blocks(h, 1);
+
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (initial_balance - expected_fee).unwrap()
+    );
+    assert_eq!(
+        st.get_spendable_balance(account.id(), 1),
+        (initial_balance - expected_fee).unwrap()
+    );
+}
+
+#[cfg(all(feature = "orchard", feature = "transparent-inputs"))]
+pub fn fully_funded_send_to_t<P0: ShieldedPoolTester, P1: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32])) // TODO: Allow for Orchard
+        // activation after Sapling
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+
+    let p0_fvk = P0::test_account_fvk(&st);
+    let p1_fvk = P1::test_account_fvk(&st);
+    let (p1_to, _) = account.usk().default_transparent_address();
+
+    let note_value = NonNegativeAmount::const_from_u64(350000);
+    st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+    st.generate_next_block(&p1_fvk, AddressType::DefaultExternal, note_value);
+    st.scan_cached_blocks(account.birthday().height(), 2);
+
+    let initial_balance = (note_value * 2u64).unwrap();
+    assert_eq!(st.get_total_balance(account.id()), initial_balance);
+    assert_eq!(st.get_spendable_balance(account.id(), 1), initial_balance);
+
+    let transfer_amount = NonNegativeAmount::const_from_u64(200000);
+    let p0_to_p1 = TransactionRequest::new(vec![Payment::without_memo(
+        Address::Transparent(p1_to).to_zcash_address(st.network()),
+        transfer_amount,
+    )])
+    .unwrap();
+
+    let input_selector = GreedyInputSelector::new();
+    // We set the default change output pool to P0, because we want to verify later that
+    // change is actually sent to P1 (as the transaction is fully fundable from P1).
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, P0::SHIELDED_PROTOCOL);
+    let proposal0 = st
+        .propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            p0_to_p1,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+
+    let _min_target_height = proposal0.min_target_height();
+    assert_eq!(proposal0.steps().len(), 1);
+    let step0 = &proposal0.steps().head;
+
+    // We expect 3 logical actions, one for the transparent output and two for the source pool.
+    let expected_fee = NonNegativeAmount::const_from_u64(15000);
+    assert_eq!(step0.balance().fee_required(), expected_fee);
+
+    let expected_change = (note_value - transfer_amount - expected_fee).unwrap();
+    let proposed_change = step0.balance().proposed_change();
+    assert_eq!(proposed_change.len(), 1);
+    let change_output = proposed_change.first().unwrap();
+    // Since there are sufficient funds in either pool, change is kept in the same pool as
+    // the source note (the target pool), and does not necessarily follow preference order.
+    // The source note will always be sapling, as we spend Sapling funds preferentially.
+    assert_eq!(change_output.output_pool(), PoolType::SAPLING);
+    assert_eq!(change_output.value(), expected_change);
+
+    let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+        account.usk(),
+        OvkPolicy::Sender,
+        &proposal0,
+    );
+    assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 1);
+
+    let (h, _) = st.generate_next_block_including(create_proposed_result.unwrap()[0]);
+    st.scan_cached_blocks(h, 1);
+
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (initial_balance - transfer_amount - expected_fee).unwrap()
+    );
+    assert_eq!(
+        st.get_spendable_balance(account.id(), 1),
+        (initial_balance - transfer_amount - expected_fee).unwrap()
+    );
+}
+
+#[cfg(feature = "orchard")]
+pub fn multi_pool_checkpoint<P0: ShieldedPoolTester, P1: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32])) // TODO: Allow for Orchard
+        // activation after Sapling
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let acct_id = account.id();
+
+    let p0_fvk = P0::test_account_fvk(&st);
+    let p1_fvk = P1::test_account_fvk(&st);
+
+    // Add some funds to the wallet; we add two notes to allow successive spends. Also,
+    // we will generate a note in the P1 pool to ensure that we have some tree state.
+    let note_value = NonNegativeAmount::const_from_u64(500000);
+    let (start_height, _, _) =
+        st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+    st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+    st.generate_next_block(&p1_fvk, AddressType::DefaultExternal, note_value);
+    let scanned = st.scan_cached_blocks(start_height, 3);
+
+    let next_to_scan = scanned.scanned_range().end;
+
+    let initial_balance = (note_value * 3u64).unwrap();
+    assert_eq!(st.get_total_balance(acct_id), initial_balance);
+    assert_eq!(st.get_spendable_balance(acct_id, 1), initial_balance);
+
+    // Generate several empty blocks
+    for _ in 0..10 {
+        st.generate_empty_block();
+    }
+
+    // Scan into the middle of the empty range
+    let scanned = st.scan_cached_blocks(next_to_scan, 5);
+    let next_to_scan = scanned.scanned_range().end;
+
+    // The initial balance should be unchanged.
+    assert_eq!(st.get_total_balance(acct_id), initial_balance);
+    assert_eq!(st.get_spendable_balance(acct_id, 1), initial_balance);
+
+    // Set up the fee rule and input selector we'll use for all the transfers.
+    let input_selector = GreedyInputSelector::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, P1::SHIELDED_PROTOCOL);
+
+    // First, send funds just to P0
+    let transfer_amount = NonNegativeAmount::const_from_u64(200000);
+    let p0_transfer = TransactionRequest::new(vec![Payment::without_memo(
+        P0::random_address(st.rng_mut()).to_zcash_address(st.network()),
+        transfer_amount,
+    )])
+    .unwrap();
+    let res = st
+        .spend(
+            &input_selector,
+            &change_strategy,
+            account.usk(),
+            p0_transfer,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+    st.generate_next_block_including(*res.first());
+
+    let expected_fee = NonNegativeAmount::const_from_u64(10000);
+    let expected_change = (note_value - transfer_amount - expected_fee).unwrap();
+    assert_eq!(
+        st.get_total_balance(acct_id),
+        ((note_value * 2u64).unwrap() + expected_change).unwrap()
+    );
+    assert_eq!(st.get_pending_change(acct_id, 1), expected_change);
+
+    // In the next block, send funds to both P0 and P1
+    let both_transfer = TransactionRequest::new(vec![
+        Payment::without_memo(
+            P0::random_address(st.rng_mut()).to_zcash_address(st.network()),
+            transfer_amount,
+        ),
+        Payment::without_memo(
+            P1::random_address(st.rng_mut()).to_zcash_address(st.network()),
+            transfer_amount,
+        ),
+    ])
+    .unwrap();
+    let res = st
+        .spend(
+            &input_selector,
+            &change_strategy,
+            account.usk(),
+            both_transfer,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        )
+        .unwrap();
+    st.generate_next_block_including(*res.first());
+
+    // Generate a few more empty blocks
+    for _ in 0..5 {
+        st.generate_empty_block();
+    }
+
+    // Generate another block with funds for us
+    let (max_height, _, _) =
+        st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+
+    // Scan everything.
+    st.scan_cached_blocks(
+        next_to_scan,
+        usize::try_from(u32::from(max_height) - u32::from(next_to_scan) + 1).unwrap(),
+    );
+
+    let expected_final = (initial_balance + note_value
+        - (transfer_amount * 3u64).unwrap()
+        - (expected_fee * 3u64).unwrap())
+    .unwrap();
+    assert_eq!(st.get_total_balance(acct_id), expected_final);
+
+    let expected_checkpoints_p0: Vec<(BlockHeight, Option<Position>)> = [
+        (99999, None),
+        (100000, Some(0)),
+        (100001, Some(1)),
+        (100002, Some(1)),
+        (100007, Some(1)), // synthetic checkpoint in empty span from scan start
+        (100013, Some(3)),
+        (100014, Some(5)),
+        (100020, Some(6)),
+    ]
+    .into_iter()
+    .map(|(h, pos)| (BlockHeight::from(h), pos.map(Position::from)))
+    .collect();
+
+    let expected_checkpoints_p1: Vec<(BlockHeight, Option<Position>)> = [
+        (99999, None),
+        (100000, None),
+        (100001, None),
+        (100002, Some(0)),
+        (100007, Some(0)), // synthetic checkpoint in empty span from scan start
+        (100013, Some(0)),
+        (100014, Some(2)),
+        (100020, Some(2)),
+    ]
+    .into_iter()
+    .map(|(h, pos)| (BlockHeight::from(h), pos.map(Position::from)))
+    .collect();
+
+    let p0_checkpoints = st
+        .wallet()
+        .get_checkpoint_history(&P0::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(p0_checkpoints.to_vec(), expected_checkpoints_p0);
+
+    let p1_checkpoints = st
+        .wallet()
+        .get_checkpoint_history(&P1::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(p1_checkpoints.to_vec(), expected_checkpoints_p1);
+}
+
+#[cfg(feature = "orchard")]
+pub fn multi_pool_checkpoints_with_pruning<P0: ShieldedPoolTester, P1: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32])) // TODO: Allow for Orchard
+        // activation after Sapling
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+
+    let p0_fvk = P0::random_fvk(st.rng_mut());
+    let p1_fvk = P1::random_fvk(st.rng_mut());
+
+    let note_value = NonNegativeAmount::const_from_u64(10000);
+    // Generate 100 P0 blocks, then 100 P1 blocks, then another 100 P0 blocks.
+    for _ in 0..10 {
+        for _ in 0..10 {
+            st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+        }
+        for _ in 0..10 {
+            st.generate_next_block(&p1_fvk, AddressType::DefaultExternal, note_value);
+        }
+    }
+    st.scan_cached_blocks(account.birthday().height(), 200);
+    for _ in 0..100 {
+        st.generate_next_block(&p0_fvk, AddressType::DefaultExternal, note_value);
+        st.generate_next_block(&p1_fvk, AddressType::DefaultExternal, note_value);
+    }
+    st.scan_cached_blocks(account.birthday().height() + 200, 200);
+}
+
+pub fn valid_chain_states<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let dfvk = T::test_account_fvk(&st);
+
+    // Empty chain should return None
+    assert_matches!(st.wallet().chain_height(), Ok(None));
+
+    // Create a fake CompactBlock sending value to the address
+    let (h1, _, _) = st.generate_next_block(
+        &dfvk,
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(5),
+    );
+
+    // Scan the cache
+    st.scan_cached_blocks(h1, 1);
+
+    // Create a second fake CompactBlock sending more value to the address
+    let (h2, _, _) = st.generate_next_block(
+        &dfvk,
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(7),
+    );
+
+    // Scanning should detect no inconsistencies
+    st.scan_cached_blocks(h2, 1);
+}
+
+// FIXME: This requires fixes to the test framework.
+#[allow(dead_code)]
+pub fn invalid_chain_cache_disconnected<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let dfvk = T::test_account_fvk(&st);
+
+    // Create some fake CompactBlocks
+    let (h, _, _) = st.generate_next_block(
+        &dfvk,
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(5),
+    );
+    let (last_contiguous_height, _, _) = st.generate_next_block(
+        &dfvk,
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(7),
+    );
+
+    // Scanning the cache should find no inconsistencies
+    st.scan_cached_blocks(h, 2);
+
+    // Create more fake CompactBlocks that don't connect to the scanned ones
+    let disconnect_height = last_contiguous_height + 1;
+    st.generate_block_at(
+        disconnect_height,
+        BlockHash([1; 32]),
+        &[FakeCompactOutput::new(
+            &dfvk,
+            AddressType::DefaultExternal,
+            NonNegativeAmount::const_from_u64(8),
+        )],
+        2,
+        2,
+        true,
+    );
+    st.generate_next_block(
+        &dfvk,
+        AddressType::DefaultExternal,
+        NonNegativeAmount::const_from_u64(3),
+    );
+
+    // Data+cache chain should be invalid at the data/cache boundary
+    assert_matches!(
+        st.try_scan_cached_blocks(
+            disconnect_height,
+            2
+        ),
+        Err(chain::error::Error::Scan(ScanError::PrevHashMismatch { at_height }))
+            if at_height == disconnect_height
+    );
+}
+
+pub fn data_db_truncation<T: ShieldedPoolTester, DSF>(ds_factory: DSF, cache: impl TestCache)
+where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Wallet summary is not yet available
+    assert_eq!(st.get_wallet_summary(0), None);
+
+    // Create fake CompactBlocks sending value to the address
+    let value = NonNegativeAmount::const_from_u64(5);
+    let value2 = NonNegativeAmount::const_from_u64(7);
+    let (h, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.generate_next_block(&dfvk, AddressType::DefaultExternal, value2);
+
+    // Scan the cache
+    st.scan_cached_blocks(h, 2);
+
+    // Spendable balance should reflect both received notes
+    assert_eq!(
+        st.get_spendable_balance(account.id(), 1),
+        (value + value2).unwrap()
+    );
+
+    // "Rewind" to height of last scanned block (this is a no-op)
+    st.wallet_mut().truncate_to_height(h + 1).unwrap();
+
+    // Spendable balance should be unaltered
+    assert_eq!(
+        st.get_spendable_balance(account.id(), 1),
+        (value + value2).unwrap()
+    );
+
+    // Rewind so that one block is dropped
+    st.wallet_mut().truncate_to_height(h).unwrap();
+
+    // Spendable balance should only contain the first received note;
+    // the rest should be pending.
+    assert_eq!(st.get_spendable_balance(account.id(), 1), value);
+    assert_eq!(st.get_pending_shielded_balance(account.id(), 1), value2);
+
+    // Scan the cache again
+    st.scan_cached_blocks(h, 2);
+
+    // Account balance should again reflect both received notes
+    assert_eq!(
+        st.get_spendable_balance(account.id(), 1),
+        (value + value2).unwrap()
+    );
+}
+
+pub fn reorg_to_checkpoint<T: ShieldedPoolTester, DSF, C>(ds_factory: DSF, cache: C)
+where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+    C: TestCache,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+
+    // Create a sequence of blocks to serve as the foundation of our chain state.
+    let p0_fvk = T::random_fvk(st.rng_mut());
+    let gen_random_block = |st: &mut TestState<C, DSF::DataStore, LocalNetwork>,
+                            output_count: usize| {
+        let fake_outputs =
+            std::iter::repeat_with(|| FakeCompactOutput::random(st.rng_mut(), p0_fvk.clone()))
+                .take(output_count)
+                .collect::<Vec<_>>();
+        st.generate_next_block_multi(&fake_outputs[..]);
+        output_count
+    };
+
+    // The stable portion of the tree will contain 20 notes.
+    for _ in 0..10 {
+        gen_random_block(&mut st, 4);
+    }
+
+    // We will reorg to this height.
+    let reorg_height = account.birthday().height() + 4;
+    let reorg_position = Position::from(19);
+
+    // Scan the first 5 blocks. The last block in this sequence will be where we simulate a
+    // reorg.
+    st.scan_cached_blocks(account.birthday().height(), 5);
+    assert_eq!(
+        st.wallet()
+            .block_max_scanned()
+            .unwrap()
+            .unwrap()
+            .block_height(),
+        reorg_height
+    );
+
+    // There will be 6 checkpoints: one for the prior block frontier, and then one for each scanned
+    // block.
+    let checkpoints = st
+        .wallet()
+        .get_checkpoint_history(&T::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(checkpoints.len(), 6);
+    assert_eq!(
+        checkpoints.last(),
+        Some(&(reorg_height, Some(reorg_position)))
+    );
+
+    // Scan another block, then simulate a reorg.
+    st.scan_cached_blocks(reorg_height + 1, 1);
+    assert_eq!(
+        st.wallet()
+            .block_max_scanned()
+            .unwrap()
+            .unwrap()
+            .block_height(),
+        reorg_height + 1
+    );
+    let checkpoints = st
+        .wallet()
+        .get_checkpoint_history(&T::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(checkpoints.len(), 7);
+    assert_eq!(
+        checkpoints.last(),
+        Some(&(reorg_height + 1, Some(reorg_position + 4)))
+    );
+
+    //        /\  /\  /\
+    //  .... /\/\/\/\/\/\
+    //          c   d   e
+
+    // Truncate back to the reorg height, but retain the block cache.
+    st.truncate_to_height_retaining_cache(reorg_height);
+
+    // The following error-prone tree state is generated by the a previous (buggy) truncate
+    // implementation:
+    //        /\  /\
+    //  .... /\/\/\/\
+    //          c
+
+    // We have pruned back to the original checkpoints & tree state.
+    let checkpoints = st
+        .wallet()
+        .get_checkpoint_history(&T::SHIELDED_PROTOCOL)
+        .unwrap();
+    assert_eq!(checkpoints.len(), 6);
+    assert_eq!(
+        checkpoints.last(),
+        Some(&(reorg_height, Some(reorg_position)))
+    );
+
+    // Skip two blocks, then (re) scan the same block.
+    st.scan_cached_blocks(reorg_height + 2, 1);
+
+    // Given the buggy truncation, this would result in this the following tree state:
+    //        /\  /\   \  /\
+    //  .... /\/\/\/\   \/\/\
+    //          c       e   f
+
+    let checkpoints = st
+        .wallet()
+        .get_checkpoint_history(&T::SHIELDED_PROTOCOL)
+        .unwrap();
+    // Even though we only scanned one block, we get a checkpoint at both the start and the end of
+    // the block due to the insertion of the prior block frontier.
+    assert_eq!(checkpoints.len(), 8);
+    assert_eq!(
+        checkpoints.last(),
+        Some(&(reorg_height + 2, Some(reorg_position + 8)))
+    );
+
+    // Now, fully truncate back to the reorg height. This should leave the tree in a state
+    // where it can be added to with arbitrary notes.
+    st.truncate_to_height(reorg_height);
+
+    // Generate some new random blocks
+    for _ in 0..10 {
+        let output_count = st.rng_mut().gen_range(2..10);
+        gen_random_block(&mut st, output_count);
+    }
+
+    // The previous truncation retained the cache, so re-scanning the same blocks would have
+    // resulted in the same note commitment tree state, and hence no conflicts; could occur. Now
+    // that we have cleared the cache and generated a different sequence blocks, if truncation did
+    // not completely clear the tree state this would generates a note commitment tree conflict.
+    st.scan_cached_blocks(reorg_height + 1, 1);
+}
+
+pub fn scan_cached_blocks_allows_blocks_out_of_order<T: ShieldedPoolTester>(
+    ds_factory: impl DataStoreFactory,
+    cache: impl TestCache,
+) {
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    let value = NonNegativeAmount::const_from_u64(50000);
+    let (h1, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    st.scan_cached_blocks(h1, 1);
+    assert_eq!(st.get_total_balance(account.id()), value);
+
+    // Create blocks to reach height + 2
+    let (h2, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    let (h3, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+
+    // Scan the later block first
+    st.scan_cached_blocks(h3, 1);
+
+    // Now scan the block of height height + 1
+    st.scan_cached_blocks(h2, 1);
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        NonNegativeAmount::const_from_u64(150_000)
+    );
+
+    // We can spend the received notes
+    let req = TransactionRequest::new(vec![Payment::without_memo(
+        T::fvk_default_address(&dfvk).to_zcash_address(st.network()),
+        NonNegativeAmount::const_from_u64(110_000),
+    )])
+    .unwrap();
+
+    let input_selector = GreedyInputSelector::new();
+    let change_strategy =
+        single_output_change_strategy(StandardFeeRule::Zip317, None, T::SHIELDED_PROTOCOL);
+
+    assert_matches!(
+        st.spend(
+            &input_selector,
+            &change_strategy,
+            account.usk(),
+            req,
+            OvkPolicy::Sender,
+            NonZeroU32::new(1).unwrap(),
+        ),
+        Ok(_)
+    );
+}
+
+pub fn scan_cached_blocks_finds_received_notes<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Wallet summary is not yet available
+    assert_eq!(st.get_wallet_summary(0), None);
+
+    // Create a fake CompactBlock sending value to the address
+    let value = NonNegativeAmount::const_from_u64(5);
+    let (h1, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+
+    // Scan the cache
+    let summary = st.scan_cached_blocks(h1, 1);
+    assert_eq!(summary.scanned_range().start, h1);
+    assert_eq!(summary.scanned_range().end, h1 + 1);
+    assert_eq!(T::received_note_count(&summary), 1);
+
+    // Account balance should reflect the received note
+    assert_eq!(st.get_total_balance(account.id()), value);
+
+    // Create a second fake CompactBlock sending more value to the address
+    let value2 = NonNegativeAmount::const_from_u64(7);
+    let (h2, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value2);
+
+    // Scan the cache again
+    let summary = st.scan_cached_blocks(h2, 1);
+    assert_eq!(summary.scanned_range().start, h2);
+    assert_eq!(summary.scanned_range().end, h2 + 1);
+    assert_eq!(T::received_note_count(&summary), 1);
+
+    // Account balance should reflect both received notes
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (value + value2).unwrap()
+    );
+}
+
+// TODO: This test can probably be entirely removed, as the following test duplicates it entirely.
+pub fn scan_cached_blocks_finds_change_notes<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Wallet summary is not yet available
+    assert_eq!(st.get_wallet_summary(0), None);
+
+    // Create a fake CompactBlock sending value to the address
+    let value = NonNegativeAmount::const_from_u64(5);
+    let (received_height, _, nf) =
+        st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+
+    // Scan the cache
+    st.scan_cached_blocks(received_height, 1);
+
+    // Account balance should reflect the received note
+    assert_eq!(st.get_total_balance(account.id()), value);
+
+    // Create a second fake CompactBlock spending value from the address
+    let not_our_key = T::sk_to_fvk(&T::sk(&[0xf5; 32]));
+    let to2 = T::fvk_default_address(&not_our_key);
+    let value2 = NonNegativeAmount::const_from_u64(2);
+    let (spent_height, _) = st.generate_next_block_spending(&dfvk, (nf, value), to2, value2);
+
+    // Scan the cache again
+    st.scan_cached_blocks(spent_height, 1);
+
+    // Account balance should equal the change
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (value - value2).unwrap()
+    );
+}
+
+pub fn scan_cached_blocks_detects_spends_out_of_order<T: ShieldedPoolTester, DSF>(
+    ds_factory: DSF,
+    cache: impl TestCache,
+) where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Wallet summary is not yet available
+    assert_eq!(st.get_wallet_summary(0), None);
+
+    // Create a fake CompactBlock sending value to the address
+    let value = NonNegativeAmount::const_from_u64(5);
+    let (received_height, _, nf) =
+        st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+
+    // Create a second fake CompactBlock spending value from the address
+    let not_our_key = T::sk_to_fvk(&T::sk(&[0xf5; 32]));
+    let to2 = T::fvk_default_address(&not_our_key);
+    let value2 = NonNegativeAmount::const_from_u64(2);
+    let (spent_height, _) = st.generate_next_block_spending(&dfvk, (nf, value), to2, value2);
+
+    // Scan the spending block first.
+    st.scan_cached_blocks(spent_height, 1);
+
+    // Account balance should equal the change
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (value - value2).unwrap()
+    );
+
+    // Now scan the block in which we received the note that was spent.
+    st.scan_cached_blocks(received_height, 1);
+
+    // Account balance should be the same.
+    assert_eq!(
+        st.get_total_balance(account.id()),
+        (value - value2).unwrap()
+    );
+}
+
+pub fn metadata_queries_exclude_unwanted_notes<T: ShieldedPoolTester, DSF, TC>(
+    ds_factory: DSF,
+    cache: TC,
+) where
+    DSF: DataStoreFactory,
+    <DSF as DataStoreFactory>::AccountId: std::fmt::Debug,
+    TC: TestCache,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(ds_factory)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let dfvk = T::test_account_fvk(&st);
+
+    // Create 10 blocks with successively increasing value
+    let value = NonNegativeAmount::const_from_u64(100_0000);
+    let (h0, _, _) = st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+    let mut note_values = vec![value];
+    for i in 2..=10 {
+        let value = NonNegativeAmount::const_from_u64(i * 100_0000);
+        st.generate_next_block(&dfvk, AddressType::DefaultExternal, value);
+        note_values.push(value);
+    }
+    st.scan_cached_blocks(h0, 10);
+
+    let test_meta = |st: &TestState<TC, DSF::DataStore, LocalNetwork>, query, expected_count| {
+        let metadata = st
+            .wallet()
+            .get_account_metadata(account.id(), &query, &[])
+            .unwrap();
+
+        assert_eq!(metadata.note_count(T::SHIELDED_PROTOCOL), expected_count);
+    };
+
+    test_meta(
+        &st,
+        NoteFilter::ExceedsMinValue(NonNegativeAmount::const_from_u64(1000_0000)),
+        Some(1),
+    );
+    test_meta(
+        &st,
+        NoteFilter::ExceedsMinValue(NonNegativeAmount::const_from_u64(500_0000)),
+        Some(6),
+    );
+    test_meta(
+        &st,
+        NoteFilter::ExceedsBalancePercentage(BoundedU8::new_const(10)),
+        Some(5),
+    );
+
+    // We haven't sent any funds yet, so we can't evaluate this query
+    test_meta(
+        &st,
+        NoteFilter::ExceedsPriorSendPercentile(BoundedU8::new_const(50)),
+        None,
+    );
+
+    // Spend half of each one of our notes, so that we can get a distribution of sent note values.
+    // FIXME: This test is currently excessively specialized to the `zcash_client_sqlite::WalletDb`
+    // implmentation of the `InputSource` trait. A better approach would be to create a test input
+    // source that can select a set of notes directly based upon their nullifiers.
+    let not_our_key = T::sk_to_fvk(&T::sk(&[0xf5; 32]));
+    let to = T::fvk_default_address(&not_our_key).to_zcash_address(st.network());
+    let nz2 = NonZeroU64::new(2).unwrap();
+
+    for value in &note_values {
+        let txids = st
+            .create_standard_transaction(&account, to.clone(), *value / nz2)
+            .unwrap();
+        st.generate_next_block_including(txids.head);
+    }
+    st.scan_cached_blocks(h0 + 10, 10);
+
+    // Since we've spent half our notes, our remaining notes each have approximately half their
+    // original value. The 50th percentile of our spends should be 250_0000 ZAT, and half of our
+    // remaining notes should have value greater than that.
+    test_meta(
+        &st,
+        NoteFilter::ExceedsPriorSendPercentile(BoundedU8::new_const(50)),
+        Some(5),
+    );
+}
diff --git a/zcash_client_backend/src/data_api/testing/sapling.rs b/zcash_client_backend/src/data_api/testing/sapling.rs
new file mode 100644
index 0000000000..fe082c224f
--- /dev/null
+++ b/zcash_client_backend/src/data_api/testing/sapling.rs
@@ -0,0 +1,153 @@
+use std::hash::Hash;
+
+use incrementalmerkletree::{Hashable, Level};
+use sapling::{
+    note_encryption::try_sapling_output_recovery,
+    zip32::{DiversifiableFullViewingKey, ExtendedSpendingKey},
+};
+use shardtree::error::ShardTreeError;
+use zcash_keys::{address::Address, keys::UnifiedSpendingKey};
+use zcash_primitives::transaction::{components::sapling::zip212_enforcement, Transaction};
+use zcash_protocol::{
+    consensus::{self, BlockHeight},
+    memo::MemoBytes,
+    value::Zatoshis,
+    ShieldedProtocol,
+};
+use zip32::Scope;
+
+use crate::{
+    data_api::{
+        chain::{CommitmentTreeRoot, ScanSummary},
+        DecryptedTransaction, InputSource, WalletCommitmentTrees, WalletSummary, WalletTest,
+    },
+    wallet::{Note, ReceivedNote},
+};
+
+use super::{pool::ShieldedPoolTester, TestState};
+
+/// Type for running pool-agnostic tests on the Sapling pool.
+pub struct SaplingPoolTester;
+impl ShieldedPoolTester for SaplingPoolTester {
+    const SHIELDED_PROTOCOL: ShieldedProtocol = ShieldedProtocol::Sapling;
+    // const MERKLE_TREE_DEPTH: u8 = sapling::NOTE_COMMITMENT_TREE_DEPTH;
+
+    type Sk = ExtendedSpendingKey;
+    type Fvk = DiversifiableFullViewingKey;
+    type MerkleTreeHash = sapling::Node;
+    type Note = sapling::Note;
+
+    fn test_account_fvk<Cache, DbT: WalletTest, P: consensus::Parameters>(
+        st: &TestState<Cache, DbT, P>,
+    ) -> Self::Fvk {
+        st.test_account_sapling().unwrap().clone()
+    }
+
+    fn usk_to_sk(usk: &UnifiedSpendingKey) -> &Self::Sk {
+        usk.sapling()
+    }
+
+    fn sk(seed: &[u8]) -> Self::Sk {
+        ExtendedSpendingKey::master(seed)
+    }
+
+    fn sk_to_fvk(sk: &Self::Sk) -> Self::Fvk {
+        sk.to_diversifiable_full_viewing_key()
+    }
+
+    fn sk_default_address(sk: &Self::Sk) -> Address {
+        sk.default_address().1.into()
+    }
+
+    fn fvk_default_address(fvk: &Self::Fvk) -> Address {
+        fvk.default_address().1.into()
+    }
+
+    fn fvks_equal(a: &Self::Fvk, b: &Self::Fvk) -> bool {
+        a.to_bytes() == b.to_bytes()
+    }
+
+    fn empty_tree_leaf() -> Self::MerkleTreeHash {
+        ::sapling::Node::empty_leaf()
+    }
+
+    fn empty_tree_root(level: Level) -> Self::MerkleTreeHash {
+        ::sapling::Node::empty_root(level)
+    }
+
+    fn put_subtree_roots<Cache, DbT: WalletTest + WalletCommitmentTrees, P>(
+        st: &mut TestState<Cache, DbT, P>,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<Self::MerkleTreeHash>],
+    ) -> Result<(), ShardTreeError<<DbT as WalletCommitmentTrees>::Error>> {
+        st.wallet_mut()
+            .put_sapling_subtree_roots(start_index, roots)
+    }
+
+    fn next_subtree_index<A: Hash + Eq>(s: &WalletSummary<A>) -> u64 {
+        s.next_sapling_subtree_index()
+    }
+
+    fn select_spendable_notes<Cache, DbT: InputSource + WalletTest, P>(
+        st: &TestState<Cache, DbT, P>,
+        account: <DbT as InputSource>::AccountId,
+        target_value: Zatoshis,
+        anchor_height: BlockHeight,
+        exclude: &[DbT::NoteRef],
+    ) -> Result<Vec<ReceivedNote<DbT::NoteRef, Self::Note>>, <DbT as InputSource>::Error> {
+        st.wallet()
+            .select_spendable_notes(
+                account,
+                target_value,
+                &[ShieldedProtocol::Sapling],
+                anchor_height,
+                exclude,
+            )
+            .map(|n| n.take_sapling())
+    }
+
+    fn decrypted_pool_outputs_count<A>(d_tx: &DecryptedTransaction<'_, A>) -> usize {
+        d_tx.sapling_outputs().len()
+    }
+
+    fn with_decrypted_pool_memos<A>(
+        d_tx: &DecryptedTransaction<'_, A>,
+        mut f: impl FnMut(&MemoBytes),
+    ) {
+        for output in d_tx.sapling_outputs() {
+            f(output.memo());
+        }
+    }
+
+    fn try_output_recovery<P: consensus::Parameters>(
+        params: &P,
+        height: BlockHeight,
+        tx: &Transaction,
+        fvk: &Self::Fvk,
+    ) -> Option<(Note, Address, MemoBytes)> {
+        for output in tx.sapling_bundle().unwrap().shielded_outputs() {
+            // Find the output that decrypts with the external OVK
+            let result = try_sapling_output_recovery(
+                &fvk.to_ovk(Scope::External),
+                output,
+                zip212_enforcement(params, height),
+            );
+
+            if result.is_some() {
+                return result.map(|(note, addr, memo)| {
+                    (
+                        Note::Sapling(note),
+                        addr.into(),
+                        MemoBytes::from_bytes(&memo).expect("correct length"),
+                    )
+                });
+            }
+        }
+
+        None
+    }
+
+    fn received_note_count(summary: &ScanSummary) -> usize {
+        summary.received_sapling_note_count()
+    }
+}
diff --git a/zcash_client_backend/src/data_api/testing/transparent.rs b/zcash_client_backend/src/data_api/testing/transparent.rs
new file mode 100644
index 0000000000..d663dc44a6
--- /dev/null
+++ b/zcash_client_backend/src/data_api/testing/transparent.rs
@@ -0,0 +1,247 @@
+use crate::{
+    data_api::{
+        testing::{
+            AddressType, DataStoreFactory, ShieldedProtocol, TestBuilder, TestCache, TestState,
+        },
+        wallet::input_selection::GreedyInputSelector,
+        Account as _, InputSource, WalletRead, WalletWrite,
+    },
+    fees::{standard, DustOutputPolicy, StandardFeeRule},
+    wallet::WalletTransparentOutput,
+};
+use assert_matches::assert_matches;
+use sapling::zip32::ExtendedSpendingKey;
+use zcash_primitives::{
+    block::BlockHash,
+    transaction::components::{amount::NonNegativeAmount, OutPoint, TxOut},
+};
+
+pub fn put_received_transparent_utxo<DSF>(dsf: DSF)
+where
+    DSF: DataStoreFactory,
+    <<DSF as DataStoreFactory>::DataStore as WalletWrite>::UtxoRef: std::fmt::Debug + PartialEq,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(dsf)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let birthday = st.test_account().unwrap().birthday().height();
+    let account_id = st.test_account().unwrap().id();
+    let uaddr = st
+        .wallet()
+        .get_current_address(account_id)
+        .unwrap()
+        .unwrap();
+    let taddr = uaddr.transparent().unwrap();
+
+    let height_1 = birthday + 12345;
+    st.wallet_mut().update_chain_tip(height_1).unwrap();
+
+    let bal_absent = st
+        .wallet()
+        .get_transparent_balances(account_id, height_1)
+        .unwrap();
+    assert!(bal_absent.is_empty());
+
+    // Create a fake transparent output.
+    let value = NonNegativeAmount::const_from_u64(100000);
+    let outpoint = OutPoint::fake();
+    let txout = TxOut {
+        value,
+        script_pubkey: taddr.script(),
+    };
+
+    // Pretend the output's transaction was mined at `height_1`.
+    let utxo = WalletTransparentOutput::from_parts(outpoint.clone(), txout.clone(), Some(height_1))
+        .unwrap();
+    let res0 = st.wallet_mut().put_received_transparent_utxo(&utxo);
+    assert_matches!(res0, Ok(_));
+
+    // Confirm that we see the output unspent as of `height_1`.
+    assert_matches!(
+        st.wallet().get_spendable_transparent_outputs(
+            taddr,
+            height_1,
+            0
+        ).as_deref(),
+        Ok([ret]) if (ret.outpoint(), ret.txout(), ret.mined_height()) == (utxo.outpoint(), utxo.txout(), Some(height_1))
+    );
+    assert_matches!(
+        st.wallet().get_unspent_transparent_output(utxo.outpoint()),
+        Ok(Some(ret)) if (ret.outpoint(), ret.txout(), ret.mined_height()) == (utxo.outpoint(), utxo.txout(), Some(height_1))
+    );
+
+    // Change the mined height of the UTXO and upsert; we should get back
+    // the same `UtxoId`.
+    let height_2 = birthday + 34567;
+    st.wallet_mut().update_chain_tip(height_2).unwrap();
+    let utxo2 = WalletTransparentOutput::from_parts(outpoint, txout, Some(height_2)).unwrap();
+    let res1 = st.wallet_mut().put_received_transparent_utxo(&utxo2);
+    assert_matches!(res1, Ok(id) if id == res0.unwrap());
+
+    // Confirm that we no longer see any unspent outputs as of `height_1`.
+    assert_matches!(
+        st.wallet()
+            .get_spendable_transparent_outputs(taddr, height_1, 0)
+            .as_deref(),
+        Ok(&[])
+    );
+
+    // We can still look up the specific output, and it has the expected height.
+    assert_matches!(
+        st.wallet().get_unspent_transparent_output(utxo2.outpoint()),
+        Ok(Some(ret)) if (ret.outpoint(), ret.txout(), ret.mined_height()) == (utxo2.outpoint(), utxo2.txout(), Some(height_2))
+    );
+
+    // If we include `height_2` then the output is returned.
+    assert_matches!(
+        st.wallet()
+            .get_spendable_transparent_outputs(taddr, height_2, 0)
+            .as_deref(),
+        Ok([ret]) if (ret.outpoint(), ret.txout(), ret.mined_height()) == (utxo.outpoint(), utxo.txout(), Some(height_2))
+    );
+
+    assert_matches!(
+        st.wallet().get_transparent_balances(account_id, height_2),
+        Ok(h) if h.get(taddr) == Some(&value)
+    );
+}
+
+pub fn transparent_balance_across_shielding<DSF>(dsf: DSF, cache: impl TestCache)
+where
+    DSF: DataStoreFactory,
+{
+    let mut st = TestBuilder::new()
+        .with_data_store_factory(dsf)
+        .with_block_cache(cache)
+        .with_account_from_sapling_activation(BlockHash([0; 32]))
+        .build();
+
+    let account = st.test_account().cloned().unwrap();
+    let uaddr = st
+        .wallet()
+        .get_current_address(account.id())
+        .unwrap()
+        .unwrap();
+    let taddr = uaddr.transparent().unwrap();
+
+    // Initialize the wallet with chain data that has no shielded notes for us.
+    let not_our_key = ExtendedSpendingKey::master(&[]).to_diversifiable_full_viewing_key();
+    let not_our_value = NonNegativeAmount::const_from_u64(10000);
+    let (start_height, _, _) =
+        st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
+    for _ in 1..10 {
+        st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
+    }
+    st.scan_cached_blocks(start_height, 10);
+
+    let check_balance = |st: &TestState<_, DSF::DataStore, _>, min_confirmations: u32, expected| {
+        // Check the wallet summary returns the expected transparent balance.
+        let summary = st
+            .wallet()
+            .get_wallet_summary(min_confirmations)
+            .unwrap()
+            .unwrap();
+        let balance = summary.account_balances().get(&account.id()).unwrap();
+        // TODO: in the future, we will distinguish between available and total
+        // balance according to `min_confirmations`
+        assert_eq!(balance.unshielded(), expected);
+
+        // Check the older APIs for consistency.
+        let mempool_height = st.wallet().chain_height().unwrap().unwrap() + 1;
+        assert_eq!(
+            st.wallet()
+                .get_transparent_balances(account.id(), mempool_height)
+                .unwrap()
+                .get(taddr)
+                .cloned()
+                .unwrap_or(NonNegativeAmount::ZERO),
+            expected,
+        );
+        assert_eq!(
+            st.wallet()
+                .get_spendable_transparent_outputs(taddr, mempool_height, 0)
+                .unwrap()
+                .into_iter()
+                .map(|utxo| utxo.value())
+                .sum::<Option<NonNegativeAmount>>(),
+            Some(expected),
+        );
+    };
+
+    // The wallet starts out with zero balance.
+    // TODO: Once we have refactored `get_wallet_summary` to distinguish between available
+    // and total balance, we should perform additional checks against available balance;
+    // we use minconf 0 here because all transparent funds are considered shieldable,
+    // irrespective of confirmation depth.
+    check_balance(&st, 0, NonNegativeAmount::ZERO);
+
+    // Create a fake transparent output.
+    let value = NonNegativeAmount::from_u64(100000).unwrap();
+    let txout = TxOut {
+        value,
+        script_pubkey: taddr.script(),
+    };
+
+    // Pretend the output was received in the chain tip.
+    let height = st.wallet().chain_height().unwrap().unwrap();
+    let utxo = WalletTransparentOutput::from_parts(OutPoint::fake(), txout, Some(height)).unwrap();
+    st.wallet_mut()
+        .put_received_transparent_utxo(&utxo)
+        .unwrap();
+
+    // The wallet should detect the balance as available
+    check_balance(&st, 0, value);
+
+    // Shield the output.
+    let input_selector = GreedyInputSelector::new();
+    let change_strategy = standard::SingleOutputChangeStrategy::new(
+        StandardFeeRule::Zip317,
+        None,
+        ShieldedProtocol::Sapling,
+        DustOutputPolicy::default(),
+    );
+    let txid = st
+        .shield_transparent_funds(
+            &input_selector,
+            &change_strategy,
+            value,
+            account.usk(),
+            &[*taddr],
+            account.id(),
+            1,
+        )
+        .unwrap()[0];
+
+    // The wallet should have zero transparent balance, because the shielding
+    // transaction can be mined.
+    check_balance(&st, 0, NonNegativeAmount::ZERO);
+
+    // Mine the shielding transaction.
+    let (mined_height, _) = st.generate_next_block_including(txid);
+    st.scan_cached_blocks(mined_height, 1);
+
+    // The wallet should still have zero transparent balance.
+    check_balance(&st, 0, NonNegativeAmount::ZERO);
+
+    // Unmine the shielding transaction via a reorg.
+    st.wallet_mut()
+        .truncate_to_height(mined_height - 1)
+        .unwrap();
+    assert_eq!(st.wallet().chain_height().unwrap(), Some(mined_height - 1));
+
+    // The wallet should still have zero transparent balance.
+    check_balance(&st, 0, NonNegativeAmount::ZERO);
+
+    // Expire the shielding transaction.
+    let expiry_height = st
+        .wallet()
+        .get_transaction(txid)
+        .unwrap()
+        .expect("Transaction exists in the wallet.")
+        .expiry_height();
+    st.wallet_mut().update_chain_tip(expiry_height).unwrap();
+
+    check_balance(&st, 0, value);
+}
diff --git a/zcash_client_backend/src/data_api/wallet.rs b/zcash_client_backend/src/data_api/wallet.rs
index d96a47e284..0d43844116 100644
--- a/zcash_client_backend/src/data_api/wallet.rs
+++ b/zcash_client_backend/src/data_api/wallet.rs
@@ -1,55 +1,99 @@
-use std::convert::Infallible;
-use std::fmt::Debug;
+//! # Functions for creating Zcash transactions that spend funds belonging to the wallet
+//!
+//! This module contains several different ways of creating Zcash transactions. This module is
+//! designed around the idea that a Zcash wallet holds its funds in notes in either the Orchard
+//! or Sapling shielded pool. In order to better preserve users' privacy, it does not provide any
+//! functionality that allows users to directly spend transparent funds except by sending them to a
+//! shielded internal address belonging to their wallet.
+//!
+//! The important high-level operations provided by this module are [`propose_transfer`],
+//! and [`create_proposed_transactions`].
+//!
+//! [`propose_transfer`] takes a [`TransactionRequest`] object, selects inputs notes and
+//! computes the fees required to satisfy that request, and returns a [`Proposal`] object that
+//! describes the transaction to be made.
+//!
+//! [`create_proposed_transactions`] constructs one or more Zcash [`Transaction`]s based upon a
+//! provided [`Proposal`], stores them to the wallet database, and returns the [`TxId`] for each
+//! constructed transaction to the caller. The caller can then use the
+//! [`WalletRead::get_transaction`] method to retrieve the newly constructed transactions. It is
+//! the responsibility of the caller to retrieve and serialize the transactions and submit them for
+//! inclusion into the Zcash blockchain.
+//!
+#![cfg_attr(
+    feature = "transparent-inputs",
+    doc = "
+Another important high-level operation provided by this module is [`propose_shielding`], which
+takes a set of transparent source addresses, and constructs a [`Proposal`] to send those funds
+to a wallet-internal shielded address, as described in [ZIP 316](https://zips.z.cash/zip-0316).
 
-use zcash_primitives::{
-    consensus::{self, NetworkUpgrade},
-    memo::MemoBytes,
-    sapling::{
-        self,
-        note_encryption::{try_sapling_note_decryption, PreparedIncomingViewingKey},
-        prover::TxProver as SaplingProver,
-        Node,
-    },
-    transaction::{
-        builder::Builder,
-        components::amount::{Amount, BalanceError},
-        fees::{fixed, FeeRule},
-        Transaction,
-    },
-    zip32::{sapling::DiversifiableFullViewingKey, sapling::ExtendedSpendingKey, AccountId, Scope},
+[`propose_shielding`]: crate::data_api::wallet::propose_shielding
+"
+)]
+//! [`TransactionRequest`]: crate::zip321::TransactionRequest
+//! [`propose_transfer`]: crate::data_api::wallet::propose_transfer
+
+use nonempty::NonEmpty;
+use rand_core::OsRng;
+use sapling::{
+    note_encryption::{try_sapling_note_decryption, PreparedIncomingViewingKey},
+    prover::{OutputProver, SpendProver},
 };
+use shardtree::error::{QueryError, ShardTreeError};
+use std::num::NonZeroU32;
 
+use super::InputSource;
 use crate::{
-    address::RecipientAddress,
+    address::Address,
     data_api::{
-        error::Error, wallet::input_selection::Proposal, DecryptedTransaction, PoolType, Recipient,
-        SentTransaction, SentTransactionOutput, WalletWrite,
+        error::Error, Account, SentTransaction, SentTransactionOutput, WalletCommitmentTrees,
+        WalletRead, WalletWrite,
     },
     decrypt_transaction,
-    fees::{self, ChangeValue, DustOutputPolicy},
+    fees::{
+        standard::SingleOutputChangeStrategy, ChangeStrategy, DustOutputPolicy, StandardFeeRule,
+    },
     keys::UnifiedSpendingKey,
-    wallet::{OvkPolicy, ReceivedSaplingNote},
+    proposal::{Proposal, ProposalError, Step, StepOutputIndex},
+    wallet::{Note, OvkPolicy, Recipient},
     zip321::{self, Payment},
+    PoolType, ShieldedProtocol,
 };
-
-pub mod input_selection;
-use input_selection::{GreedyInputSelector, GreedyInputSelectorError, InputSelector};
+use zcash_primitives::{
+    legacy::TransparentAddress,
+    transaction::{
+        builder::{BuildConfig, BuildResult, Builder},
+        components::{amount::NonNegativeAmount, sapling::zip212_enforcement, OutPoint},
+        fees::FeeRule,
+        Transaction, TxId,
+    },
+};
+use zcash_protocol::{
+    consensus::{self, BlockHeight, NetworkUpgrade},
+    memo::MemoBytes,
+};
+use zip32::Scope;
 
 #[cfg(feature = "transparent-inputs")]
 use {
-    crate::wallet::WalletTransparentOutput,
-    zcash_primitives::{
-        legacy::TransparentAddress, sapling::keys::OutgoingViewingKey,
-        transaction::components::amount::NonNegativeAmount,
-    },
+    crate::{fees::ChangeValue, proposal::StepOutput, wallet::TransparentAddressMetadata},
+    core::convert::Infallible,
+    input_selection::ShieldingSelector,
+    std::collections::HashMap,
+    zcash_keys::encoding::AddressCodec,
+    zcash_primitives::transaction::components::TxOut,
 };
 
+pub mod input_selection;
+use input_selection::{GreedyInputSelector, InputSelector, InputSelectorError};
+
 /// Scans a [`Transaction`] for any information that can be decrypted by the accounts in
 /// the wallet, and saves it to the wallet.
 pub fn decrypt_and_store_transaction<ParamsT, DbT>(
     params: &ParamsT,
     data: &mut DbT,
     tx: &Transaction,
+    mined_height: Option<BlockHeight>,
 ) -> Result<(), DbT::Error>
 where
     ParamsT: consensus::Parameters,
@@ -60,583 +104,1028 @@ where
 
     // Height is block height for mined transactions, and the "mempool height" (chain height + 1)
     // for mempool transactions.
-    let height = data
-        .get_tx_height(tx.txid())?
-        .or(data
-            .block_height_extrema()?
-            .map(|(_, max_height)| max_height + 1))
-        .or_else(|| params.activation_height(NetworkUpgrade::Sapling))
-        .expect("Sapling activation height must be known.");
-
-    data.store_decrypted_tx(DecryptedTransaction {
-        tx,
-        sapling_outputs: &decrypt_transaction(params, height, tx, &ufvks),
+    let height = mined_height.map(Ok).unwrap_or_else(|| {
+        Ok(data
+            .get_tx_height(tx.txid())?
+            .or(data.chain_height()?.map(|max_height| max_height + 1))
+            .or_else(|| params.activation_height(NetworkUpgrade::Sapling))
+            .expect("Sapling activation height must be known."))
     })?;
 
+    data.store_decrypted_tx(decrypt_transaction(params, height, tx, &ufvks))?;
+
     Ok(())
 }
 
-#[allow(clippy::needless_doctest_main)]
-/// Creates a transaction paying the specified address from the given account.
-///
-/// Returns the row index of the newly-created transaction in the `transactions` table
-/// within the data database. The caller can read the raw transaction bytes from the `raw`
-/// column in order to broadcast the transaction to the network.
-///
-/// Do not call this multiple times in parallel, or you will generate transactions that
-/// double-spend the same notes.
-///
-/// # Transaction privacy
-///
-/// `ovk_policy` specifies the desired policy for which outgoing viewing key should be
-/// able to decrypt the outputs of this transaction. This is primarily relevant to
-/// wallet recovery from backup; in particular, [`OvkPolicy::Discard`] will prevent the
-/// recipient's address, and the contents of `memo`, from ever being recovered from the
-/// block chain. (The total value sent can always be inferred by the sender from the spent
-/// notes and received change.)
-///
-/// Regardless of the specified policy, `create_spend_to_address` saves `to`, `value`, and
-/// `memo` in `db_data`. This can be deleted independently of `ovk_policy`.
-///
-/// For details on what transaction information is visible to the holder of a full or
-/// outgoing viewing key, refer to [ZIP 310].
-///
-/// [ZIP 310]: https://zips.z.cash/zip-0310
-///
-/// Parameters:
-/// * `wallet_db`: A read/write reference to the wallet database
-/// * `params`: Consensus parameters
-/// * `prover`: The [`sapling::TxProver`] to use in constructing the shielded transaction.
-/// * `usk`: The unified spending key that controls the funds that will be spent
-///   in the resulting transaction. This procedure will return an error if the
-///   USK does not correspond to an account known to the wallet.
-/// * `to`: The address to which `amount` will be paid.
-/// * `amount`: The amount to send.
-/// * `memo`: A memo to be included in the output to the recipient.
-/// * `ovk_policy`: The policy to use for constructing outgoing viewing keys that
-///   can allow the sender to view the resulting notes on the blockchain.
-/// * `min_confirmations`: The minimum number of confirmations that a previously
-///   received note must have in the blockchain in order to be considered for being
-///   spent. A value of 10 confirmations is recommended.
-///
-/// # Examples
-///
-/// ```
-/// # #[cfg(feature = "test-dependencies")]
-/// # {
-/// use tempfile::NamedTempFile;
-/// use zcash_primitives::{
-///     consensus::{self, Network},
-///     constants::testnet::COIN_TYPE,
-///     transaction::{TxId, components::Amount},
-///     zip32::AccountId,
-/// };
-/// use zcash_proofs::prover::LocalTxProver;
-/// use zcash_client_backend::{
-///     keys::UnifiedSpendingKey,
-///     data_api::{wallet::create_spend_to_address, error::Error, testing},
-///     wallet::OvkPolicy,
-/// };
-///
-/// # use std::convert::Infallible;
-/// # use zcash_primitives::transaction::components::amount::BalanceError;
-/// # use zcash_client_backend::{
-/// #     data_api::wallet::input_selection::GreedyInputSelectorError,
-/// # };
-/// #
-/// # fn main() {
-/// #   test();
-/// # }
-/// #
-/// # #[allow(deprecated)]
-/// # fn test() -> Result<TxId, Error<(), GreedyInputSelectorError<BalanceError, u32>, Infallible, u32>> {
-///
-/// let tx_prover = match LocalTxProver::with_default_location() {
-///     Some(tx_prover) => tx_prover,
-///     None => {
-///         panic!("Cannot locate the Zcash parameters. Please run zcash-fetch-params or fetch-params.sh to download the parameters, and then re-run the tests.");
-///     }
-/// };
-///
-/// let account = AccountId::from(0);
-/// let usk = UnifiedSpendingKey::from_seed(&Network::TestNetwork, &[0; 32][..], account).unwrap();
-/// let to = usk.to_unified_full_viewing_key().default_address().0.into();
-///
-/// let mut db_read = testing::MockWalletDb {
-///     network: Network::TestNetwork
-/// };
-///
-/// create_spend_to_address(
-///     &mut db_read,
-///     &Network::TestNetwork,
-///     tx_prover,
-///     &usk,
-///     &to,
-///     Amount::from_u64(1).unwrap(),
-///     None,
-///     OvkPolicy::Sender,
-///     10
-/// )
-///
-/// # }
-/// # }
-/// ```
-/// [`sapling::TxProver`]: zcash_primitives::sapling::prover::TxProver
+/// Errors that may be generated in construction of proposals for shielded->shielded or
+/// shielded->transparent transfers.
+pub type ProposeTransferErrT<DbT, CommitmentTreeErrT, InputsT, ChangeT> = Error<
+    <DbT as WalletRead>::Error,
+    CommitmentTreeErrT,
+    <InputsT as InputSelector>::Error,
+    <<ChangeT as ChangeStrategy>::FeeRule as FeeRule>::Error,
+    <ChangeT as ChangeStrategy>::Error,
+    <<InputsT as InputSelector>::InputSource as InputSource>::NoteRef,
+>;
+
+/// Errors that may be generated in construction of proposals for transparent->shielded
+/// wallet-internal transfers.
+#[cfg(feature = "transparent-inputs")]
+pub type ProposeShieldingErrT<DbT, CommitmentTreeErrT, InputsT, ChangeT> = Error<
+    <DbT as WalletRead>::Error,
+    CommitmentTreeErrT,
+    <InputsT as ShieldingSelector>::Error,
+    <<ChangeT as ChangeStrategy>::FeeRule as FeeRule>::Error,
+    <ChangeT as ChangeStrategy>::Error,
+    Infallible,
+>;
+
+/// Errors that may be generated in combined creation and execution of transaction proposals.
+pub type CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N> = Error<
+    <DbT as WalletRead>::Error,
+    <DbT as WalletCommitmentTrees>::Error,
+    InputsErrT,
+    <FeeRuleT as FeeRule>::Error,
+    ChangeErrT,
+    N,
+>;
+
+/// Errors that may be generated in the execution of proposals that may send shielded inputs.
+pub type TransferErrT<DbT, InputsT, ChangeT> = Error<
+    <DbT as WalletRead>::Error,
+    <DbT as WalletCommitmentTrees>::Error,
+    <InputsT as InputSelector>::Error,
+    <<ChangeT as ChangeStrategy>::FeeRule as FeeRule>::Error,
+    <ChangeT as ChangeStrategy>::Error,
+    <<InputsT as InputSelector>::InputSource as InputSource>::NoteRef,
+>;
+
+/// Errors that may be generated in the execution of shielding proposals.
+#[cfg(feature = "transparent-inputs")]
+pub type ShieldErrT<DbT, InputsT, ChangeT> = Error<
+    <DbT as WalletRead>::Error,
+    <DbT as WalletCommitmentTrees>::Error,
+    <InputsT as ShieldingSelector>::Error,
+    <<ChangeT as ChangeStrategy>::FeeRule as FeeRule>::Error,
+    <ChangeT as ChangeStrategy>::Error,
+    Infallible,
+>;
+
+/// Select transaction inputs, compute fees, and construct a proposal for a transaction or series
+/// of transactions that can then be authorized and made ready for submission to the network with
+/// [`create_proposed_transactions`].
 #[allow(clippy::too_many_arguments)]
 #[allow(clippy::type_complexity)]
-#[deprecated(
-    note = "Use `spend` instead. `create_spend_to_address` uses a fixed fee of 10000 zatoshis, which is not compliant with ZIP 317."
-)]
-pub fn create_spend_to_address<DbT, ParamsT>(
+pub fn propose_transfer<DbT, ParamsT, InputsT, ChangeT, CommitmentTreeErrT>(
     wallet_db: &mut DbT,
     params: &ParamsT,
-    prover: impl SaplingProver,
-    usk: &UnifiedSpendingKey,
-    to: &RecipientAddress,
-    amount: Amount,
-    memo: Option<MemoBytes>,
-    ovk_policy: OvkPolicy,
-    min_confirmations: u32,
+    spend_from_account: <DbT as InputSource>::AccountId,
+    input_selector: &InputsT,
+    change_strategy: &ChangeT,
+    request: zip321::TransactionRequest,
+    min_confirmations: NonZeroU32,
 ) -> Result<
-    DbT::TxRef,
-    Error<
-        DbT::Error,
-        GreedyInputSelectorError<BalanceError, DbT::NoteRef>,
-        Infallible,
-        DbT::NoteRef,
-    >,
+    Proposal<ChangeT::FeeRule, <DbT as InputSource>::NoteRef>,
+    ProposeTransferErrT<DbT, CommitmentTreeErrT, InputsT, ChangeT>,
 >
 where
+    DbT: WalletRead + InputSource<Error = <DbT as WalletRead>::Error>,
+    <DbT as InputSource>::NoteRef: Copy + Eq + Ord,
     ParamsT: consensus::Parameters + Clone,
-    DbT: WalletWrite,
-    DbT::NoteRef: Copy + Eq + Ord,
+    InputsT: InputSelector<InputSource = DbT>,
+    ChangeT: ChangeStrategy<MetaSource = DbT>,
 {
-    let req = zip321::TransactionRequest::new(vec![Payment {
-        recipient_address: to.clone(),
-        amount,
-        memo,
-        label: None,
-        message: None,
-        other_params: vec![],
-    }])
-    .expect(
-        "It should not be possible for this to violate ZIP 321 request construction invariants.",
-    );
+    let (target_height, anchor_height) = wallet_db
+        .get_target_and_anchor_heights(min_confirmations)
+        .map_err(|e| Error::from(InputSelectorError::DataSource(e)))?
+        .ok_or_else(|| Error::from(InputSelectorError::SyncRequired))?;
 
-    #[allow(deprecated)]
-    let fee_rule = fixed::FeeRule::standard();
-    let change_strategy = fees::fixed::SingleOutputChangeStrategy::new(fee_rule);
-    spend(
-        wallet_db,
-        params,
-        prover,
-        &GreedyInputSelector::<DbT, _>::new(change_strategy, DustOutputPolicy::default()),
-        usk,
-        req,
-        ovk_policy,
-        min_confirmations,
-    )
+    input_selector
+        .propose_transaction(
+            params,
+            wallet_db,
+            target_height,
+            anchor_height,
+            spend_from_account,
+            request,
+            change_strategy,
+        )
+        .map_err(Error::from)
 }
 
-/// Constructs a transaction that sends funds as specified by the `request` argument
-/// and stores it to the wallet's "sent transactions" data store, and returns a
-/// unique identifier for the transaction; this identifier is used only for internal
-/// reference purposes and is not the same as the transaction's txid, although after v4
-/// transactions have been made invalid in a future network upgrade, the txid could
-/// potentially be used for this type (as it is non-malleable for v5+ transactions).
-///
-/// This procedure uses the wallet's underlying note selection algorithm to choose
-/// inputs of sufficient value to satisfy the request, if possible.
-///
-/// Do not call this multiple times in parallel, or you will generate transactions that
-/// double-spend the same notes.
-///
-/// # Transaction privacy
+/// Proposes making a payment to the specified address from the given account.
 ///
-/// `ovk_policy` specifies the desired policy for which outgoing viewing key should be
-/// able to decrypt the outputs of this transaction. This is primarily relevant to
-/// wallet recovery from backup; in particular, [`OvkPolicy::Discard`] will prevent the
-/// recipient's address, and the contents of `memo`, from ever being recovered from the
-/// block chain. (The total value sent can always be inferred by the sender from the spent
-/// notes and received change.)
+/// Returns the proposal, which may then be executed using [`create_proposed_transactions`].
+/// Depending upon the recipient address, more than one transaction may be constructed
+/// in the execution of the returned proposal.
 ///
-/// Regardless of the specified policy, `create_spend_to_address` saves `to`, `value`, and
-/// `memo` in `db_data`. This can be deleted independently of `ovk_policy`.
-///
-/// For details on what transaction information is visible to the holder of a full or
-/// outgoing viewing key, refer to [ZIP 310].
-///
-/// [ZIP 310]: https://zips.z.cash/zip-0310
+/// This method uses the basic [`GreedyInputSelector`] for input selection.
 ///
 /// Parameters:
-/// * `wallet_db`: A read/write reference to the wallet database
-/// * `params`: Consensus parameters
-/// * `prover`: The [`sapling::TxProver`] to use in constructing the shielded transaction.
-/// * `input_selector`: The [`InputSelector`] that will be used to select available
-///   inputs from the wallet database, choose change amounts and compute required
-///   transaction fees.
-/// * `usk`: The unified spending key that controls the funds that will be spent
+/// * `wallet_db`: A read/write reference to the wallet database.
+/// * `params`: Consensus parameters.
+/// * `fee_rule`: The fee rule to use in creating the transaction.
+/// * `spend_from_account`: The unified account that controls the funds that will be spent
 ///   in the resulting transaction. This procedure will return an error if the
-///   USK does not correspond to an account known to the wallet.
-/// * `request`: The ZIP-321 payment request specifying the recipients and amounts
-///   for the transaction.
-/// * `ovk_policy`: The policy to use for constructing outgoing viewing keys that
-///   can allow the sender to view the resulting notes on the blockchain.
+///   account ID does not correspond to an account known to the wallet.
 /// * `min_confirmations`: The minimum number of confirmations that a previously
 ///   received note must have in the blockchain in order to be considered for being
-///   spent. A value of 10 confirmations is recommended.
-///
-/// [`sapling::TxProver`]: zcash_primitives::sapling::prover::TxProver
+///   spent. A value of 10 confirmations is recommended and 0-conf transactions are
+///   not supported.
+/// * `to`: The address to which `amount` will be paid.
+/// * `amount`: The amount to send.
+/// * `memo`: A memo to be included in the output to the recipient.
+/// * `change_memo`: A memo to be included in any change output that is created.
+/// * `fallback_change_pool`: The shielded pool to which change should be sent if
+///   automatic change pool determination fails.
 #[allow(clippy::too_many_arguments)]
 #[allow(clippy::type_complexity)]
-pub fn spend<DbT, ParamsT, InputsT>(
+pub fn propose_standard_transfer_to_address<DbT, ParamsT, CommitmentTreeErrT>(
     wallet_db: &mut DbT,
     params: &ParamsT,
-    prover: impl SaplingProver,
-    input_selector: &InputsT,
-    usk: &UnifiedSpendingKey,
-    request: zip321::TransactionRequest,
-    ovk_policy: OvkPolicy,
-    min_confirmations: u32,
+    fee_rule: StandardFeeRule,
+    spend_from_account: <DbT as InputSource>::AccountId,
+    min_confirmations: NonZeroU32,
+    to: &Address,
+    amount: NonNegativeAmount,
+    memo: Option<MemoBytes>,
+    change_memo: Option<MemoBytes>,
+    fallback_change_pool: ShieldedProtocol,
 ) -> Result<
-    DbT::TxRef,
-    Error<DbT::Error, InputsT::Error, <InputsT::FeeRule as FeeRule>::Error, DbT::NoteRef>,
+    Proposal<StandardFeeRule, DbT::NoteRef>,
+    ProposeTransferErrT<
+        DbT,
+        CommitmentTreeErrT,
+        GreedyInputSelector<DbT>,
+        SingleOutputChangeStrategy<DbT>,
+    >,
 >
 where
-    DbT: WalletWrite,
-    DbT::TxRef: Copy + Debug,
-    DbT::NoteRef: Copy + Eq + Ord,
     ParamsT: consensus::Parameters + Clone,
-    InputsT: InputSelector<DataSource = DbT>,
+    DbT: InputSource,
+    DbT: WalletRead<
+        Error = <DbT as InputSource>::Error,
+        AccountId = <DbT as InputSource>::AccountId,
+    >,
+    DbT::NoteRef: Copy + Eq + Ord,
 {
-    let account = wallet_db
-        .get_account_for_ufvk(&usk.to_unified_full_viewing_key())
-        .map_err(Error::DataSource)?
-        .ok_or(Error::KeyNotRecognized)?;
+    let request = zip321::TransactionRequest::new(vec![Payment::new(
+        to.to_zcash_address(params),
+        amount,
+        memo,
+        None,
+        None,
+        vec![],
+    )
+    .ok_or(Error::MemoForbidden)?])
+    .expect(
+        "It should not be possible for this to violate ZIP 321 request construction invariants.",
+    );
+
+    let input_selector = GreedyInputSelector::<DbT>::new();
+    let change_strategy = SingleOutputChangeStrategy::<DbT>::new(
+        fee_rule,
+        change_memo,
+        fallback_change_pool,
+        DustOutputPolicy::default(),
+    );
 
-    let proposal = propose_transfer(
+    propose_transfer(
         wallet_db,
         params,
-        account,
-        input_selector,
+        spend_from_account,
+        &input_selector,
+        &change_strategy,
         request,
         min_confirmations,
-    )?;
-
-    create_proposed_transaction(wallet_db, params, prover, usk, ovk_policy, proposal, None)
-}
-
-/// Select transaction inputs, compute fees, and construct a proposal for a transaction
-/// that can then be authorized and made ready for submission to the network with
-/// [`create_proposed_transaction`].
-#[allow(clippy::too_many_arguments)]
-#[allow(clippy::type_complexity)]
-pub fn propose_transfer<DbT, ParamsT, InputsT>(
-    wallet_db: &mut DbT,
-    params: &ParamsT,
-    spend_from_account: AccountId,
-    input_selector: &InputsT,
-    request: zip321::TransactionRequest,
-    min_confirmations: u32,
-) -> Result<
-    Proposal<InputsT::FeeRule, DbT::NoteRef>,
-    Error<DbT::Error, InputsT::Error, <InputsT::FeeRule as FeeRule>::Error, DbT::NoteRef>,
->
-where
-    DbT: WalletWrite,
-    DbT::NoteRef: Copy + Eq + Ord,
-    ParamsT: consensus::Parameters + Clone,
-    InputsT: InputSelector<DataSource = DbT>,
-{
-    // Target the next block, assuming we are up-to-date.
-    let (target_height, anchor_height) = wallet_db
-        .get_target_and_anchor_heights(min_confirmations)
-        .map_err(Error::DataSource)
-        .and_then(|x| x.ok_or(Error::ScanRequired))?;
-
-    input_selector
-        .propose_transaction(
-            params,
-            wallet_db,
-            spend_from_account,
-            anchor_height,
-            target_height,
-            request,
-        )
-        .map_err(Error::from)
+    )
 }
 
+/// Constructs a proposal to shield all of the funds belonging to the provided set of
+/// addresses.
 #[cfg(feature = "transparent-inputs")]
 #[allow(clippy::too_many_arguments)]
 #[allow(clippy::type_complexity)]
-pub fn propose_shielding<DbT, ParamsT, InputsT>(
+pub fn propose_shielding<DbT, ParamsT, InputsT, ChangeT, CommitmentTreeErrT>(
     wallet_db: &mut DbT,
     params: &ParamsT,
     input_selector: &InputsT,
+    change_strategy: &ChangeT,
     shielding_threshold: NonNegativeAmount,
     from_addrs: &[TransparentAddress],
+    to_account: <DbT as InputSource>::AccountId,
     min_confirmations: u32,
 ) -> Result<
-    Proposal<InputsT::FeeRule, DbT::NoteRef>,
-    Error<DbT::Error, InputsT::Error, <InputsT::FeeRule as FeeRule>::Error, DbT::NoteRef>,
+    Proposal<ChangeT::FeeRule, Infallible>,
+    ProposeShieldingErrT<DbT, CommitmentTreeErrT, InputsT, ChangeT>,
 >
 where
     ParamsT: consensus::Parameters,
-    DbT: WalletWrite,
-    DbT::NoteRef: Copy + Eq + Ord,
-    InputsT: InputSelector<DataSource = DbT>,
+    DbT: WalletRead + InputSource<Error = <DbT as WalletRead>::Error>,
+    InputsT: ShieldingSelector<InputSource = DbT>,
+    ChangeT: ChangeStrategy<MetaSource = DbT>,
 {
-    let (target_height, latest_anchor) = wallet_db
-        .get_target_and_anchor_heights(min_confirmations)
-        .map_err(Error::DataSource)
-        .and_then(|x| x.ok_or(Error::ScanRequired))?;
+    let chain_tip_height = wallet_db
+        .chain_height()
+        .map_err(|e| Error::from(InputSelectorError::DataSource(e)))?
+        .ok_or_else(|| Error::from(InputSelectorError::SyncRequired))?;
 
     input_selector
         .propose_shielding(
             params,
             wallet_db,
+            change_strategy,
             shielding_threshold,
             from_addrs,
-            latest_anchor,
-            target_height,
+            to_account,
+            chain_tip_height + 1,
+            min_confirmations,
         )
         .map_err(Error::from)
 }
 
-/// Construct, prove, and sign a transaction using the inputs supplied by the given proposal,
-/// and persist it to the wallet database.
+struct StepResult<AccountId> {
+    build_result: BuildResult,
+    outputs: Vec<SentTransactionOutput<AccountId>>,
+    fee_amount: NonNegativeAmount,
+    #[cfg(feature = "transparent-inputs")]
+    utxos_spent: Vec<OutPoint>,
+}
+
+/// Construct, prove, and sign a transaction or series of transactions using the inputs supplied by
+/// the given proposal, and persist it to the wallet database.
 ///
-/// Returns the database identifier for the newly constructed transaction, or an error if
+/// Returns the database identifier for each newly constructed transaction, or an error if
 /// an error occurs in transaction construction, proving, or signing.
+///
+/// When evaluating multi-step proposals, only transparent outputs of any given step may be spent
+/// in later steps; attempting to spend a shielded note (including change) output by an earlier
+/// step is not supported, because the ultimate positions of those notes in the global note
+/// commitment tree cannot be known until the transaction that produces those notes is mined,
+/// and therefore the required spend proofs for such notes cannot be constructed.
 #[allow(clippy::too_many_arguments)]
 #[allow(clippy::type_complexity)]
-pub fn create_proposed_transaction<DbT, ParamsT, InputsErrT, FeeRuleT>(
+pub fn create_proposed_transactions<DbT, ParamsT, InputsErrT, FeeRuleT, ChangeErrT, N>(
     wallet_db: &mut DbT,
     params: &ParamsT,
-    prover: impl SaplingProver,
+    spend_prover: &impl SpendProver,
+    output_prover: &impl OutputProver,
     usk: &UnifiedSpendingKey,
     ovk_policy: OvkPolicy,
-    proposal: Proposal<FeeRuleT, DbT::NoteRef>,
-    change_memo: Option<MemoBytes>,
-) -> Result<DbT::TxRef, Error<DbT::Error, InputsErrT, FeeRuleT::Error, DbT::NoteRef>>
+    proposal: &Proposal<FeeRuleT, N>,
+) -> Result<NonEmpty<TxId>, CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>>
 where
-    DbT: WalletWrite,
-    DbT::TxRef: Copy + Debug,
-    DbT::NoteRef: Copy + Eq + Ord,
+    DbT: WalletWrite + WalletCommitmentTrees,
     ParamsT: consensus::Parameters + Clone,
     FeeRuleT: FeeRule,
 {
-    let account = wallet_db
+    // The set of transparent `StepOutput`s available and unused from prior steps.
+    // When a transparent `StepOutput` is created, it is added to the map. When it
+    // is consumed, it is removed from the map.
+    #[cfg(feature = "transparent-inputs")]
+    let mut unused_transparent_outputs = HashMap::new();
+
+    let account_id = wallet_db
         .get_account_for_ufvk(&usk.to_unified_full_viewing_key())
         .map_err(Error::DataSource)?
-        .ok_or(Error::KeyNotRecognized)?;
+        .ok_or(Error::KeyNotRecognized)?
+        .id();
 
-    let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
+    let mut step_results = Vec::with_capacity(proposal.steps().len());
+    for step in proposal.steps() {
+        let step_result: StepResult<_> = create_proposed_transaction(
+            wallet_db,
+            params,
+            spend_prover,
+            output_prover,
+            usk,
+            account_id,
+            ovk_policy.clone(),
+            proposal.fee_rule(),
+            proposal.min_target_height(),
+            &step_results,
+            step,
+            #[cfg(feature = "transparent-inputs")]
+            &mut unused_transparent_outputs,
+        )?;
+        step_results.push((step, step_result));
+    }
 
-    // Apply the outgoing viewing key policy.
-    let external_ovk = match ovk_policy {
-        OvkPolicy::Sender => Some(dfvk.to_ovk(Scope::External)),
-        OvkPolicy::Custom(ovk) => Some(ovk),
-        OvkPolicy::Discard => None,
-    };
+    // Ephemeral outputs must be referenced exactly once.
+    #[cfg(feature = "transparent-inputs")]
+    for so in unused_transparent_outputs.into_keys() {
+        if let StepOutputIndex::Change(i) = so.output_index() {
+            // references have already been checked
+            if step_results[so.step_index()].0.balance().proposed_change()[i].is_ephemeral() {
+                return Err(ProposalError::EphemeralOutputLeftUnspent(so).into());
+            }
+        }
+    }
 
-    let internal_ovk = || {
-        #[cfg(feature = "transparent-inputs")]
-        return if proposal.is_shielding() {
-            Some(OutgoingViewingKey(
-                usk.transparent()
-                    .to_account_pubkey()
-                    .internal_ovk()
-                    .as_bytes(),
-            ))
-        } else {
-            Some(dfvk.to_ovk(Scope::Internal))
-        };
+    let created = time::OffsetDateTime::now_utc();
+
+    // Store the transactions only after creating all of them. This avoids undesired
+    // retransmissions in case a transaction is stored and the creation of a subsequent
+    // transaction fails.
+    let mut transactions = Vec::with_capacity(proposal.steps().len());
+    let mut txids = Vec::with_capacity(proposal.steps().len());
+    #[allow(unused_variables)]
+    for (_, step_result) in step_results.iter() {
+        let tx = step_result.build_result.transaction();
+        transactions.push(SentTransaction::new(
+            tx,
+            created,
+            proposal.min_target_height(),
+            account_id,
+            &step_result.outputs,
+            step_result.fee_amount,
+            #[cfg(feature = "transparent-inputs")]
+            &step_result.utxos_spent,
+        ));
+        txids.push(tx.txid());
+    }
+
+    wallet_db
+        .store_transactions_to_be_sent(&transactions)
+        .map_err(Error::DataSource)?;
+
+    Ok(NonEmpty::from_vec(txids).expect("proposal.steps is NonEmpty"))
+}
+
+// `unused_transparent_outputs` maps `StepOutput`s for transparent outputs
+// that have not been consumed so far, to the corresponding pair of
+// `TransparentAddress` and `Outpoint`.
+#[allow(clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
+fn create_proposed_transaction<DbT, ParamsT, InputsErrT, FeeRuleT, ChangeErrT, N>(
+    wallet_db: &mut DbT,
+    params: &ParamsT,
+    spend_prover: &impl SpendProver,
+    output_prover: &impl OutputProver,
+    usk: &UnifiedSpendingKey,
+    account_id: <DbT as WalletRead>::AccountId,
+    ovk_policy: OvkPolicy,
+    fee_rule: &FeeRuleT,
+    min_target_height: BlockHeight,
+    prior_step_results: &[(&Step<N>, StepResult<<DbT as WalletRead>::AccountId>)],
+    proposal_step: &Step<N>,
+    #[cfg(feature = "transparent-inputs")] unused_transparent_outputs: &mut HashMap<
+        StepOutput,
+        (TransparentAddress, OutPoint),
+    >,
+) -> Result<
+    StepResult<<DbT as WalletRead>::AccountId>,
+    CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>,
+>
+where
+    DbT: WalletWrite + WalletCommitmentTrees,
+    ParamsT: consensus::Parameters + Clone,
+    FeeRuleT: FeeRule,
+{
+    #[cfg(feature = "transparent-inputs")]
+    let step_index = prior_step_results.len();
+
+    // We only support spending transparent payments or transparent ephemeral outputs from a
+    // prior step (when "transparent-inputs" is enabled).
+    //
+    // TODO: Maybe support spending prior shielded outputs at some point? Doing so would require
+    // a higher-level approach in the wallet that waits for transactions with shielded outputs to
+    // be mined and only then attempts to perform the next step.
+    #[allow(clippy::never_loop)]
+    for input_ref in proposal_step.prior_step_inputs() {
+        let (prior_step, _) = prior_step_results
+            .get(input_ref.step_index())
+            .ok_or(ProposalError::ReferenceError(*input_ref))?;
+
+        #[allow(unused_variables)]
+        let output_pool = match input_ref.output_index() {
+            StepOutputIndex::Payment(i) => prior_step.payment_pools().get(&i).cloned(),
+            StepOutputIndex::Change(i) => match prior_step.balance().proposed_change().get(i) {
+                Some(change) if !change.is_ephemeral() => {
+                    return Err(ProposalError::SpendsChange(*input_ref).into());
+                }
+                other => other.map(|change| change.output_pool()),
+            },
+        }
+        .ok_or(ProposalError::ReferenceError(*input_ref))?;
 
+        // Return an error on trying to spend a prior output that is not supported.
+        #[cfg(feature = "transparent-inputs")]
+        if output_pool != PoolType::TRANSPARENT {
+            return Err(Error::ProposalNotSupported);
+        }
         #[cfg(not(feature = "transparent-inputs"))]
-        Some(dfvk.to_ovk(Scope::Internal))
+        return Err(Error::ProposalNotSupported);
+    }
+
+    let (sapling_anchor, sapling_inputs) = if proposal_step
+        .involves(PoolType::Shielded(ShieldedProtocol::Sapling))
+    {
+        proposal_step.shielded_inputs().map_or_else(
+            || Ok((Some(sapling::Anchor::empty_tree()), vec![])),
+            |inputs| {
+                wallet_db.with_sapling_tree_mut::<_, _, Error<_, _, _, _, _, _>>(|sapling_tree| {
+                    let anchor = sapling_tree
+                        .root_at_checkpoint_id(&inputs.anchor_height())?
+                        .ok_or(ProposalError::AnchorNotFound(inputs.anchor_height()))?
+                        .into();
+
+                    let sapling_inputs = inputs
+                        .notes()
+                        .iter()
+                        .filter_map(|selected| match selected.note() {
+                            Note::Sapling(note) => {
+                                let key = match selected.spending_key_scope() {
+                                    Scope::External => usk.sapling().clone(),
+                                    Scope::Internal => usk.sapling().derive_internal(),
+                                };
+
+                                sapling_tree
+                                    .witness_at_checkpoint_id_caching(
+                                        selected.note_commitment_tree_position(),
+                                        &inputs.anchor_height(),
+                                    )
+                                    .and_then(|witness| {
+                                        witness.ok_or(ShardTreeError::Query(
+                                            QueryError::CheckpointPruned,
+                                        ))
+                                    })
+                                    .map(|merkle_path| Some((key, note, merkle_path)))
+                                    .map_err(Error::from)
+                                    .transpose()
+                            }
+                            #[cfg(feature = "orchard")]
+                            Note::Orchard(_) => None,
+                        })
+                        .collect::<Result<Vec<_>, Error<_, _, _, _, _, _>>>()?;
+
+                    Ok((Some(anchor), sapling_inputs))
+                })
+            },
+        )?
+    } else {
+        (None, vec![])
+    };
+
+    #[cfg(feature = "orchard")]
+    let (orchard_anchor, orchard_inputs) = if proposal_step
+        .involves(PoolType::Shielded(ShieldedProtocol::Orchard))
+    {
+        proposal_step.shielded_inputs().map_or_else(
+            || Ok((Some(orchard::Anchor::empty_tree()), vec![])),
+            |inputs| {
+                wallet_db.with_orchard_tree_mut::<_, _, Error<_, _, _, _, _, _>>(|orchard_tree| {
+                    let anchor = orchard_tree
+                        .root_at_checkpoint_id(&inputs.anchor_height())?
+                        .ok_or(ProposalError::AnchorNotFound(inputs.anchor_height()))?
+                        .into();
+
+                    let orchard_inputs = inputs
+                        .notes()
+                        .iter()
+                        .filter_map(|selected| match selected.note() {
+                            #[cfg(feature = "orchard")]
+                            Note::Orchard(note) => orchard_tree
+                                .witness_at_checkpoint_id_caching(
+                                    selected.note_commitment_tree_position(),
+                                    &inputs.anchor_height(),
+                                )
+                                .and_then(|witness| {
+                                    witness
+                                        .ok_or(ShardTreeError::Query(QueryError::CheckpointPruned))
+                                })
+                                .map(|merkle_path| Some((note, merkle_path)))
+                                .map_err(Error::from)
+                                .transpose(),
+                            Note::Sapling(_) => None,
+                        })
+                        .collect::<Result<Vec<_>, Error<_, _, _, _, _, _>>>()?;
+
+                    Ok((Some(anchor), orchard_inputs))
+                })
+            },
+        )?
+    } else {
+        (None, vec![])
     };
+    #[cfg(not(feature = "orchard"))]
+    let orchard_anchor = None;
 
     // Create the transaction. The type of the proposal ensures that there
-    // are no possible transparent inputs, so we ignore those
-    let mut builder = Builder::new(params.clone(), proposal.target_height());
+    // are no possible transparent inputs, so we ignore those here.
+    let mut builder = Builder::new(
+        params.clone(),
+        min_target_height,
+        BuildConfig::Standard {
+            sapling_anchor,
+            orchard_anchor,
+        },
+    );
 
-    for selected in proposal.sapling_inputs() {
-        let (note, key, merkle_path) = select_key_for_note(selected, usk.sapling(), &dfvk)
-            .ok_or(Error::NoteMismatch(selected.note_id))?;
+    #[cfg(all(feature = "transparent-inputs", not(feature = "orchard")))]
+    let has_shielded_inputs = !sapling_inputs.is_empty();
+    #[cfg(all(feature = "transparent-inputs", feature = "orchard"))]
+    let has_shielded_inputs = !(sapling_inputs.is_empty() && orchard_inputs.is_empty());
+
+    for (sapling_key, sapling_note, merkle_path) in sapling_inputs.into_iter() {
+        builder.add_sapling_spend(&sapling_key, sapling_note.clone(), merkle_path)?;
+    }
 
-        builder.add_sapling_spend(key, selected.diversifier, note, merkle_path)?;
+    #[cfg(feature = "orchard")]
+    for (orchard_note, merkle_path) in orchard_inputs.into_iter() {
+        builder.add_orchard_spend(usk.orchard(), *orchard_note, merkle_path.into())?;
     }
 
     #[cfg(feature = "transparent-inputs")]
-    let utxos = {
-        let known_addrs = wallet_db
-            .get_transparent_receivers(account)
-            .map_err(Error::DataSource)?;
+    let mut cache = HashMap::<TransparentAddress, TransparentAddressMetadata>::new();
+
+    #[cfg(feature = "transparent-inputs")]
+    let mut metadata_from_address = |addr: TransparentAddress| -> Result<
+        TransparentAddressMetadata,
+        CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>,
+    > {
+        match cache.get(&addr) {
+            Some(result) => Ok(result.clone()),
+            None => {
+                // `wallet_db.get_transparent_address_metadata` includes reserved ephemeral
+                // addresses in its lookup. We don't need to include these in order to be
+                // able to construct ZIP 320 transactions, because in that case the ephemeral
+                // output is represented via a "change" reference to a previous step. However,
+                // we do need them in order to create a transaction from a proposal that
+                // explicitly spends an output from an ephemeral address (only for outputs
+                // already detected by this wallet instance).
 
-        let mut utxos: Vec<WalletTransparentOutput> = vec![];
-        for utxo in proposal.transparent_inputs() {
-            utxos.push(utxo.clone());
+                let result = wallet_db
+                    .get_transparent_address_metadata(account_id, &addr)
+                    .map_err(InputSelectorError::DataSource)?
+                    .ok_or(Error::AddressNotRecognized(addr))?;
+                cache.insert(addr, result.clone());
+                Ok(result)
+            }
+        }
+    };
 
-            let diversifier_index = known_addrs
-                .get(utxo.recipient_address())
-                .ok_or_else(|| Error::AddressNotRecognized(*utxo.recipient_address()))?
-                .diversifier_index();
+    #[cfg(feature = "transparent-inputs")]
+    let utxos_spent = {
+        let mut utxos_spent: Vec<OutPoint> = vec![];
+        let add_transparent_input =
+            |builder: &mut Builder<_, _>,
+             utxos_spent: &mut Vec<_>,
+             address_metadata: &TransparentAddressMetadata,
+             outpoint: OutPoint,
+             txout: TxOut|
+             -> Result<(), CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>> {
+                let secret_key = usk
+                    .transparent()
+                    .derive_secret_key(address_metadata.scope(), address_metadata.address_index())
+                    .expect("spending key derivation should not fail");
 
-            let child_index = u32::try_from(*diversifier_index)
-                .map_err(|_| Error::ChildIndexOutOfRange(*diversifier_index))?;
+                utxos_spent.push(outpoint.clone());
+                builder.add_transparent_input(secret_key, outpoint, txout)?;
 
-            let secret_key = usk
-                .transparent()
-                .derive_external_secret_key(child_index)
-                .unwrap();
+                Ok(())
+            };
 
-            builder.add_transparent_input(
-                secret_key,
+        for utxo in proposal_step.transparent_inputs() {
+            add_transparent_input(
+                &mut builder,
+                &mut utxos_spent,
+                &metadata_from_address(*utxo.recipient_address())?,
                 utxo.outpoint().clone(),
                 utxo.txout().clone(),
             )?;
         }
-        utxos
+        for input_ref in proposal_step.prior_step_inputs() {
+            // A referenced transparent step output must exist and be referenced *at most* once.
+            // (Exactly once in the case of ephemeral outputs.)
+            let (address, outpoint) = unused_transparent_outputs
+                .remove(input_ref)
+                .ok_or(Error::Proposal(ProposalError::ReferenceError(*input_ref)))?;
+
+            let address_metadata = metadata_from_address(address)?;
+
+            let txout = &prior_step_results[input_ref.step_index()]
+                .1
+                .build_result
+                .transaction()
+                .transparent_bundle()
+                .ok_or(ProposalError::ReferenceError(*input_ref))?
+                .vout[outpoint.n() as usize];
+
+            add_transparent_input(
+                &mut builder,
+                &mut utxos_spent,
+                &address_metadata,
+                outpoint,
+                txout.clone(),
+            )?;
+        }
+        utxos_spent
     };
 
-    let mut sapling_output_meta = vec![];
-    let mut transparent_output_meta = vec![];
-    for payment in proposal.transaction_request().payments() {
-        match &payment.recipient_address {
-            RecipientAddress::Unified(ua) => {
-                builder.add_sapling_output(
-                    external_ovk,
-                    *ua.sapling().expect("TODO: Add Orchard support to builder"),
-                    payment.amount,
-                    payment.memo.clone().unwrap_or_else(MemoBytes::empty),
+    #[cfg(feature = "orchard")]
+    let orchard_fvk: orchard::keys::FullViewingKey = usk.orchard().into();
+
+    #[cfg(feature = "orchard")]
+    let orchard_external_ovk = match &ovk_policy {
+        OvkPolicy::Sender => Some(orchard_fvk.to_ovk(orchard::keys::Scope::External)),
+        OvkPolicy::Custom { orchard, .. } => Some(orchard.clone()),
+        OvkPolicy::Discard => None,
+    };
+
+    #[cfg(feature = "orchard")]
+    let orchard_internal_ovk = || {
+        #[cfg(feature = "transparent-inputs")]
+        if proposal_step.is_shielding() {
+            return Some(orchard::keys::OutgoingViewingKey::from(
+                usk.transparent()
+                    .to_account_pubkey()
+                    .internal_ovk()
+                    .as_bytes(),
+            ));
+        }
+
+        Some(orchard_fvk.to_ovk(Scope::Internal))
+    };
+
+    let sapling_dfvk = usk.sapling().to_diversifiable_full_viewing_key();
+
+    // Apply the outgoing viewing key policy.
+    let sapling_external_ovk = match &ovk_policy {
+        OvkPolicy::Sender => Some(sapling_dfvk.to_ovk(Scope::External)),
+        OvkPolicy::Custom { sapling, .. } => Some(*sapling),
+        OvkPolicy::Discard => None,
+    };
+
+    let sapling_internal_ovk = || {
+        #[cfg(feature = "transparent-inputs")]
+        if proposal_step.is_shielding() {
+            return Some(sapling::keys::OutgoingViewingKey(
+                usk.transparent()
+                    .to_account_pubkey()
+                    .internal_ovk()
+                    .as_bytes(),
+            ));
+        }
+
+        Some(sapling_dfvk.to_ovk(Scope::Internal))
+    };
+
+    #[cfg(feature = "orchard")]
+    let mut orchard_output_meta: Vec<(
+        Recipient<_, PoolType, _>,
+        NonNegativeAmount,
+        Option<MemoBytes>,
+    )> = vec![];
+    let mut sapling_output_meta: Vec<(
+        Recipient<_, PoolType, _>,
+        NonNegativeAmount,
+        Option<MemoBytes>,
+    )> = vec![];
+    let mut transparent_output_meta: Vec<(
+        Recipient<_, _, ()>,
+        TransparentAddress,
+        NonNegativeAmount,
+        StepOutputIndex,
+    )> = vec![];
+
+    for (&payment_index, output_pool) in proposal_step.payment_pools() {
+        let payment = proposal_step
+            .transaction_request()
+            .payments()
+            .get(&payment_index)
+            .expect(
+                "The mapping between payment index and payment is checked in step construction",
+            );
+        let recipient_address = payment.recipient_address();
+
+        let add_sapling_output = |builder: &mut Builder<_, _>,
+                                  sapling_output_meta: &mut Vec<_>,
+                                  to: sapling::PaymentAddress|
+         -> Result<
+            (),
+            CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>,
+        > {
+            let memo = payment.memo().map_or_else(MemoBytes::empty, |m| m.clone());
+            builder.add_sapling_output(sapling_external_ovk, to, payment.amount(), memo.clone())?;
+            sapling_output_meta.push((
+                Recipient::External(recipient_address.clone(), PoolType::SAPLING),
+                payment.amount(),
+                Some(memo),
+            ));
+            Ok(())
+        };
+
+        #[cfg(feature = "orchard")]
+        let add_orchard_output =
+            |builder: &mut Builder<_, _>,
+             orchard_output_meta: &mut Vec<_>,
+             to: orchard::Address|
+             -> Result<(), CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>> {
+                let memo = payment.memo().map_or_else(MemoBytes::empty, |m| m.clone());
+                builder.add_orchard_output(
+                    orchard_external_ovk.clone(),
+                    to,
+                    payment.amount().into(),
+                    memo.clone(),
                 )?;
-                sapling_output_meta.push((
-                    Recipient::Unified(ua.clone(), PoolType::Sapling),
-                    payment.amount,
-                    payment.memo.clone(),
+                orchard_output_meta.push((
+                    Recipient::External(recipient_address.clone(), PoolType::ORCHARD),
+                    payment.amount(),
+                    Some(memo),
                 ));
-            }
-            RecipientAddress::Shielded(addr) => {
-                builder.add_sapling_output(
-                    external_ovk,
-                    *addr,
-                    payment.amount,
-                    payment.memo.clone().unwrap_or_else(MemoBytes::empty),
-                )?;
-                sapling_output_meta.push((
-                    Recipient::Sapling(*addr),
-                    payment.amount,
-                    payment.memo.clone(),
+                Ok(())
+            };
+
+        let add_transparent_output =
+            |builder: &mut Builder<_, _>,
+             transparent_output_meta: &mut Vec<_>,
+             to: TransparentAddress|
+             -> Result<(), CreateErrT<DbT, InputsErrT, FeeRuleT, ChangeErrT, N>> {
+                // Always reject sending to one of our known ephemeral addresses.
+                #[cfg(feature = "transparent-inputs")]
+                if wallet_db
+                    .find_account_for_ephemeral_address(&to)
+                    .map_err(Error::DataSource)?
+                    .is_some()
+                {
+                    return Err(Error::PaysEphemeralTransparentAddress(to.encode(params)));
+                }
+                if payment.memo().is_some() {
+                    return Err(Error::MemoForbidden);
+                }
+                builder.add_transparent_output(&to, payment.amount())?;
+                transparent_output_meta.push((
+                    Recipient::External(recipient_address.clone(), PoolType::TRANSPARENT),
+                    to,
+                    payment.amount(),
+                    StepOutputIndex::Payment(payment_index),
                 ));
+                Ok(())
+            };
+
+        match recipient_address
+            .clone()
+            .convert_if_network(params.network_type())?
+        {
+            Address::Unified(ua) => match output_pool {
+                #[cfg(not(feature = "orchard"))]
+                PoolType::Shielded(ShieldedProtocol::Orchard) => {
+                    return Err(Error::ProposalNotSupported);
+                }
+                #[cfg(feature = "orchard")]
+                PoolType::Shielded(ShieldedProtocol::Orchard) => {
+                    let to = *ua.orchard().expect("The mapping between payment pool and receiver is checked in step construction");
+                    add_orchard_output(&mut builder, &mut orchard_output_meta, to)?;
+                }
+                PoolType::Shielded(ShieldedProtocol::Sapling) => {
+                    let to = *ua.sapling().expect("The mapping between payment pool and receiver is checked in step construction");
+                    add_sapling_output(&mut builder, &mut sapling_output_meta, to)?;
+                }
+                PoolType::Transparent => {
+                    let to = *ua.transparent().expect("The mapping between payment pool and receiver is checked in step construction");
+                    add_transparent_output(&mut builder, &mut transparent_output_meta, to)?;
+                }
+            },
+            Address::Sapling(to) => {
+                add_sapling_output(&mut builder, &mut sapling_output_meta, to)?;
             }
-            RecipientAddress::Transparent(to) => {
-                if payment.memo.is_some() {
-                    return Err(Error::MemoForbidden);
-                } else {
-                    builder.add_transparent_output(to, payment.amount)?;
+            Address::Transparent(to) => {
+                add_transparent_output(&mut builder, &mut transparent_output_meta, to)?;
+            }
+            #[cfg(not(feature = "transparent-inputs"))]
+            Address::Tex(_) => {
+                return Err(Error::ProposalNotSupported);
+            }
+            #[cfg(feature = "transparent-inputs")]
+            Address::Tex(data) => {
+                if has_shielded_inputs {
+                    return Err(ProposalError::PaysTexFromShielded.into());
                 }
-                transparent_output_meta.push((*to, payment.amount));
+                let to = TransparentAddress::PublicKeyHash(data);
+                add_transparent_output(&mut builder, &mut transparent_output_meta, to)?;
             }
         }
     }
 
-    for change_value in proposal.balance().proposed_change() {
-        match change_value {
-            ChangeValue::Sapling(amount) => {
+    for change_value in proposal_step.balance().proposed_change() {
+        let memo = change_value
+            .memo()
+            .map_or_else(MemoBytes::empty, |m| m.clone());
+        let output_pool = change_value.output_pool();
+        match output_pool {
+            PoolType::Shielded(ShieldedProtocol::Sapling) => {
                 builder.add_sapling_output(
-                    internal_ovk(),
-                    dfvk.change_address().1,
-                    *amount,
-                    MemoBytes::empty(),
+                    sapling_internal_ovk(),
+                    sapling_dfvk.change_address().1,
+                    change_value.value(),
+                    memo.clone(),
                 )?;
                 sapling_output_meta.push((
-                    Recipient::InternalAccount(account, PoolType::Sapling),
-                    *amount,
-                    change_memo.clone(),
+                    Recipient::InternalAccount {
+                        receiving_account: account_id,
+                        external_address: None,
+                        note: output_pool,
+                    },
+                    change_value.value(),
+                    Some(memo),
                 ))
             }
+            PoolType::Shielded(ShieldedProtocol::Orchard) => {
+                #[cfg(not(feature = "orchard"))]
+                return Err(Error::UnsupportedChangeType(output_pool));
+
+                #[cfg(feature = "orchard")]
+                {
+                    builder.add_orchard_output(
+                        orchard_internal_ovk(),
+                        orchard_fvk.address_at(0u32, orchard::keys::Scope::Internal),
+                        change_value.value().into(),
+                        memo.clone(),
+                    )?;
+                    orchard_output_meta.push((
+                        Recipient::InternalAccount {
+                            receiving_account: account_id,
+                            external_address: None,
+                            note: output_pool,
+                        },
+                        change_value.value(),
+                        Some(memo),
+                    ))
+                }
+            }
+            PoolType::Transparent => {
+                #[cfg(not(feature = "transparent-inputs"))]
+                return Err(Error::UnsupportedChangeType(output_pool));
+            }
+        }
+    }
+
+    // This reserves the ephemeral addresses even if transaction construction fails.
+    // It is not worth the complexity of being able to unreserve them, because there
+    // are few failure modes after this point that would allow us to do so.
+    #[cfg(feature = "transparent-inputs")]
+    {
+        let ephemeral_outputs: Vec<(usize, &ChangeValue)> = proposal_step
+            .balance()
+            .proposed_change()
+            .iter()
+            .enumerate()
+            .filter(|(_, change_value)| {
+                change_value.is_ephemeral() && change_value.output_pool() == PoolType::Transparent
+            })
+            .collect();
+
+        let addresses_and_metadata = wallet_db
+            .reserve_next_n_ephemeral_addresses(account_id, ephemeral_outputs.len())
+            .map_err(Error::DataSource)?;
+        assert_eq!(addresses_and_metadata.len(), ephemeral_outputs.len());
+
+        // We don't need the TransparentAddressMetadata here; we can look it up from the data source later.
+        for ((change_index, change_value), (ephemeral_address, _)) in
+            ephemeral_outputs.iter().zip(addresses_and_metadata)
+        {
+            // This output is ephemeral; we will report an error in `create_proposed_transactions`
+            // if a later step does not consume it.
+            builder.add_transparent_output(&ephemeral_address, change_value.value())?;
+            transparent_output_meta.push((
+                Recipient::EphemeralTransparent {
+                    receiving_account: account_id,
+                    ephemeral_address,
+                    outpoint_metadata: (),
+                },
+                ephemeral_address,
+                change_value.value(),
+                StepOutputIndex::Change(*change_index),
+            ))
         }
     }
 
     // Build the transaction with the specified fee rule
-    let (tx, sapling_build_meta) = builder.build(&prover, proposal.fee_rule())?;
+    let build_result = builder.build(OsRng, spend_prover, output_prover, fee_rule)?;
+
+    #[cfg(feature = "orchard")]
+    let orchard_internal_ivk = orchard_fvk.to_ivk(orchard::keys::Scope::Internal);
+    #[cfg(feature = "orchard")]
+    let orchard_outputs =
+        orchard_output_meta
+            .into_iter()
+            .enumerate()
+            .map(|(i, (recipient, value, memo))| {
+                let output_index = build_result
+                    .orchard_meta()
+                    .output_action_index(i)
+                    .expect("An action should exist in the transaction for each Orchard output.");
+
+                let recipient = recipient
+                    .map_internal_account_note(|pool| {
+                        assert!(pool == PoolType::ORCHARD);
+                        build_result
+                            .transaction()
+                            .orchard_bundle()
+                            .and_then(|bundle| {
+                                bundle
+                                    .decrypt_output_with_key(output_index, &orchard_internal_ivk)
+                                    .map(|(note, _, _)| Note::Orchard(note))
+                            })
+                    })
+                    .internal_account_note_transpose_option()
+                    .expect("Wallet-internal outputs must be decryptable with the wallet's IVK");
 
-    let internal_ivk = PreparedIncomingViewingKey::new(&dfvk.to_ivk(Scope::Internal));
+                SentTransactionOutput::from_parts(output_index, recipient, value, memo)
+            });
+
+    let sapling_internal_ivk =
+        PreparedIncomingViewingKey::new(&sapling_dfvk.to_ivk(Scope::Internal));
     let sapling_outputs =
         sapling_output_meta
             .into_iter()
             .enumerate()
             .map(|(i, (recipient, value, memo))| {
-                let output_index = sapling_build_meta
+                let output_index = build_result
+                    .sapling_meta()
                     .output_index(i)
-                    .expect("An output should exist in the transaction for each shielded payment.");
-
-                let received_as =
-                    if let Recipient::InternalAccount(account, PoolType::Sapling) = recipient {
-                        tx.sapling_bundle().and_then(|bundle| {
-                            try_sapling_note_decryption(
-                                params,
-                                proposal.target_height(),
-                                &internal_ivk,
-                                &bundle.shielded_outputs()[output_index],
-                            )
-                            .map(|(note, _, _)| (account, note))
-                        })
-                    } else {
-                        None
-                    };
+                    .expect("An output should exist in the transaction for each Sapling payment.");
 
-                SentTransactionOutput::from_parts(output_index, recipient, value, memo, received_as)
+                let recipient = recipient
+                    .map_internal_account_note(|pool| {
+                        assert!(pool == PoolType::SAPLING);
+                        build_result
+                            .transaction()
+                            .sapling_bundle()
+                            .and_then(|bundle| {
+                                try_sapling_note_decryption(
+                                    &sapling_internal_ivk,
+                                    &bundle.shielded_outputs()[output_index],
+                                    zip212_enforcement(params, min_target_height),
+                                )
+                                .map(|(note, _, _)| Note::Sapling(note))
+                            })
+                    })
+                    .internal_account_note_transpose_option()
+                    .expect("Wallet-internal outputs must be decryptable with the wallet's IVK");
+
+                SentTransactionOutput::from_parts(output_index, recipient, value, memo)
             });
 
-    let transparent_outputs = transparent_output_meta.into_iter().map(|(addr, value)| {
-        let script = addr.script();
-        let output_index = tx
+    let txid: [u8; 32] = build_result.transaction().txid().into();
+    assert_eq!(
+        transparent_output_meta.len(),
+        build_result
+            .transaction()
             .transparent_bundle()
-            .and_then(|b| {
-                b.vout
-                    .iter()
-                    .enumerate()
-                    .find(|(_, tx_out)| tx_out.script_pubkey == script)
-            })
-            .map(|(index, _)| index)
-            .expect("An output should exist in the transaction for each transparent payment.");
-
-        SentTransactionOutput::from_parts(
-            output_index,
-            Recipient::Transparent(addr),
-            value,
-            None,
-            None,
-        )
-    });
+            .map_or(0, |b| b.vout.len()),
+    );
 
-    wallet_db
-        .store_sent_tx(&SentTransaction {
-            tx: &tx,
-            created: time::OffsetDateTime::now_utc(),
-            account,
-            outputs: sapling_outputs.chain(transparent_outputs).collect(),
-            fee_amount: proposal.balance().fee_required(),
+    #[allow(unused_variables)]
+    let transparent_outputs = transparent_output_meta.into_iter().enumerate().map(
+        |(n, (recipient, address, value, step_output_index))| {
+            // This assumes that transparent outputs are pushed onto `transparent_output_meta`
+            // with the same indices they have in the transaction's transparent outputs.
+            // We do not reorder transparent outputs; there is no reason to do so because it
+            // would not usefully improve privacy.
+            let outpoint = OutPoint::new(txid, n as u32);
+
+            let recipient = recipient.map_ephemeral_transparent_outpoint(|()| outpoint.clone());
             #[cfg(feature = "transparent-inputs")]
-            utxos_spent: utxos.iter().map(|utxo| utxo.outpoint().clone()).collect(),
-        })
-        .map_err(Error::DataSource)
+            unused_transparent_outputs.insert(
+                StepOutput::new(step_index, step_output_index),
+                (address, outpoint),
+            );
+            SentTransactionOutput::from_parts(n, recipient, value, None)
+        },
+    );
+
+    let mut outputs: Vec<SentTransactionOutput<_>> = vec![];
+    #[cfg(feature = "orchard")]
+    outputs.extend(orchard_outputs);
+    outputs.extend(sapling_outputs);
+    outputs.extend(transparent_outputs);
+
+    Ok(StepResult {
+        build_result,
+        outputs,
+        fee_amount: proposal_step.balance().fee_required(),
+        #[cfg(feature = "transparent-inputs")]
+        utxos_spent,
+    })
 }
 
-/// Constructs a transaction that consumes available transparent UTXOs belonging to
-/// the specified secret key, and sends them to the default address for the provided Sapling
-/// extended full viewing key.
+/// Constructs a transaction that consumes available transparent UTXOs belonging to the specified
+/// secret key, and sends them to the most-preferred receiver of the default internal address for
+/// the provided Unified Spending Key.
 ///
 /// This procedure will not attempt to shield transparent funds if the total amount being shielded
-/// is less than the default fee to send the transaction. Fees will be paid only from the transparent
-/// UTXOs being consumed.
+/// is less than the default fee to send the transaction. Fees will be paid only from the
+/// transparent UTXOs being consumed.
 ///
 /// Parameters:
 /// * `wallet_db`: A read/write reference to the wallet database
 /// * `params`: Consensus parameters
-/// * `prover`: The [`sapling::TxProver`] to use in constructing the shielded transaction.
+/// * `spend_prover`: The [`sapling::SpendProver`] to use in constructing the shielded
+///   transaction.
+/// * `output_prover`: The [`sapling::OutputProver`] to use in constructing the shielded
+///   transaction.
 /// * `input_selector`: The [`InputSelector`] to for note selection and change and fee
 ///   determination
 /// * `usk`: The unified spending key that will be used to detect and spend transparent UTXOs,
@@ -648,82 +1137,53 @@ where
 /// * `from_addrs`: The list of transparent addresses that will be used to filter transaparent
 ///   UTXOs received by the wallet. Only UTXOs received at one of the provided addresses will
 ///   be selected to be shielded.
-/// * `memo`: A memo to be included in the output to the (internal) recipient.
-///   This can be used to take notes about auto-shielding operations internal
-///   to the wallet that the wallet can use to improve how it represents those
-///   shielding transactions to the user.
 /// * `min_confirmations`: The minimum number of confirmations that a previously
-///   received UTXO must have in the blockchain in order to be considered for being
-///   spent.
+///   received note must have in the blockchain in order to be considered for being
+///   spent. A value of 10 confirmations is recommended and 0-conf transactions are
+///   not supported.
 ///
-/// [`sapling::TxProver`]: zcash_primitives::sapling::prover::TxProver
+/// [`sapling::SpendProver`]: sapling::prover::SpendProver
+/// [`sapling::OutputProver`]: sapling::prover::OutputProver
 #[cfg(feature = "transparent-inputs")]
 #[allow(clippy::too_many_arguments)]
 #[allow(clippy::type_complexity)]
-pub fn shield_transparent_funds<DbT, ParamsT, InputsT>(
+pub fn shield_transparent_funds<DbT, ParamsT, InputsT, ChangeT>(
     wallet_db: &mut DbT,
     params: &ParamsT,
-    prover: impl SaplingProver,
+    spend_prover: &impl SpendProver,
+    output_prover: &impl OutputProver,
     input_selector: &InputsT,
+    change_strategy: &ChangeT,
     shielding_threshold: NonNegativeAmount,
     usk: &UnifiedSpendingKey,
     from_addrs: &[TransparentAddress],
-    memo: &MemoBytes,
+    to_account: <DbT as InputSource>::AccountId,
     min_confirmations: u32,
-) -> Result<
-    DbT::TxRef,
-    Error<DbT::Error, InputsT::Error, <InputsT::FeeRule as FeeRule>::Error, DbT::NoteRef>,
->
+) -> Result<NonEmpty<TxId>, ShieldErrT<DbT, InputsT, ChangeT>>
 where
     ParamsT: consensus::Parameters,
-    DbT: WalletWrite,
-    DbT::NoteRef: Copy + Eq + Ord,
-    InputsT: InputSelector<DataSource = DbT>,
+    DbT: WalletWrite + WalletCommitmentTrees + InputSource<Error = <DbT as WalletRead>::Error>,
+    InputsT: ShieldingSelector<InputSource = DbT>,
+    ChangeT: ChangeStrategy<MetaSource = DbT>,
 {
     let proposal = propose_shielding(
         wallet_db,
         params,
         input_selector,
+        change_strategy,
         shielding_threshold,
         from_addrs,
+        to_account,
         min_confirmations,
     )?;
 
-    create_proposed_transaction(
+    create_proposed_transactions(
         wallet_db,
         params,
-        prover,
+        spend_prover,
+        output_prover,
         usk,
         OvkPolicy::Sender,
-        proposal,
-        Some(memo.clone()),
+        &proposal,
     )
 }
-
-fn select_key_for_note<N>(
-    selected: &ReceivedSaplingNote<N>,
-    extsk: &ExtendedSpendingKey,
-    dfvk: &DiversifiableFullViewingKey,
-) -> Option<(sapling::Note, ExtendedSpendingKey, sapling::MerklePath)> {
-    let merkle_path = selected.witness.path().expect("the tree is not empty");
-
-    // Attempt to reconstruct the note being spent using both the internal and external dfvks
-    // corresponding to the unified spending key, checking against the witness we are using
-    // to spend the note that we've used the correct key.
-    let external_note = dfvk
-        .diversified_address(selected.diversifier)
-        .map(|addr| addr.create_note(selected.note_value.into(), selected.rseed));
-    let internal_note = dfvk
-        .diversified_change_address(selected.diversifier)
-        .map(|addr| addr.create_note(selected.note_value.into(), selected.rseed));
-
-    let expected_root = selected.witness.root();
-    external_note
-        .filter(|n| expected_root == merkle_path.root(Node::from_cmu(&n.cmu())))
-        .map(|n| (n, extsk.clone(), merkle_path.clone()))
-        .or_else(|| {
-            internal_note
-                .filter(|n| expected_root == merkle_path.root(Node::from_cmu(&n.cmu())))
-                .map(|n| (n, extsk.derive_internal(), merkle_path))
-        })
-}
diff --git a/zcash_client_backend/src/data_api/wallet/input_selection.rs b/zcash_client_backend/src/data_api/wallet/input_selection.rs
index 798b834501..09cbf7e99d 100644
--- a/zcash_client_backend/src/data_api/wallet/input_selection.rs
+++ b/zcash_client_backend/src/data_api/wallet/input_selection.rs
@@ -1,43 +1,74 @@
 //! Types related to the process of selecting inputs to be spent given a transaction request.
 
 use core::marker::PhantomData;
-use std::collections::BTreeSet;
-use std::fmt;
+use std::{
+    collections::BTreeMap,
+    error,
+    fmt::{self, Debug, Display},
+};
 
+use nonempty::NonEmpty;
+use zcash_address::ConversionError;
 use zcash_primitives::{
     consensus::{self, BlockHeight},
-    legacy::TransparentAddress,
-    transaction::{
-        components::{
-            amount::{Amount, BalanceError, NonNegativeAmount},
-            sapling::fees as sapling,
-            OutPoint, TxOut,
-        },
-        fees::FeeRule,
+    transaction::components::{
+        amount::{BalanceError, NonNegativeAmount},
+        TxOut,
     },
-    zip32::AccountId,
 };
 
 use crate::{
-    address::{RecipientAddress, UnifiedAddress},
-    data_api::WalletRead,
-    fees::{ChangeError, ChangeStrategy, DustOutputPolicy, TransactionBalance},
-    wallet::{ReceivedSaplingNote, WalletTransparentOutput},
+    address::{Address, UnifiedAddress},
+    data_api::{InputSource, SimpleNoteRetention, SpendableNotes},
+    fees::{sapling, ChangeError, ChangeStrategy},
+    proposal::{Proposal, ProposalError, ShieldedInputs},
+    wallet::WalletTransparentOutput,
     zip321::TransactionRequest,
+    PoolType, ShieldedProtocol,
+};
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    crate::{
+        fees::EphemeralBalance,
+        proposal::{Step, StepOutput, StepOutputIndex},
+        zip321::Payment,
+    },
+    std::collections::BTreeSet,
+    std::convert::Infallible,
+    zcash_primitives::{legacy::TransparentAddress, transaction::components::OutPoint},
 };
 
+#[cfg(feature = "orchard")]
+use crate::fees::orchard as orchard_fees;
+
 /// The type of errors that may be produced in input selection.
-pub enum InputSelectorError<DbErrT, SelectorErrT> {
+#[derive(Debug)]
+pub enum InputSelectorError<DbErrT, SelectorErrT, ChangeErrT, N> {
     /// An error occurred accessing the underlying data store.
     DataSource(DbErrT),
     /// An error occurred specific to the provided input selector's selection rules.
     Selection(SelectorErrT),
+    /// An error occurred in computing the change or fee for the proposed transfer.
+    Change(ChangeError<ChangeErrT, N>),
+    /// Input selection attempted to generate an invalid transaction proposal.
+    Proposal(ProposalError),
+    /// An error occurred parsing the address from a payment request.
+    Address(ConversionError<&'static str>),
     /// Insufficient funds were available to satisfy the payment request that inputs were being
     /// selected to attempt to satisfy.
-    InsufficientFunds { available: Amount, required: Amount },
+    InsufficientFunds {
+        available: NonNegativeAmount,
+        required: NonNegativeAmount,
+    },
+    /// The data source does not have enough information to choose an expiry height
+    /// for the transaction.
+    SyncRequired,
 }
 
-impl<DE: fmt::Display, SE: fmt::Display> fmt::Display for InputSelectorError<DE, SE> {
+impl<DE: fmt::Display, SE: fmt::Display, CE: fmt::Display, N: fmt::Display> fmt::Display
+    for InputSelectorError<DE, SE, CE, N>
+{
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match &self {
             InputSelectorError::DataSource(e) => {
@@ -50,61 +81,68 @@ impl<DE: fmt::Display, SE: fmt::Display> fmt::Display for InputSelectorError<DE,
             InputSelectorError::Selection(e) => {
                 write!(f, "Note selection encountered the following error: {}", e)
             }
+            InputSelectorError::Change(e) => write!(
+                f,
+                "Proposal generation failed due to an error in computing change or transaction fees: {}",
+                e
+            ),
+            InputSelectorError::Proposal(e) => {
+                write!(
+                    f,
+                    "Input selection attempted to generate an invalid proposal: {}",
+                    e
+                )
+            }
+            InputSelectorError::Address(e) => {
+                write!(
+                    f,
+                    "An error occurred decoding the address from a payment request: {}.",
+                    e
+                )
+            }
             InputSelectorError::InsufficientFunds {
                 available,
                 required,
             } => write!(
                 f,
                 "Insufficient balance (have {}, need {} including fee)",
-                i64::from(*available),
-                i64::from(*required)
+                u64::from(*available),
+                u64::from(*required)
             ),
+            InputSelectorError::SyncRequired => {
+                write!(f, "Insufficient chain data is available, sync required.")
+            }
         }
     }
 }
 
-/// A data structure that describes the inputs to be consumed and outputs to
-/// be produced in a proposed transaction.
-pub struct Proposal<FeeRuleT, NoteRef> {
-    transaction_request: TransactionRequest,
-    transparent_inputs: Vec<WalletTransparentOutput>,
-    sapling_inputs: Vec<ReceivedSaplingNote<NoteRef>>,
-    balance: TransactionBalance,
-    fee_rule: FeeRuleT,
-    target_height: BlockHeight,
-    is_shielding: bool,
+impl<DE, SE, CE, N> error::Error for InputSelectorError<DE, SE, CE, N>
+where
+    DE: Debug + Display + error::Error + 'static,
+    SE: Debug + Display + error::Error + 'static,
+    CE: Debug + Display + error::Error + 'static,
+    N: Debug + Display + 'static,
+{
+    fn source(&self) -> Option<&(dyn error::Error + 'static)> {
+        match &self {
+            Self::DataSource(e) => Some(e),
+            Self::Selection(e) => Some(e),
+            Self::Change(e) => Some(e),
+            Self::Proposal(e) => Some(e),
+            _ => None,
+        }
+    }
 }
 
-impl<FeeRuleT, NoteRef> Proposal<FeeRuleT, NoteRef> {
-    /// Returns the transaction request that describes the payments to be made.
-    pub fn transaction_request(&self) -> &TransactionRequest {
-        &self.transaction_request
-    }
-    /// Returns the transparent inputs that have been selected to fund the transaction.
-    pub fn transparent_inputs(&self) -> &[WalletTransparentOutput] {
-        &self.transparent_inputs
-    }
-    /// Returns the Sapling inputs that have been selected to fund the transaction.
-    pub fn sapling_inputs(&self) -> &[ReceivedSaplingNote<NoteRef>] {
-        &self.sapling_inputs
-    }
-    /// Returns the change outputs to be added to the transaction and the fee to be paid.
-    pub fn balance(&self) -> &TransactionBalance {
-        &self.balance
+impl<E, S, F, N> From<ConversionError<&'static str>> for InputSelectorError<E, S, F, N> {
+    fn from(value: ConversionError<&'static str>) -> Self {
+        InputSelectorError::Address(value)
     }
-    /// Returns the fee rule to be used by the transaction builder.
-    pub fn fee_rule(&self) -> &FeeRuleT {
-        &self.fee_rule
-    }
-    /// Returns the target height for which the proposal was prepared.
-    pub fn target_height(&self) -> BlockHeight {
-        self.target_height
-    }
-    /// Returns a flag indicating whether or not the proposed transaction
-    /// is exclusively wallet-internal (if it does not involve any external
-    /// recipients).
-    pub fn is_shielding(&self) -> bool {
-        self.is_shielding
+}
+
+impl<E, S, C, N> From<ChangeError<C, N>> for InputSelectorError<E, S, C, N> {
+    fn from(err: ChangeError<C, N>) -> Self {
+        InputSelectorError::Change(err)
     }
 }
 
@@ -116,14 +154,13 @@ impl<FeeRuleT, NoteRef> Proposal<FeeRuleT, NoteRef> {
 pub trait InputSelector {
     /// The type of errors that may be generated in input selection
     type Error;
-    /// The type of data source that the input selector expects to access to obtain input notes and
-    /// UTXOs. This associated type permits input selectors that may use specialized knowledge of
-    /// the internals of a particular backing data store, if the generic API of `WalletRead` does
-    /// not provide sufficiently fine-grained operations for a particular backing store to
-    /// optimally perform input selection.
-    type DataSource: WalletRead;
-    /// The type of the fee rule that this input selector uses when computing fees.
-    type FeeRule: FeeRule;
+
+    /// The type of data source that the input selector expects to access to obtain input notes.
+    /// This associated type permits input selectors that may use specialized knowledge of the
+    /// internals of a particular backing data store, if the generic API of `InputSource` does not
+    /// provide sufficiently fine-grained operations for a particular backing store to optimally
+    /// perform input selection.
+    type InputSource: InputSource;
 
     /// Performs input selection and returns a proposal for transaction construction including
     /// change and fee outputs.
@@ -139,22 +176,44 @@ pub trait InputSelector {
     ///
     /// If insufficient funds are available to satisfy the required outputs for the shielding
     /// request, this operation must fail and return [`InputSelectorError::InsufficientFunds`].
-    #[allow(clippy::too_many_arguments)]
     #[allow(clippy::type_complexity)]
-    fn propose_transaction<ParamsT>(
+    #[allow(clippy::too_many_arguments)]
+    fn propose_transaction<ParamsT, ChangeT>(
         &self,
         params: &ParamsT,
-        wallet_db: &Self::DataSource,
-        account: AccountId,
-        anchor_height: BlockHeight,
+        wallet_db: &Self::InputSource,
         target_height: BlockHeight,
+        anchor_height: BlockHeight,
+        account: <Self::InputSource as InputSource>::AccountId,
         transaction_request: TransactionRequest,
+        change_strategy: &ChangeT,
     ) -> Result<
-        Proposal<Self::FeeRule, <<Self as InputSelector>::DataSource as WalletRead>::NoteRef>,
-        InputSelectorError<<<Self as InputSelector>::DataSource as WalletRead>::Error, Self::Error>,
+        Proposal<<ChangeT as ChangeStrategy>::FeeRule, <Self::InputSource as InputSource>::NoteRef>,
+        InputSelectorError<
+            <Self::InputSource as InputSource>::Error,
+            Self::Error,
+            ChangeT::Error,
+            <Self::InputSource as InputSource>::NoteRef,
+        >,
     >
     where
-        ParamsT: consensus::Parameters;
+        ParamsT: consensus::Parameters,
+        ChangeT: ChangeStrategy<MetaSource = Self::InputSource>;
+}
+
+/// A strategy for selecting transaction inputs and proposing transaction outputs
+/// for shielding-only transactions (transactions which spend transparent UTXOs and
+/// send all transaction outputs to the wallet's shielded internal address(es)).
+#[cfg(feature = "transparent-inputs")]
+pub trait ShieldingSelector {
+    /// The type of errors that may be generated in input selection
+    type Error;
+    /// The type of data source that the input selector expects to access to obtain input
+    /// transparent UTXOs. This associated type permits input selectors that may use specialized
+    /// knowledge of the internals of a particular backing data store, if the generic API of
+    /// [`InputSource`] does not provide sufficiently fine-grained operations for a
+    /// particular backing store to optimally perform input selection.
+    type InputSource: InputSource;
 
     /// Performs input selection and returns a proposal for the construction of a shielding
     /// transaction.
@@ -164,36 +223,44 @@ pub trait InputSelector {
     /// specified source addresses. If insufficient funds are available to satisfy the required
     /// outputs for the shielding request, this operation must fail and return
     /// [`InputSelectorError::InsufficientFunds`].
-    #[allow(clippy::too_many_arguments)]
     #[allow(clippy::type_complexity)]
-    fn propose_shielding<ParamsT>(
+    #[allow(clippy::too_many_arguments)]
+    fn propose_shielding<ParamsT, ChangeT>(
         &self,
         params: &ParamsT,
-        wallet_db: &Self::DataSource,
+        wallet_db: &Self::InputSource,
+        change_strategy: &ChangeT,
         shielding_threshold: NonNegativeAmount,
         source_addrs: &[TransparentAddress],
-        confirmed_height: BlockHeight,
+        to_account: <Self::InputSource as InputSource>::AccountId,
         target_height: BlockHeight,
+        min_confirmations: u32,
     ) -> Result<
-        Proposal<Self::FeeRule, <<Self as InputSelector>::DataSource as WalletRead>::NoteRef>,
-        InputSelectorError<<<Self as InputSelector>::DataSource as WalletRead>::Error, Self::Error>,
+        Proposal<<ChangeT as ChangeStrategy>::FeeRule, Infallible>,
+        InputSelectorError<
+            <Self::InputSource as InputSource>::Error,
+            Self::Error,
+            ChangeT::Error,
+            Infallible,
+        >,
     >
     where
-        ParamsT: consensus::Parameters;
+        ParamsT: consensus::Parameters,
+        ChangeT: ChangeStrategy<MetaSource = Self::InputSource>;
 }
 
 /// Errors that can occur as a consequence of greedy input selection.
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub enum GreedyInputSelectorError<ChangeStrategyErrT, NoteRefT> {
+pub enum GreedyInputSelectorError {
     /// An intermediate value overflowed or underflowed the valid monetary range.
     Balance(BalanceError),
     /// A unified address did not contain a supported receiver.
     UnsupportedAddress(Box<UnifiedAddress>),
-    /// An error was encountered in change selection.
-    Change(ChangeError<ChangeStrategyErrT, NoteRefT>),
+    /// Support for transparent-source-only (TEX) addresses requires the transparent-inputs feature.
+    UnsupportedTexAddress,
 }
 
-impl<CE: fmt::Display, N: fmt::Display> fmt::Display for GreedyInputSelectorError<CE, N> {
+impl fmt::Display for GreedyInputSelectorError {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match &self {
             GreedyInputSelectorError::Balance(e) => write!(
@@ -206,49 +273,58 @@ impl<CE: fmt::Display, N: fmt::Display> fmt::Display for GreedyInputSelectorErro
                 // don't have network parameters here
                 write!(f, "Unified address contains no supported receivers.")
             }
-            GreedyInputSelectorError::Change(err) => {
-                write!(f, "An error occurred computing change and fees: {}", err)
+            GreedyInputSelectorError::UnsupportedTexAddress => {
+                write!(f, "Support for transparent-source-only (TEX) addresses requires the transparent-inputs feature.")
             }
         }
     }
 }
 
-impl<DbErrT, ChangeStrategyErrT, NoteRefT>
-    From<GreedyInputSelectorError<ChangeStrategyErrT, NoteRefT>>
-    for InputSelectorError<DbErrT, GreedyInputSelectorError<ChangeStrategyErrT, NoteRefT>>
+impl<DbErrT, ChangeErrT, N> From<GreedyInputSelectorError>
+    for InputSelectorError<DbErrT, GreedyInputSelectorError, ChangeErrT, N>
 {
-    fn from(err: GreedyInputSelectorError<ChangeStrategyErrT, NoteRefT>) -> Self {
+    fn from(err: GreedyInputSelectorError) -> Self {
         InputSelectorError::Selection(err)
     }
 }
 
-impl<DbErrT, ChangeStrategyErrT, NoteRefT> From<ChangeError<ChangeStrategyErrT, NoteRefT>>
-    for InputSelectorError<DbErrT, GreedyInputSelectorError<ChangeStrategyErrT, NoteRefT>>
-{
-    fn from(err: ChangeError<ChangeStrategyErrT, NoteRefT>) -> Self {
-        InputSelectorError::Selection(GreedyInputSelectorError::Change(err))
-    }
-}
-
-impl<DbErrT, ChangeStrategyErrT, NoteRefT> From<BalanceError>
-    for InputSelectorError<DbErrT, GreedyInputSelectorError<ChangeStrategyErrT, NoteRefT>>
+impl<DbErrT, ChangeErrT, N> From<BalanceError>
+    for InputSelectorError<DbErrT, GreedyInputSelectorError, ChangeErrT, N>
 {
     fn from(err: BalanceError) -> Self {
         InputSelectorError::Selection(GreedyInputSelectorError::Balance(err))
     }
 }
 
-pub(crate) struct SaplingPayment(Amount);
+pub(crate) struct SaplingPayment(NonNegativeAmount);
 
 #[cfg(test)]
 impl SaplingPayment {
-    pub(crate) fn new(amount: Amount) -> Self {
+    pub(crate) fn new(amount: NonNegativeAmount) -> Self {
         SaplingPayment(amount)
     }
 }
 
 impl sapling::OutputView for SaplingPayment {
-    fn value(&self) -> Amount {
+    fn value(&self) -> NonNegativeAmount {
+        self.0
+    }
+}
+
+#[cfg(feature = "orchard")]
+pub(crate) struct OrchardPayment(NonNegativeAmount);
+
+#[cfg(test)]
+#[cfg(feature = "orchard")]
+impl OrchardPayment {
+    pub(crate) fn new(amount: NonNegativeAmount) -> Self {
+        OrchardPayment(amount)
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl orchard_fees::OutputView for OrchardPayment {
+    fn value(&self) -> NonNegativeAmount {
         self.0
     }
 }
@@ -256,135 +332,433 @@ impl sapling::OutputView for SaplingPayment {
 /// An [`InputSelector`] implementation that uses a greedy strategy to select between available
 /// notes.
 ///
-/// This implementation performs input selection using methods available via the [`WalletRead`]
-/// interface.
-pub struct GreedyInputSelector<DbT, ChangeT> {
-    change_strategy: ChangeT,
-    dust_output_policy: DustOutputPolicy,
+/// This implementation performs input selection using methods available via the
+/// [`InputSource`] interface.
+pub struct GreedyInputSelector<DbT> {
     _ds_type: PhantomData<DbT>,
 }
 
-impl<DbT, ChangeT: ChangeStrategy> GreedyInputSelector<DbT, ChangeT> {
+impl<DbT> GreedyInputSelector<DbT> {
     /// Constructs a new greedy input selector that uses the provided change strategy to determine
     /// change values and fee amounts.
-    pub fn new(change_strategy: ChangeT, dust_output_policy: DustOutputPolicy) -> Self {
+    ///
+    /// The [`ChangeStrategy`] provided must produce exactly one ephemeral change value when
+    /// computing a transaction balance if an [`EphemeralBalance::Output`] value is provided for
+    /// its ephemeral balance, or the resulting [`GreedyInputSelector`] will return an error when
+    /// attempting to construct a transaction proposal that requires such an output.
+    ///
+    /// [`EphemeralBalance::Output`]: crate::fees::EphemeralBalance::Output
+    pub fn new() -> Self {
         GreedyInputSelector {
-            change_strategy,
-            dust_output_policy,
             _ds_type: PhantomData,
         }
     }
 }
 
-impl<DbT, ChangeT> InputSelector for GreedyInputSelector<DbT, ChangeT>
-where
-    DbT: WalletRead,
-    ChangeT: ChangeStrategy,
-    ChangeT::FeeRule: Clone,
-{
-    type Error = GreedyInputSelectorError<ChangeT::Error, DbT::NoteRef>;
-    type DataSource = DbT;
-    type FeeRule = ChangeT::FeeRule;
+impl<DbT> Default for GreedyInputSelector<DbT> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<DbT: InputSource> InputSelector for GreedyInputSelector<DbT> {
+    type Error = GreedyInputSelectorError;
+    type InputSource = DbT;
 
     #[allow(clippy::type_complexity)]
-    fn propose_transaction<ParamsT>(
+    fn propose_transaction<ParamsT, ChangeT>(
         &self,
         params: &ParamsT,
-        wallet_db: &Self::DataSource,
-        account: AccountId,
-        anchor_height: BlockHeight,
+        wallet_db: &Self::InputSource,
         target_height: BlockHeight,
+        anchor_height: BlockHeight,
+        account: <DbT as InputSource>::AccountId,
         transaction_request: TransactionRequest,
-    ) -> Result<Proposal<Self::FeeRule, DbT::NoteRef>, InputSelectorError<DbT::Error, Self::Error>>
+        change_strategy: &ChangeT,
+    ) -> Result<
+        Proposal<<ChangeT as ChangeStrategy>::FeeRule, DbT::NoteRef>,
+        InputSelectorError<<DbT as InputSource>::Error, Self::Error, ChangeT::Error, DbT::NoteRef>,
+    >
     where
         ParamsT: consensus::Parameters,
+        Self::InputSource: InputSource,
+        ChangeT: ChangeStrategy<MetaSource = DbT>,
     {
         let mut transparent_outputs = vec![];
         let mut sapling_outputs = vec![];
-        let mut output_total = Amount::zero();
-        for payment in transaction_request.payments() {
-            output_total = (output_total + payment.amount).ok_or(BalanceError::Overflow)?;
-
-            let mut push_transparent = |taddr: TransparentAddress| {
-                transparent_outputs.push(TxOut {
-                    value: payment.amount,
-                    script_pubkey: taddr.script(),
-                });
-            };
-            let mut push_sapling = || {
-                sapling_outputs.push(SaplingPayment(payment.amount));
-            };
-
-            match &payment.recipient_address {
-                RecipientAddress::Transparent(addr) => {
-                    push_transparent(*addr);
+        #[cfg(feature = "orchard")]
+        let mut orchard_outputs = vec![];
+        let mut payment_pools = BTreeMap::new();
+
+        // In a ZIP 320 pair, tr0 refers to the first transaction request that
+        // collects shielded value and sends it to an ephemeral address, and tr1
+        // refers to the second transaction request that pays the TEX addresses.
+        #[cfg(feature = "transparent-inputs")]
+        let mut tr1_transparent_outputs = vec![];
+        #[cfg(feature = "transparent-inputs")]
+        let mut tr1_payments = vec![];
+        #[cfg(feature = "transparent-inputs")]
+        let mut tr1_payment_pools = BTreeMap::new();
+        // This balance value is just used for overflow checking; the actual value of ephemeral
+        // outputs will be computed from the constructed `tr1_transparent_outputs` value
+        // constructed below.
+        #[cfg(feature = "transparent-inputs")]
+        let mut total_ephemeral = NonNegativeAmount::ZERO;
+
+        for (idx, payment) in transaction_request.payments() {
+            let recipient_address: Address = payment
+                .recipient_address()
+                .clone()
+                .convert_if_network(params.network_type())?;
+
+            match recipient_address {
+                Address::Transparent(addr) => {
+                    payment_pools.insert(*idx, PoolType::TRANSPARENT);
+                    transparent_outputs.push(TxOut {
+                        value: payment.amount(),
+                        script_pubkey: addr.script(),
+                    });
+                }
+                #[cfg(feature = "transparent-inputs")]
+                Address::Tex(data) => {
+                    let p2pkh_addr = TransparentAddress::PublicKeyHash(data);
+
+                    tr1_payment_pools.insert(*idx, PoolType::TRANSPARENT);
+                    tr1_transparent_outputs.push(TxOut {
+                        value: payment.amount(),
+                        script_pubkey: p2pkh_addr.script(),
+                    });
+                    tr1_payments.push(
+                        Payment::new(
+                            payment.recipient_address().clone(),
+                            payment.amount(),
+                            None,
+                            payment.label().cloned(),
+                            payment.message().cloned(),
+                            payment.other_params().to_vec(),
+                        )
+                        .expect("cannot fail because memo is None"),
+                    );
+                    total_ephemeral = (total_ephemeral + payment.amount())
+                        .ok_or_else(|| GreedyInputSelectorError::Balance(BalanceError::Overflow))?;
+                }
+                #[cfg(not(feature = "transparent-inputs"))]
+                Address::Tex(_) => {
+                    return Err(InputSelectorError::Selection(
+                        GreedyInputSelectorError::UnsupportedTexAddress,
+                    ));
                 }
-                RecipientAddress::Shielded(_) => {
-                    push_sapling();
+                Address::Sapling(_) => {
+                    payment_pools.insert(*idx, PoolType::SAPLING);
+                    sapling_outputs.push(SaplingPayment(payment.amount()));
                 }
-                RecipientAddress::Unified(addr) => {
-                    if addr.sapling().is_some() {
-                        push_sapling();
-                    } else if let Some(addr) = addr.transparent() {
-                        push_transparent(*addr);
-                    } else {
-                        return Err(InputSelectorError::Selection(
-                            GreedyInputSelectorError::UnsupportedAddress(Box::new(addr.clone())),
-                        ));
+                Address::Unified(addr) => {
+                    #[cfg(feature = "orchard")]
+                    if addr.has_orchard() {
+                        payment_pools.insert(*idx, PoolType::ORCHARD);
+                        orchard_outputs.push(OrchardPayment(payment.amount()));
+                        continue;
                     }
+
+                    if addr.has_sapling() {
+                        payment_pools.insert(*idx, PoolType::SAPLING);
+                        sapling_outputs.push(SaplingPayment(payment.amount()));
+                        continue;
+                    }
+
+                    if let Some(addr) = addr.transparent() {
+                        payment_pools.insert(*idx, PoolType::TRANSPARENT);
+                        transparent_outputs.push(TxOut {
+                            value: payment.amount(),
+                            script_pubkey: addr.script(),
+                        });
+                        continue;
+                    }
+
+                    return Err(InputSelectorError::Selection(
+                        GreedyInputSelectorError::UnsupportedAddress(Box::new(addr)),
+                    ));
                 }
             }
         }
 
-        let mut sapling_inputs: Vec<ReceivedSaplingNote<DbT::NoteRef>> = vec![];
-        let mut prior_available = Amount::zero();
-        let mut amount_required = Amount::zero();
+        let mut shielded_inputs = SpendableNotes::empty();
+        let mut prior_available = NonNegativeAmount::ZERO;
+        let mut amount_required = NonNegativeAmount::ZERO;
         let mut exclude: Vec<DbT::NoteRef> = vec![];
+
         // This loop is guaranteed to terminate because on each iteration we check that the amount
         // of funds selected is strictly increasing. The loop will either return a successful
         // result or the wallet will eventually run out of funds to select.
         loop {
-            let balance = self.change_strategy.compute_balance(
+            #[cfg(not(feature = "orchard"))]
+            let use_sapling = true;
+            #[cfg(feature = "orchard")]
+            let (use_sapling, use_orchard) = {
+                let (sapling_input_total, orchard_input_total) = (
+                    shielded_inputs.sapling_value()?,
+                    shielded_inputs.orchard_value()?,
+                );
+
+                // Use Sapling inputs if there are no Orchard outputs or if there are insufficient
+                // funds from Orchard inputs to cover the amount required.
+                let use_sapling =
+                    orchard_outputs.is_empty() || amount_required > orchard_input_total;
+                // Use Orchard inputs if there are insufficient funds from Sapling inputs to cover
+                // the amount required.
+                let use_orchard = !use_sapling || amount_required > sapling_input_total;
+
+                (use_sapling, use_orchard)
+            };
+
+            let sapling_inputs = if use_sapling {
+                shielded_inputs
+                    .sapling()
+                    .iter()
+                    .map(|i| (*i.internal_note_id(), i.note().value()))
+                    .collect()
+            } else {
+                vec![]
+            };
+
+            #[cfg(feature = "orchard")]
+            let orchard_inputs = if use_orchard {
+                shielded_inputs
+                    .orchard()
+                    .iter()
+                    .map(|i| (*i.internal_note_id(), i.note().value()))
+                    .collect()
+            } else {
+                vec![]
+            };
+
+            let selected_input_ids = sapling_inputs.iter().map(|(id, _)| id);
+            #[cfg(feature = "orchard")]
+            let selected_input_ids =
+                selected_input_ids.chain(orchard_inputs.iter().map(|(id, _)| id));
+
+            let selected_input_ids = selected_input_ids.cloned().collect::<Vec<_>>();
+
+            let wallet_meta = change_strategy
+                .fetch_wallet_meta(wallet_db, account, &selected_input_ids)
+                .map_err(InputSelectorError::DataSource)?;
+
+            #[cfg(not(feature = "transparent-inputs"))]
+            let ephemeral_balance = None;
+
+            #[cfg(feature = "transparent-inputs")]
+            let (ephemeral_balance, tr1_balance_opt) = {
+                if tr1_transparent_outputs.is_empty() {
+                    (None, None)
+                } else {
+                    // The ephemeral input going into transaction 1 must be able to pay that
+                    // transaction's fee, as well as the TEX address payments.
+
+                    // First compute the required total with an additional zero input,
+                    // catching the `InsufficientFunds` error to obtain the required amount
+                    // given the provided change strategy. Ignore the change memo in order
+                    // to avoid adding a change output.
+                    let tr1_required_input_value = match change_strategy
+                        .compute_balance::<_, DbT::NoteRef>(
+                            params,
+                            target_height,
+                            &[] as &[WalletTransparentOutput],
+                            &tr1_transparent_outputs,
+                            &sapling::EmptyBundleView,
+                            #[cfg(feature = "orchard")]
+                            &orchard_fees::EmptyBundleView,
+                            Some(&EphemeralBalance::Input(NonNegativeAmount::ZERO)),
+                            &wallet_meta,
+                        ) {
+                        Err(ChangeError::InsufficientFunds { required, .. }) => required,
+                        Err(ChangeError::DustInputs { .. }) => {
+                            unreachable!("no inputs were supplied")
+                        }
+                        Err(other) => return Err(InputSelectorError::Change(other)),
+                        Ok(_) => NonNegativeAmount::ZERO, // shouldn't happen
+                    };
+
+                    // Now recompute to obtain the `TransactionBalance` and verify that it
+                    // fully accounts for the required fees.
+                    let tr1_balance = change_strategy.compute_balance::<_, DbT::NoteRef>(
+                        params,
+                        target_height,
+                        &[] as &[WalletTransparentOutput],
+                        &tr1_transparent_outputs,
+                        &sapling::EmptyBundleView,
+                        #[cfg(feature = "orchard")]
+                        &orchard_fees::EmptyBundleView,
+                        Some(&EphemeralBalance::Input(tr1_required_input_value)),
+                        &wallet_meta,
+                    )?;
+                    assert_eq!(tr1_balance.total(), tr1_balance.fee_required());
+
+                    (
+                        Some(EphemeralBalance::Output(tr1_required_input_value)),
+                        Some(tr1_balance),
+                    )
+                }
+            };
+
+            // In the ZIP 320 case, this is the balance for transaction 0, taking into account
+            // the ephemeral output.
+            let balance = change_strategy.compute_balance(
                 params,
                 target_height,
-                &Vec::<WalletTransparentOutput>::new(),
+                &[] as &[WalletTransparentOutput],
                 &transparent_outputs,
-                &sapling_inputs,
-                &sapling_outputs,
-                &self.dust_output_policy,
+                &(
+                    ::sapling::builder::BundleType::DEFAULT,
+                    &sapling_inputs[..],
+                    &sapling_outputs[..],
+                ),
+                #[cfg(feature = "orchard")]
+                &(
+                    ::orchard::builder::BundleType::DEFAULT,
+                    &orchard_inputs[..],
+                    &orchard_outputs[..],
+                ),
+                ephemeral_balance.as_ref(),
+                &wallet_meta,
             );
 
             match balance {
                 Ok(balance) => {
-                    return Ok(Proposal {
+                    // At this point, we have enough input value to pay for everything, so we will
+                    // return at the end of this block.
+
+                    let shielded_inputs =
+                        NonEmpty::from_vec(shielded_inputs.into_vec(&SimpleNoteRetention {
+                            sapling: use_sapling,
+                            #[cfg(feature = "orchard")]
+                            orchard: use_orchard,
+                        }))
+                        .map(|notes| ShieldedInputs::from_parts(anchor_height, notes));
+
+                    #[cfg(feature = "transparent-inputs")]
+                    if let Some(tr1_balance) = tr1_balance_opt {
+                        // Construct two new `TransactionRequest`s:
+                        // * `tr0` excludes the TEX outputs, and in their place includes
+                        //   a single additional ephemeral output to the transparent pool.
+                        // * `tr1` spends from that ephemeral output to each TEX output.
+
+                        // Find exactly one ephemeral change output.
+                        let ephemeral_outputs = balance
+                            .proposed_change()
+                            .iter()
+                            .enumerate()
+                            .filter(|(_, c)| c.is_ephemeral())
+                            .collect::<Vec<_>>();
+
+                        let ephemeral_value = ephemeral_balance
+                            .and_then(|b| b.ephemeral_output_amount())
+                            .expect("ephemeral output balance exists (constructed above)");
+
+                        let ephemeral_output_index = match &ephemeral_outputs[..] {
+                            [(i, change_value)] if change_value.value() == ephemeral_value => {
+                                Ok(*i)
+                            }
+                            _ => Err(InputSelectorError::Proposal(
+                                ProposalError::EphemeralOutputsInvalid,
+                            )),
+                        }?;
+
+                        let ephemeral_stepoutput =
+                            StepOutput::new(0, StepOutputIndex::Change(ephemeral_output_index));
+
+                        let tr0 = TransactionRequest::from_indexed(
+                            transaction_request
+                                .payments()
+                                .iter()
+                                .filter(|(idx, _payment)| !tr1_payment_pools.contains_key(idx))
+                                .map(|(k, v)| (*k, v.clone()))
+                                .collect(),
+                        )
+                        .expect("removing payments from a TransactionRequest preserves validity");
+
+                        let mut steps = vec![];
+                        steps.push(
+                            Step::from_parts(
+                                &[],
+                                tr0,
+                                payment_pools,
+                                vec![],
+                                shielded_inputs,
+                                vec![],
+                                balance,
+                                false,
+                            )
+                            .map_err(InputSelectorError::Proposal)?,
+                        );
+
+                        let tr1 =
+                            TransactionRequest::new(tr1_payments).expect("valid by construction");
+                        steps.push(
+                            Step::from_parts(
+                                &steps,
+                                tr1,
+                                tr1_payment_pools,
+                                vec![],
+                                None,
+                                vec![ephemeral_stepoutput],
+                                tr1_balance,
+                                false,
+                            )
+                            .map_err(InputSelectorError::Proposal)?,
+                        );
+
+                        return Proposal::multi_step(
+                            change_strategy.fee_rule().clone(),
+                            target_height,
+                            NonEmpty::from_vec(steps).expect("steps is known to be nonempty"),
+                        )
+                        .map_err(InputSelectorError::Proposal);
+                    }
+
+                    return Proposal::single_step(
                         transaction_request,
-                        transparent_inputs: vec![],
-                        sapling_inputs,
+                        payment_pools,
+                        vec![],
+                        shielded_inputs,
                         balance,
-                        fee_rule: (*self.change_strategy.fee_rule()).clone(),
+                        (*change_strategy.fee_rule()).clone(),
                         target_height,
-                        is_shielding: false,
-                    });
+                        false,
+                    )
+                    .map_err(InputSelectorError::Proposal);
                 }
-                Err(ChangeError::DustInputs { mut sapling, .. }) => {
+                Err(ChangeError::DustInputs {
+                    mut sapling,
+                    #[cfg(feature = "orchard")]
+                    mut orchard,
+                    ..
+                }) => {
                     exclude.append(&mut sapling);
+                    #[cfg(feature = "orchard")]
+                    exclude.append(&mut orchard);
                 }
                 Err(ChangeError::InsufficientFunds { required, .. }) => {
                     amount_required = required;
                 }
-                Err(other) => return Err(other.into()),
+                Err(other) => return Err(InputSelectorError::Change(other)),
             }
 
-            sapling_inputs = wallet_db
-                .select_spendable_sapling_notes(account, amount_required, anchor_height, &exclude)
+            #[cfg(not(feature = "orchard"))]
+            let selectable_pools = &[ShieldedProtocol::Sapling];
+            #[cfg(feature = "orchard")]
+            let selectable_pools = &[ShieldedProtocol::Sapling, ShieldedProtocol::Orchard];
+
+            shielded_inputs = wallet_db
+                .select_spendable_notes(
+                    account,
+                    amount_required,
+                    selectable_pools,
+                    anchor_height,
+                    &exclude,
+                )
                 .map_err(InputSelectorError::DataSource)?;
 
-            let new_available = sapling_inputs
-                .iter()
-                .map(|n| n.note_value)
-                .sum::<Option<Amount>>()
-                .ok_or(BalanceError::Overflow)?;
-
+            let new_available = shielded_inputs.total_value()?;
             if new_available <= prior_available {
                 return Err(InputSelectorError::InsufficientFunds {
                     required: amount_required,
@@ -397,37 +771,57 @@ where
             }
         }
     }
+}
+
+#[cfg(feature = "transparent-inputs")]
+impl<DbT: InputSource> ShieldingSelector for GreedyInputSelector<DbT> {
+    type Error = GreedyInputSelectorError;
+    type InputSource = DbT;
 
     #[allow(clippy::type_complexity)]
-    fn propose_shielding<ParamsT>(
+    fn propose_shielding<ParamsT, ChangeT>(
         &self,
         params: &ParamsT,
-        wallet_db: &Self::DataSource,
+        wallet_db: &Self::InputSource,
+        change_strategy: &ChangeT,
         shielding_threshold: NonNegativeAmount,
         source_addrs: &[TransparentAddress],
-        confirmed_height: BlockHeight,
+        to_account: <Self::InputSource as InputSource>::AccountId,
         target_height: BlockHeight,
-    ) -> Result<Proposal<Self::FeeRule, DbT::NoteRef>, InputSelectorError<DbT::Error, Self::Error>>
+        min_confirmations: u32,
+    ) -> Result<
+        Proposal<<ChangeT as ChangeStrategy>::FeeRule, Infallible>,
+        InputSelectorError<<DbT as InputSource>::Error, Self::Error, ChangeT::Error, Infallible>,
+    >
     where
         ParamsT: consensus::Parameters,
+        ChangeT: ChangeStrategy<MetaSource = Self::InputSource>,
     {
         let mut transparent_inputs: Vec<WalletTransparentOutput> = source_addrs
             .iter()
-            .map(|taddr| wallet_db.get_unspent_transparent_outputs(taddr, confirmed_height, &[]))
+            .map(|taddr| {
+                wallet_db.get_spendable_transparent_outputs(taddr, target_height, min_confirmations)
+            })
             .collect::<Result<Vec<Vec<_>>, _>>()
             .map_err(InputSelectorError::DataSource)?
             .into_iter()
             .flat_map(|v| v.into_iter())
             .collect();
 
-        let trial_balance = self.change_strategy.compute_balance(
+        let wallet_meta = change_strategy
+            .fetch_wallet_meta(wallet_db, to_account, &[])
+            .map_err(InputSelectorError::DataSource)?;
+
+        let trial_balance = change_strategy.compute_balance(
             params,
             target_height,
             &transparent_inputs,
-            &Vec::<TxOut>::new(),
-            &Vec::<ReceivedSaplingNote<DbT::NoteRef>>::new(),
-            &Vec::<SaplingPayment>::new(),
-            &self.dust_output_policy,
+            &[] as &[TxOut],
+            &sapling::EmptyBundleView,
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &wallet_meta,
         );
 
         let balance = match trial_balance {
@@ -436,35 +830,37 @@ where
                 let exclusions: BTreeSet<OutPoint> = transparent.into_iter().collect();
                 transparent_inputs.retain(|i| !exclusions.contains(i.outpoint()));
 
-                self.change_strategy.compute_balance(
+                change_strategy.compute_balance(
                     params,
                     target_height,
                     &transparent_inputs,
-                    &Vec::<TxOut>::new(),
-                    &Vec::<ReceivedSaplingNote<DbT::NoteRef>>::new(),
-                    &Vec::<SaplingPayment>::new(),
-                    &self.dust_output_policy,
+                    &[] as &[TxOut],
+                    &sapling::EmptyBundleView,
+                    #[cfg(feature = "orchard")]
+                    &orchard_fees::EmptyBundleView,
+                    None,
+                    &wallet_meta,
                 )?
             }
-            Err(other) => {
-                return Err(other.into());
-            }
+            Err(other) => return Err(InputSelectorError::Change(other)),
         };
 
-        if balance.total() >= shielding_threshold.into() {
-            Ok(Proposal {
-                transaction_request: TransactionRequest::empty(),
+        if balance.total() >= shielding_threshold {
+            Proposal::single_step(
+                TransactionRequest::empty(),
+                BTreeMap::new(),
                 transparent_inputs,
-                sapling_inputs: vec![],
+                None,
                 balance,
-                fee_rule: (*self.change_strategy.fee_rule()).clone(),
+                (*change_strategy.fee_rule()).clone(),
                 target_height,
-                is_shielding: true,
-            })
+                true,
+            )
+            .map_err(InputSelectorError::Proposal)
         } else {
             Err(InputSelectorError::InsufficientFunds {
                 available: balance.total(),
-                required: shielding_threshold.into(),
+                required: shielding_threshold,
             })
         }
     }
diff --git a/zcash_client_backend/src/decrypt.rs b/zcash_client_backend/src/decrypt.rs
index eb7e78e2df..da3749ea65 100644
--- a/zcash_client_backend/src/decrypt.rs
+++ b/zcash_client_backend/src/decrypt.rs
@@ -1,19 +1,19 @@
 use std::collections::HashMap;
 
+use sapling::note_encryption::{PreparedIncomingViewingKey, SaplingDomain};
+use zcash_note_encryption::{try_note_decryption, try_output_recovery_with_ovk};
 use zcash_primitives::{
     consensus::{self, BlockHeight},
     memo::MemoBytes,
-    sapling::{
-        self,
-        note_encryption::{
-            try_sapling_note_decryption, try_sapling_output_recovery, PreparedIncomingViewingKey,
-        },
-    },
+    transaction::components::{amount::NonNegativeAmount, sapling::zip212_enforcement},
     transaction::Transaction,
-    zip32::{AccountId, Scope},
+    zip32::Scope,
 };
 
-use crate::keys::UnifiedFullViewingKey;
+use crate::{data_api::DecryptedTransaction, keys::UnifiedFullViewingKey};
+
+#[cfg(feature = "orchard")]
+use orchard::note_encryption::OrchardDomain;
 
 /// An enumeration of the possible relationships a TXO can have to the wallet.
 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
@@ -30,41 +30,92 @@ pub enum TransferType {
 }
 
 /// A decrypted shielded output.
-pub struct DecryptedOutput<Note> {
-    /// The index of the output within [`shielded_outputs`].
-    ///
-    /// [`shielded_outputs`]: zcash_primitives::transaction::TransactionData
-    pub index: usize,
+pub struct DecryptedOutput<Note, AccountId> {
+    index: usize,
+    note: Note,
+    account: AccountId,
+    memo: MemoBytes,
+    transfer_type: TransferType,
+}
+
+impl<Note, AccountId> DecryptedOutput<Note, AccountId> {
+    pub fn new(
+        index: usize,
+        note: Note,
+        account: AccountId,
+        memo: MemoBytes,
+        transfer_type: TransferType,
+    ) -> Self {
+        Self {
+            index,
+            note,
+            account,
+            memo,
+            transfer_type,
+        }
+    }
+
+    /// The index of the output within the shielded outputs of the Sapling bundle or the actions of
+    /// the Orchard bundle, depending upon the type of [`Self::note`].
+    pub fn index(&self) -> usize {
+        self.index
+    }
+
     /// The note within the output.
-    pub note: Note,
+    pub fn note(&self) -> &Note {
+        &self.note
+    }
+
     /// The account that decrypted the note.
-    pub account: AccountId,
+    pub fn account(&self) -> &AccountId {
+        &self.account
+    }
+
     /// The memo bytes included with the note.
-    pub memo: MemoBytes,
-    /// True if this output was recovered using an [`OutgoingViewingKey`], meaning that
-    /// this is a logical output of the transaction.
-    ///
-    /// [`OutgoingViewingKey`]: zcash_primitives::keys::OutgoingViewingKey
-    pub transfer_type: TransferType,
+    pub fn memo(&self) -> &MemoBytes {
+        &self.memo
+    }
+
+    /// Returns a [`TransferType`] value that is determined based upon what type of key was used to
+    /// decrypt the transaction.
+    pub fn transfer_type(&self) -> TransferType {
+        self.transfer_type
+    }
+}
+
+impl<A> DecryptedOutput<sapling::Note, A> {
+    pub fn note_value(&self) -> NonNegativeAmount {
+        NonNegativeAmount::from_u64(self.note.value().inner())
+            .expect("Sapling note value is expected to have been validated by consensus.")
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl<A> DecryptedOutput<orchard::note::Note, A> {
+    pub fn note_value(&self) -> NonNegativeAmount {
+        NonNegativeAmount::from_u64(self.note.value().inner())
+            .expect("Orchard note value is expected to have been validated by consensus.")
+    }
 }
 
 /// Scans a [`Transaction`] for any information that can be decrypted by the set of
 /// [`UnifiedFullViewingKey`]s.
-pub fn decrypt_transaction<P: consensus::Parameters>(
+pub fn decrypt_transaction<'a, P: consensus::Parameters, AccountId: Copy>(
     params: &P,
     height: BlockHeight,
-    tx: &Transaction,
+    tx: &'a Transaction,
     ufvks: &HashMap<AccountId, UnifiedFullViewingKey>,
-) -> Vec<DecryptedOutput<sapling::Note>> {
-    tx.sapling_bundle()
+) -> DecryptedTransaction<'a, AccountId> {
+    let zip212_enforcement = zip212_enforcement(params, height);
+    let sapling_bundle = tx.sapling_bundle();
+    let sapling_outputs = sapling_bundle
         .iter()
         .flat_map(|bundle| {
             ufvks
                 .iter()
-                .flat_map(move |(account, ufvk)| {
-                    ufvk.sapling().into_iter().map(|dfvk| (*account, dfvk))
-                })
-                .flat_map(move |(account, dfvk)| {
+                .flat_map(|(account, ufvk)| ufvk.sapling().into_iter().map(|dfvk| (*account, dfvk)))
+                .flat_map(|(account, dfvk)| {
+                    let sapling_domain = SaplingDomain::new(zip212_enforcement);
                     let ivk_external =
                         PreparedIncomingViewingKey::new(&dfvk.to_ivk(Scope::External));
                     let ivk_internal =
@@ -76,31 +127,97 @@ pub fn decrypt_transaction<P: consensus::Parameters>(
                         .iter()
                         .enumerate()
                         .flat_map(move |(index, output)| {
-                            try_sapling_note_decryption(params, height, &ivk_external, output)
+                            try_note_decryption(&sapling_domain, &ivk_external, output)
                                 .map(|ret| (ret, TransferType::Incoming))
                                 .or_else(|| {
-                                    try_sapling_note_decryption(
-                                        params,
-                                        height,
-                                        &ivk_internal,
+                                    try_note_decryption(&sapling_domain, &ivk_internal, output)
+                                        .map(|ret| (ret, TransferType::WalletInternal))
+                                })
+                                .or_else(|| {
+                                    try_output_recovery_with_ovk(
+                                        &sapling_domain,
+                                        &ovk,
                                         output,
+                                        output.cv(),
+                                        output.out_ciphertext(),
+                                    )
+                                    .map(|ret| (ret, TransferType::Outgoing))
+                                })
+                                .into_iter()
+                                .map(move |((note, _, memo), transfer_type)| {
+                                    DecryptedOutput::new(
+                                        index,
+                                        note,
+                                        account,
+                                        MemoBytes::from_bytes(&memo).expect("correct length"),
+                                        transfer_type,
                                     )
-                                    .map(|ret| (ret, TransferType::WalletInternal))
                                 })
+                        })
+                })
+        })
+        .collect();
+
+    #[cfg(feature = "orchard")]
+    let orchard_bundle = tx.orchard_bundle();
+    #[cfg(feature = "orchard")]
+    let orchard_outputs = orchard_bundle
+        .iter()
+        .flat_map(|bundle| {
+            ufvks
+                .iter()
+                .flat_map(|(account, ufvk)| ufvk.orchard().into_iter().map(|fvk| (*account, fvk)))
+                .flat_map(|(account, fvk)| {
+                    let ivk_external = orchard::keys::PreparedIncomingViewingKey::new(
+                        &fvk.to_ivk(Scope::External),
+                    );
+                    let ivk_internal = orchard::keys::PreparedIncomingViewingKey::new(
+                        &fvk.to_ivk(Scope::Internal),
+                    );
+                    let ovk = fvk.to_ovk(Scope::External);
+
+                    bundle
+                        .actions()
+                        .iter()
+                        .enumerate()
+                        .flat_map(move |(index, action)| {
+                            let domain = OrchardDomain::for_action(action);
+                            try_note_decryption(&domain, &ivk_external, action)
+                                .map(|ret| (ret, TransferType::Incoming))
                                 .or_else(|| {
-                                    try_sapling_output_recovery(params, height, &ovk, output)
-                                        .map(|ret| (ret, TransferType::Outgoing))
+                                    try_note_decryption(&domain, &ivk_internal, action)
+                                        .map(|ret| (ret, TransferType::WalletInternal))
+                                })
+                                .or_else(|| {
+                                    try_output_recovery_with_ovk(
+                                        &domain,
+                                        &ovk,
+                                        action,
+                                        action.cv_net(),
+                                        &action.encrypted_note().out_ciphertext,
+                                    )
+                                    .map(|ret| (ret, TransferType::Outgoing))
                                 })
                                 .into_iter()
-                                .map(move |((note, _, memo), transfer_type)| DecryptedOutput {
-                                    index,
-                                    note,
-                                    account,
-                                    memo,
-                                    transfer_type,
+                                .map(move |((note, _, memo), transfer_type)| {
+                                    DecryptedOutput::new(
+                                        index,
+                                        note,
+                                        account,
+                                        MemoBytes::from_bytes(&memo).expect("correct length"),
+                                        transfer_type,
+                                    )
                                 })
                         })
                 })
         })
-        .collect()
+        .collect();
+
+    DecryptedTransaction::new(
+        Some(height),
+        tx,
+        sapling_outputs,
+        #[cfg(feature = "orchard")]
+        orchard_outputs,
+    )
 }
diff --git a/zcash_client_backend/src/fees.rs b/zcash_client_backend/src/fees.rs
index b83477159e..1950c05092 100644
--- a/zcash_client_backend/src/fees.rs
+++ b/zcash_client_backend/src/fees.rs
@@ -1,31 +1,153 @@
-use std::fmt;
+use std::{
+    fmt::{self, Debug, Display},
+    num::{NonZeroU64, NonZeroUsize},
+};
 
 use zcash_primitives::{
     consensus::{self, BlockHeight},
+    memo::MemoBytes,
     transaction::{
-        components::{
-            amount::{Amount, BalanceError},
-            sapling::fees as sapling,
-            transparent::fees as transparent,
-            OutPoint,
+        components::{amount::NonNegativeAmount, OutPoint},
+        fees::{
+            transparent::{self, InputSize},
+            zip317::{self as prim_zip317},
+            FeeRule,
         },
-        fees::FeeRule,
     },
 };
+use zcash_protocol::{PoolType, ShieldedProtocol};
 
+use crate::data_api::InputSource;
+
+pub mod common;
+#[cfg(feature = "non-standard-fees")]
 pub mod fixed;
+#[cfg(feature = "orchard")]
+pub mod orchard;
+pub mod sapling;
+pub mod standard;
 pub mod zip317;
 
-/// A proposed change amount and output pool.
+/// An enumeration of the standard fee rules supported by the wallet backend.
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub enum StandardFeeRule {
+    Zip317,
+}
+
+impl FeeRule for StandardFeeRule {
+    type Error = prim_zip317::FeeError;
+
+    fn fee_required<P: consensus::Parameters>(
+        &self,
+        params: &P,
+        target_height: BlockHeight,
+        transparent_input_sizes: impl IntoIterator<Item = InputSize>,
+        transparent_output_sizes: impl IntoIterator<Item = usize>,
+        sapling_input_count: usize,
+        sapling_output_count: usize,
+        orchard_action_count: usize,
+    ) -> Result<NonNegativeAmount, Self::Error> {
+        #[allow(deprecated)]
+        match self {
+            Self::Zip317 => prim_zip317::FeeRule::standard().fee_required(
+                params,
+                target_height,
+                transparent_input_sizes,
+                transparent_output_sizes,
+                sapling_input_count,
+                sapling_output_count,
+                orchard_action_count,
+            ),
+        }
+    }
+}
+
+/// `ChangeValue` represents either a proposed change output to a shielded pool
+/// (with an optional change memo), or if the "transparent-inputs" feature is
+/// enabled, an ephemeral output to the transparent pool.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ChangeValue(ChangeValueInner);
+
 #[derive(Clone, Debug, PartialEq, Eq)]
-pub enum ChangeValue {
-    Sapling(Amount),
+enum ChangeValueInner {
+    Shielded {
+        protocol: ShieldedProtocol,
+        value: NonNegativeAmount,
+        memo: Option<MemoBytes>,
+    },
+    #[cfg(feature = "transparent-inputs")]
+    EphemeralTransparent { value: NonNegativeAmount },
 }
 
 impl ChangeValue {
-    pub fn value(&self) -> Amount {
-        match self {
-            ChangeValue::Sapling(value) => *value,
+    /// Constructs a new ephemeral transparent output value.
+    #[cfg(feature = "transparent-inputs")]
+    pub fn ephemeral_transparent(value: NonNegativeAmount) -> Self {
+        Self(ChangeValueInner::EphemeralTransparent { value })
+    }
+
+    /// Constructs a new change value that will be created as a shielded output.
+    pub fn shielded(
+        protocol: ShieldedProtocol,
+        value: NonNegativeAmount,
+        memo: Option<MemoBytes>,
+    ) -> Self {
+        Self(ChangeValueInner::Shielded {
+            protocol,
+            value,
+            memo,
+        })
+    }
+
+    /// Constructs a new change value that will be created as a Sapling output.
+    pub fn sapling(value: NonNegativeAmount, memo: Option<MemoBytes>) -> Self {
+        Self::shielded(ShieldedProtocol::Sapling, value, memo)
+    }
+
+    /// Constructs a new change value that will be created as an Orchard output.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(value: NonNegativeAmount, memo: Option<MemoBytes>) -> Self {
+        Self::shielded(ShieldedProtocol::Orchard, value, memo)
+    }
+
+    /// Returns the pool to which the change or ephemeral output should be sent.
+    pub fn output_pool(&self) -> PoolType {
+        match &self.0 {
+            ChangeValueInner::Shielded { protocol, .. } => PoolType::Shielded(*protocol),
+            #[cfg(feature = "transparent-inputs")]
+            ChangeValueInner::EphemeralTransparent { .. } => PoolType::Transparent,
+        }
+    }
+
+    /// Returns the value of the change or ephemeral output to be created, in zatoshis.
+    pub fn value(&self) -> NonNegativeAmount {
+        match &self.0 {
+            ChangeValueInner::Shielded { value, .. } => *value,
+            #[cfg(feature = "transparent-inputs")]
+            ChangeValueInner::EphemeralTransparent { value } => *value,
+        }
+    }
+
+    /// Returns the memo to be associated with the output.
+    pub fn memo(&self) -> Option<&MemoBytes> {
+        match &self.0 {
+            ChangeValueInner::Shielded { memo, .. } => memo.as_ref(),
+            #[cfg(feature = "transparent-inputs")]
+            ChangeValueInner::EphemeralTransparent { .. } => None,
+        }
+    }
+
+    /// Whether this is to be an ephemeral output.
+    #[cfg_attr(
+        not(feature = "transparent-inputs"),
+        doc = "This is always false because the `transparent-inputs` feature is
+               not enabled."
+    )]
+    pub fn is_ephemeral(&self) -> bool {
+        match &self.0 {
+            ChangeValueInner::Shielded { .. } => false,
+            #[cfg(feature = "transparent-inputs")]
+            ChangeValueInner::EphemeralTransparent { .. } => true,
         }
     }
 }
@@ -36,38 +158,46 @@ impl ChangeValue {
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct TransactionBalance {
     proposed_change: Vec<ChangeValue>,
-    fee_required: Amount,
-    total: Amount,
+    fee_required: NonNegativeAmount,
+
+    // A cache for the sum of proposed change and fee; we compute it on construction anyway, so we
+    // cache the resulting value.
+    total: NonNegativeAmount,
 }
 
 impl TransactionBalance {
     /// Constructs a new balance from its constituent parts.
-    pub fn new(proposed_change: Vec<ChangeValue>, fee_required: Amount) -> Option<Self> {
-        proposed_change
+    pub fn new(
+        proposed_change: Vec<ChangeValue>,
+        fee_required: NonNegativeAmount,
+    ) -> Result<Self, ()> {
+        let total = proposed_change
             .iter()
-            .map(|v| v.value())
-            .chain(Some(fee_required))
-            .sum::<Option<Amount>>()
-            .map(|total| TransactionBalance {
-                proposed_change,
-                fee_required,
-                total,
-            })
+            .map(|c| c.value())
+            .chain(Some(fee_required).into_iter())
+            .sum::<Option<NonNegativeAmount>>()
+            .ok_or(())?;
+
+        Ok(Self {
+            proposed_change,
+            fee_required,
+            total,
+        })
     }
 
-    /// The change values proposed by the [`ChangeStrategy`] that computed this balance.  
+    /// The change values proposed by the [`ChangeStrategy`] that computed this balance.
     pub fn proposed_change(&self) -> &[ChangeValue] {
         &self.proposed_change
     }
 
     /// Returns the fee computed for the transaction, assuming that the suggested
     /// change outputs are added to the transaction.
-    pub fn fee_required(&self) -> Amount {
+    pub fn fee_required(&self) -> NonNegativeAmount {
         self.fee_required
     }
 
     /// Returns the sum of the proposed change outputs and the required fee.
-    pub fn total(&self) -> Amount {
+    pub fn total(&self) -> NonNegativeAmount {
         self.total
     }
 }
@@ -79,22 +209,37 @@ pub enum ChangeError<E, NoteRefT> {
     /// required outputs and fees.
     InsufficientFunds {
         /// The total of the inputs provided to change selection
-        available: Amount,
+        available: NonNegativeAmount,
         /// The total amount of input value required to fund the requested outputs,
         /// including the required fees.
-        required: Amount,
+        required: NonNegativeAmount,
     },
-    /// Some of the inputs provided to the transaction were determined to currently have no
-    /// economic value (i.e. their inclusion in a transaction causes fees to rise in an amount
-    /// greater than their value.)
+    /// Some of the inputs provided to the transaction have value less than the
+    /// marginal fee, and could not be determined to have any economic value in
+    /// the context of this input selection.
+    ///
+    /// This determination is potentially conservative in the sense that inputs
+    /// with value less than or equal to the marginal fee might be excluded, even
+    /// though in practice they would not cause the fee to increase. Inputs with
+    /// value greater than the marginal fee will never be excluded.
+    ///
+    /// The ordering of the inputs in each list is unspecified.
     DustInputs {
-        /// The outpoints corresponding to transparent inputs having no current economic value.
+        /// The outpoints for transparent inputs that could not be determined to
+        /// have economic value in the context of this input selection.
         transparent: Vec<OutPoint>,
-        /// The identifiers for Sapling inputs having not current economic value
+        /// The identifiers for Sapling inputs that could not be determined to
+        /// have economic value in the context of this input selection.
         sapling: Vec<NoteRefT>,
+        /// The identifiers for Orchard inputs that could not be determined to
+        /// have economic value in the context of this input selection.
+        #[cfg(feature = "orchard")]
+        orchard: Vec<NoteRefT>,
     },
     /// An error occurred that was specific to the change selection strategy in use.
     StrategyError(E),
+    /// The proposed bundle structure would violate bundle type construction rules.
+    BundleError(&'static str),
 }
 
 impl<CE: fmt::Display, N: fmt::Display> fmt::Display for ChangeError<CE, N> {
@@ -106,48 +251,73 @@ impl<CE: fmt::Display, N: fmt::Display> fmt::Display for ChangeError<CE, N> {
             } => write!(
                 f,
                 "Insufficient funds: required {} zatoshis, but only {} zatoshis were available.",
-                i64::from(required),
-                i64::from(available)
+                u64::from(*required),
+                u64::from(*available)
             ),
             ChangeError::DustInputs {
                 transparent,
                 sapling,
+                #[cfg(feature = "orchard")]
+                orchard,
             } => {
+                #[cfg(feature = "orchard")]
+                let orchard_len = orchard.len();
+                #[cfg(not(feature = "orchard"))]
+                let orchard_len = 0;
+
                 // we can't encode the UA to its string representation because we
                 // don't have network parameters here
-                write!(f, "Insufficient funds: {} dust inputs were present, but would cost more to spend than they are worth.", transparent.len() + sapling.len())
+                write!(
+                    f,
+                    "Insufficient funds: {} dust inputs were present, but would cost more to spend than they are worth.",
+                    transparent.len() + sapling.len() + orchard_len,
+                )
             }
             ChangeError::StrategyError(err) => {
                 write!(f, "{}", err)
             }
+            ChangeError::BundleError(err) => {
+                write!(
+                    f,
+                    "The proposed transaction structure violates bundle type constraints: {}",
+                    err
+                )
+            }
         }
     }
 }
 
-impl<NoteRefT> From<BalanceError> for ChangeError<BalanceError, NoteRefT> {
-    fn from(err: BalanceError) -> ChangeError<BalanceError, NoteRefT> {
-        ChangeError::StrategyError(err)
+impl<E, N> std::error::Error for ChangeError<E, N>
+where
+    E: Debug + Display + std::error::Error + 'static,
+    N: Debug + Display + 'static,
+{
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match &self {
+            ChangeError::StrategyError(e) => Some(e),
+            _ => None,
+        }
     }
 }
 
-/// An enumeration of actions to tak when a transaction would potentially create dust
-/// outputs (outputs that are likely to be without economic value due to fee rules.)
+/// An enumeration of actions to take when a transaction would potentially create dust
+/// outputs (outputs that are likely to be without economic value due to fee rules).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum DustAction {
     /// Do not allow creation of dust outputs; instead, require that additional inputs be provided.
     Reject,
     /// Explicitly allow the creation of dust change amounts greater than the specified value.
     AllowDustChange,
-    /// Allow dust amounts to be added to the transaction fee
+    /// Allow dust amounts to be added to the transaction fee.
     AddDustToFee,
 }
 
 /// A policy describing how a [`ChangeStrategy`] should treat potentially dust-valued change
-/// outputs (outputs that are likely to be without economic value due to fee rules.)
+/// outputs (outputs that are likely to be without economic value due to fee rules).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub struct DustOutputPolicy {
     action: DustAction,
-    dust_threshold: Option<Amount>,
+    dust_threshold: Option<NonNegativeAmount>,
 }
 
 impl DustOutputPolicy {
@@ -155,22 +325,22 @@ impl DustOutputPolicy {
     ///
     /// A dust policy created with `None` as the dust threshold will delegate determination
     /// of the dust threshold to the change strategy that is evaluating the strategy; this
-    /// recommended, but an explicit value (including zero) may be provided to explicitly
+    /// is recommended, but an explicit value (including zero) may be provided to explicitly
     /// override the determination of the change strategy.
-    pub fn new(action: DustAction, dust_threshold: Option<Amount>) -> Self {
+    pub fn new(action: DustAction, dust_threshold: Option<NonNegativeAmount>) -> Self {
         Self {
             action,
             dust_threshold,
         }
     }
 
-    /// Returns the action to take in the event that a dust change amount would be produced
+    /// Returns the action to take in the event that a dust change amount would be produced.
     pub fn action(&self) -> DustAction {
         self.action
     }
     /// Returns a value that will be used to override the dust determination logic of the
     /// change policy, if any.
-    pub fn dust_threshold(&self) -> Option<Amount> {
+    pub fn dust_threshold(&self) -> Option<NonNegativeAmount> {
         self.dust_threshold
     }
 }
@@ -181,16 +351,177 @@ impl Default for DustOutputPolicy {
     }
 }
 
+/// A policy that describes how change output should be split into multiple notes for the purpose
+/// of note management.
+///
+/// If an account contains at least [`Self::target_output_count`] notes having at least value
+/// [`Self::min_split_output_value`], this policy will recommend a single output; if the account
+/// contains fewer such notes, this policy will recommend that multiple outputs be produced in
+/// order to achieve the target.
+#[derive(Clone, Copy, Debug)]
+pub struct SplitPolicy {
+    target_output_count: NonZeroUsize,
+    min_split_output_value: Option<NonNegativeAmount>,
+}
+
+impl SplitPolicy {
+    /// In the case that no other conditions provided by the user are available to fall back on,
+    /// a default value of [`MARGINAL_FEE`] * 100 will be used as the "minimum usable note value"
+    /// when retrieving wallet metadata.
+    ///
+    /// [`MARGINAL_FEE`]: zcash_primitives::transaction::fees::zip317::MARGINAL_FEE
+    pub(crate) const MIN_NOTE_VALUE: NonNegativeAmount = NonNegativeAmount::const_from_u64(500000);
+
+    /// Constructs a new [`SplitPolicy`] that splits change to ensure the given number of spendable
+    /// outputs exists within an account, each having at least the specified minimum note value.
+    pub fn with_min_output_value(
+        target_output_count: NonZeroUsize,
+        min_split_output_value: NonNegativeAmount,
+    ) -> Self {
+        Self {
+            target_output_count,
+            min_split_output_value: Some(min_split_output_value),
+        }
+    }
+
+    /// Constructs a [`SplitPolicy`] that prescribes a single output (no splitting).
+    pub fn single_output() -> Self {
+        Self {
+            target_output_count: NonZeroUsize::MIN,
+            min_split_output_value: None,
+        }
+    }
+
+    /// Returns the number of outputs that this policy will attempt to ensure that the wallet has
+    /// available for spending.
+    pub fn target_output_count(&self) -> NonZeroUsize {
+        self.target_output_count
+    }
+
+    /// Returns the minimum value for a note resulting from splitting of change.
+    pub fn min_split_output_value(&self) -> Option<NonNegativeAmount> {
+        self.min_split_output_value
+    }
+
+    /// Returns the number of output notes to produce from the given total change value, given the
+    /// total value and number of existing unspent notes in the account and this policy.
+    ///
+    /// If splitting change to produce [`Self::target_output_count`] would result in notes of value
+    /// less than [`Self::min_split_output_value`], then this will suggest a smaller number of
+    /// splits so that each resulting change note has sufficient value.
+    pub fn split_count(
+        &self,
+        existing_notes: Option<usize>,
+        existing_notes_total: Option<NonNegativeAmount>,
+        total_change: NonNegativeAmount,
+    ) -> NonZeroUsize {
+        fn to_nonzero_u64(value: usize) -> NonZeroU64 {
+            NonZeroU64::new(u64::try_from(value).expect("usize fits into u64"))
+                .expect("NonZeroU64 input derived from NonZeroUsize")
+        }
+
+        let mut split_count = NonZeroUsize::new(
+            usize::from(self.target_output_count)
+                .saturating_sub(existing_notes.unwrap_or(usize::MAX)),
+        )
+        .unwrap_or(NonZeroUsize::MIN);
+
+        let min_split_output_value = self.min_split_output_value.or_else(|| {
+            // If no minimum split output size is set, we choose the minimum split size to be a
+            // quarter of the average value of notes in the wallet after the transaction.
+            (existing_notes_total + total_change).map(|total| {
+                *total
+                    .div_with_remainder(to_nonzero_u64(
+                        usize::from(self.target_output_count).saturating_mul(4),
+                    ))
+                    .quotient()
+            })
+        });
+
+        if let Some(min_split_output_value) = min_split_output_value {
+            loop {
+                let per_output_change =
+                    total_change.div_with_remainder(to_nonzero_u64(usize::from(split_count)));
+                if *per_output_change.quotient() >= min_split_output_value {
+                    return split_count;
+                } else if let Some(new_count) = NonZeroUsize::new(usize::from(split_count) - 1) {
+                    split_count = new_count;
+                } else {
+                    // We always create at least one change output.
+                    return NonZeroUsize::MIN;
+                }
+            }
+        } else {
+            NonZeroUsize::MIN
+        }
+    }
+}
+
+/// `EphemeralBalance` describes the ephemeral input or output value for a transaction. It is used
+/// in fee computation for series of transactions that use an ephemeral transparent output in an
+/// intermediate step, such as when sending from a shielded pool to a [ZIP 320] "TEX" address.
+///
+/// [ZIP 320]: https://zips.z.cash/zip-0320
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum EphemeralBalance {
+    Input(NonNegativeAmount),
+    Output(NonNegativeAmount),
+}
+
+impl EphemeralBalance {
+    pub fn is_input(&self) -> bool {
+        matches!(self, EphemeralBalance::Input(_))
+    }
+
+    pub fn is_output(&self) -> bool {
+        matches!(self, EphemeralBalance::Output(_))
+    }
+
+    pub fn ephemeral_input_amount(&self) -> Option<NonNegativeAmount> {
+        match self {
+            EphemeralBalance::Input(v) => Some(*v),
+            EphemeralBalance::Output(_) => None,
+        }
+    }
+
+    pub fn ephemeral_output_amount(&self) -> Option<NonNegativeAmount> {
+        match self {
+            EphemeralBalance::Input(_) => None,
+            EphemeralBalance::Output(v) => Some(*v),
+        }
+    }
+}
+
 /// A trait that represents the ability to compute the suggested change and fees that must be paid
 /// by a transaction having a specified set of inputs and outputs.
 pub trait ChangeStrategy {
-    type FeeRule: FeeRule;
+    type FeeRule: FeeRule + Clone;
     type Error;
 
+    /// The type of metadata source that this change strategy requires in order to be able to
+    /// retrieve required wallet metadata. If more capabilities are required of the backend than
+    /// are exposed in the [`InputSource`] trait, the implementer of this trait should define their
+    /// own trait that descends from [`InputSource`] and adds the required capabilities there, and
+    /// then implement that trait for their desired database backend.
+    type MetaSource: InputSource;
+
+    /// Tye type of wallet metadata that this change strategy relies upon in order to compute
+    /// change.
+    type AccountMetaT;
+
     /// Returns the fee rule that this change strategy will respect when performing
     /// balance computations.
     fn fee_rule(&self) -> &Self::FeeRule;
 
+    /// Uses the provided metadata source to obtain the wallet metadata required for change
+    /// creation determinations.
+    fn fetch_wallet_meta(
+        &self,
+        meta_source: &Self::MetaSource,
+        account: <Self::MetaSource as InputSource>::AccountId,
+        exclude: &[<Self::MetaSource as InputSource>::NoteRef],
+    ) -> Result<Self::AccountMetaT, <Self::MetaSource as InputSource>::Error>;
+
     /// Computes the totals of inputs, suggested change amounts, and fees given the
     /// provided inputs and outputs being used to construct a transaction.
     ///
@@ -198,6 +529,24 @@ pub trait ChangeStrategy {
     /// change outputs recommended by this operation. If insufficient funds are available to
     /// supply the requested outputs and required fees, implementations should return
     /// [`ChangeError::InsufficientFunds`].
+    ///
+    /// If the inputs include notes or UTXOs that are not economic to spend in the context
+    /// of this input selection, a [`ChangeError::DustInputs`] error can be returned
+    /// indicating inputs that should be removed from the selection (all of which will
+    /// have value less than or equal to the marginal fee). The caller should order the
+    /// inputs from most to least preferred to spend within each pool, so that the most
+    /// preferred ones are less likely to be indicated to remove.
+    ///
+    /// - `ephemeral_balance`: if the transaction is to be constructed with either an
+    ///   ephemeral transparent input or an ephemeral transparent output this argument
+    ///   may be used to provide the value of that input or output. The value of this
+    ///   argument should be `None` in the case that there are no such items.
+    /// - `wallet_meta`: Additional wallet metadata that the change strategy may use
+    ///   in determining how to construct change outputs. This wallet metadata value
+    ///   should be computed excluding the inputs provided in the `transparent_inputs`,
+    ///   `sapling`, and `orchard` arguments.
+    ///
+    /// [ZIP 320]: https://zips.z.cash/zip-0320
     #[allow(clippy::too_many_arguments)]
     fn compute_balance<P: consensus::Parameters, NoteRefT: Clone>(
         &self,
@@ -205,20 +554,26 @@ pub trait ChangeStrategy {
         target_height: BlockHeight,
         transparent_inputs: &[impl transparent::InputView],
         transparent_outputs: &[impl transparent::OutputView],
-        sapling_inputs: &[impl sapling::InputView<NoteRefT>],
-        sapling_outputs: &[impl sapling::OutputView],
-        dust_output_policy: &DustOutputPolicy,
+        sapling: &impl sapling::BundleView<NoteRefT>,
+        #[cfg(feature = "orchard")] orchard: &impl orchard::BundleView<NoteRefT>,
+        ephemeral_balance: Option<&EphemeralBalance>,
+        wallet_meta: &Self::AccountMetaT,
     ) -> Result<TransactionBalance, ChangeError<Self::Error, NoteRefT>>;
 }
 
 #[cfg(test)]
 pub(crate) mod tests {
-    use zcash_primitives::transaction::components::{
-        amount::Amount,
-        sapling::fees as sapling,
-        transparent::{fees as transparent, OutPoint, TxOut},
+    use zcash_primitives::transaction::{
+        components::{
+            amount::NonNegativeAmount,
+            transparent::{OutPoint, TxOut},
+        },
+        fees::transparent,
     };
 
+    use super::sapling;
+
+    #[derive(Debug)]
     pub(crate) struct TestTransparentInput {
         pub outpoint: OutPoint,
         pub coin: TxOut,
@@ -235,14 +590,14 @@ pub(crate) mod tests {
 
     pub(crate) struct TestSaplingInput {
         pub note_id: u32,
-        pub value: Amount,
+        pub value: NonNegativeAmount,
     }
 
     impl sapling::InputView<u32> for TestSaplingInput {
         fn note_id(&self) -> &u32 {
             &self.note_id
         }
-        fn value(&self) -> Amount {
+        fn value(&self) -> NonNegativeAmount {
             self.value
         }
     }
diff --git a/zcash_client_backend/src/fees/common.rs b/zcash_client_backend/src/fees/common.rs
new file mode 100644
index 0000000000..8aa7f38f40
--- /dev/null
+++ b/zcash_client_backend/src/fees/common.rs
@@ -0,0 +1,783 @@
+use core::cmp::{max, min};
+use std::num::{NonZeroU64, NonZeroUsize};
+
+use zcash_primitives::{
+    consensus::{self, BlockHeight},
+    memo::MemoBytes,
+    transaction::{
+        components::amount::{BalanceError, NonNegativeAmount},
+        fees::{transparent, zip317::MINIMUM_FEE, zip317::P2PKH_STANDARD_OUTPUT_SIZE, FeeRule},
+    },
+};
+use zcash_protocol::ShieldedProtocol;
+
+use crate::data_api::AccountMeta;
+
+use super::{
+    sapling as sapling_fees, ChangeError, ChangeValue, DustAction, DustOutputPolicy,
+    EphemeralBalance, SplitPolicy, TransactionBalance,
+};
+
+#[cfg(feature = "orchard")]
+use super::orchard as orchard_fees;
+
+pub(crate) struct NetFlows {
+    t_in: NonNegativeAmount,
+    t_out: NonNegativeAmount,
+    sapling_in: NonNegativeAmount,
+    sapling_out: NonNegativeAmount,
+    orchard_in: NonNegativeAmount,
+    orchard_out: NonNegativeAmount,
+}
+
+impl NetFlows {
+    fn total_in(&self) -> Result<NonNegativeAmount, BalanceError> {
+        (self.t_in + self.sapling_in + self.orchard_in).ok_or(BalanceError::Overflow)
+    }
+    fn total_out(&self) -> Result<NonNegativeAmount, BalanceError> {
+        (self.t_out + self.sapling_out + self.orchard_out).ok_or(BalanceError::Overflow)
+    }
+    /// Returns true iff the flows excluding change are fully transparent.
+    fn is_transparent(&self) -> bool {
+        !(self.sapling_in.is_positive()
+            || self.sapling_out.is_positive()
+            || self.orchard_in.is_positive()
+            || self.orchard_out.is_positive())
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn calculate_net_flows<NoteRefT: Clone, F: FeeRule, E>(
+    transparent_inputs: &[impl transparent::InputView],
+    transparent_outputs: &[impl transparent::OutputView],
+    sapling: &impl sapling_fees::BundleView<NoteRefT>,
+    #[cfg(feature = "orchard")] orchard: &impl orchard_fees::BundleView<NoteRefT>,
+    ephemeral_balance: Option<&EphemeralBalance>,
+) -> Result<NetFlows, ChangeError<E, NoteRefT>>
+where
+    E: From<F::Error> + From<BalanceError>,
+{
+    let overflow = || ChangeError::StrategyError(E::from(BalanceError::Overflow));
+
+    let t_in = transparent_inputs
+        .iter()
+        .map(|t_in| t_in.coin().value)
+        .chain(ephemeral_balance.and_then(|b| b.ephemeral_input_amount()))
+        .sum::<Option<_>>()
+        .ok_or_else(overflow)?;
+    let t_out = transparent_outputs
+        .iter()
+        .map(|t_out| t_out.value())
+        .chain(ephemeral_balance.and_then(|b| b.ephemeral_output_amount()))
+        .sum::<Option<_>>()
+        .ok_or_else(overflow)?;
+    let sapling_in = sapling
+        .inputs()
+        .iter()
+        .map(sapling_fees::InputView::<NoteRefT>::value)
+        .sum::<Option<_>>()
+        .ok_or_else(overflow)?;
+    let sapling_out = sapling
+        .outputs()
+        .iter()
+        .map(sapling_fees::OutputView::value)
+        .sum::<Option<_>>()
+        .ok_or_else(overflow)?;
+
+    #[cfg(feature = "orchard")]
+    let orchard_in = orchard
+        .inputs()
+        .iter()
+        .map(orchard_fees::InputView::<NoteRefT>::value)
+        .sum::<Option<_>>()
+        .ok_or_else(overflow)?;
+    #[cfg(not(feature = "orchard"))]
+    let orchard_in = NonNegativeAmount::ZERO;
+
+    #[cfg(feature = "orchard")]
+    let orchard_out = orchard
+        .outputs()
+        .iter()
+        .map(orchard_fees::OutputView::value)
+        .sum::<Option<_>>()
+        .ok_or_else(overflow)?;
+    #[cfg(not(feature = "orchard"))]
+    let orchard_out = NonNegativeAmount::ZERO;
+
+    Ok(NetFlows {
+        t_in,
+        t_out,
+        sapling_in,
+        sapling_out,
+        orchard_in,
+        orchard_out,
+    })
+}
+
+/// Decide which shielded pool change should go to if there is any.
+pub(crate) fn select_change_pool(
+    _net_flows: &NetFlows,
+    _fallback_change_pool: ShieldedProtocol,
+) -> ShieldedProtocol {
+    // TODO: implement a less naive strategy for selecting the pool to which change will be sent.
+    #[cfg(feature = "orchard")]
+    if _net_flows.orchard_in.is_positive() || _net_flows.orchard_out.is_positive() {
+        // Send change to Orchard if we're spending any Orchard inputs or creating any Orchard outputs.
+        ShieldedProtocol::Orchard
+    } else if _net_flows.sapling_in.is_positive() || _net_flows.sapling_out.is_positive() {
+        // Otherwise, send change to Sapling if we're spending any Sapling inputs or creating any
+        // Sapling outputs, so that we avoid pool-crossing.
+        ShieldedProtocol::Sapling
+    } else {
+        // The flows are transparent, so there may not be change. If there is, the caller
+        // gets to decide where to shield it.
+        _fallback_change_pool
+    }
+    #[cfg(not(feature = "orchard"))]
+    ShieldedProtocol::Sapling
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct OutputManifest {
+    transparent: usize,
+    sapling: usize,
+    orchard: usize,
+}
+
+impl OutputManifest {
+    const ZERO: OutputManifest = OutputManifest {
+        transparent: 0,
+        sapling: 0,
+        orchard: 0,
+    };
+
+    pub(crate) fn sapling(&self) -> usize {
+        self.sapling
+    }
+
+    pub(crate) fn orchard(&self) -> usize {
+        self.orchard
+    }
+
+    pub(crate) fn total_shielded(&self) -> usize {
+        self.sapling + self.orchard
+    }
+}
+
+pub(crate) struct SinglePoolBalanceConfig<'a, P, F> {
+    params: &'a P,
+    fee_rule: &'a F,
+    dust_output_policy: &'a DustOutputPolicy,
+    default_dust_threshold: NonNegativeAmount,
+    split_policy: &'a SplitPolicy,
+    fallback_change_pool: ShieldedProtocol,
+    marginal_fee: NonNegativeAmount,
+    grace_actions: usize,
+}
+
+impl<'a, P, F> SinglePoolBalanceConfig<'a, P, F> {
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) fn new(
+        params: &'a P,
+        fee_rule: &'a F,
+        dust_output_policy: &'a DustOutputPolicy,
+        default_dust_threshold: NonNegativeAmount,
+        split_policy: &'a SplitPolicy,
+        fallback_change_pool: ShieldedProtocol,
+        marginal_fee: NonNegativeAmount,
+        grace_actions: usize,
+    ) -> Self {
+        Self {
+            params,
+            fee_rule,
+            dust_output_policy,
+            default_dust_threshold,
+            split_policy,
+            fallback_change_pool,
+            marginal_fee,
+            grace_actions,
+        }
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn single_pool_output_balance<P: consensus::Parameters, NoteRefT: Clone, F: FeeRule, E>(
+    cfg: SinglePoolBalanceConfig<P, F>,
+    wallet_meta: Option<&AccountMeta>,
+    target_height: BlockHeight,
+    transparent_inputs: &[impl transparent::InputView],
+    transparent_outputs: &[impl transparent::OutputView],
+    sapling: &impl sapling_fees::BundleView<NoteRefT>,
+    #[cfg(feature = "orchard")] orchard: &impl orchard_fees::BundleView<NoteRefT>,
+    change_memo: Option<&MemoBytes>,
+    ephemeral_balance: Option<&EphemeralBalance>,
+) -> Result<TransactionBalance, ChangeError<E, NoteRefT>>
+where
+    E: From<F::Error> + From<BalanceError>,
+{
+    // The change memo, if any, must be attached to the change in the intermediate step that
+    // produces the ephemeral output, and so it should be discarded in the ultimate step; this is
+    // distinguished by identifying that this transaction has ephemeral inputs.
+    let change_memo = change_memo.filter(|_| ephemeral_balance.map_or(true, |b| !b.is_input()));
+
+    let overflow = || ChangeError::StrategyError(E::from(BalanceError::Overflow));
+    let underflow = || ChangeError::StrategyError(E::from(BalanceError::Underflow));
+
+    let net_flows = calculate_net_flows::<NoteRefT, F, E>(
+        transparent_inputs,
+        transparent_outputs,
+        sapling,
+        #[cfg(feature = "orchard")]
+        orchard,
+        ephemeral_balance,
+    )?;
+
+    let change_pool = select_change_pool(&net_flows, cfg.fallback_change_pool);
+    let target_change_count = wallet_meta.map_or(1, |m| {
+        usize::from(cfg.split_policy.target_output_count)
+            // If we cannot determine a total note count, fall back to a single output
+            .saturating_sub(m.total_note_count().unwrap_or(usize::MAX))
+            .max(1)
+    });
+    let target_change_counts = OutputManifest {
+        transparent: 0,
+        sapling: if change_pool == ShieldedProtocol::Sapling {
+            target_change_count
+        } else {
+            0
+        },
+        orchard: if change_pool == ShieldedProtocol::Orchard {
+            target_change_count
+        } else {
+            0
+        },
+    };
+
+    // We don't create a fully-transparent transaction if a change memo is used.
+    let transparent = net_flows.is_transparent() && change_memo.is_none();
+
+    // If we have a non-zero marginal fee, we need to check for uneconomic inputs.
+    // This is basically assuming that fee rules with non-zero marginal fee are
+    // "ZIP 317-like", but we can generalize later if needed.
+    if cfg.marginal_fee.is_positive() {
+        // Is it certain that there will be a change output? If it is not certain,
+        // we should call `check_for_uneconomic_inputs` with `possible_change`
+        // including both possibilities.
+        let possible_change = {
+            // These are the situations where we might not have a change output.
+            if transparent
+                || (cfg.dust_output_policy.action() == DustAction::AddDustToFee
+                    && change_memo.is_none())
+            {
+                vec![OutputManifest::ZERO, target_change_counts]
+            } else {
+                vec![target_change_counts]
+            }
+        };
+
+        check_for_uneconomic_inputs(
+            transparent_inputs,
+            transparent_outputs,
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            cfg.marginal_fee,
+            cfg.grace_actions,
+            &possible_change[..],
+            ephemeral_balance,
+        )?;
+    }
+
+    let total_in = net_flows
+        .total_in()
+        .map_err(|e| ChangeError::StrategyError(E::from(e)))?;
+    let total_out = net_flows
+        .total_out()
+        .map_err(|e| ChangeError::StrategyError(E::from(e)))?;
+
+    let sapling_input_count = sapling
+        .bundle_type()
+        .num_spends(sapling.inputs().len())
+        .map_err(ChangeError::BundleError)?;
+    let sapling_output_count = |change_count| {
+        sapling
+            .bundle_type()
+            .num_outputs(
+                sapling.inputs().len(),
+                sapling.outputs().len() + change_count,
+            )
+            .map_err(ChangeError::BundleError)
+    };
+
+    #[cfg(feature = "orchard")]
+    let orchard_action_count = |change_count| {
+        orchard
+            .bundle_type()
+            .num_actions(
+                orchard.inputs().len(),
+                orchard.outputs().len() + change_count,
+            )
+            .map_err(ChangeError::BundleError)
+    };
+    #[cfg(not(feature = "orchard"))]
+    let orchard_action_count = |change_count: usize| -> Result<usize, ChangeError<E, NoteRefT>> {
+        if change_count != 0 {
+            Err(ChangeError::BundleError(
+                "Nonzero Orchard change requested but the `orchard` feature is not enabled.",
+            ))
+        } else {
+            Ok(0)
+        }
+    };
+
+    // Once we calculate the balance with and without change, there are five cases:
+    //
+    // 1. Insufficient funds even without change.
+    // 2. The fee amount without change exactly cancels out the net flow balance.
+    // 3. The fee amount without change is smaller than the change.
+    //    3a. Insufficient funds once the change output is added.
+    //    3b. The fee amount with change exactly cancels out the net flow balance.
+    //    3c. The fee amount with change leaves a non-zero change value.
+    //
+    // Case 2 happens for the second transaction of a ZIP 320 pair. In that case
+    // the transaction will be fully transparent, and there must be no change.
+    //
+    // If cases 2 or 3b happen for a transaction with any shielded flows, we
+    // want there to be a zero-value shielded change output anyway (i.e. treat
+    // case 2 as case 3, and case 3b as case 3c), because:
+    // * being able to distinguish these cases potentially leaks too much
+    //   information (an adversary that knows the number of external recipients
+    //   and the sum of their outputs learns the sum of the inputs if no change
+    //   output is present); and
+    // * we will then always have an shielded output in which to put change_memo,
+    //   if one is used.
+    //
+    // Note that using the `DustAction::AddDustToFee` policy inherently leaks
+    // more information.
+
+    let transparent_input_sizes = transparent_inputs
+        .iter()
+        .map(|i| i.serialized_size())
+        .chain(
+            ephemeral_balance
+                .and_then(|b| b.ephemeral_input_amount())
+                .map(|_| transparent::InputSize::STANDARD_P2PKH),
+        );
+    let transparent_output_sizes = transparent_outputs
+        .iter()
+        .map(|i| i.serialized_size())
+        .chain(
+            ephemeral_balance
+                .and_then(|b| b.ephemeral_output_amount())
+                .map(|_| P2PKH_STANDARD_OUTPUT_SIZE),
+        );
+
+    let fee_without_change = cfg
+        .fee_rule
+        .fee_required(
+            cfg.params,
+            target_height,
+            transparent_input_sizes.clone(),
+            transparent_output_sizes.clone(),
+            sapling_input_count,
+            sapling_output_count(0)?,
+            orchard_action_count(0)?,
+        )
+        .map_err(|fee_error| ChangeError::StrategyError(E::from(fee_error)))?;
+
+    let fee_with_change = max(
+        fee_without_change,
+        cfg.fee_rule
+            .fee_required(
+                cfg.params,
+                target_height,
+                transparent_input_sizes.clone(),
+                transparent_output_sizes.clone(),
+                sapling_input_count,
+                sapling_output_count(target_change_counts.sapling())?,
+                orchard_action_count(target_change_counts.orchard())?,
+            )
+            .map_err(|fee_error| ChangeError::StrategyError(E::from(fee_error)))?,
+    );
+
+    let total_out_plus_fee_without_change =
+        (total_out + fee_without_change).ok_or_else(overflow)?;
+    let total_out_plus_fee_with_change = (total_out + fee_with_change).ok_or_else(overflow)?;
+
+    #[allow(unused_mut)]
+    let (mut change, fee) = {
+        if transparent && total_in < total_out_plus_fee_without_change {
+            // Case 1 for a tx with all transparent flows.
+            return Err(ChangeError::InsufficientFunds {
+                available: total_in,
+                required: total_out_plus_fee_without_change,
+            });
+        } else if transparent && total_in == total_out_plus_fee_without_change {
+            // Case 2 for a tx with all transparent flows.
+            (vec![], fee_without_change)
+        } else if total_in < total_out_plus_fee_with_change {
+            // Case 3a, or case 1 or 2 with non-transparent flows.
+            return Err(ChangeError::InsufficientFunds {
+                available: total_in,
+                required: total_out_plus_fee_with_change,
+            });
+        } else {
+            // Case 3b or 3c.
+            let proposed_change =
+                (total_in - total_out_plus_fee_with_change).expect("checked above");
+
+            // We obtain a split count based on the total number of notes of sufficient size
+            // available in the wallet, irrespective of pool. If we don't have any wallet metadata
+            // available, we fall back to generating a single change output.
+            let split_count = wallet_meta.map_or(NonZeroUsize::MIN, |wm| {
+                cfg.split_policy.split_count(
+                    wm.total_note_count(),
+                    wm.total_value(),
+                    proposed_change,
+                )
+            });
+            let per_output_change = proposed_change.div_with_remainder(
+                NonZeroU64::new(
+                    u64::try_from(usize::from(split_count)).expect("usize fits into u64"),
+                )
+                .unwrap(),
+            );
+
+            // If we don't have as many change outputs as we expected, recompute the fee.
+            let (fee_with_change, excess_fee) =
+                if usize::from(split_count) < target_change_counts.total_shielded() {
+                    let new_fee_with_change = cfg
+                        .fee_rule
+                        .fee_required(
+                            cfg.params,
+                            target_height,
+                            transparent_input_sizes,
+                            transparent_output_sizes,
+                            sapling_input_count,
+                            sapling_output_count(if change_pool == ShieldedProtocol::Sapling {
+                                usize::from(split_count)
+                            } else {
+                                0
+                            })?,
+                            orchard_action_count(if change_pool == ShieldedProtocol::Orchard {
+                                usize::from(split_count)
+                            } else {
+                                0
+                            })?,
+                        )
+                        .map_err(|fee_error| ChangeError::StrategyError(E::from(fee_error)))?;
+                    (
+                        new_fee_with_change,
+                        (fee_with_change - new_fee_with_change).unwrap_or(NonNegativeAmount::ZERO),
+                    )
+                } else {
+                    (fee_with_change, NonNegativeAmount::ZERO)
+                };
+
+            let simple_case = || {
+                (
+                    (0usize..split_count.into())
+                        .map(|i| {
+                            ChangeValue::shielded(
+                                change_pool,
+                                if i == 0 {
+                                    // Add any remainder to the first output only
+                                    (*per_output_change.quotient()
+                                        + *per_output_change.remainder()
+                                        + excess_fee)
+                                        .unwrap()
+                                } else {
+                                    // For any other output, the change value will just be the
+                                    // quotient.
+                                    *per_output_change.quotient()
+                                },
+                                change_memo.cloned(),
+                            )
+                        })
+                        .collect(),
+                    fee_with_change,
+                )
+            };
+
+            let change_dust_threshold = cfg
+                .dust_output_policy
+                .dust_threshold()
+                .unwrap_or(cfg.default_dust_threshold);
+
+            if proposed_change < change_dust_threshold {
+                match cfg.dust_output_policy.action() {
+                    DustAction::Reject => {
+                        // Always allow zero-valued change even for the `Reject` policy:
+                        // * it should be allowed in order to record change memos and to improve
+                        //   indistinguishability;
+                        // * this case occurs in practice when sending all funds from an account;
+                        // * zero-valued notes do not require witness tracking;
+                        // * the effect on trial decryption overhead is small.
+                        if proposed_change.is_zero() && excess_fee.is_zero() {
+                            simple_case()
+                        } else {
+                            let shortfall =
+                                (change_dust_threshold - proposed_change).ok_or_else(underflow)?;
+
+                            return Err(ChangeError::InsufficientFunds {
+                                available: total_in,
+                                required: (total_in + shortfall).ok_or_else(overflow)?,
+                            });
+                        }
+                    }
+                    DustAction::AllowDustChange => simple_case(),
+                    DustAction::AddDustToFee => {
+                        // Zero-valued change is also always allowed for this policy, but when
+                        // no change memo is given, we might omit the change output instead.
+
+                        let fee_with_dust = (total_in - total_out)
+                            .expect("we already checked for sufficient funds");
+                        // We can add a change output if necessary.
+                        assert!(fee_with_change <= fee_with_dust);
+
+                        let reasonable_fee = (fee_with_change + (MINIMUM_FEE * 10u64).unwrap())
+                            .ok_or_else(overflow)?;
+
+                        if fee_with_dust > reasonable_fee {
+                            // Defend against losing money by using AddDustToFee with a too-high
+                            // dust threshold.
+                            simple_case()
+                        } else if change_memo.is_some() {
+                            (
+                                vec![ChangeValue::shielded(
+                                    change_pool,
+                                    NonNegativeAmount::ZERO,
+                                    change_memo.cloned(),
+                                )],
+                                fee_with_dust,
+                            )
+                        } else {
+                            (vec![], fee_with_dust)
+                        }
+                    }
+                }
+            } else {
+                simple_case()
+            }
+        }
+    };
+    #[cfg(feature = "transparent-inputs")]
+    change.extend(
+        ephemeral_balance
+            .and_then(|b| b.ephemeral_output_amount())
+            .map(ChangeValue::ephemeral_transparent),
+    );
+
+    TransactionBalance::new(change, fee).map_err(|_| overflow())
+}
+
+/// Returns a `[ChangeStrategy::DustInputs]` error if some of the inputs provided
+/// to the transaction have value less than the marginal fee, and could not be
+/// determined to have any economic value in the context of this input selection.
+///
+/// This determination is potentially conservative in the sense that outputs
+/// with value less than the marginal fee might be excluded, even though in
+/// practice they would not cause the fee to increase. Outputs with value
+/// greater than the marginal fee will never be excluded.
+///
+/// `possible_change` is a slice of `(transparent_change, sapling_change, orchard_change)`
+/// tuples indicating possible combinations of how many change outputs (0 or 1)
+/// might be included in the transaction for each pool. The shape of the tuple
+/// does not depend on which protocol features are enabled.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn check_for_uneconomic_inputs<NoteRefT: Clone, E>(
+    transparent_inputs: &[impl transparent::InputView],
+    transparent_outputs: &[impl transparent::OutputView],
+    sapling: &impl sapling_fees::BundleView<NoteRefT>,
+    #[cfg(feature = "orchard")] orchard: &impl orchard_fees::BundleView<NoteRefT>,
+    marginal_fee: NonNegativeAmount,
+    grace_actions: usize,
+    possible_change: &[OutputManifest],
+    ephemeral_balance: Option<&EphemeralBalance>,
+) -> Result<(), ChangeError<E, NoteRefT>> {
+    let mut t_dust: Vec<_> = transparent_inputs
+        .iter()
+        .filter_map(|i| {
+            // For now, we're just assuming P2PKH inputs, so we don't check the
+            // size of the input script.
+            if i.coin().value <= marginal_fee {
+                Some(i.outpoint().clone())
+            } else {
+                None
+            }
+        })
+        .collect();
+
+    let mut s_dust: Vec<_> = sapling
+        .inputs()
+        .iter()
+        .filter_map(|i| {
+            if sapling_fees::InputView::<NoteRefT>::value(i) <= marginal_fee {
+                Some(sapling_fees::InputView::<NoteRefT>::note_id(i).clone())
+            } else {
+                None
+            }
+        })
+        .collect();
+
+    #[cfg(feature = "orchard")]
+    let mut o_dust: Vec<NoteRefT> = orchard
+        .inputs()
+        .iter()
+        .filter_map(|i| {
+            if orchard_fees::InputView::<NoteRefT>::value(i) <= marginal_fee {
+                Some(orchard_fees::InputView::<NoteRefT>::note_id(i).clone())
+            } else {
+                None
+            }
+        })
+        .collect();
+    #[cfg(not(feature = "orchard"))]
+    let mut o_dust: Vec<NoteRefT> = vec![];
+
+    // If we don't have any dust inputs, there is nothing to check.
+    if t_dust.is_empty() && s_dust.is_empty() && o_dust.is_empty() {
+        return Ok(());
+    }
+
+    let (t_inputs_len, t_outputs_len) = (
+        transparent_inputs.len() + usize::from(ephemeral_balance.map_or(false, |b| b.is_input())),
+        transparent_outputs.len() + usize::from(ephemeral_balance.map_or(false, |b| b.is_output())),
+    );
+    let (s_inputs_len, s_outputs_len) = (sapling.inputs().len(), sapling.outputs().len());
+    #[cfg(feature = "orchard")]
+    let (o_inputs_len, o_outputs_len) = (orchard.inputs().len(), orchard.outputs().len());
+    #[cfg(not(feature = "orchard"))]
+    let (o_inputs_len, o_outputs_len) = (0usize, 0usize);
+
+    let t_non_dust = t_inputs_len.checked_sub(t_dust.len()).unwrap();
+    let s_non_dust = s_inputs_len.checked_sub(s_dust.len()).unwrap();
+    let o_non_dust = o_inputs_len.checked_sub(o_dust.len()).unwrap();
+
+    // Return the number of allowed dust inputs from each pool.
+    let allowed_dust = |change: &OutputManifest| {
+        // Here we assume a "ZIP 317-like" fee model in which the existence of an output
+        // to a given pool implies that a corresponding input from that pool can be
+        // provided without increasing the fee. (This is also likely to be true for
+        // future fee models if we do not want to penalize use of Orchard relative to
+        // other pools.)
+        //
+        // Under that assumption, we want to calculate the maximum number of dust inputs
+        // from each pool, out of the ones we actually have, that can be economically
+        // spent along with the non-dust inputs. Get an initial estimate by calculating
+        // the number of dust inputs in each pool that will be allowed regardless of
+        // padding or grace.
+
+        let t_allowed = min(
+            t_dust.len(),
+            (t_outputs_len + change.transparent).saturating_sub(t_non_dust),
+        );
+        let s_allowed = min(
+            s_dust.len(),
+            (s_outputs_len + change.sapling).saturating_sub(s_non_dust),
+        );
+        let o_allowed = min(
+            o_dust.len(),
+            (o_outputs_len + change.orchard).saturating_sub(o_non_dust),
+        );
+
+        // We'll be spending the non-dust and allowed dust in each pool.
+        let t_req_inputs = t_non_dust + t_allowed;
+        let s_req_inputs = s_non_dust + s_allowed;
+        #[cfg(feature = "orchard")]
+        let o_req_inputs = o_non_dust + o_allowed;
+
+        // This calculates the hypothetical number of actions with given extra inputs,
+        // for ZIP 317 and the padding rules in effect. The padding rules for each
+        // pool are subtle (they also depend on `bundle_required` for example), so we
+        // must actually call them rather than try to predict their effect. To tell
+        // whether we can freely add an extra input from a given pool, we need to call
+        // them both with and without that input; if the number of actions does not
+        // increase, then the input is free to add.
+        let hypothetical_actions = |t_extra, s_extra, _o_extra| {
+            let s_spend_count = sapling
+                .bundle_type()
+                .num_spends(s_req_inputs + s_extra)
+                .map_err(ChangeError::BundleError)?;
+
+            let s_output_count = sapling
+                .bundle_type()
+                .num_outputs(s_req_inputs + s_extra, s_outputs_len + change.sapling)
+                .map_err(ChangeError::BundleError)?;
+
+            #[cfg(feature = "orchard")]
+            let o_action_count = orchard
+                .bundle_type()
+                .num_actions(o_req_inputs + _o_extra, o_outputs_len + change.orchard)
+                .map_err(ChangeError::BundleError)?;
+            #[cfg(not(feature = "orchard"))]
+            let o_action_count = 0;
+
+            // To calculate the number of unused actions, we assume that transparent inputs
+            // and outputs are P2PKH.
+            Ok(
+                max(t_req_inputs + t_extra, t_outputs_len + change.transparent)
+                    + max(s_spend_count, s_output_count)
+                    + o_action_count,
+            )
+        };
+
+        // First calculate the baseline number of logical actions with only the definitely
+        // allowed inputs estimated above. If it is less than `grace_actions`, try to allocate
+        // a grace input first to transparent dust, then to Sapling dust, then to Orchard dust.
+        // If the number of actions increases, it was not possible to allocate that input for
+        // free. This approach is sufficient because at most one such input can be allocated,
+        // since `grace_actions` is at most 2 for ZIP 317 and there must be at least one
+        // logical action. (If `grace_actions` were greater than 2 then the code would still
+        // be correct, it would just not find all potential extra inputs.)
+
+        let baseline = hypothetical_actions(0, 0, 0)?;
+
+        let (t_extra, s_extra, o_extra) = if baseline >= grace_actions {
+            (0, 0, 0)
+        } else if t_dust.len() > t_allowed && hypothetical_actions(1, 0, 0)? <= baseline {
+            (1, 0, 0)
+        } else if s_dust.len() > s_allowed && hypothetical_actions(0, 1, 0)? <= baseline {
+            (0, 1, 0)
+        } else if o_dust.len() > o_allowed && hypothetical_actions(0, 0, 1)? <= baseline {
+            (0, 0, 1)
+        } else {
+            (0, 0, 0)
+        };
+        Ok(OutputManifest {
+            transparent: t_allowed + t_extra,
+            sapling: s_allowed + s_extra,
+            orchard: o_allowed + o_extra,
+        })
+    };
+
+    // Find the least number of allowed dust inputs for each pool for any `possible_change`.
+    let allowed = possible_change
+        .iter()
+        .map(allowed_dust)
+        .collect::<Result<Vec<_>, _>>()?
+        .into_iter()
+        .reduce(|l, r| OutputManifest {
+            transparent: min(l.transparent, r.transparent),
+            sapling: min(l.sapling, r.sapling),
+            orchard: min(l.orchard, r.orchard),
+        })
+        .expect("possible_change is nonempty");
+
+    // The inputs in the tail of each list after the first `*_allowed` are returned as uneconomic.
+    // The caller should order the inputs from most to least preferred to spend.
+    let t_dust = t_dust.split_off(allowed.transparent);
+    let s_dust = s_dust.split_off(allowed.sapling);
+    let o_dust = o_dust.split_off(allowed.orchard);
+
+    if t_dust.is_empty() && s_dust.is_empty() && o_dust.is_empty() {
+        Ok(())
+    } else {
+        Err(ChangeError::DustInputs {
+            transparent: t_dust,
+            sapling: s_dust,
+            #[cfg(feature = "orchard")]
+            orchard: o_dust,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/fees/fixed.rs b/zcash_client_backend/src/fees/fixed.rs
index 28b309bb5a..b755d653b3 100644
--- a/zcash_client_backend/src/fees/fixed.rs
+++ b/zcash_client_backend/src/fees/fixed.rs
@@ -1,154 +1,115 @@
 //! Change strategies designed for use with a fixed fee.
-use std::cmp::Ordering;
+
+use std::marker::PhantomData;
 
 use zcash_primitives::{
     consensus::{self, BlockHeight},
+    memo::MemoBytes,
     transaction::{
-        components::{
-            amount::{Amount, BalanceError},
-            sapling::fees as sapling,
-            transparent::fees as transparent,
-        },
-        fees::{fixed::FeeRule as FixedFeeRule, FeeRule},
+        components::amount::{BalanceError, NonNegativeAmount},
+        fees::{fixed::FeeRule as FixedFeeRule, transparent},
     },
 };
 
+use crate::{data_api::InputSource, ShieldedProtocol};
+
 use super::{
-    ChangeError, ChangeStrategy, ChangeValue, DustAction, DustOutputPolicy, TransactionBalance,
+    common::{single_pool_output_balance, SinglePoolBalanceConfig},
+    sapling as sapling_fees, ChangeError, ChangeStrategy, DustOutputPolicy, EphemeralBalance,
+    SplitPolicy, TransactionBalance,
 };
 
-/// A change strategy that and proposes change as a single output to the most current supported
-/// shielded pool and delegates fee calculation to the provided fee rule.
-pub struct SingleOutputChangeStrategy {
+#[cfg(feature = "orchard")]
+use super::orchard as orchard_fees;
+
+/// A change strategy that proposes change as a single output. The output pool is chosen
+/// as the most current pool that avoids unnecessary pool-crossing (with a specified
+/// fallback when the transaction has no shielded inputs). Fee calculation is delegated
+/// to the provided fee rule.
+pub struct SingleOutputChangeStrategy<I> {
     fee_rule: FixedFeeRule,
+    change_memo: Option<MemoBytes>,
+    fallback_change_pool: ShieldedProtocol,
+    dust_output_policy: DustOutputPolicy,
+    meta_source: PhantomData<I>,
 }
 
-impl SingleOutputChangeStrategy {
-    /// Constructs a new [`SingleOutputChangeStrategy`] with the specified fee rule.
-    pub fn new(fee_rule: FixedFeeRule) -> Self {
-        Self { fee_rule }
+impl<I> SingleOutputChangeStrategy<I> {
+    /// Constructs a new [`SingleOutputChangeStrategy`] with the specified fee rule
+    /// and change memo.
+    ///
+    /// `fallback_change_pool` is used when more than one shielded pool is enabled via
+    /// feature flags, and the transaction has no shielded inputs.
+    pub fn new(
+        fee_rule: FixedFeeRule,
+        change_memo: Option<MemoBytes>,
+        fallback_change_pool: ShieldedProtocol,
+        dust_output_policy: DustOutputPolicy,
+    ) -> Self {
+        Self {
+            fee_rule,
+            change_memo,
+            fallback_change_pool,
+            dust_output_policy,
+            meta_source: PhantomData,
+        }
     }
 }
 
-impl ChangeStrategy for SingleOutputChangeStrategy {
+impl<I: InputSource> ChangeStrategy for SingleOutputChangeStrategy<I> {
     type FeeRule = FixedFeeRule;
     type Error = BalanceError;
+    type MetaSource = I;
+    type AccountMetaT = ();
 
     fn fee_rule(&self) -> &Self::FeeRule {
         &self.fee_rule
     }
 
+    fn fetch_wallet_meta(
+        &self,
+        _meta_source: &Self::MetaSource,
+        _account: <Self::MetaSource as InputSource>::AccountId,
+        _exclude: &[<Self::MetaSource as crate::data_api::InputSource>::NoteRef],
+    ) -> Result<Self::AccountMetaT, <Self::MetaSource as crate::data_api::InputSource>::Error> {
+        Ok(())
+    }
+
     fn compute_balance<P: consensus::Parameters, NoteRefT: Clone>(
         &self,
         params: &P,
         target_height: BlockHeight,
         transparent_inputs: &[impl transparent::InputView],
         transparent_outputs: &[impl transparent::OutputView],
-        sapling_inputs: &[impl sapling::InputView<NoteRefT>],
-        sapling_outputs: &[impl sapling::OutputView],
-        dust_output_policy: &DustOutputPolicy,
+        sapling: &impl sapling_fees::BundleView<NoteRefT>,
+        #[cfg(feature = "orchard")] orchard: &impl orchard_fees::BundleView<NoteRefT>,
+        ephemeral_balance: Option<&EphemeralBalance>,
+        _wallet_meta: &Self::AccountMetaT,
     ) -> Result<TransactionBalance, ChangeError<Self::Error, NoteRefT>> {
-        let t_in = transparent_inputs
-            .iter()
-            .map(|t_in| t_in.coin().value)
-            .sum::<Option<_>>()
-            .ok_or(BalanceError::Overflow)?;
-        let t_out = transparent_outputs
-            .iter()
-            .map(|t_out| t_out.value())
-            .sum::<Option<_>>()
-            .ok_or(BalanceError::Overflow)?;
-        let sapling_in = sapling_inputs
-            .iter()
-            .map(|s_in| s_in.value())
-            .sum::<Option<_>>()
-            .ok_or(BalanceError::Overflow)?;
-        let sapling_out = sapling_outputs
-            .iter()
-            .map(|s_out| s_out.value())
-            .sum::<Option<_>>()
-            .ok_or(BalanceError::Overflow)?;
-
-        let fee_amount = self
-            .fee_rule
-            .fee_required(
-                params,
-                target_height,
-                transparent_inputs,
-                transparent_outputs,
-                sapling_inputs.len(),
-                sapling_outputs.len() + 1,
-            )
-            .unwrap(); // fixed::FeeRule::fee_required is infallible.
-
-        let total_in = (t_in + sapling_in).ok_or(BalanceError::Overflow)?;
-
-        if (!transparent_inputs.is_empty() || !sapling_inputs.is_empty()) && fee_amount > total_in {
-            // For the fixed-fee selection rule, the only time we consider inputs dust is when the fee
-            // exceeds the value of all input values.
-            Err(ChangeError::DustInputs {
-                transparent: transparent_inputs
-                    .iter()
-                    .map(|i| i.outpoint())
-                    .cloned()
-                    .collect(),
-                sapling: sapling_inputs
-                    .iter()
-                    .map(|i| i.note_id())
-                    .cloned()
-                    .collect(),
-            })
-        } else {
-            let total_out = [t_out, sapling_out, fee_amount]
-                .iter()
-                .sum::<Option<Amount>>()
-                .ok_or(BalanceError::Overflow)?;
-
-            let proposed_change = (total_in - total_out).ok_or(BalanceError::Underflow)?;
-            match proposed_change.cmp(&Amount::zero()) {
-                Ordering::Less => Err(ChangeError::InsufficientFunds {
-                    available: total_in,
-                    required: total_out,
-                }),
-                Ordering::Equal => TransactionBalance::new(vec![], fee_amount)
-                    .ok_or_else(|| BalanceError::Overflow.into()),
-                Ordering::Greater => {
-                    let dust_threshold = dust_output_policy
-                        .dust_threshold()
-                        .unwrap_or_else(|| self.fee_rule.fixed_fee());
-
-                    if dust_threshold > proposed_change {
-                        match dust_output_policy.action() {
-                            DustAction::Reject => {
-                                let shortfall = (dust_threshold - proposed_change)
-                                    .ok_or(BalanceError::Underflow)?;
-                                Err(ChangeError::InsufficientFunds {
-                                    available: total_in,
-                                    required: (total_in + shortfall)
-                                        .ok_or(BalanceError::Overflow)?,
-                                })
-                            }
-                            DustAction::AllowDustChange => TransactionBalance::new(
-                                vec![ChangeValue::Sapling(proposed_change)],
-                                fee_amount,
-                            )
-                            .ok_or_else(|| BalanceError::Overflow.into()),
-                            DustAction::AddDustToFee => TransactionBalance::new(
-                                vec![],
-                                (fee_amount + proposed_change).unwrap(),
-                            )
-                            .ok_or_else(|| BalanceError::Overflow.into()),
-                        }
-                    } else {
-                        TransactionBalance::new(
-                            vec![ChangeValue::Sapling(proposed_change)],
-                            fee_amount,
-                        )
-                        .ok_or_else(|| BalanceError::Overflow.into())
-                    }
-                }
-            }
-        }
+        let split_policy = SplitPolicy::single_output();
+        let cfg = SinglePoolBalanceConfig::new(
+            params,
+            &self.fee_rule,
+            &self.dust_output_policy,
+            self.fee_rule.fixed_fee(),
+            &split_policy,
+            self.fallback_change_pool,
+            NonNegativeAmount::ZERO,
+            0,
+        );
+
+        single_pool_output_balance(
+            cfg,
+            None,
+            target_height,
+            transparent_inputs,
+            transparent_outputs,
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            self.change_memo.as_ref(),
+            ephemeral_balance,
+        )
     }
 }
 
@@ -157,25 +118,33 @@ mod tests {
     use zcash_primitives::{
         consensus::{Network, NetworkUpgrade, Parameters},
         transaction::{
-            components::{amount::Amount, transparent::TxOut},
-            fees::fixed::FeeRule as FixedFeeRule,
+            components::{amount::NonNegativeAmount, transparent::TxOut},
+            fees::{fixed::FeeRule as FixedFeeRule, zip317::MINIMUM_FEE},
         },
     };
 
     use super::SingleOutputChangeStrategy;
     use crate::{
-        data_api::wallet::input_selection::SaplingPayment,
+        data_api::{testing::MockWalletDb, wallet::input_selection::SaplingPayment},
         fees::{
             tests::{TestSaplingInput, TestTransparentInput},
             ChangeError, ChangeStrategy, ChangeValue, DustOutputPolicy,
         },
+        ShieldedProtocol,
     };
 
+    #[cfg(feature = "orchard")]
+    use crate::fees::orchard as orchard_fees;
+
     #[test]
     fn change_without_dust() {
-        #[allow(deprecated)]
-        let fee_rule = FixedFeeRule::standard();
-        let change_strategy = SingleOutputChangeStrategy::new(fee_rule);
+        let fee_rule = FixedFeeRule::non_standard(MINIMUM_FEE);
+        let change_strategy = SingleOutputChangeStrategy::<MockWalletDb>::new(
+            fee_rule,
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+        );
 
         // spend a single Sapling note that is sufficient to pay the fee
         let result = change_strategy.compute_balance(
@@ -183,28 +152,41 @@ mod tests {
             Network::TestNetwork
                 .activation_height(NetworkUpgrade::Nu5)
                 .unwrap(),
-            &Vec::<TestTransparentInput>::new(),
-            &Vec::<TxOut>::new(),
-            &[TestSaplingInput {
-                note_id: 0,
-                value: Amount::from_u64(60000).unwrap(),
-            }],
-            &[SaplingPayment::new(Amount::from_u64(40000).unwrap())],
-            &DustOutputPolicy::default(),
+            &[] as &[TestTransparentInput],
+            &[] as &[TxOut],
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[TestSaplingInput {
+                    note_id: 0,
+                    value: NonNegativeAmount::const_from_u64(60000),
+                }][..],
+                &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                    40000,
+                ))][..],
+            ),
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
         );
 
         assert_matches!(
             result,
-            Ok(balance) if balance.proposed_change() == [ChangeValue::Sapling(Amount::from_u64(10000).unwrap())]
-                && balance.fee_required() == Amount::from_u64(10000).unwrap()
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::sapling(NonNegativeAmount::const_from_u64(10000), None)] &&
+                balance.fee_required() == MINIMUM_FEE
         );
     }
 
     #[test]
     fn dust_change() {
-        #[allow(deprecated)]
-        let fee_rule = FixedFeeRule::standard();
-        let change_strategy = SingleOutputChangeStrategy::new(fee_rule);
+        let fee_rule = FixedFeeRule::non_standard(MINIMUM_FEE);
+        let change_strategy = SingleOutputChangeStrategy::<MockWalletDb>::new(
+            fee_rule,
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+        );
 
         // spend a single Sapling note that is sufficient to pay the fee
         let result = change_strategy.compute_balance(
@@ -212,27 +194,35 @@ mod tests {
             Network::TestNetwork
                 .activation_height(NetworkUpgrade::Nu5)
                 .unwrap(),
-            &Vec::<TestTransparentInput>::new(),
-            &Vec::<TxOut>::new(),
-            &[
-                TestSaplingInput {
-                    note_id: 0,
-                    value: Amount::from_u64(40000).unwrap(),
-                },
-                // enough to pay a fee, plus dust
-                TestSaplingInput {
-                    note_id: 0,
-                    value: Amount::from_u64(10100).unwrap(),
-                },
-            ],
-            &[SaplingPayment::new(Amount::from_u64(40000).unwrap())],
-            &DustOutputPolicy::default(),
+            &[] as &[TestTransparentInput],
+            &[] as &[TxOut],
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[
+                    TestSaplingInput {
+                        note_id: 0,
+                        value: NonNegativeAmount::const_from_u64(40000),
+                    },
+                    // enough to pay a fee, plus dust
+                    TestSaplingInput {
+                        note_id: 0,
+                        value: NonNegativeAmount::const_from_u64(10100),
+                    },
+                ][..],
+                &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                    40000,
+                ))][..],
+            ),
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
         );
 
         assert_matches!(
             result,
             Err(ChangeError::InsufficientFunds { available, required })
-            if available == Amount::from_u64(50100).unwrap() && required == Amount::from_u64(60000).unwrap()
+            if available == NonNegativeAmount::const_from_u64(50100) && required == NonNegativeAmount::const_from_u64(60000)
         );
     }
 }
diff --git a/zcash_client_backend/src/fees/orchard.rs b/zcash_client_backend/src/fees/orchard.rs
new file mode 100644
index 0000000000..b4a9278519
--- /dev/null
+++ b/zcash_client_backend/src/fees/orchard.rs
@@ -0,0 +1,93 @@
+//! Types related to computation of fees and change related to the Orchard components
+//! of a transaction.
+
+use std::convert::Infallible;
+use zcash_primitives::transaction::components::amount::NonNegativeAmount;
+
+use orchard::builder::BundleType;
+
+/// A trait that provides a minimized view of Orchard bundle configuration
+/// suitable for use in fee and change calculation.
+pub trait BundleView<NoteRef> {
+    /// The type of inputs to the bundle.
+    type In: InputView<NoteRef>;
+    /// The type of inputs of the bundle.
+    type Out: OutputView;
+
+    /// Returns the type of the bundle
+    fn bundle_type(&self) -> BundleType;
+    /// Returns the inputs to the bundle.
+    fn inputs(&self) -> &[Self::In];
+    /// Returns the outputs of the bundle.
+    fn outputs(&self) -> &[Self::Out];
+}
+
+impl<'a, NoteRef, In: InputView<NoteRef>, Out: OutputView> BundleView<NoteRef>
+    for (BundleType, &'a [In], &'a [Out])
+{
+    type In = In;
+    type Out = Out;
+
+    fn bundle_type(&self) -> BundleType {
+        self.0
+    }
+
+    fn inputs(&self) -> &[In] {
+        self.1
+    }
+
+    fn outputs(&self) -> &[Out] {
+        self.2
+    }
+}
+
+/// A [`BundleView`] for the empty bundle with [`BundleType::DEFAULT`] bundle type.
+pub struct EmptyBundleView;
+
+impl<NoteRef> BundleView<NoteRef> for EmptyBundleView {
+    type In = Infallible;
+    type Out = Infallible;
+
+    fn bundle_type(&self) -> BundleType {
+        BundleType::DEFAULT
+    }
+
+    fn inputs(&self) -> &[Self::In] {
+        &[]
+    }
+
+    fn outputs(&self) -> &[Self::Out] {
+        &[]
+    }
+}
+
+/// A trait that provides a minimized view of an Orchard input suitable for use in fee and change
+/// calculation.
+pub trait InputView<NoteRef> {
+    /// An identifier for the input being spent.
+    fn note_id(&self) -> &NoteRef;
+    /// The value of the input being spent.
+    fn value(&self) -> NonNegativeAmount;
+}
+
+impl<N> InputView<N> for Infallible {
+    fn note_id(&self) -> &N {
+        unreachable!()
+    }
+    fn value(&self) -> NonNegativeAmount {
+        unreachable!()
+    }
+}
+
+/// A trait that provides a minimized view of a Orchard output suitable for use in fee and change
+/// calculation.
+pub trait OutputView {
+    /// The value of the output being produced.
+    fn value(&self) -> NonNegativeAmount;
+}
+
+impl OutputView for Infallible {
+    fn value(&self) -> NonNegativeAmount {
+        unreachable!()
+    }
+}
diff --git a/zcash_client_backend/src/fees/sapling.rs b/zcash_client_backend/src/fees/sapling.rs
new file mode 100644
index 0000000000..9f17f53a61
--- /dev/null
+++ b/zcash_client_backend/src/fees/sapling.rs
@@ -0,0 +1,113 @@
+//! Types related to computation of fees and change related to the Sapling components
+//! of a transaction.
+
+use std::convert::Infallible;
+
+use sapling::builder::{BundleType, OutputInfo, SpendInfo};
+use zcash_primitives::transaction::components::amount::NonNegativeAmount;
+
+/// A trait that provides a minimized view of Sapling bundle configuration
+/// suitable for use in fee and change calculation.
+pub trait BundleView<NoteRef> {
+    /// The type of inputs to the bundle.
+    type In: InputView<NoteRef>;
+    /// The type of inputs of the bundle.
+    type Out: OutputView;
+
+    /// Returns the type of the bundle
+    fn bundle_type(&self) -> BundleType;
+    /// Returns the inputs to the bundle.
+    fn inputs(&self) -> &[Self::In];
+    /// Returns the outputs of the bundle.
+    fn outputs(&self) -> &[Self::Out];
+}
+
+impl<'a, NoteRef, In: InputView<NoteRef>, Out: OutputView> BundleView<NoteRef>
+    for (BundleType, &'a [In], &'a [Out])
+{
+    type In = In;
+    type Out = Out;
+
+    fn bundle_type(&self) -> BundleType {
+        self.0
+    }
+
+    fn inputs(&self) -> &[In] {
+        self.1
+    }
+
+    fn outputs(&self) -> &[Out] {
+        self.2
+    }
+}
+
+/// A [`BundleView`] for the empty bundle with [`BundleType::DEFAULT`] bundle type.
+pub struct EmptyBundleView;
+
+impl<NoteRef> BundleView<NoteRef> for EmptyBundleView {
+    type In = Infallible;
+    type Out = Infallible;
+
+    fn bundle_type(&self) -> BundleType {
+        BundleType::DEFAULT
+    }
+
+    fn inputs(&self) -> &[Self::In] {
+        &[]
+    }
+
+    fn outputs(&self) -> &[Self::Out] {
+        &[]
+    }
+}
+
+/// A trait that provides a minimized view of a Sapling input suitable for use in
+/// fee and change calculation.
+pub trait InputView<NoteRef> {
+    /// An identifier for the input being spent.
+    fn note_id(&self) -> &NoteRef;
+    /// The value of the input being spent.
+    fn value(&self) -> NonNegativeAmount;
+}
+
+impl<N> InputView<N> for Infallible {
+    fn note_id(&self) -> &N {
+        unreachable!()
+    }
+    fn value(&self) -> NonNegativeAmount {
+        unreachable!()
+    }
+}
+
+// `SpendDescriptionInfo` does not contain a note identifier, so we can only implement
+// `InputView<()>`
+impl InputView<()> for SpendInfo {
+    fn note_id(&self) -> &() {
+        &()
+    }
+
+    fn value(&self) -> NonNegativeAmount {
+        NonNegativeAmount::try_from(self.value().inner())
+            .expect("An existing note to be spent must have a valid amount value.")
+    }
+}
+
+/// A trait that provides a minimized view of a Sapling output suitable for use in
+/// fee and change calculation.
+pub trait OutputView {
+    /// The value of the output being produced.
+    fn value(&self) -> NonNegativeAmount;
+}
+
+impl OutputView for OutputInfo {
+    fn value(&self) -> NonNegativeAmount {
+        NonNegativeAmount::try_from(self.value().inner())
+            .expect("Output values should be checked at construction.")
+    }
+}
+
+impl OutputView for Infallible {
+    fn value(&self) -> NonNegativeAmount {
+        unreachable!()
+    }
+}
diff --git a/zcash_client_backend/src/fees/standard.rs b/zcash_client_backend/src/fees/standard.rs
new file mode 100644
index 0000000000..f9a14a8514
--- /dev/null
+++ b/zcash_client_backend/src/fees/standard.rs
@@ -0,0 +1,17 @@
+//! Change strategies designed for use with a standard fee.
+
+use super::StandardFeeRule;
+
+/// A change strategy that proposes change as a single output. The output pool is chosen
+/// as the most current pool that avoids unnecessary pool-crossing (with a specified
+/// fallback when the transaction has no shielded inputs). Fee calculation is delegated
+/// to the provided fee rule.
+pub type SingleOutputChangeStrategy<I> =
+    super::zip317::SingleOutputChangeStrategy<StandardFeeRule, I>;
+
+/// A change strategy that proposes change as potentially multiple evenly-sized outputs having at
+/// least a threshold value. The output pool is chosen as the most current pool that avoids
+/// unnecessary pool-crossing (with a specified fallback when the transaction has no shielded
+/// inputs). Fee calculation is delegated to the provided fee rule.
+pub type MultiOutputChangeStrategy<I> =
+    super::zip317::MultiOutputChangeStrategy<StandardFeeRule, I>;
diff --git a/zcash_client_backend/src/fees/zip317.rs b/zcash_client_backend/src/fees/zip317.rs
index 142bf7ce65..e654bb56d7 100644
--- a/zcash_client_backend/src/fees/zip317.rs
+++ b/zcash_client_backend/src/fees/zip317.rs
@@ -3,246 +3,305 @@
 //! Change selection in ZIP 317 requires careful handling of low-valued inputs
 //! to ensure that inputs added to a transaction do not cause fees to rise by
 //! an amount greater than their value.
-use core::cmp::Ordering;
+
+use std::marker::PhantomData;
 
 use zcash_primitives::{
     consensus::{self, BlockHeight},
-    transaction::{
-        components::{
-            amount::{Amount, BalanceError},
-            sapling::fees as sapling,
-            transparent::fees as transparent,
-        },
-        fees::{
-            zip317::{FeeError as Zip317FeeError, FeeRule as Zip317FeeRule},
-            FeeRule,
-        },
-    },
+    memo::MemoBytes,
+    transaction::fees::{transparent, zip317 as prim_zip317, FeeRule},
+};
+use zcash_protocol::value::{BalanceError, Zatoshis};
+
+use crate::{
+    data_api::{AccountMeta, InputSource, NoteFilter},
+    fees::StandardFeeRule,
+    ShieldedProtocol,
 };
 
 use super::{
-    ChangeError, ChangeStrategy, ChangeValue, DustAction, DustOutputPolicy, TransactionBalance,
+    common::{single_pool_output_balance, SinglePoolBalanceConfig},
+    sapling as sapling_fees, ChangeError, ChangeStrategy, DustOutputPolicy, EphemeralBalance,
+    SplitPolicy, TransactionBalance,
 };
 
-/// A change strategy that and proposes change as a single output to the most current supported
-/// shielded pool and delegates fee calculation to the provided fee rule.
-pub struct SingleOutputChangeStrategy {
-    fee_rule: Zip317FeeRule,
+#[cfg(feature = "orchard")]
+use super::orchard as orchard_fees;
+
+/// An extension to the [`FeeRule`] trait that exposes methods required for
+/// ZIP 317 fee calculation.
+pub trait Zip317FeeRule: FeeRule {
+    /// Returns the ZIP 317 marginal fee.
+    fn marginal_fee(&self) -> Zatoshis;
+
+    /// Returns the ZIP 317 number of grace actions
+    fn grace_actions(&self) -> usize;
 }
 
-impl SingleOutputChangeStrategy {
+impl Zip317FeeRule for prim_zip317::FeeRule {
+    fn marginal_fee(&self) -> Zatoshis {
+        self.marginal_fee()
+    }
+
+    fn grace_actions(&self) -> usize {
+        self.grace_actions()
+    }
+}
+
+impl Zip317FeeRule for StandardFeeRule {
+    fn marginal_fee(&self) -> Zatoshis {
+        prim_zip317::FeeRule::standard().marginal_fee()
+    }
+
+    fn grace_actions(&self) -> usize {
+        prim_zip317::FeeRule::standard().grace_actions()
+    }
+}
+
+/// A change strategy that proposes change as a single output. The output pool is chosen
+/// as the most current pool that avoids unnecessary pool-crossing (with a specified
+/// fallback when the transaction has no shielded inputs). Fee calculation is delegated
+/// to the provided fee rule.
+pub struct SingleOutputChangeStrategy<R, I> {
+    fee_rule: R,
+    change_memo: Option<MemoBytes>,
+    fallback_change_pool: ShieldedProtocol,
+    dust_output_policy: DustOutputPolicy,
+    meta_source: PhantomData<I>,
+}
+
+impl<R, I> SingleOutputChangeStrategy<R, I> {
     /// Constructs a new [`SingleOutputChangeStrategy`] with the specified ZIP 317
-    /// fee parameters.
-    pub fn new(fee_rule: Zip317FeeRule) -> Self {
-        Self { fee_rule }
+    /// fee parameters and change memo.
+    ///
+    /// `fallback_change_pool` is used when more than one shielded pool is enabled via
+    /// feature flags, and the transaction has no shielded inputs.
+    pub fn new(
+        fee_rule: R,
+        change_memo: Option<MemoBytes>,
+        fallback_change_pool: ShieldedProtocol,
+        dust_output_policy: DustOutputPolicy,
+    ) -> Self {
+        Self {
+            fee_rule,
+            change_memo,
+            fallback_change_pool,
+            dust_output_policy,
+            meta_source: PhantomData,
+        }
     }
 }
 
-impl ChangeStrategy for SingleOutputChangeStrategy {
-    type FeeRule = Zip317FeeRule;
-    type Error = Zip317FeeError;
+impl<R, I> ChangeStrategy for SingleOutputChangeStrategy<R, I>
+where
+    R: Zip317FeeRule + Clone,
+    I: InputSource,
+    <R as FeeRule>::Error: From<BalanceError>,
+{
+    type FeeRule = R;
+    type Error = <R as FeeRule>::Error;
+    type MetaSource = I;
+    type AccountMetaT = ();
 
     fn fee_rule(&self) -> &Self::FeeRule {
         &self.fee_rule
     }
 
+    fn fetch_wallet_meta(
+        &self,
+        _meta_source: &Self::MetaSource,
+        _account: <Self::MetaSource as InputSource>::AccountId,
+        _exclude: &[<Self::MetaSource as InputSource>::NoteRef],
+    ) -> Result<Self::AccountMetaT, <Self::MetaSource as InputSource>::Error> {
+        Ok(())
+    }
+
     fn compute_balance<P: consensus::Parameters, NoteRefT: Clone>(
         &self,
         params: &P,
         target_height: BlockHeight,
         transparent_inputs: &[impl transparent::InputView],
         transparent_outputs: &[impl transparent::OutputView],
-        sapling_inputs: &[impl sapling::InputView<NoteRefT>],
-        sapling_outputs: &[impl sapling::OutputView],
-        dust_output_policy: &DustOutputPolicy,
+        sapling: &impl sapling_fees::BundleView<NoteRefT>,
+        #[cfg(feature = "orchard")] orchard: &impl orchard_fees::BundleView<NoteRefT>,
+        ephemeral_balance: Option<&EphemeralBalance>,
+        _wallet_meta: &Self::AccountMetaT,
     ) -> Result<TransactionBalance, ChangeError<Self::Error, NoteRefT>> {
-        let mut transparent_dust: Vec<_> = transparent_inputs
-            .iter()
-            .filter_map(|i| {
-                // for now, we're just assuming p2pkh inputs, so we don't check the size of the input
-                // script
-                if i.coin().value < self.fee_rule.marginal_fee() {
-                    Some(i.outpoint().clone())
-                } else {
-                    None
-                }
-            })
-            .collect();
-
-        let mut sapling_dust: Vec<_> = sapling_inputs
-            .iter()
-            .filter_map(|i| {
-                if i.value() < self.fee_rule.marginal_fee() {
-                    Some(i.note_id().clone())
-                } else {
-                    None
-                }
-            })
-            .collect();
-
-        // Depending on the shape of the transaction, we may be able to spend up to
-        // `grace_actions - 1` dust inputs. If we don't have any dust inputs though,
-        // we don't need to worry about any of that.
-        if !(transparent_dust.is_empty() && sapling_dust.is_empty()) {
-            let t_non_dust = transparent_inputs.len() - transparent_dust.len();
-            let t_allowed_dust = transparent_outputs.len().saturating_sub(t_non_dust);
-
-            // We add one to the sapling outputs for the (single) change output Note that this
-            // means that wallet-internal shielding transactions are an opportunity to spend a dust
-            // note.
-            let s_non_dust = sapling_inputs.len() - sapling_dust.len();
-            let s_allowed_dust = (sapling_outputs.len() + 1).saturating_sub(s_non_dust);
-
-            let available_grace_inputs = self
-                .fee_rule
-                .grace_actions()
-                .saturating_sub(t_non_dust)
-                .saturating_sub(s_non_dust);
-
-            let mut t_disallowed_dust = transparent_dust.len().saturating_sub(t_allowed_dust);
-            let mut s_disallowed_dust = sapling_dust.len().saturating_sub(s_allowed_dust);
-
-            if available_grace_inputs > 0 {
-                // If we have available grace inputs, allocate them first to transparent dust
-                // and then to Sapling dust. The caller has provided inputs that it is willing
-                // to spend, so we don't need to consider privacy effects at this layer.
-                let t_grace_dust = available_grace_inputs.saturating_sub(t_disallowed_dust);
-                t_disallowed_dust = t_disallowed_dust.saturating_sub(t_grace_dust);
-
-                let s_grace_dust = available_grace_inputs
-                    .saturating_sub(t_grace_dust)
-                    .saturating_sub(s_disallowed_dust);
-                s_disallowed_dust = s_disallowed_dust.saturating_sub(s_grace_dust);
-            }
-
-            // Truncate the lists of inputs to be disregarded in input selection to just the
-            // disallowed lengths. This has the effect of prioritizing inputs for inclusion by the
-            // order of the original input slices, with the most preferred inputs first.
-            transparent_dust.reverse();
-            transparent_dust.truncate(t_disallowed_dust);
-            sapling_dust.reverse();
-            sapling_dust.truncate(s_disallowed_dust);
-
-            if !(transparent_dust.is_empty() && sapling_dust.is_empty()) {
-                return Err(ChangeError::DustInputs {
-                    transparent: transparent_dust,
-                    sapling: sapling_dust,
-                });
-            }
-        }
+        let split_policy = SplitPolicy::single_output();
+        let cfg = SinglePoolBalanceConfig::new(
+            params,
+            &self.fee_rule,
+            &self.dust_output_policy,
+            self.fee_rule.marginal_fee(),
+            &split_policy,
+            self.fallback_change_pool,
+            self.fee_rule.marginal_fee(),
+            self.fee_rule.grace_actions(),
+        );
+
+        single_pool_output_balance(
+            cfg,
+            None,
+            target_height,
+            transparent_inputs,
+            transparent_outputs,
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            self.change_memo.as_ref(),
+            ephemeral_balance,
+        )
+    }
+}
+
+/// A change strategy that attempts to split the change value into some number of equal-sized notes
+/// as dictated by the included [`SplitPolicy`] value.
+pub struct MultiOutputChangeStrategy<R, I> {
+    fee_rule: R,
+    change_memo: Option<MemoBytes>,
+    fallback_change_pool: ShieldedProtocol,
+    dust_output_policy: DustOutputPolicy,
+    split_policy: SplitPolicy,
+    meta_source: PhantomData<I>,
+}
 
-        let overflow = || ChangeError::StrategyError(Zip317FeeError::from(BalanceError::Overflow));
-        let underflow =
-            || ChangeError::StrategyError(Zip317FeeError::from(BalanceError::Underflow));
-
-        let t_in = transparent_inputs
-            .iter()
-            .map(|t_in| t_in.coin().value)
-            .sum::<Option<_>>()
-            .ok_or_else(overflow)?;
-        let t_out = transparent_outputs
-            .iter()
-            .map(|t_out| t_out.value())
-            .sum::<Option<_>>()
-            .ok_or_else(overflow)?;
-        let sapling_in = sapling_inputs
-            .iter()
-            .map(|s_in| s_in.value())
-            .sum::<Option<_>>()
-            .ok_or_else(overflow)?;
-        let sapling_out = sapling_outputs
-            .iter()
-            .map(|s_out| s_out.value())
-            .sum::<Option<_>>()
-            .ok_or_else(overflow)?;
-
-        let fee_amount = self
-            .fee_rule
-            .fee_required(
-                params,
-                target_height,
-                transparent_inputs,
-                transparent_outputs,
-                sapling_inputs.len(),
-                // add one for Sapling change, then account for Sapling output padding performed by
-                // the transaction builder
-                std::cmp::max(sapling_outputs.len() + 1, 2),
-            )
-            .map_err(ChangeError::StrategyError)?;
-
-        let total_in = (t_in + sapling_in).ok_or_else(overflow)?;
-
-        let total_out = [t_out, sapling_out, fee_amount]
-            .iter()
-            .sum::<Option<Amount>>()
-            .ok_or_else(overflow)?;
-
-        let proposed_change = (total_in - total_out).ok_or_else(underflow)?;
-        match proposed_change.cmp(&Amount::zero()) {
-            Ordering::Less => Err(ChangeError::InsufficientFunds {
-                available: total_in,
-                required: total_out,
-            }),
-            Ordering::Equal => TransactionBalance::new(vec![], fee_amount).ok_or_else(overflow),
-            Ordering::Greater => {
-                let dust_threshold = dust_output_policy
-                    .dust_threshold()
-                    .unwrap_or_else(|| self.fee_rule.marginal_fee());
-
-                if dust_threshold > proposed_change {
-                    match dust_output_policy.action() {
-                        DustAction::Reject => {
-                            let shortfall =
-                                (dust_threshold - proposed_change).ok_or_else(underflow)?;
-
-                            Err(ChangeError::InsufficientFunds {
-                                available: total_in,
-                                required: (total_in + shortfall).ok_or_else(overflow)?,
-                            })
-                        }
-                        DustAction::AllowDustChange => TransactionBalance::new(
-                            vec![ChangeValue::Sapling(proposed_change)],
-                            fee_amount,
-                        )
-                        .ok_or_else(overflow),
-                        DustAction::AddDustToFee => {
-                            TransactionBalance::new(vec![], (fee_amount + proposed_change).unwrap())
-                                .ok_or_else(overflow)
-                        }
-                    }
-                } else {
-                    TransactionBalance::new(vec![ChangeValue::Sapling(proposed_change)], fee_amount)
-                        .ok_or_else(overflow)
-                }
-            }
+impl<R, I> MultiOutputChangeStrategy<R, I> {
+    /// Constructs a new [`MultiOutputChangeStrategy`] with the specified ZIP 317
+    /// fee parameters, change memo, and change splitting policy.
+    ///
+    /// This change strategy will fall back to creating a single change output if insufficient
+    /// change value is available to create notes with at least the minimum value dictated by the
+    /// split policy.
+    ///
+    /// - `fallback_change_pool`: the pool to which change will be sent if when more than one
+    ///   shielded pool is enabled via feature flags, and the transaction has no shielded inputs.
+    /// - `split_policy`: A policy value describing how the change value should be returned as
+    ///   multiple notes.
+    pub fn new(
+        fee_rule: R,
+        change_memo: Option<MemoBytes>,
+        fallback_change_pool: ShieldedProtocol,
+        dust_output_policy: DustOutputPolicy,
+        split_policy: SplitPolicy,
+    ) -> Self {
+        Self {
+            fee_rule,
+            change_memo,
+            fallback_change_pool,
+            dust_output_policy,
+            split_policy,
+            meta_source: PhantomData,
         }
     }
 }
 
+impl<R, I> ChangeStrategy for MultiOutputChangeStrategy<R, I>
+where
+    R: Zip317FeeRule + Clone,
+    I: InputSource,
+    <R as FeeRule>::Error: From<BalanceError>,
+{
+    type FeeRule = R;
+    type Error = <R as FeeRule>::Error;
+    type MetaSource = I;
+    type AccountMetaT = AccountMeta;
+
+    fn fee_rule(&self) -> &Self::FeeRule {
+        &self.fee_rule
+    }
+
+    fn fetch_wallet_meta(
+        &self,
+        meta_source: &Self::MetaSource,
+        account: <Self::MetaSource as InputSource>::AccountId,
+        exclude: &[<Self::MetaSource as InputSource>::NoteRef],
+    ) -> Result<Self::AccountMetaT, <Self::MetaSource as InputSource>::Error> {
+        let note_selector = NoteFilter::ExceedsMinValue(
+            self.split_policy
+                .min_split_output_value()
+                .unwrap_or(SplitPolicy::MIN_NOTE_VALUE),
+        );
+
+        meta_source.get_account_metadata(account, &note_selector, exclude)
+    }
+
+    fn compute_balance<P: consensus::Parameters, NoteRefT: Clone>(
+        &self,
+        params: &P,
+        target_height: BlockHeight,
+        transparent_inputs: &[impl transparent::InputView],
+        transparent_outputs: &[impl transparent::OutputView],
+        sapling: &impl sapling_fees::BundleView<NoteRefT>,
+        #[cfg(feature = "orchard")] orchard: &impl orchard_fees::BundleView<NoteRefT>,
+        ephemeral_balance: Option<&EphemeralBalance>,
+        wallet_meta: &Self::AccountMetaT,
+    ) -> Result<TransactionBalance, ChangeError<Self::Error, NoteRefT>> {
+        let cfg = SinglePoolBalanceConfig::new(
+            params,
+            &self.fee_rule,
+            &self.dust_output_policy,
+            self.fee_rule.marginal_fee(),
+            &self.split_policy,
+            self.fallback_change_pool,
+            self.fee_rule.marginal_fee(),
+            self.fee_rule.grace_actions(),
+        );
+
+        single_pool_output_balance(
+            cfg,
+            Some(wallet_meta),
+            target_height,
+            transparent_inputs,
+            transparent_outputs,
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            self.change_memo.as_ref(),
+            ephemeral_balance,
+        )
+    }
+}
+
 #[cfg(test)]
 mod tests {
+    use std::{convert::Infallible, num::NonZeroUsize};
 
     use zcash_primitives::{
         consensus::{Network, NetworkUpgrade, Parameters},
         legacy::Script,
         transaction::{
-            components::{amount::Amount, transparent::TxOut},
+            components::{amount::NonNegativeAmount, transparent::TxOut},
             fees::zip317::FeeRule as Zip317FeeRule,
         },
     };
 
     use super::SingleOutputChangeStrategy;
     use crate::{
-        data_api::wallet::input_selection::SaplingPayment,
+        data_api::{
+            testing::MockWalletDb, wallet::input_selection::SaplingPayment, AccountMeta, PoolMeta,
+        },
         fees::{
             tests::{TestSaplingInput, TestTransparentInput},
-            ChangeError, ChangeStrategy, ChangeValue, DustOutputPolicy,
+            zip317::MultiOutputChangeStrategy,
+            ChangeError, ChangeStrategy, ChangeValue, DustAction, DustOutputPolicy, SplitPolicy,
         },
+        ShieldedProtocol,
+    };
+
+    #[cfg(feature = "orchard")]
+    use {
+        crate::data_api::wallet::input_selection::OrchardPayment,
+        crate::fees::orchard as orchard_fees,
     };
 
     #[test]
     fn change_without_dust() {
-        let change_strategy = SingleOutputChangeStrategy::new(Zip317FeeRule::standard());
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+        );
 
         // spend a single Sapling note that is sufficient to pay the fee
         let result = change_strategy.compute_balance(
@@ -250,26 +309,149 @@ mod tests {
             Network::TestNetwork
                 .activation_height(NetworkUpgrade::Nu5)
                 .unwrap(),
-            &Vec::<TestTransparentInput>::new(),
-            &Vec::<TxOut>::new(),
-            &[TestSaplingInput {
-                note_id: 0,
-                value: Amount::from_u64(55000).unwrap(),
-            }],
-            &[SaplingPayment::new(Amount::from_u64(40000).unwrap())],
-            &DustOutputPolicy::default(),
+            &[] as &[TestTransparentInput],
+            &[] as &[TxOut],
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[TestSaplingInput {
+                    note_id: 0,
+                    value: NonNegativeAmount::const_from_u64(55000),
+                }][..],
+                &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                    40000,
+                ))][..],
+            ),
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
         );
 
         assert_matches!(
             result,
-            Ok(balance) if balance.proposed_change() == [ChangeValue::Sapling(Amount::from_u64(5000).unwrap())]
-                && balance.fee_required() == Amount::from_u64(10000).unwrap()
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::sapling(NonNegativeAmount::const_from_u64(5000), None)] &&
+                balance.fee_required() == NonNegativeAmount::const_from_u64(10000)
+        );
+    }
+
+    #[test]
+    fn change_without_dust_multi() {
+        let change_strategy = MultiOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+            SplitPolicy::with_min_output_value(
+                NonZeroUsize::new(5).unwrap(),
+                NonNegativeAmount::const_from_u64(100_0000),
+            ),
         );
+
+        {
+            // spend a single Sapling note and produce 5 outputs
+            let balance = |existing_notes, total| {
+                change_strategy.compute_balance(
+                    &Network::TestNetwork,
+                    Network::TestNetwork
+                        .activation_height(NetworkUpgrade::Nu5)
+                        .unwrap(),
+                    &[] as &[TestTransparentInput],
+                    &[] as &[TxOut],
+                    &(
+                        sapling::builder::BundleType::DEFAULT,
+                        &[TestSaplingInput {
+                            note_id: 0,
+                            value: NonNegativeAmount::const_from_u64(750_0000),
+                        }][..],
+                        &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                            100_0000,
+                        ))][..],
+                    ),
+                    #[cfg(feature = "orchard")]
+                    &orchard_fees::EmptyBundleView,
+                    None,
+                    &AccountMeta::new(Some(PoolMeta::new(existing_notes, total)), None),
+                )
+            };
+
+            assert_matches!(
+                balance(0, NonNegativeAmount::ZERO),
+                Ok(balance) if
+                    balance.proposed_change() == [
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(129_4000), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(129_4000), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(129_4000), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(129_4000), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(129_4000), None),
+                    ] &&
+                    balance.fee_required() == NonNegativeAmount::const_from_u64(30000)
+            );
+
+            assert_matches!(
+                balance(2, NonNegativeAmount::const_from_u64(100_0000)),
+                Ok(balance) if
+                    balance.proposed_change() == [
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(216_0000), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(216_0000), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(216_0000), None),
+                    ] &&
+                    balance.fee_required() == NonNegativeAmount::const_from_u64(20000)
+            );
+        }
+
+        {
+            // spend a single Sapling note and produce 4 outputs, as the value of the note isn't
+            // sufficient to produce 5
+            let result = change_strategy.compute_balance(
+                &Network::TestNetwork,
+                Network::TestNetwork
+                    .activation_height(NetworkUpgrade::Nu5)
+                    .unwrap(),
+                &[] as &[TestTransparentInput],
+                &[] as &[TxOut],
+                &(
+                    sapling::builder::BundleType::DEFAULT,
+                    &[TestSaplingInput {
+                        note_id: 0,
+                        value: NonNegativeAmount::const_from_u64(600_0000),
+                    }][..],
+                    &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                        100_0000,
+                    ))][..],
+                ),
+                #[cfg(feature = "orchard")]
+                &orchard_fees::EmptyBundleView,
+                None,
+                &AccountMeta::new(
+                    Some(PoolMeta::new(0, NonNegativeAmount::ZERO)),
+                    Some(PoolMeta::new(0, NonNegativeAmount::ZERO)),
+                ),
+            );
+
+            assert_matches!(
+                result,
+                Ok(balance) if
+                    balance.proposed_change() == [
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(124_7500), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(124_2500), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(124_2500), None),
+                        ChangeValue::sapling(NonNegativeAmount::const_from_u64(124_2500), None),
+                    ] &&
+                    balance.fee_required() == NonNegativeAmount::const_from_u64(25000)
+            );
+        }
     }
 
     #[test]
-    fn change_with_transparent_payments() {
-        let change_strategy = SingleOutputChangeStrategy::new(Zip317FeeRule::standard());
+    #[cfg(feature = "orchard")]
+    fn cross_pool_change_without_dust() {
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Orchard,
+            DustOutputPolicy::default(),
+        );
 
         // spend a single Sapling note that is sufficient to pay the fee
         let result = change_strategy.compute_balance(
@@ -277,90 +459,337 @@ mod tests {
             Network::TestNetwork
                 .activation_height(NetworkUpgrade::Nu5)
                 .unwrap(),
-            &Vec::<TestTransparentInput>::new(),
+            &[] as &[TestTransparentInput],
+            &[] as &[TxOut],
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[TestSaplingInput {
+                    note_id: 0,
+                    value: NonNegativeAmount::const_from_u64(55000),
+                }][..],
+                &[] as &[Infallible],
+            ),
+            &(
+                orchard::builder::BundleType::DEFAULT,
+                &[] as &[Infallible],
+                &[OrchardPayment::new(NonNegativeAmount::const_from_u64(
+                    30000,
+                ))][..],
+            ),
+            None,
+            &(),
+        );
+
+        assert_matches!(
+            result,
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::orchard(NonNegativeAmount::const_from_u64(5000), None)] &&
+                balance.fee_required() == NonNegativeAmount::const_from_u64(20000)
+        );
+    }
+
+    #[test]
+    fn change_with_transparent_payments_implicitly_allowing_zero_change() {
+        change_with_transparent_payments(DustOutputPolicy::default())
+    }
+
+    #[test]
+    fn change_with_transparent_payments_explicitly_allowing_zero_change() {
+        change_with_transparent_payments(DustOutputPolicy::new(
+            DustAction::AllowDustChange,
+            Some(NonNegativeAmount::ZERO),
+        ))
+    }
+
+    fn change_with_transparent_payments(dust_output_policy: DustOutputPolicy) {
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            dust_output_policy,
+        );
+
+        // spend a single Sapling note that is sufficient to pay the fee
+        let result = change_strategy.compute_balance(
+            &Network::TestNetwork,
+            Network::TestNetwork
+                .activation_height(NetworkUpgrade::Nu5)
+                .unwrap(),
+            &[] as &[TestTransparentInput],
             &[TxOut {
-                value: Amount::from_u64(40000).unwrap(),
+                value: NonNegativeAmount::const_from_u64(40000),
                 script_pubkey: Script(vec![]),
             }],
-            &[TestSaplingInput {
-                note_id: 0,
-                value: Amount::from_u64(55000).unwrap(),
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[TestSaplingInput {
+                    note_id: 0,
+                    value: NonNegativeAmount::const_from_u64(55000),
+                }][..],
+                &[] as &[Infallible],
+            ),
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
+        );
+
+        assert_matches!(
+            result,
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::sapling(NonNegativeAmount::ZERO, None)]
+                && balance.fee_required() == NonNegativeAmount::const_from_u64(15000)
+        );
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn change_fully_transparent_no_change() {
+        use crate::fees::sapling as sapling_fees;
+        use zcash_primitives::{legacy::TransparentAddress, transaction::components::OutPoint};
+
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+        );
+
+        // Spend a single transparent UTXO that is exactly sufficient to pay the fee.
+        let result = change_strategy.compute_balance::<_, Infallible>(
+            &Network::TestNetwork,
+            Network::TestNetwork
+                .activation_height(NetworkUpgrade::Nu5)
+                .unwrap(),
+            &[TestTransparentInput {
+                outpoint: OutPoint::fake(),
+                coin: TxOut {
+                    value: NonNegativeAmount::const_from_u64(50000),
+                    script_pubkey: TransparentAddress::PublicKeyHash([0u8; 20]).script(),
+                },
+            }],
+            &[TxOut {
+                value: NonNegativeAmount::const_from_u64(40000),
+                script_pubkey: Script(vec![]),
             }],
-            &Vec::<SaplingPayment>::new(),
-            &DustOutputPolicy::default(),
+            &sapling_fees::EmptyBundleView,
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
         );
 
         assert_matches!(
             result,
-            Ok(balance) if balance.proposed_change().is_empty()
-                && balance.fee_required() == Amount::from_u64(15000).unwrap()
+            Ok(balance) if
+                balance.proposed_change().is_empty() &&
+                balance.fee_required() == NonNegativeAmount::const_from_u64(10000)
         );
     }
 
     #[test]
-    fn change_with_allowable_dust() {
-        let change_strategy = SingleOutputChangeStrategy::new(Zip317FeeRule::standard());
+    #[cfg(feature = "transparent-inputs")]
+    fn change_transparent_flows_with_shielded_change() {
+        use crate::fees::sapling as sapling_fees;
+        use zcash_primitives::{legacy::TransparentAddress, transaction::components::OutPoint};
+
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+        );
 
-        // spend a single Sapling note that is sufficient to pay the fee
-        let result = change_strategy.compute_balance(
+        // Spend a single transparent UTXO that is sufficient to pay the fee.
+        let result = change_strategy.compute_balance::<_, Infallible>(
             &Network::TestNetwork,
             Network::TestNetwork
                 .activation_height(NetworkUpgrade::Nu5)
                 .unwrap(),
-            &Vec::<TestTransparentInput>::new(),
-            &Vec::<TxOut>::new(),
-            &[
-                TestSaplingInput {
-                    note_id: 0,
-                    value: Amount::from_u64(49000).unwrap(),
+            &[TestTransparentInput {
+                outpoint: OutPoint::fake(),
+                coin: TxOut {
+                    value: NonNegativeAmount::const_from_u64(63000),
+                    script_pubkey: TransparentAddress::PublicKeyHash([0u8; 20]).script(),
                 },
-                TestSaplingInput {
-                    note_id: 1,
-                    value: Amount::from_u64(1000).unwrap(),
+            }],
+            &[TxOut {
+                value: NonNegativeAmount::const_from_u64(40000),
+                script_pubkey: Script(vec![]),
+            }],
+            &sapling_fees::EmptyBundleView,
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
+        );
+
+        assert_matches!(
+            result,
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::sapling(NonNegativeAmount::const_from_u64(8000), None)] &&
+                balance.fee_required() == NonNegativeAmount::const_from_u64(15000)
+        );
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn change_transparent_flows_with_shielded_dust_change() {
+        use crate::fees::sapling as sapling_fees;
+        use zcash_primitives::{legacy::TransparentAddress, transaction::components::OutPoint};
+
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::new(
+                DustAction::AllowDustChange,
+                Some(NonNegativeAmount::const_from_u64(1000)),
+            ),
+        );
+
+        // Spend a single transparent UTXO that is sufficient to pay the fee.
+        // The change will go to the fallback shielded change pool even though all inputs
+        // and payments are transparent, and even though the change amount (1000) would
+        // normally be considered dust, because we set the dust policy to allow that.
+        let result = change_strategy.compute_balance::<_, Infallible>(
+            &Network::TestNetwork,
+            Network::TestNetwork
+                .activation_height(NetworkUpgrade::Nu5)
+                .unwrap(),
+            &[TestTransparentInput {
+                outpoint: OutPoint::fake(),
+                coin: TxOut {
+                    value: NonNegativeAmount::const_from_u64(56000),
+                    script_pubkey: TransparentAddress::PublicKeyHash([0u8; 20]).script(),
                 },
-            ],
-            &[SaplingPayment::new(Amount::from_u64(40000).unwrap())],
-            &DustOutputPolicy::default(),
+            }],
+            &[TxOut {
+                value: NonNegativeAmount::const_from_u64(40000),
+                script_pubkey: Script(vec![]),
+            }],
+            &sapling_fees::EmptyBundleView,
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
+        );
+
+        assert_matches!(
+            result,
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::sapling(NonNegativeAmount::const_from_u64(1000), None)] &&
+                balance.fee_required() == NonNegativeAmount::const_from_u64(15000)
+        );
+    }
+
+    #[test]
+    fn change_with_allowable_dust_implicitly_allowing_zero_change() {
+        change_with_allowable_dust(DustOutputPolicy::default())
+    }
+
+    #[test]
+    fn change_with_allowable_dust_explicitly_allowing_zero_change() {
+        change_with_allowable_dust(DustOutputPolicy::new(
+            DustAction::AllowDustChange,
+            Some(NonNegativeAmount::ZERO),
+        ))
+    }
+
+    fn change_with_allowable_dust(dust_output_policy: DustOutputPolicy) {
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            dust_output_policy,
+        );
+
+        // Spend two Sapling notes, one of them dust. There is sufficient to
+        // pay the fee: if only one note is spent then we are 1000 short, but
+        // if both notes are spent then the fee stays at 10000 (even with a
+        // zero-valued change output), so we have just enough.
+        let result = change_strategy.compute_balance(
+            &Network::TestNetwork,
+            Network::TestNetwork
+                .activation_height(NetworkUpgrade::Nu5)
+                .unwrap(),
+            &[] as &[TestTransparentInput],
+            &[] as &[TxOut],
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[
+                    TestSaplingInput {
+                        note_id: 0,
+                        value: NonNegativeAmount::const_from_u64(49000),
+                    },
+                    TestSaplingInput {
+                        note_id: 1,
+                        value: NonNegativeAmount::const_from_u64(1000),
+                    },
+                ][..],
+                &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                    40000,
+                ))][..],
+            ),
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
         );
 
         assert_matches!(
             result,
-            Ok(balance) if balance.proposed_change().is_empty()
-                && balance.fee_required() == Amount::from_u64(10000).unwrap()
+            Ok(balance) if
+                balance.proposed_change() == [ChangeValue::sapling(NonNegativeAmount::ZERO, None)] &&
+                balance.fee_required() == NonNegativeAmount::const_from_u64(10000)
         );
     }
 
     #[test]
     fn change_with_disallowed_dust() {
-        let change_strategy = SingleOutputChangeStrategy::new(Zip317FeeRule::standard());
+        let change_strategy = SingleOutputChangeStrategy::<_, MockWalletDb>::new(
+            Zip317FeeRule::standard(),
+            None,
+            ShieldedProtocol::Sapling,
+            DustOutputPolicy::default(),
+        );
 
-        // spend a single Sapling note that is sufficient to pay the fee
+        // Attempt to spend three Sapling notes, one of them dust. Adding the third
+        // note increases the number of actions, and so it is uneconomic to spend it.
         let result = change_strategy.compute_balance(
             &Network::TestNetwork,
             Network::TestNetwork
                 .activation_height(NetworkUpgrade::Nu5)
                 .unwrap(),
-            &Vec::<TestTransparentInput>::new(),
-            &Vec::<TxOut>::new(),
-            &[
-                TestSaplingInput {
-                    note_id: 0,
-                    value: Amount::from_u64(29000).unwrap(),
-                },
-                TestSaplingInput {
-                    note_id: 1,
-                    value: Amount::from_u64(20000).unwrap(),
-                },
-                TestSaplingInput {
-                    note_id: 2,
-                    value: Amount::from_u64(1000).unwrap(),
-                },
-            ],
-            &[SaplingPayment::new(Amount::from_u64(40000).unwrap())],
-            &DustOutputPolicy::default(),
+            &[] as &[TestTransparentInput],
+            &[] as &[TxOut],
+            &(
+                sapling::builder::BundleType::DEFAULT,
+                &[
+                    TestSaplingInput {
+                        note_id: 0,
+                        value: NonNegativeAmount::const_from_u64(29000),
+                    },
+                    TestSaplingInput {
+                        note_id: 1,
+                        value: NonNegativeAmount::const_from_u64(20000),
+                    },
+                    TestSaplingInput {
+                        note_id: 2,
+                        value: NonNegativeAmount::const_from_u64(1000),
+                    },
+                ][..],
+                &[SaplingPayment::new(NonNegativeAmount::const_from_u64(
+                    30000,
+                ))][..],
+            ),
+            #[cfg(feature = "orchard")]
+            &orchard_fees::EmptyBundleView,
+            None,
+            &(),
         );
 
-        // We will get an error here, because the dust input now isn't free to add
+        // We will get an error here, because the dust input isn't free to add
         // to the transaction.
         assert_matches!(
             result,
diff --git a/zcash_client_backend/src/keys.rs b/zcash_client_backend/src/keys.rs
deleted file mode 100644
index 54a585dcb4..0000000000
--- a/zcash_client_backend/src/keys.rs
+++ /dev/null
@@ -1,764 +0,0 @@
-//! Helper functions for managing light client key material.
-use orchard;
-use zcash_address::unified::{self, Container, Encoding};
-use zcash_primitives::{
-    consensus,
-    zip32::{AccountId, DiversifierIndex},
-};
-
-use crate::address::UnifiedAddress;
-
-#[cfg(feature = "transparent-inputs")]
-use {
-    std::convert::TryInto,
-    zcash_primitives::legacy::keys::{self as legacy, IncomingViewingKey},
-};
-
-#[cfg(feature = "unstable")]
-use {
-    byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt},
-    std::convert::TryFrom,
-    std::io::{Read, Write},
-    zcash_address::unified::Typecode,
-    zcash_encoding::CompactSize,
-    zcash_primitives::consensus::BranchId,
-};
-
-pub mod sapling {
-    pub use zcash_primitives::zip32::sapling::{
-        DiversifiableFullViewingKey, ExtendedFullViewingKey, ExtendedSpendingKey,
-    };
-    use zcash_primitives::zip32::{AccountId, ChildIndex};
-
-    /// Derives the ZIP 32 [`ExtendedSpendingKey`] for a given coin type and account from the
-    /// given seed.
-    ///
-    /// # Panics
-    ///
-    /// Panics if `seed` is shorter than 32 bytes.
-    ///
-    /// # Examples
-    ///
-    /// ```
-    /// use zcash_primitives::{
-    ///     constants::testnet::COIN_TYPE,
-    ///     zip32::AccountId,
-    /// };
-    /// use zcash_client_backend::{
-    ///     keys::sapling,
-    /// };
-    ///
-    /// let extsk = sapling::spending_key(&[0; 32][..], COIN_TYPE, AccountId::from(0));
-    /// ```
-    /// [`ExtendedSpendingKey`]: zcash_primitives::zip32::ExtendedSpendingKey
-    pub fn spending_key(seed: &[u8], coin_type: u32, account: AccountId) -> ExtendedSpendingKey {
-        if seed.len() < 32 {
-            panic!("ZIP 32 seeds MUST be at least 32 bytes");
-        }
-
-        ExtendedSpendingKey::from_path(
-            &ExtendedSpendingKey::master(seed),
-            &[
-                ChildIndex::Hardened(32),
-                ChildIndex::Hardened(coin_type),
-                ChildIndex::Hardened(account.into()),
-            ],
-        )
-    }
-}
-
-#[cfg(feature = "transparent-inputs")]
-fn to_transparent_child_index(j: DiversifierIndex) -> Option<u32> {
-    let (low_4_bytes, rest) = j.0.split_at(4);
-    let transparent_j = u32::from_le_bytes(low_4_bytes.try_into().unwrap());
-    if transparent_j > (0x7FFFFFFF) || rest.iter().any(|b| b != &0) {
-        None
-    } else {
-        Some(transparent_j)
-    }
-}
-
-#[derive(Debug)]
-#[doc(hidden)]
-pub enum DerivationError {
-    Orchard(orchard::zip32::Error),
-    #[cfg(feature = "transparent-inputs")]
-    Transparent(hdwallet::error::Error),
-}
-
-/// A version identifier for the encoding of unified spending keys.
-///
-/// Each era corresponds to a range of block heights. During an era, the unified spending key
-/// parsed from an encoded form tagged with that era's identifier is expected to provide
-/// sufficient spending authority to spend any non-Sprout shielded note created in a transaction
-/// within the era's block range.
-#[cfg(feature = "unstable")]
-#[derive(Debug, PartialEq, Eq)]
-pub enum Era {
-    /// The Orchard era begins at Orchard activation, and will end if a new pool that requires a
-    /// change to unified spending keys is introduced.
-    Orchard,
-}
-
-/// A type for errors that can occur when decoding keys from their serialized representations.
-#[cfg(feature = "unstable")]
-#[derive(Debug, PartialEq, Eq)]
-pub enum DecodingError {
-    ReadError(&'static str),
-    EraInvalid,
-    EraMismatch(Era),
-    TypecodeInvalid,
-    LengthInvalid,
-    LengthMismatch(Typecode, u32),
-    InsufficientData(Typecode),
-    KeyDataInvalid(Typecode),
-}
-
-#[cfg(feature = "unstable")]
-impl Era {
-    /// Returns the unique identifier for the era.
-    fn id(&self) -> u32 {
-        // We use the consensus branch id of the network upgrade that introduced a
-        // new USK format as the identifier for the era.
-        match self {
-            Era::Orchard => u32::from(BranchId::Nu5),
-        }
-    }
-
-    fn try_from_id(id: u32) -> Option<Self> {
-        BranchId::try_from(id).ok().and_then(|b| match b {
-            BranchId::Nu5 => Some(Era::Orchard),
-            _ => None,
-        })
-    }
-}
-
-/// A set of viewing keys that are all associated with a single
-/// ZIP-0032 account identifier.
-#[derive(Clone, Debug)]
-#[doc(hidden)]
-pub struct UnifiedSpendingKey {
-    #[cfg(feature = "transparent-inputs")]
-    transparent: legacy::AccountPrivKey,
-    sapling: sapling::ExtendedSpendingKey,
-    orchard: orchard::keys::SpendingKey,
-}
-
-#[doc(hidden)]
-impl UnifiedSpendingKey {
-    pub fn from_seed<P: consensus::Parameters>(
-        params: &P,
-        seed: &[u8],
-        account: AccountId,
-    ) -> Result<UnifiedSpendingKey, DerivationError> {
-        if seed.len() < 32 {
-            panic!("ZIP 32 seeds MUST be at least 32 bytes");
-        }
-
-        let orchard =
-            orchard::keys::SpendingKey::from_zip32_seed(seed, params.coin_type(), account.into())
-                .map_err(DerivationError::Orchard)?;
-
-        #[cfg(feature = "transparent-inputs")]
-        let transparent = legacy::AccountPrivKey::from_seed(params, seed, account)
-            .map_err(DerivationError::Transparent)?;
-
-        Ok(UnifiedSpendingKey {
-            #[cfg(feature = "transparent-inputs")]
-            transparent,
-            sapling: sapling::spending_key(seed, params.coin_type(), account),
-            orchard,
-        })
-    }
-
-    pub fn to_unified_full_viewing_key(&self) -> UnifiedFullViewingKey {
-        UnifiedFullViewingKey {
-            #[cfg(feature = "transparent-inputs")]
-            transparent: Some(self.transparent.to_account_pubkey()),
-            sapling: Some(self.sapling.to_diversifiable_full_viewing_key()),
-            orchard: Some((&self.orchard).into()),
-            unknown: vec![],
-        }
-    }
-
-    /// Returns the transparent component of the unified key at the
-    /// BIP44 path `m/44'/<coin_type>'/<account>'`.
-    #[cfg(feature = "transparent-inputs")]
-    pub fn transparent(&self) -> &legacy::AccountPrivKey {
-        &self.transparent
-    }
-
-    /// Returns the Sapling extended spending key component of this unified spending key.
-    pub fn sapling(&self) -> &sapling::ExtendedSpendingKey {
-        &self.sapling
-    }
-
-    /// Returns the Orchard spending key component of this unified spending key.
-    pub fn orchard(&self) -> &orchard::keys::SpendingKey {
-        &self.orchard
-    }
-
-    /// Returns a binary encoding of this key suitable for decoding with [`decode`].
-    ///
-    /// The encoded form of a unified spending key is only intended for use
-    /// within wallets when required for storage and/or crossing FFI boundaries;
-    /// unified spending keys should not be exposed to users, and consequently
-    /// no string-based encoding is defined. This encoding does not include any
-    /// internal validation metadata (such as checksums) as keys decoded from
-    /// this form will necessarily be validated when the attempt is made to
-    /// spend a note that they have authority for.
-    #[cfg(feature = "unstable")]
-    pub fn to_bytes(&self, era: Era) -> Vec<u8> {
-        let mut result = vec![];
-        result.write_u32::<LittleEndian>(era.id()).unwrap();
-
-        // orchard
-        let orchard_key = self.orchard();
-        CompactSize::write(&mut result, usize::try_from(Typecode::Orchard).unwrap()).unwrap();
-
-        let orchard_key_bytes = orchard_key.to_bytes();
-        CompactSize::write(&mut result, orchard_key_bytes.len()).unwrap();
-        result.write_all(orchard_key_bytes).unwrap();
-
-        // sapling
-        let sapling_key = self.sapling();
-        CompactSize::write(&mut result, usize::try_from(Typecode::Sapling).unwrap()).unwrap();
-
-        let sapling_key_bytes = sapling_key.to_bytes();
-        CompactSize::write(&mut result, sapling_key_bytes.len()).unwrap();
-        result.write_all(&sapling_key_bytes).unwrap();
-
-        // transparent
-        #[cfg(feature = "transparent-inputs")]
-        {
-            let account_tkey = self.transparent();
-            CompactSize::write(&mut result, usize::try_from(Typecode::P2pkh).unwrap()).unwrap();
-
-            let account_tkey_bytes = account_tkey.to_bytes();
-            CompactSize::write(&mut result, account_tkey_bytes.len()).unwrap();
-            result.write_all(&account_tkey_bytes).unwrap();
-        }
-
-        result
-    }
-
-    /// Decodes a [`UnifiedSpendingKey`] value from its serialized representation.
-    ///
-    /// See [`to_bytes`] for additional detail about the encoded form.
-    #[allow(clippy::unnecessary_unwrap)]
-    #[cfg(feature = "unstable")]
-    pub fn from_bytes(era: Era, encoded: &[u8]) -> Result<Self, DecodingError> {
-        let mut source = std::io::Cursor::new(encoded);
-        let decoded_era = source
-            .read_u32::<LittleEndian>()
-            .map_err(|_| DecodingError::ReadError("era"))
-            .and_then(|id| Era::try_from_id(id).ok_or(DecodingError::EraInvalid))?;
-
-        if decoded_era != era {
-            return Err(DecodingError::EraMismatch(decoded_era));
-        }
-
-        let mut orchard = None;
-        let mut sapling = None;
-        #[cfg(feature = "transparent-inputs")]
-        let mut transparent = None;
-        loop {
-            let tc = CompactSize::read_t::<_, u32>(&mut source)
-                .map_err(|_| DecodingError::ReadError("typecode"))
-                .and_then(|v| Typecode::try_from(v).map_err(|_| DecodingError::TypecodeInvalid))?;
-
-            let len = CompactSize::read_t::<_, u32>(&mut source)
-                .map_err(|_| DecodingError::ReadError("key length"))?;
-
-            match tc {
-                Typecode::Orchard => {
-                    if len != 32 {
-                        return Err(DecodingError::LengthMismatch(Typecode::Orchard, len));
-                    }
-
-                    let mut key = [0u8; 32];
-                    source
-                        .read_exact(&mut key)
-                        .map_err(|_| DecodingError::InsufficientData(Typecode::Orchard))?;
-                    orchard = Some(
-                        Option::<orchard::keys::SpendingKey>::from(
-                            orchard::keys::SpendingKey::from_bytes(key),
-                        )
-                        .ok_or(DecodingError::KeyDataInvalid(Typecode::Orchard))?,
-                    );
-                }
-                Typecode::Sapling => {
-                    if len != 169 {
-                        return Err(DecodingError::LengthMismatch(Typecode::Sapling, len));
-                    }
-
-                    let mut key = [0u8; 169];
-                    source
-                        .read_exact(&mut key)
-                        .map_err(|_| DecodingError::InsufficientData(Typecode::Sapling))?;
-                    sapling = Some(
-                        sapling::ExtendedSpendingKey::from_bytes(&key)
-                            .map_err(|_| DecodingError::KeyDataInvalid(Typecode::Sapling))?,
-                    );
-                }
-                #[cfg(feature = "transparent-inputs")]
-                Typecode::P2pkh => {
-                    if len != 64 {
-                        return Err(DecodingError::LengthMismatch(Typecode::P2pkh, len));
-                    }
-
-                    let mut key = [0u8; 64];
-                    source
-                        .read_exact(&mut key)
-                        .map_err(|_| DecodingError::InsufficientData(Typecode::P2pkh))?;
-                    transparent = Some(
-                        legacy::AccountPrivKey::from_bytes(&key)
-                            .ok_or(DecodingError::KeyDataInvalid(Typecode::P2pkh))?,
-                    );
-                }
-                _ => {
-                    return Err(DecodingError::TypecodeInvalid);
-                }
-            }
-
-            #[cfg(feature = "transparent-inputs")]
-            let has_transparent = transparent.is_some();
-            #[cfg(not(feature = "transparent-inputs"))]
-            let has_transparent = true;
-
-            if orchard.is_some() && sapling.is_some() && has_transparent {
-                return Ok(UnifiedSpendingKey {
-                    orchard: orchard.unwrap(),
-                    sapling: sapling.unwrap(),
-                    #[cfg(feature = "transparent-inputs")]
-                    transparent: transparent.unwrap(),
-                });
-            }
-        }
-    }
-}
-
-/// A [ZIP 316](https://zips.z.cash/zip-0316) unified full viewing key.
-#[derive(Clone, Debug)]
-#[doc(hidden)]
-pub struct UnifiedFullViewingKey {
-    #[cfg(feature = "transparent-inputs")]
-    transparent: Option<legacy::AccountPubKey>,
-    sapling: Option<sapling::DiversifiableFullViewingKey>,
-    orchard: Option<orchard::keys::FullViewingKey>,
-    unknown: Vec<(u32, Vec<u8>)>,
-}
-
-#[doc(hidden)]
-impl UnifiedFullViewingKey {
-    /// Construct a new unified full viewing key, if the required components are present.
-    pub fn new(
-        #[cfg(feature = "transparent-inputs")] transparent: Option<legacy::AccountPubKey>,
-        sapling: Option<sapling::DiversifiableFullViewingKey>,
-        orchard: Option<orchard::keys::FullViewingKey>,
-    ) -> Option<UnifiedFullViewingKey> {
-        if sapling.is_none() {
-            None
-        } else {
-            Some(UnifiedFullViewingKey {
-                #[cfg(feature = "transparent-inputs")]
-                transparent,
-                sapling,
-                orchard,
-                // We don't allow constructing new UFVKs with unknown items, but we store
-                // this to allow parsing such UFVKs.
-                unknown: vec![],
-            })
-        }
-    }
-
-    /// Parses a `UnifiedFullViewingKey` from its [ZIP 316] string encoding.
-    ///
-    /// [ZIP 316]: https://zips.z.cash/zip-0316
-    pub fn decode<P: consensus::Parameters>(params: &P, encoding: &str) -> Result<Self, String> {
-        let (net, ufvk) = unified::Ufvk::decode(encoding).map_err(|e| e.to_string())?;
-        let expected_net = params.address_network().expect("Unrecognized network");
-        if net != expected_net {
-            return Err(format!(
-                "UFVK is for network {:?} but we expected {:?}",
-                net, expected_net,
-            ));
-        }
-
-        let mut orchard = None;
-        let mut sapling = None;
-        #[cfg(feature = "transparent-inputs")]
-        let mut transparent = None;
-
-        // We can use as-parsed order here for efficiency, because we're breaking out the
-        // receivers we support from the unknown receivers.
-        let unknown = ufvk
-            .items_as_parsed()
-            .iter()
-            .filter_map(|receiver| match receiver {
-                unified::Fvk::Orchard(data) => orchard::keys::FullViewingKey::from_bytes(data)
-                    .ok_or("Invalid Orchard FVK in Unified FVK")
-                    .map(|addr| {
-                        orchard = Some(addr);
-                        None
-                    })
-                    .transpose(),
-                unified::Fvk::Sapling(data) => {
-                    sapling::DiversifiableFullViewingKey::from_bytes(data)
-                        .ok_or("Invalid Sapling FVK in Unified FVK")
-                        .map(|pa| {
-                            sapling = Some(pa);
-                            None
-                        })
-                        .transpose()
-                }
-                #[cfg(feature = "transparent-inputs")]
-                unified::Fvk::P2pkh(data) => legacy::AccountPubKey::deserialize(data)
-                    .map_err(|_| "Invalid transparent FVK in Unified FVK")
-                    .map(|tfvk| {
-                        transparent = Some(tfvk);
-                        None
-                    })
-                    .transpose(),
-                #[cfg(not(feature = "transparent-inputs"))]
-                unified::Fvk::P2pkh(data) => {
-                    Some(Ok((unified::Typecode::P2pkh.into(), data.to_vec())))
-                }
-                unified::Fvk::Unknown { typecode, data } => Some(Ok((*typecode, data.clone()))),
-            })
-            .collect::<Result<_, _>>()?;
-
-        Ok(Self {
-            #[cfg(feature = "transparent-inputs")]
-            transparent,
-            sapling,
-            orchard,
-            unknown,
-        })
-    }
-
-    /// Returns the string encoding of this `UnifiedFullViewingKey` for the given network.
-    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
-        let items = std::iter::empty()
-            .chain(
-                self.orchard
-                    .as_ref()
-                    .map(|fvk| fvk.to_bytes())
-                    .map(unified::Fvk::Orchard),
-            )
-            .chain(
-                self.sapling
-                    .as_ref()
-                    .map(|dfvk| dfvk.to_bytes())
-                    .map(unified::Fvk::Sapling),
-            )
-            .chain(
-                self.unknown
-                    .iter()
-                    .map(|(typecode, data)| unified::Fvk::Unknown {
-                        typecode: *typecode,
-                        data: data.clone(),
-                    }),
-            );
-        #[cfg(feature = "transparent-inputs")]
-        let items = items.chain(
-            self.transparent
-                .as_ref()
-                .map(|tfvk| tfvk.serialize().try_into().unwrap())
-                .map(unified::Fvk::P2pkh),
-        );
-
-        let ufvk = unified::Ufvk::try_from_items(items.collect())
-            .expect("UnifiedFullViewingKey should only be constructed safely");
-        ufvk.encode(&params.address_network().expect("Unrecognized network"))
-    }
-
-    /// Returns the transparent component of the unified key at the
-    /// BIP44 path `m/44'/<coin_type>'/<account>'`.
-    #[cfg(feature = "transparent-inputs")]
-    pub fn transparent(&self) -> Option<&legacy::AccountPubKey> {
-        self.transparent.as_ref()
-    }
-
-    /// Returns the Sapling diversifiable full viewing key component of this unified key.
-    pub fn sapling(&self) -> Option<&sapling::DiversifiableFullViewingKey> {
-        self.sapling.as_ref()
-    }
-
-    /// Returns the Orchard full viewing key component of this unified key.
-    pub fn orchard(&self) -> Option<&orchard::keys::FullViewingKey> {
-        self.orchard.as_ref()
-    }
-
-    /// Attempts to derive the Unified Address for the given diversifier index.
-    ///
-    /// Returns `None` if the specified index does not produce a valid diversifier.
-    // TODO: Allow filtering down by receiver types?
-    pub fn address(&self, j: DiversifierIndex) -> Option<UnifiedAddress> {
-        let sapling = if let Some(extfvk) = self.sapling.as_ref() {
-            Some(extfvk.address(j)?)
-        } else {
-            None
-        };
-
-        #[cfg(feature = "transparent-inputs")]
-        let transparent = if let Some(tfvk) = self.transparent.as_ref() {
-            match to_transparent_child_index(j) {
-                Some(transparent_j) => match tfvk
-                    .derive_external_ivk()
-                    .and_then(|tivk| tivk.derive_address(transparent_j))
-                {
-                    Ok(taddr) => Some(taddr),
-                    Err(_) => return None,
-                },
-                // Diversifier doesn't generate a valid transparent child index.
-                None => return None,
-            }
-        } else {
-            None
-        };
-        #[cfg(not(feature = "transparent-inputs"))]
-        let transparent = None;
-
-        UnifiedAddress::from_receivers(None, sapling, transparent)
-    }
-
-    /// Searches the diversifier space starting at diversifier index `j` for one which will
-    /// produce a valid diversifier, and return the Unified Address constructed using that
-    /// diversifier along with the index at which the valid diversifier was found.
-    ///
-    /// Returns `None` if no valid diversifier exists
-    pub fn find_address(
-        &self,
-        mut j: DiversifierIndex,
-    ) -> Option<(UnifiedAddress, DiversifierIndex)> {
-        // If we need to generate a transparent receiver, check that the user has not
-        // specified an invalid transparent child index, from which we can never search to
-        // find a valid index.
-        #[cfg(feature = "transparent-inputs")]
-        if self.transparent.is_some() && to_transparent_child_index(j).is_none() {
-            return None;
-        }
-
-        // Find a working diversifier and construct the associated address.
-        loop {
-            let res = self.address(j);
-            if let Some(ua) = res {
-                break Some((ua, j));
-            }
-            if j.increment().is_err() {
-                break None;
-            }
-        }
-    }
-
-    /// Returns the Unified Address corresponding to the smallest valid diversifier index,
-    /// along with that index.
-    pub fn default_address(&self) -> (UnifiedAddress, DiversifierIndex) {
-        self.find_address(DiversifierIndex::new())
-            .expect("UFVK should have at least one valid diversifier")
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod testing {
-    use proptest::prelude::*;
-
-    use super::UnifiedSpendingKey;
-    use zcash_primitives::{consensus::Network, zip32::AccountId};
-
-    pub fn arb_unified_spending_key(params: Network) -> impl Strategy<Value = UnifiedSpendingKey> {
-        prop::array::uniform32(prop::num::u8::ANY).prop_flat_map(move |seed| {
-            prop::num::u32::ANY
-                .prop_map(move |account| {
-                    UnifiedSpendingKey::from_seed(&params, &seed, AccountId::from(account))
-                })
-                .prop_filter("seeds must generate valid USKs", |v| v.is_ok())
-                .prop_map(|v| v.unwrap())
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use proptest::prelude::proptest;
-
-    use super::{sapling, UnifiedFullViewingKey};
-    use zcash_primitives::{consensus::MAIN_NETWORK, zip32::AccountId};
-
-    #[cfg(feature = "transparent-inputs")]
-    use {
-        crate::{address::RecipientAddress, encoding::AddressCodec},
-        zcash_address::test_vectors,
-        zcash_primitives::{
-            legacy::{
-                self,
-                keys::{AccountPrivKey, IncomingViewingKey},
-            },
-            zip32::DiversifierIndex,
-        },
-    };
-
-    #[cfg(feature = "unstable")]
-    use {
-        super::{testing::arb_unified_spending_key, Era, UnifiedSpendingKey},
-        subtle::ConstantTimeEq,
-        zcash_primitives::consensus::Network,
-    };
-
-    #[cfg(feature = "transparent-inputs")]
-    fn seed() -> Vec<u8> {
-        let seed_hex = "6ef5f84def6f4b9d38f466586a8380a38593bd47c8cda77f091856176da47f26b5bd1c8d097486e5635df5a66e820d28e1d73346f499801c86228d43f390304f";
-        hex::decode(seed_hex).unwrap()
-    }
-
-    #[test]
-    #[should_panic]
-    fn spending_key_panics_on_short_seed() {
-        let _ = sapling::spending_key(&[0; 31][..], 0, AccountId::from(0));
-    }
-
-    #[cfg(feature = "transparent-inputs")]
-    #[test]
-    fn pk_to_taddr() {
-        let taddr =
-            legacy::keys::AccountPrivKey::from_seed(&MAIN_NETWORK, &seed(), AccountId::from(0))
-                .unwrap()
-                .to_account_pubkey()
-                .derive_external_ivk()
-                .unwrap()
-                .derive_address(0)
-                .unwrap()
-                .encode(&MAIN_NETWORK);
-        assert_eq!(taddr, "t1PKtYdJJHhc3Pxowmznkg7vdTwnhEsCvR4".to_string());
-    }
-
-    #[test]
-    fn ufvk_round_trip() {
-        let account = 0.into();
-
-        let orchard = {
-            let sk = orchard::keys::SpendingKey::from_zip32_seed(&[0; 32], 0, 0).unwrap();
-            Some(orchard::keys::FullViewingKey::from(&sk))
-        };
-
-        let sapling = {
-            let extsk = sapling::spending_key(&[0; 32], 0, account);
-            Some(extsk.to_diversifiable_full_viewing_key())
-        };
-
-        #[cfg(feature = "transparent-inputs")]
-        let transparent = {
-            let privkey =
-                AccountPrivKey::from_seed(&MAIN_NETWORK, &[0; 32], AccountId::from(0)).unwrap();
-            Some(privkey.to_account_pubkey())
-        };
-
-        let ufvk = UnifiedFullViewingKey::new(
-            #[cfg(feature = "transparent-inputs")]
-            transparent,
-            sapling,
-            orchard,
-        )
-        .unwrap();
-
-        let encoded = ufvk.encode(&MAIN_NETWORK);
-
-        // test encoded form against known values
-        let encoded_with_t = "uview1tg6rpjgju2s2j37gkgjq79qrh5lvzr6e0ed3n4sf4hu5qd35vmsh7avl80xa6mx7ryqce9hztwaqwrdthetpy4pc0kce25x453hwcmax02p80pg5savlg865sft9reat07c5vlactr6l2pxtlqtqunt2j9gmvr8spcuzf07af80h5qmut38h0gvcfa9k4rwujacwwca9vu8jev7wq6c725huv8qjmhss3hdj2vh8cfxhpqcm2qzc34msyrfxk5u6dqttt4vv2mr0aajreww5yufpk0gn4xkfm888467k7v6fmw7syqq6cceu078yw8xja502jxr0jgum43lhvpzmf7eu5dmnn6cr6f7p43yw8znzgxg598mllewnx076hljlvynhzwn5es94yrv65tdg3utuz2u3sras0wfcq4adxwdvlk387d22g3q98t5z74quw2fa4wed32escx8dwh4mw35t4jwf35xyfxnu83mk5s4kw2glkgsshmxk";
-        let _encoded_no_t = "uview12z384wdq76ceewlsu0esk7d97qnd23v2qnvhujxtcf2lsq8g4hwzpx44fwxssnm5tg8skyh4tnc8gydwxefnnm0hd0a6c6etmj0pp9jqkdsllkr70u8gpf7ndsfqcjlqn6dec3faumzqlqcmtjf8vp92h7kj38ph2786zx30hq2wru8ae3excdwc8w0z3t9fuw7mt7xy5sn6s4e45kwm0cjp70wytnensgdnev286t3vew3yuwt2hcz865y037k30e428dvgne37xvyeal2vu8yjnznphf9t2rw3gdp0hk5zwq00ws8f3l3j5n3qkqgsyzrwx4qzmgq0xwwk4vz2r6vtsykgz089jncvycmem3535zjwvvtvjw8v98y0d5ydwte575gjm7a7k";
-        #[cfg(feature = "transparent-inputs")]
-        assert_eq!(encoded, encoded_with_t);
-        #[cfg(not(feature = "transparent-inputs"))]
-        assert_eq!(encoded, _encoded_no_t);
-
-        let decoded = UnifiedFullViewingKey::decode(&MAIN_NETWORK, &encoded).unwrap();
-        let reencoded = decoded.encode(&MAIN_NETWORK);
-        assert_eq!(encoded, reencoded);
-
-        #[cfg(feature = "transparent-inputs")]
-        assert_eq!(
-            decoded.transparent.map(|t| t.serialize()),
-            ufvk.transparent.as_ref().map(|t| t.serialize()),
-        );
-        assert_eq!(
-            decoded.sapling.map(|s| s.to_bytes()),
-            ufvk.sapling.map(|s| s.to_bytes()),
-        );
-        assert_eq!(
-            decoded.orchard.map(|o| o.to_bytes()),
-            ufvk.orchard.map(|o| o.to_bytes()),
-        );
-
-        let decoded_with_t = UnifiedFullViewingKey::decode(&MAIN_NETWORK, encoded_with_t).unwrap();
-        #[cfg(feature = "transparent-inputs")]
-        assert_eq!(
-            decoded_with_t.transparent.map(|t| t.serialize()),
-            ufvk.transparent.as_ref().map(|t| t.serialize()),
-        );
-        #[cfg(not(feature = "transparent-inputs"))]
-        assert_eq!(decoded_with_t.unknown.len(), 1);
-    }
-
-    #[test]
-    #[cfg(feature = "transparent-inputs")]
-    fn ufvk_derivation() {
-        for tv in test_vectors::UNIFIED {
-            let usk = UnifiedSpendingKey::from_seed(
-                &MAIN_NETWORK,
-                &tv.root_seed,
-                AccountId::from(tv.account),
-            )
-            .expect("seed produced a valid unified spending key");
-
-            let d_idx = DiversifierIndex::from(tv.diversifier_index);
-            let ufvk = usk.to_unified_full_viewing_key();
-
-            // The test vectors contain some diversifier indices that do not generate
-            // valid Sapling addresses, so skip those.
-            if ufvk.sapling().unwrap().address(d_idx).is_none() {
-                continue;
-            }
-
-            let ua = ufvk.address(d_idx).unwrap_or_else(|| panic!("diversifier index {} should have produced a valid unified address for account {}",
-                tv.diversifier_index, tv.account));
-
-            match RecipientAddress::decode(&MAIN_NETWORK, tv.unified_addr) {
-                Some(RecipientAddress::Unified(tvua)) => {
-                    // We always derive transparent and Sapling receivers, but not
-                    // every value in the test vectors has these present.
-                    if tvua.transparent().is_some() {
-                        assert_eq!(tvua.transparent(), ua.transparent());
-                    }
-                    if tvua.sapling().is_some() {
-                        assert_eq!(tvua.sapling(), ua.sapling());
-                    }
-                }
-                _other => {
-                    panic!(
-                        "{} did not decode to a valid unified address",
-                        tv.unified_addr
-                    );
-                }
-            }
-        }
-    }
-
-    proptest! {
-        #[test]
-        #[cfg(feature = "unstable")]
-        fn prop_usk_roundtrip(usk in arb_unified_spending_key(Network::MainNetwork)) {
-            let encoded = usk.to_bytes(Era::Orchard);
-            #[cfg(not(feature = "transparent-inputs"))]
-            assert_eq!(encoded.len(), 4 + 2 + 32 + 2 + 169);
-            #[cfg(feature = "transparent-inputs")]
-            assert_eq!(encoded.len(), 4 + 2 + 32 + 2 + 169 + 2 + 64);
-            let decoded = UnifiedSpendingKey::from_bytes(Era::Orchard, &encoded);
-            let decoded = decoded.unwrap_or_else(|e| panic!("Error decoding USK: {:?}", e));
-            assert!(bool::from(decoded.orchard().ct_eq(usk.orchard())));
-            assert_eq!(decoded.sapling(), usk.sapling());
-            #[cfg(feature = "transparent-inputs")]
-            assert_eq!(decoded.transparent().to_bytes(), usk.transparent().to_bytes());
-        }
-    }
-}
diff --git a/zcash_client_backend/src/lib.rs b/zcash_client_backend/src/lib.rs
index f737116623..2dfd599562 100644
--- a/zcash_client_backend/src/lib.rs
+++ b/zcash_client_backend/src/lib.rs
@@ -2,25 +2,89 @@
 //!
 //! `zcash_client_backend` contains Rust structs and traits for creating shielded Zcash
 //! light clients.
+//!
+//! # Design
+//!
+//! ## Wallet sync
+//!
+//! The APIs in the [`data_api::chain`] module can be used to implement the following
+//! synchronization flow:
+//!
+//! ```text
+//!                          ┌─────────────┐  ┌─────────────┐
+//!                          │Get required │  │   Update    │
+//!                          │subtree root │─▶│subtree roots│
+//!                          │    range    │  └─────────────┘
+//!                          └─────────────┘         │
+//!                                                  ▼
+//!                                             ┌─────────┐
+//!                                             │ Update  │
+//!           ┌────────────────────────────────▶│chain tip│◀──────┐
+//!           │                                 └─────────┘       │
+//!           │                                      │            │
+//!           │                                      ▼            │
+//!    ┌─────────────┐        ┌────────────┐  ┌─────────────┐     │
+//!    │  Truncate   │        │Split range │  │Get suggested│     │
+//!    │  wallet to  │        │into batches│◀─│ scan ranges │     │
+//!    │rewind height│        └────────────┘  └─────────────┘     │
+//!    └─────────────┘               │                            │
+//!           ▲                     ╱│╲                           │
+//!           │      ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─              │
+//!      ┌────────┐         ┌───────────────┐       │             │
+//!      │ Choose │  │      │Download blocks│                     │
+//!      │ rewind │         │   to cache    │       │             │
+//!      │ height │  │      └───────────────┘           .───────────────────.
+//!      └────────┘                 │               │  ( Scan ranges updated )
+//!           ▲      │              ▼                   `───────────────────'
+//!           │               ┌───────────┐         │             ▲
+//!  .───────────────┴─.      │Scan cached│    .─────────.        │
+//! ( Continuity error  )◀────│  blocks   │──▶(  Success  )───────┤
+//!  `───────────────┬─'      └───────────┘    `─────────'        │
+//!                                 │               │             │
+//!                  │       ┌──────┴───────┐                     │
+//!                          ▼              ▼       │             ▼
+//!                  │┌─────────────┐┌─────────────┐  ┌──────────────────────┐
+//!                   │Delete blocks││   Enhance   ││ │Update wallet balance │
+//!                  ││ from cache  ││transactions │  │  and sync progress   │
+//!                   └─────────────┘└─────────────┘│ └──────────────────────┘
+//!                  └ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─
+//! ```
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
 
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
 // Catch documentation errors caused by code changes.
 #![deny(rustdoc::broken_intra_doc_links)]
 // Temporary until we have addressed all Result<T, ()> cases.
 #![allow(clippy::result_unit_err)]
 
-pub mod address;
+pub use zcash_keys::address;
 pub mod data_api;
 mod decrypt;
-pub mod encoding;
+pub use zcash_keys::encoding;
 pub mod fees;
-pub mod keys;
+pub use zcash_keys::keys;
+pub mod proposal;
 pub mod proto;
 pub mod scan;
+pub mod scanning;
 pub mod wallet;
-pub mod welding_rig;
-pub mod zip321;
+pub use zip321;
+
+#[cfg(feature = "sync")]
+pub mod sync;
+
+#[cfg(feature = "unstable-serialization")]
+pub mod serialization;
+
+#[cfg(feature = "tor")]
+pub mod tor;
 
 pub use decrypt::{decrypt_transaction, DecryptedOutput, TransferType};
+pub use zcash_protocol::{PoolType, ShieldedProtocol};
 
 #[cfg(test)]
 #[macro_use]
diff --git a/zcash_client_backend/src/proposal.rs b/zcash_client_backend/src/proposal.rs
new file mode 100644
index 0000000000..45391cb2b7
--- /dev/null
+++ b/zcash_client_backend/src/proposal.rs
@@ -0,0 +1,583 @@
+//! Types related to the construction and evaluation of transaction proposals.
+
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fmt::{self, Debug, Display},
+};
+
+use nonempty::NonEmpty;
+use zcash_primitives::{
+    consensus::BlockHeight,
+    transaction::{components::amount::NonNegativeAmount, TxId},
+};
+
+use crate::{
+    fees::TransactionBalance,
+    wallet::{Note, ReceivedNote, WalletTransparentOutput},
+    zip321::TransactionRequest,
+    PoolType, ShieldedProtocol,
+};
+
+/// Errors that can occur in construction of a [`Step`].
+#[derive(Debug, Clone)]
+pub enum ProposalError {
+    /// The total output value of the transaction request is not a valid Zcash amount.
+    RequestTotalInvalid,
+    /// The total of transaction inputs overflows the valid range of Zcash values.
+    Overflow,
+    /// The input total and output total of the payment request are not equal to one another. The
+    /// sum of transaction outputs, change, and fees is required to be exactly equal to the value
+    /// of provided inputs.
+    BalanceError {
+        input_total: NonNegativeAmount,
+        output_total: NonNegativeAmount,
+    },
+    /// The `is_shielding` flag may only be set to `true` under the following conditions:
+    /// * The total of transparent inputs is nonzero
+    /// * There exist no Sapling inputs
+    /// * There provided transaction request is empty; i.e. the only output values specified
+    ///   are change and fee amounts.
+    ShieldingInvalid,
+    /// No anchor information could be obtained for the specified block height.
+    AnchorNotFound(BlockHeight),
+    /// A reference to the output of a prior step is invalid.
+    ReferenceError(StepOutput),
+    /// An attempted double-spend of a prior step output was detected.
+    StepDoubleSpend(StepOutput),
+    /// An attempted double-spend of an output belonging to the wallet was detected.
+    ChainDoubleSpend(PoolType, TxId, u32),
+    /// There was a mismatch between the payments in the proposal's transaction request
+    /// and the payment pool selection values.
+    PaymentPoolsMismatch,
+    /// The proposal tried to spend a change output. Mark the `ChangeValue` as ephemeral if this is intended.
+    SpendsChange(StepOutput),
+    /// A proposal step created an ephemeral output that was not spent in any later step.
+    #[cfg(feature = "transparent-inputs")]
+    EphemeralOutputLeftUnspent(StepOutput),
+    /// The proposal included a payment to a TEX address and a spend from a shielded input in the same step.
+    #[cfg(feature = "transparent-inputs")]
+    PaysTexFromShielded,
+    /// The change strategy provided to input selection failed to correctly generate an ephemeral
+    /// change output when needed for sending to a TEX address.
+    #[cfg(feature = "transparent-inputs")]
+    EphemeralOutputsInvalid,
+}
+
+impl Display for ProposalError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            ProposalError::RequestTotalInvalid => write!(
+                f,
+                "The total requested output value is not a valid Zcash amount."
+            ),
+            ProposalError::Overflow => write!(
+                f,
+                "The total of transaction inputs overflows the valid range of Zcash values."
+            ),
+            ProposalError::BalanceError {
+                input_total,
+                output_total,
+            } => write!(
+                f,
+                "Balance error: the output total {} was not equal to the input total {}",
+                u64::from(*output_total),
+                u64::from(*input_total)
+            ),
+            ProposalError::ShieldingInvalid => write!(
+                f,
+                "The proposal violates the rules for a shielding transaction."
+            ),
+            ProposalError::AnchorNotFound(h) => {
+                write!(f, "Unable to compute anchor for block height {:?}", h)
+            }
+            ProposalError::ReferenceError(r) => {
+                write!(f, "No prior step output found for reference {:?}", r)
+            }
+            ProposalError::StepDoubleSpend(r) => write!(
+                f,
+                "The proposal uses the output of step {:?} in more than one place.",
+                r
+            ),
+            ProposalError::ChainDoubleSpend(pool, txid, index) => write!(
+                f,
+                "The proposal attempts to spend the same output twice: {}, {}, {}",
+                pool, txid, index
+            ),
+            ProposalError::PaymentPoolsMismatch => write!(
+                f,
+                "The chosen payment pools did not match the payments of the transaction request."
+            ),
+            ProposalError::SpendsChange(r) => write!(
+                f,
+                "The proposal attempts to spends the change output created at step {:?}.",
+                r,
+            ),
+            #[cfg(feature = "transparent-inputs")]
+            ProposalError::EphemeralOutputLeftUnspent(r) => write!(
+                f,
+                "The proposal created an ephemeral output at step {:?} that was not spent in any later step.",
+                r,
+            ),
+            #[cfg(feature = "transparent-inputs")]
+            ProposalError::PaysTexFromShielded => write!(
+                f,
+                "The proposal included a payment to a TEX address and a spend from a shielded input in the same step.",
+            ),
+            #[cfg(feature = "transparent-inputs")]
+            ProposalError::EphemeralOutputsInvalid => write!(
+                f,
+                "The proposal generator failed to correctly generate an ephemeral change output when needed for sending to a TEX address."
+            ),
+        }
+    }
+}
+
+impl std::error::Error for ProposalError {}
+
+/// The Sapling inputs to a proposed transaction.
+#[derive(Clone, PartialEq, Eq)]
+pub struct ShieldedInputs<NoteRef> {
+    anchor_height: BlockHeight,
+    notes: NonEmpty<ReceivedNote<NoteRef, Note>>,
+}
+
+impl<NoteRef> ShieldedInputs<NoteRef> {
+    /// Constructs a [`ShieldedInputs`] from its constituent parts.
+    pub fn from_parts(
+        anchor_height: BlockHeight,
+        notes: NonEmpty<ReceivedNote<NoteRef, Note>>,
+    ) -> Self {
+        Self {
+            anchor_height,
+            notes,
+        }
+    }
+
+    /// Returns the anchor height for Sapling inputs that should be used when constructing the
+    /// proposed transaction.
+    pub fn anchor_height(&self) -> BlockHeight {
+        self.anchor_height
+    }
+
+    /// Returns the list of Sapling notes to be used as inputs to the proposed transaction.
+    pub fn notes(&self) -> &NonEmpty<ReceivedNote<NoteRef, Note>> {
+        &self.notes
+    }
+}
+
+/// A proposal for a series of transactions to be created.
+///
+/// Each step of the proposal represents a separate transaction to be created. At present, only
+/// transparent outputs of earlier steps may be spent in later steps; the ability to chain shielded
+/// transaction steps may be added in a future update.
+#[derive(Clone, PartialEq, Eq)]
+pub struct Proposal<FeeRuleT, NoteRef> {
+    fee_rule: FeeRuleT,
+    min_target_height: BlockHeight,
+    steps: NonEmpty<Step<NoteRef>>,
+}
+
+impl<FeeRuleT, NoteRef> Proposal<FeeRuleT, NoteRef> {
+    /// Constructs a validated multi-step [`Proposal`].
+    ///
+    /// This operation validates the proposal for agreement between outputs and inputs
+    /// in the case of multi-step proposals, and ensures that no double-spends are being
+    /// proposed.
+    ///
+    /// Parameters:
+    /// * `fee_rule`: The fee rule observed by the proposed transaction.
+    /// * `min_target_height`: The minimum block height at which the transaction may be created.
+    /// * `steps`: A vector of steps that make up the proposal.
+    pub fn multi_step(
+        fee_rule: FeeRuleT,
+        min_target_height: BlockHeight,
+        steps: NonEmpty<Step<NoteRef>>,
+    ) -> Result<Self, ProposalError> {
+        let mut consumed_chain_inputs: BTreeSet<(PoolType, TxId, u32)> = BTreeSet::new();
+        let mut consumed_prior_inputs: BTreeSet<StepOutput> = BTreeSet::new();
+
+        for (i, step) in steps.iter().enumerate() {
+            for prior_ref in step.prior_step_inputs() {
+                // check that there are no forward references
+                if prior_ref.step_index() >= i {
+                    return Err(ProposalError::ReferenceError(*prior_ref));
+                }
+                // check that the reference is valid
+                let prior_step = &steps[prior_ref.step_index()];
+                match prior_ref.output_index() {
+                    StepOutputIndex::Payment(idx) => {
+                        if prior_step.transaction_request().payments().len() <= idx {
+                            return Err(ProposalError::ReferenceError(*prior_ref));
+                        }
+                    }
+                    StepOutputIndex::Change(idx) => {
+                        if prior_step.balance().proposed_change().len() <= idx {
+                            return Err(ProposalError::ReferenceError(*prior_ref));
+                        }
+                    }
+                }
+                // check that there are no double-spends
+                if !consumed_prior_inputs.insert(*prior_ref) {
+                    return Err(ProposalError::StepDoubleSpend(*prior_ref));
+                }
+            }
+
+            for t_out in step.transparent_inputs() {
+                let key = (
+                    PoolType::TRANSPARENT,
+                    TxId::from_bytes(*t_out.outpoint().hash()),
+                    t_out.outpoint().n(),
+                );
+                if !consumed_chain_inputs.insert(key) {
+                    return Err(ProposalError::ChainDoubleSpend(key.0, key.1, key.2));
+                }
+            }
+
+            for s_out in step.shielded_inputs().iter().flat_map(|i| i.notes().iter()) {
+                let key = (
+                    match &s_out.note() {
+                        Note::Sapling(_) => PoolType::SAPLING,
+                        #[cfg(feature = "orchard")]
+                        Note::Orchard(_) => PoolType::ORCHARD,
+                    },
+                    *s_out.txid(),
+                    s_out.output_index().into(),
+                );
+                if !consumed_chain_inputs.insert(key) {
+                    return Err(ProposalError::ChainDoubleSpend(key.0, key.1, key.2));
+                }
+            }
+        }
+
+        Ok(Self {
+            fee_rule,
+            min_target_height,
+            steps,
+        })
+    }
+
+    /// Constructs a validated [`Proposal`] having only a single step from its constituent parts.
+    ///
+    /// This operation validates the proposal for balance consistency and agreement between
+    /// the `is_shielding` flag and the structure of the proposal.
+    ///
+    /// Parameters:
+    /// * `transaction_request`: The ZIP 321 transaction request describing the payments to be
+    ///    made.
+    /// * `payment_pools`: A map from payment index to pool type.
+    /// * `transparent_inputs`: The set of previous transparent outputs to be spent.
+    /// * `shielded_inputs`: The sets of previous shielded outputs to be spent.
+    /// * `balance`: The change outputs to be added the transaction and the fee to be paid.
+    /// * `fee_rule`: The fee rule observed by the proposed transaction.
+    /// * `min_target_height`: The minimum block height at which the transaction may be created.
+    /// * `is_shielding`: A flag that identifies whether this is a wallet-internal shielding
+    ///    transaction.
+    #[allow(clippy::too_many_arguments)]
+    pub fn single_step(
+        transaction_request: TransactionRequest,
+        payment_pools: BTreeMap<usize, PoolType>,
+        transparent_inputs: Vec<WalletTransparentOutput>,
+        shielded_inputs: Option<ShieldedInputs<NoteRef>>,
+        balance: TransactionBalance,
+        fee_rule: FeeRuleT,
+        min_target_height: BlockHeight,
+        is_shielding: bool,
+    ) -> Result<Self, ProposalError> {
+        Ok(Self {
+            fee_rule,
+            min_target_height,
+            steps: NonEmpty::singleton(Step::from_parts(
+                &[],
+                transaction_request,
+                payment_pools,
+                transparent_inputs,
+                shielded_inputs,
+                vec![],
+                balance,
+                is_shielding,
+            )?),
+        })
+    }
+
+    /// Returns the fee rule to be used by the transaction builder.
+    pub fn fee_rule(&self) -> &FeeRuleT {
+        &self.fee_rule
+    }
+
+    /// Returns the target height for which the proposal was prepared.
+    ///
+    /// The chain must contain at least this many blocks in order for the proposal to
+    /// be executed.
+    pub fn min_target_height(&self) -> BlockHeight {
+        self.min_target_height
+    }
+
+    /// Returns the steps of the proposal. Each step corresponds to an independent transaction to
+    /// be generated as a result of this proposal.
+    pub fn steps(&self) -> &NonEmpty<Step<NoteRef>> {
+        &self.steps
+    }
+}
+
+impl<FeeRuleT: Debug, NoteRef> Debug for Proposal<FeeRuleT, NoteRef> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Proposal")
+            .field("fee_rule", &self.fee_rule)
+            .field("min_target_height", &self.min_target_height)
+            .field("steps", &self.steps)
+            .finish()
+    }
+}
+
+/// A reference to either a payment or change output within a step.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum StepOutputIndex {
+    Payment(usize),
+    Change(usize),
+}
+
+/// A reference to the output of a step in a proposal.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct StepOutput {
+    step_index: usize,
+    output_index: StepOutputIndex,
+}
+
+impl StepOutput {
+    /// Constructs a new [`StepOutput`] from its constituent parts.
+    pub fn new(step_index: usize, output_index: StepOutputIndex) -> Self {
+        Self {
+            step_index,
+            output_index,
+        }
+    }
+
+    /// Returns the step index to which this reference refers.
+    pub fn step_index(&self) -> usize {
+        self.step_index
+    }
+
+    /// Returns the identifier for the payment or change output within
+    /// the referenced step.
+    pub fn output_index(&self) -> StepOutputIndex {
+        self.output_index
+    }
+}
+
+/// The inputs to be consumed and outputs to be produced in a proposed transaction.
+#[derive(Clone, PartialEq, Eq)]
+pub struct Step<NoteRef> {
+    transaction_request: TransactionRequest,
+    payment_pools: BTreeMap<usize, PoolType>,
+    transparent_inputs: Vec<WalletTransparentOutput>,
+    shielded_inputs: Option<ShieldedInputs<NoteRef>>,
+    prior_step_inputs: Vec<StepOutput>,
+    balance: TransactionBalance,
+    is_shielding: bool,
+}
+
+impl<NoteRef> Step<NoteRef> {
+    /// Constructs a validated [`Step`] from its constituent parts.
+    ///
+    /// This operation validates the proposal for balance consistency and agreement between
+    /// the `is_shielding` flag and the structure of the proposal.
+    ///
+    /// Parameters:
+    /// * `transaction_request`: The ZIP 321 transaction request describing the payments
+    ///   to be made.
+    /// * `payment_pools`: A map from payment index to pool type. The set of payment indices
+    ///   provided here must exactly match the set of payment indices in the [`TransactionRequest`],
+    ///   and the selected pool for an index must correspond to a valid receiver of the
+    ///   address at that index (or the address itself in the case of bare transparent or Sapling
+    ///   addresses).
+    /// * `transparent_inputs`: The set of previous transparent outputs to be spent.
+    /// * `shielded_inputs`: The sets of previous shielded outputs to be spent.
+    /// * `balance`: The change outputs to be added the transaction and the fee to be paid.
+    /// * `is_shielding`: A flag that identifies whether this is a wallet-internal shielding
+    ///   transaction.
+    #[allow(clippy::too_many_arguments)]
+    pub fn from_parts(
+        prior_steps: &[Step<NoteRef>],
+        transaction_request: TransactionRequest,
+        payment_pools: BTreeMap<usize, PoolType>,
+        transparent_inputs: Vec<WalletTransparentOutput>,
+        shielded_inputs: Option<ShieldedInputs<NoteRef>>,
+        prior_step_inputs: Vec<StepOutput>,
+        balance: TransactionBalance,
+        is_shielding: bool,
+    ) -> Result<Self, ProposalError> {
+        // Verify that the set of payment pools matches exactly a set of valid payment recipients
+        if transaction_request.payments().len() != payment_pools.len() {
+            return Err(ProposalError::PaymentPoolsMismatch);
+        }
+        for (idx, pool) in &payment_pools {
+            if !transaction_request
+                .payments()
+                .get(idx)
+                .iter()
+                .any(|payment| payment.recipient_address().can_receive_as(*pool))
+            {
+                return Err(ProposalError::PaymentPoolsMismatch);
+            }
+        }
+
+        let transparent_input_total = transparent_inputs
+            .iter()
+            .map(|out| out.txout().value)
+            .try_fold(NonNegativeAmount::ZERO, |acc, a| {
+                (acc + a).ok_or(ProposalError::Overflow)
+            })?;
+
+        let shielded_input_total = shielded_inputs
+            .iter()
+            .flat_map(|s_in| s_in.notes().iter())
+            .map(|out| out.note().value())
+            .try_fold(NonNegativeAmount::ZERO, |acc, a| (acc + a))
+            .ok_or(ProposalError::Overflow)?;
+
+        let prior_step_input_total = prior_step_inputs
+            .iter()
+            .map(|s_ref| {
+                let step = prior_steps
+                    .get(s_ref.step_index)
+                    .ok_or(ProposalError::ReferenceError(*s_ref))?;
+                Ok(match s_ref.output_index {
+                    StepOutputIndex::Payment(i) => step
+                        .transaction_request
+                        .payments()
+                        .get(&i)
+                        .ok_or(ProposalError::ReferenceError(*s_ref))?
+                        .amount(),
+                    StepOutputIndex::Change(i) => step
+                        .balance
+                        .proposed_change()
+                        .get(i)
+                        .ok_or(ProposalError::ReferenceError(*s_ref))?
+                        .value(),
+                })
+            })
+            .collect::<Result<Vec<_>, _>>()?
+            .into_iter()
+            .try_fold(NonNegativeAmount::ZERO, |acc, a| (acc + a))
+            .ok_or(ProposalError::Overflow)?;
+
+        let input_total = (transparent_input_total + shielded_input_total + prior_step_input_total)
+            .ok_or(ProposalError::Overflow)?;
+
+        let request_total = transaction_request
+            .total()
+            .map_err(|_| ProposalError::RequestTotalInvalid)?;
+        let output_total = (request_total + balance.total()).ok_or(ProposalError::Overflow)?;
+
+        if is_shielding
+            && (transparent_input_total == NonNegativeAmount::ZERO
+                || shielded_input_total > NonNegativeAmount::ZERO
+                || request_total > NonNegativeAmount::ZERO)
+        {
+            return Err(ProposalError::ShieldingInvalid);
+        }
+
+        if input_total == output_total {
+            Ok(Self {
+                transaction_request,
+                payment_pools,
+                transparent_inputs,
+                shielded_inputs,
+                prior_step_inputs,
+                balance,
+                is_shielding,
+            })
+        } else {
+            Err(ProposalError::BalanceError {
+                input_total,
+                output_total,
+            })
+        }
+    }
+
+    /// Returns the transaction request that describes the payments to be made.
+    pub fn transaction_request(&self) -> &TransactionRequest {
+        &self.transaction_request
+    }
+    /// Returns the map from payment index to the pool that has been selected
+    /// for the output that will fulfill that payment.
+    pub fn payment_pools(&self) -> &BTreeMap<usize, PoolType> {
+        &self.payment_pools
+    }
+    /// Returns the transparent inputs that have been selected to fund the transaction.
+    pub fn transparent_inputs(&self) -> &[WalletTransparentOutput] {
+        &self.transparent_inputs
+    }
+    /// Returns the shielded inputs that have been selected to fund the transaction.
+    pub fn shielded_inputs(&self) -> Option<&ShieldedInputs<NoteRef>> {
+        self.shielded_inputs.as_ref()
+    }
+    /// Returns the inputs that should be obtained from the outputs of the transaction
+    /// created to satisfy a previous step of the proposal.
+    pub fn prior_step_inputs(&self) -> &[StepOutput] {
+        self.prior_step_inputs.as_ref()
+    }
+    /// Returns the change outputs to be added to the transaction and the fee to be paid.
+    pub fn balance(&self) -> &TransactionBalance {
+        &self.balance
+    }
+    /// Returns a flag indicating whether or not the proposed transaction
+    /// is exclusively wallet-internal (if it does not involve any external
+    /// recipients).
+    pub fn is_shielding(&self) -> bool {
+        self.is_shielding
+    }
+
+    /// Returns whether or not this proposal requires interaction with the specified pool.
+    pub fn involves(&self, pool_type: PoolType) -> bool {
+        let input_in_this_pool = || match pool_type {
+            PoolType::Transparent => self.is_shielding || !self.transparent_inputs.is_empty(),
+            PoolType::Shielded(ShieldedProtocol::Sapling) => {
+                self.shielded_inputs.iter().any(|s_in| {
+                    s_in.notes()
+                        .iter()
+                        .any(|note| matches!(note.note(), Note::Sapling(_)))
+                })
+            }
+            #[cfg(feature = "orchard")]
+            PoolType::Shielded(ShieldedProtocol::Orchard) => {
+                self.shielded_inputs.iter().any(|s_in| {
+                    s_in.notes()
+                        .iter()
+                        .any(|note| matches!(note.note(), Note::Orchard(_)))
+                })
+            }
+            #[cfg(not(feature = "orchard"))]
+            PoolType::Shielded(ShieldedProtocol::Orchard) => false,
+        };
+        let output_in_this_pool = || self.payment_pools().values().any(|pool| *pool == pool_type);
+        let change_in_this_pool = || {
+            self.balance
+                .proposed_change()
+                .iter()
+                .any(|c| c.output_pool() == pool_type)
+        };
+
+        input_in_this_pool() || output_in_this_pool() || change_in_this_pool()
+    }
+}
+
+impl<NoteRef> Debug for Step<NoteRef> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Step")
+            .field("transaction_request", &self.transaction_request)
+            .field("transparent_inputs", &self.transparent_inputs)
+            .field(
+                "shielded_inputs",
+                &self.shielded_inputs().map(|i| i.notes.len()),
+            )
+            .field("prior_step_inputs", &self.prior_step_inputs)
+            .field(
+                "anchor_height",
+                &self.shielded_inputs().map(|i| i.anchor_height),
+            )
+            .field("balance", &self.balance)
+            .field("is_shielding", &self.is_shielding)
+            .finish_non_exhaustive()
+    }
+}
diff --git a/zcash_client_backend/src/proto.rs b/zcash_client_backend/src/proto.rs
index 761a5affd0..79813d7c4c 100644
--- a/zcash_client_backend/src/proto.rs
+++ b/zcash_client_backend/src/proto.rs
@@ -1,20 +1,48 @@
-//! Generated code for handling light client protobuf structs.
+//! This module contains generated code for handling light client protobuf structs.
 
+use incrementalmerkletree::frontier::CommitmentTree;
+use nonempty::NonEmpty;
+use std::{
+    array::TryFromSliceError,
+    collections::BTreeMap,
+    fmt::{self, Display},
+    io,
+};
+
+use sapling::{self, note::ExtractedNoteCommitment, Node};
+use zcash_note_encryption::{EphemeralKeyBytes, COMPACT_NOTE_SIZE};
 use zcash_primitives::{
     block::{BlockHash, BlockHeader},
     consensus::BlockHeight,
-    sapling::{note::ExtractedNoteCommitment, Nullifier},
-    transaction::{components::sapling, TxId},
+    memo::{self, MemoBytes},
+    merkle_tree::read_commitment_tree,
+    transaction::{components::amount::NonNegativeAmount, TxId},
 };
 
-use zcash_note_encryption::{EphemeralKeyBytes, COMPACT_NOTE_SIZE};
+use crate::{
+    data_api::{chain::ChainState, InputSource},
+    fees::{ChangeValue, StandardFeeRule, TransactionBalance},
+    proposal::{Proposal, ProposalError, ShieldedInputs, Step, StepOutput, StepOutputIndex},
+    zip321::{TransactionRequest, Zip321Error},
+    PoolType, ShieldedProtocol,
+};
+
+#[cfg(feature = "transparent-inputs")]
+use zcash_primitives::transaction::components::OutPoint;
+
+#[cfg(feature = "orchard")]
+use orchard::tree::MerkleHashOrchard;
 
 #[rustfmt::skip]
 #[allow(unknown_lints)]
 #[allow(clippy::derive_partial_eq_without_eq)]
 pub mod compact_formats;
 
-#[cfg(feature = "lightwalletd-tonic")]
+#[rustfmt::skip]
+#[allow(unknown_lints)]
+#[allow(clippy::derive_partial_eq_without_eq)]
+pub mod proposal;
+
 #[rustfmt::skip]
 #[allow(unknown_lints)]
 #[allow(clippy::derive_partial_eq_without_eq)]
@@ -113,10 +141,12 @@ impl compact_formats::CompactSaplingOutput {
     }
 }
 
-impl<A: sapling::Authorization> From<sapling::OutputDescription<A>>
+impl<Proof> From<&sapling::bundle::OutputDescription<Proof>>
     for compact_formats::CompactSaplingOutput
 {
-    fn from(out: sapling::OutputDescription<A>) -> compact_formats::CompactSaplingOutput {
+    fn from(
+        out: &sapling::bundle::OutputDescription<Proof>,
+    ) -> compact_formats::CompactSaplingOutput {
         compact_formats::CompactSaplingOutput {
             cmu: out.cmu().to_bytes().to_vec(),
             ephemeral_key: out.ephemeral_key().as_ref().to_vec(),
@@ -125,20 +155,671 @@ impl<A: sapling::Authorization> From<sapling::OutputDescription<A>>
     }
 }
 
-impl TryFrom<compact_formats::CompactSaplingOutput> for sapling::CompactOutputDescription {
+impl TryFrom<compact_formats::CompactSaplingOutput>
+    for sapling::note_encryption::CompactOutputDescription
+{
     type Error = ();
 
     fn try_from(value: compact_formats::CompactSaplingOutput) -> Result<Self, Self::Error> {
-        Ok(sapling::CompactOutputDescription {
+        (&value).try_into()
+    }
+}
+
+impl TryFrom<&compact_formats::CompactSaplingOutput>
+    for sapling::note_encryption::CompactOutputDescription
+{
+    type Error = ();
+
+    fn try_from(value: &compact_formats::CompactSaplingOutput) -> Result<Self, Self::Error> {
+        Ok(sapling::note_encryption::CompactOutputDescription {
             cmu: value.cmu()?,
             ephemeral_key: value.ephemeral_key()?,
-            enc_ciphertext: value.ciphertext.try_into().map_err(|_| ())?,
+            enc_ciphertext: value.ciphertext[..].try_into().map_err(|_| ())?,
         })
     }
 }
 
 impl compact_formats::CompactSaplingSpend {
-    pub fn nf(&self) -> Result<Nullifier, ()> {
-        Nullifier::from_slice(&self.nf).map_err(|_| ())
+    pub fn nf(&self) -> Result<sapling::Nullifier, ()> {
+        sapling::Nullifier::from_slice(&self.nf).map_err(|_| ())
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl TryFrom<&compact_formats::CompactOrchardAction> for orchard::note_encryption::CompactAction {
+    type Error = ();
+
+    fn try_from(value: &compact_formats::CompactOrchardAction) -> Result<Self, Self::Error> {
+        Ok(orchard::note_encryption::CompactAction::from_parts(
+            value.nf()?,
+            value.cmx()?,
+            value.ephemeral_key()?,
+            value.ciphertext[..].try_into().map_err(|_| ())?,
+        ))
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl compact_formats::CompactOrchardAction {
+    /// Returns the note commitment for the output of this action.
+    ///
+    /// A convenience method that parses [`CompactOrchardAction.cmx`].
+    ///
+    /// [`CompactOrchardAction.cmx`]: #structfield.cmx
+    pub fn cmx(&self) -> Result<orchard::note::ExtractedNoteCommitment, ()> {
+        Option::from(orchard::note::ExtractedNoteCommitment::from_bytes(
+            &self.cmx[..].try_into().map_err(|_| ())?,
+        ))
+        .ok_or(())
+    }
+
+    /// Returns the nullifier for the spend of this action.
+    ///
+    /// A convenience method that parses [`CompactOrchardAction.nullifier`].
+    ///
+    /// [`CompactOrchardAction.nullifier`]: #structfield.nullifier
+    pub fn nf(&self) -> Result<orchard::note::Nullifier, ()> {
+        let nf_bytes: [u8; 32] = self.nullifier[..].try_into().map_err(|_| ())?;
+        Option::from(orchard::note::Nullifier::from_bytes(&nf_bytes)).ok_or(())
+    }
+
+    /// Returns the ephemeral public key for the output of this action.
+    ///
+    /// A convenience method that parses [`CompactOrchardAction.ephemeral_key`].
+    ///
+    /// [`CompactOrchardAction.ephemeral_key`]: #structfield.ephemeral_key
+    pub fn ephemeral_key(&self) -> Result<EphemeralKeyBytes, ()> {
+        self.ephemeral_key[..]
+            .try_into()
+            .map(EphemeralKeyBytes)
+            .map_err(|_| ())
+    }
+}
+
+impl<A: sapling::bundle::Authorization> From<&sapling::bundle::SpendDescription<A>>
+    for compact_formats::CompactSaplingSpend
+{
+    fn from(spend: &sapling::bundle::SpendDescription<A>) -> compact_formats::CompactSaplingSpend {
+        compact_formats::CompactSaplingSpend {
+            nf: spend.nullifier().to_vec(),
+        }
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl<SpendAuth> From<&orchard::Action<SpendAuth>> for compact_formats::CompactOrchardAction {
+    fn from(action: &orchard::Action<SpendAuth>) -> compact_formats::CompactOrchardAction {
+        compact_formats::CompactOrchardAction {
+            nullifier: action.nullifier().to_bytes().to_vec(),
+            cmx: action.cmx().to_bytes().to_vec(),
+            ephemeral_key: action.encrypted_note().epk_bytes.to_vec(),
+            ciphertext: action.encrypted_note().enc_ciphertext[..COMPACT_NOTE_SIZE].to_vec(),
+        }
+    }
+}
+
+impl service::TreeState {
+    /// Deserializes and returns the Sapling note commitment tree field of the tree state.
+    pub fn sapling_tree(
+        &self,
+    ) -> io::Result<CommitmentTree<Node, { sapling::NOTE_COMMITMENT_TREE_DEPTH }>> {
+        if self.sapling_tree.is_empty() {
+            Ok(CommitmentTree::empty())
+        } else {
+            let sapling_tree_bytes = hex::decode(&self.sapling_tree).map_err(|e| {
+                io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("Hex decoding of Sapling tree bytes failed: {:?}", e),
+                )
+            })?;
+            read_commitment_tree::<Node, _, { sapling::NOTE_COMMITMENT_TREE_DEPTH }>(
+                &sapling_tree_bytes[..],
+            )
+        }
+    }
+
+    /// Deserializes and returns the Sapling note commitment tree field of the tree state.
+    #[cfg(feature = "orchard")]
+    pub fn orchard_tree(
+        &self,
+    ) -> io::Result<CommitmentTree<MerkleHashOrchard, { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 }>>
+    {
+        if self.orchard_tree.is_empty() {
+            Ok(CommitmentTree::empty())
+        } else {
+            let orchard_tree_bytes = hex::decode(&self.orchard_tree).map_err(|e| {
+                io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("Hex decoding of Orchard tree bytes failed: {:?}", e),
+                )
+            })?;
+            read_commitment_tree::<
+                MerkleHashOrchard,
+                _,
+                { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 },
+            >(&orchard_tree_bytes[..])
+        }
+    }
+
+    /// Parses this tree state into a [`ChainState`] for use with [`scan_cached_blocks`].
+    ///
+    /// [`scan_cached_blocks`]: crate::data_api::chain::scan_cached_blocks
+    pub fn to_chain_state(&self) -> io::Result<ChainState> {
+        let mut hash_bytes = hex::decode(&self.hash).map_err(|e| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("Block hash is not valid hex: {:?}", e),
+            )
+        })?;
+        // Zcashd hex strings for block hashes are byte-reversed.
+        hash_bytes.reverse();
+
+        Ok(ChainState::new(
+            self.height
+                .try_into()
+                .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "Invalid block height"))?,
+            BlockHash::try_from_slice(&hash_bytes).ok_or_else(|| {
+                io::Error::new(io::ErrorKind::InvalidData, "Invalid block hash length.")
+            })?,
+            self.sapling_tree()?.to_frontier(),
+            #[cfg(feature = "orchard")]
+            self.orchard_tree()?.to_frontier(),
+        ))
+    }
+}
+
+/// Constant for the V1 proposal serialization version.
+pub const PROPOSAL_SER_V1: u32 = 1;
+
+/// Errors that can occur in the process of decoding a [`Proposal`] from its protobuf
+/// representation.
+#[derive(Debug, Clone)]
+pub enum ProposalDecodingError<DbError> {
+    /// The encoded proposal contained no steps.
+    NoSteps,
+    /// The ZIP 321 transaction request URI was invalid.
+    Zip321(Zip321Error),
+    /// A proposed input was null.
+    NullInput(usize),
+    /// A transaction identifier string did not decode to a valid transaction ID.
+    TxIdInvalid(TryFromSliceError),
+    /// An invalid value pool identifier was encountered.
+    ValuePoolNotSupported(i32),
+    /// A failure occurred trying to retrieve an unspent note or UTXO from the wallet database.
+    InputRetrieval(DbError),
+    /// The unspent note or UTXO corresponding to a proposal input was not found in the wallet
+    /// database.
+    InputNotFound(TxId, PoolType, u32),
+    /// The transaction balance, or a component thereof, failed to decode correctly.
+    BalanceInvalid,
+    /// Failed to decode a ZIP-302-compliant memo from the provided memo bytes.
+    MemoInvalid(memo::Error),
+    /// The serialization version returned by the protobuf was not recognized.
+    VersionInvalid(u32),
+    /// The fee rule specified by the proposal is not supported by the wallet.
+    FeeRuleNotSupported(proposal::FeeRule),
+    /// The proposal violated balance or structural constraints.
+    ProposalInvalid(ProposalError),
+    /// An inputs field for the given protocol was present, but contained no input note references.
+    EmptyShieldedInputs(ShieldedProtocol),
+    /// A memo field was provided for a transparent output.
+    TransparentMemo,
+    /// Change outputs to the specified pool are not supported.
+    InvalidChangeRecipient(PoolType),
+    /// Ephemeral outputs to the specified pool are not supported.
+    InvalidEphemeralRecipient(PoolType),
+}
+
+impl<E> From<Zip321Error> for ProposalDecodingError<E> {
+    fn from(value: Zip321Error) -> Self {
+        Self::Zip321(value)
+    }
+}
+
+impl<E: Display> Display for ProposalDecodingError<E> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            ProposalDecodingError::NoSteps => write!(f, "The proposal had no steps."),
+            ProposalDecodingError::Zip321(err) => write!(f, "Transaction request invalid: {}", err),
+            ProposalDecodingError::NullInput(i) => {
+                write!(f, "Proposed input was null at index {}", i)
+            }
+            ProposalDecodingError::TxIdInvalid(err) => {
+                write!(f, "Invalid transaction id: {:?}", err)
+            }
+            ProposalDecodingError::ValuePoolNotSupported(id) => {
+                write!(f, "Invalid value pool identifier: {:?}", id)
+            }
+            ProposalDecodingError::InputRetrieval(err) => write!(
+                f,
+                "An error occurred retrieving a transaction input: {}",
+                err
+            ),
+            ProposalDecodingError::InputNotFound(txid, pool, idx) => write!(
+                f,
+                "No {} input found for txid {}, index {}",
+                pool, txid, idx
+            ),
+            ProposalDecodingError::BalanceInvalid => {
+                write!(f, "An error occurred decoding the proposal balance.")
+            }
+            ProposalDecodingError::MemoInvalid(err) => {
+                write!(f, "An error occurred decoding a proposed memo: {}", err)
+            }
+            ProposalDecodingError::VersionInvalid(v) => {
+                write!(f, "Unrecognized proposal version {}", v)
+            }
+            ProposalDecodingError::FeeRuleNotSupported(r) => {
+                write!(
+                    f,
+                    "Fee calculation using the {:?} fee rule is not supported.",
+                    r
+                )
+            }
+            ProposalDecodingError::ProposalInvalid(err) => write!(f, "{}", err),
+            ProposalDecodingError::EmptyShieldedInputs(protocol) => write!(
+                f,
+                "An inputs field was present for {:?}, but contained no note references.",
+                protocol
+            ),
+            ProposalDecodingError::TransparentMemo => {
+                write!(f, "Transparent outputs cannot have memos.")
+            }
+            ProposalDecodingError::InvalidChangeRecipient(pool_type) => write!(
+                f,
+                "Change outputs to the {} pool are not supported.",
+                pool_type
+            ),
+            ProposalDecodingError::InvalidEphemeralRecipient(pool_type) => write!(
+                f,
+                "Ephemeral outputs to the {} pool are not supported.",
+                pool_type
+            ),
+        }
+    }
+}
+
+impl<E: std::error::Error + 'static> std::error::Error for ProposalDecodingError<E> {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            ProposalDecodingError::Zip321(e) => Some(e),
+            ProposalDecodingError::InputRetrieval(e) => Some(e),
+            ProposalDecodingError::MemoInvalid(e) => Some(e),
+            _ => None,
+        }
+    }
+}
+
+fn pool_type<T>(pool_id: i32) -> Result<PoolType, ProposalDecodingError<T>> {
+    match proposal::ValuePool::try_from(pool_id) {
+        Ok(proposal::ValuePool::Transparent) => Ok(PoolType::TRANSPARENT),
+        Ok(proposal::ValuePool::Sapling) => Ok(PoolType::SAPLING),
+        Ok(proposal::ValuePool::Orchard) => Ok(PoolType::ORCHARD),
+        _ => Err(ProposalDecodingError::ValuePoolNotSupported(pool_id)),
+    }
+}
+
+impl proposal::ReceivedOutput {
+    pub fn parse_txid(&self) -> Result<TxId, TryFromSliceError> {
+        Ok(TxId::from_bytes(self.txid[..].try_into()?))
+    }
+
+    pub fn pool_type<T>(&self) -> Result<PoolType, ProposalDecodingError<T>> {
+        pool_type(self.value_pool)
+    }
+}
+
+impl proposal::ChangeValue {
+    pub fn pool_type<T>(&self) -> Result<PoolType, ProposalDecodingError<T>> {
+        pool_type(self.value_pool)
+    }
+}
+
+impl From<PoolType> for proposal::ValuePool {
+    fn from(value: PoolType) -> Self {
+        match value {
+            PoolType::Transparent => proposal::ValuePool::Transparent,
+            PoolType::Shielded(p) => p.into(),
+        }
+    }
+}
+
+impl From<ShieldedProtocol> for proposal::ValuePool {
+    fn from(value: ShieldedProtocol) -> Self {
+        match value {
+            ShieldedProtocol::Sapling => proposal::ValuePool::Sapling,
+            ShieldedProtocol::Orchard => proposal::ValuePool::Orchard,
+        }
+    }
+}
+
+impl proposal::Proposal {
+    /// Serializes a [`Proposal`] based upon a supported [`StandardFeeRule`] to its protobuf
+    /// representation.
+    pub fn from_standard_proposal<NoteRef>(value: &Proposal<StandardFeeRule, NoteRef>) -> Self {
+        use proposal::proposed_input;
+        use proposal::{PriorStepChange, PriorStepOutput, ReceivedOutput};
+        let steps = value
+            .steps()
+            .iter()
+            .map(|step| {
+                let transaction_request = step.transaction_request().to_uri();
+
+                let anchor_height = step
+                    .shielded_inputs()
+                    .map_or_else(|| 0, |i| u32::from(i.anchor_height()));
+
+                let inputs = step
+                    .transparent_inputs()
+                    .iter()
+                    .map(|utxo| proposal::ProposedInput {
+                        value: Some(proposed_input::Value::ReceivedOutput(ReceivedOutput {
+                            txid: utxo.outpoint().hash().to_vec(),
+                            value_pool: proposal::ValuePool::Transparent.into(),
+                            index: utxo.outpoint().n(),
+                            value: utxo.txout().value.into(),
+                        })),
+                    })
+                    .chain(step.shielded_inputs().iter().flat_map(|s_in| {
+                        s_in.notes().iter().map(|rec_note| proposal::ProposedInput {
+                            value: Some(proposed_input::Value::ReceivedOutput(ReceivedOutput {
+                                txid: rec_note.txid().as_ref().to_vec(),
+                                value_pool: proposal::ValuePool::from(rec_note.note().protocol())
+                                    .into(),
+                                index: rec_note.output_index().into(),
+                                value: rec_note.note().value().into(),
+                            })),
+                        })
+                    }))
+                    .chain(step.prior_step_inputs().iter().map(|p_in| {
+                        match p_in.output_index() {
+                            StepOutputIndex::Payment(i) => proposal::ProposedInput {
+                                value: Some(proposed_input::Value::PriorStepOutput(
+                                    PriorStepOutput {
+                                        step_index: p_in
+                                            .step_index()
+                                            .try_into()
+                                            .expect("Step index fits into a u32"),
+                                        payment_index: i
+                                            .try_into()
+                                            .expect("Payment index fits into a u32"),
+                                    },
+                                )),
+                            },
+                            StepOutputIndex::Change(i) => proposal::ProposedInput {
+                                value: Some(proposed_input::Value::PriorStepChange(
+                                    PriorStepChange {
+                                        step_index: p_in
+                                            .step_index()
+                                            .try_into()
+                                            .expect("Step index fits into a u32"),
+                                        change_index: i
+                                            .try_into()
+                                            .expect("Payment index fits into a u32"),
+                                    },
+                                )),
+                            },
+                        }
+                    }))
+                    .collect();
+
+                let payment_output_pools = step
+                    .payment_pools()
+                    .iter()
+                    .map(|(idx, pool_type)| proposal::PaymentOutputPool {
+                        payment_index: u32::try_from(*idx).expect("Payment index fits into a u32"),
+                        value_pool: proposal::ValuePool::from(*pool_type).into(),
+                    })
+                    .collect();
+
+                let balance = Some(proposal::TransactionBalance {
+                    proposed_change: step
+                        .balance()
+                        .proposed_change()
+                        .iter()
+                        .map(|change| proposal::ChangeValue {
+                            value: change.value().into(),
+                            value_pool: proposal::ValuePool::from(change.output_pool()).into(),
+                            memo: change.memo().map(|memo_bytes| proposal::MemoBytes {
+                                value: memo_bytes.as_slice().to_vec(),
+                            }),
+                            is_ephemeral: change.is_ephemeral(),
+                        })
+                        .collect(),
+                    fee_required: step.balance().fee_required().into(),
+                });
+
+                proposal::ProposalStep {
+                    transaction_request,
+                    payment_output_pools,
+                    anchor_height,
+                    inputs,
+                    balance,
+                    is_shielding: step.is_shielding(),
+                }
+            })
+            .collect();
+
+        proposal::Proposal {
+            proto_version: PROPOSAL_SER_V1,
+            fee_rule: match value.fee_rule() {
+                StandardFeeRule::Zip317 => proposal::FeeRule::Zip317,
+            }
+            .into(),
+            min_target_height: value.min_target_height().into(),
+            steps,
+        }
+    }
+
+    /// Attempts to parse a [`Proposal`] based upon a supported [`StandardFeeRule`] from its
+    /// protobuf representation.
+    pub fn try_into_standard_proposal<DbT, DbError>(
+        &self,
+        wallet_db: &DbT,
+    ) -> Result<Proposal<StandardFeeRule, DbT::NoteRef>, ProposalDecodingError<DbError>>
+    where
+        DbT: InputSource<Error = DbError>,
+    {
+        use self::proposal::proposed_input::Value::*;
+        match self.proto_version {
+            PROPOSAL_SER_V1 => {
+                let fee_rule = match self.fee_rule() {
+                    proposal::FeeRule::Zip317 => StandardFeeRule::Zip317,
+                    other => {
+                        return Err(ProposalDecodingError::FeeRuleNotSupported(other));
+                    }
+                };
+
+                let mut steps = Vec::with_capacity(self.steps.len());
+                for step in &self.steps {
+                    let transaction_request =
+                        TransactionRequest::from_uri(&step.transaction_request)?;
+
+                    let payment_pools = step
+                        .payment_output_pools
+                        .iter()
+                        .map(|pop| {
+                            Ok((
+                                usize::try_from(pop.payment_index)
+                                    .expect("Payment index fits into a usize"),
+                                pool_type(pop.value_pool)?,
+                            ))
+                        })
+                        .collect::<Result<BTreeMap<usize, PoolType>, ProposalDecodingError<DbError>>>()?;
+
+                    #[allow(unused_mut)]
+                    let mut transparent_inputs = vec![];
+                    let mut received_notes = vec![];
+                    let mut prior_step_inputs = vec![];
+                    for (i, input) in step.inputs.iter().enumerate() {
+                        match input
+                            .value
+                            .as_ref()
+                            .ok_or(ProposalDecodingError::NullInput(i))?
+                        {
+                            ReceivedOutput(out) => {
+                                let txid = out
+                                    .parse_txid()
+                                    .map_err(ProposalDecodingError::TxIdInvalid)?;
+
+                                match out.pool_type()? {
+                                    PoolType::Transparent => {
+                                        #[cfg(not(feature = "transparent-inputs"))]
+                                        return Err(ProposalDecodingError::ValuePoolNotSupported(
+                                            out.value_pool,
+                                        ));
+
+                                        #[cfg(feature = "transparent-inputs")]
+                                        {
+                                            let outpoint = OutPoint::new(txid.into(), out.index);
+                                            transparent_inputs.push(
+                                                wallet_db
+                                                    .get_unspent_transparent_output(&outpoint)
+                                                    .map_err(ProposalDecodingError::InputRetrieval)?
+                                                    .ok_or({
+                                                        ProposalDecodingError::InputNotFound(
+                                                            txid,
+                                                            PoolType::TRANSPARENT,
+                                                            out.index,
+                                                        )
+                                                    })?,
+                                            );
+                                        }
+                                    }
+                                    PoolType::Shielded(protocol) => received_notes.push(
+                                        wallet_db
+                                            .get_spendable_note(&txid, protocol, out.index)
+                                            .map_err(ProposalDecodingError::InputRetrieval)
+                                            .and_then(|opt| {
+                                                opt.ok_or({
+                                                    ProposalDecodingError::InputNotFound(
+                                                        txid,
+                                                        PoolType::Shielded(protocol),
+                                                        out.index,
+                                                    )
+                                                })
+                                            })?,
+                                    ),
+                                }
+                            }
+                            PriorStepOutput(s_ref) => {
+                                prior_step_inputs.push(StepOutput::new(
+                                    s_ref
+                                        .step_index
+                                        .try_into()
+                                        .expect("Step index fits into a usize"),
+                                    StepOutputIndex::Payment(
+                                        s_ref
+                                            .payment_index
+                                            .try_into()
+                                            .expect("Payment index fits into a usize"),
+                                    ),
+                                ));
+                            }
+                            PriorStepChange(s_ref) => {
+                                prior_step_inputs.push(StepOutput::new(
+                                    s_ref
+                                        .step_index
+                                        .try_into()
+                                        .expect("Step index fits into a usize"),
+                                    StepOutputIndex::Change(
+                                        s_ref
+                                            .change_index
+                                            .try_into()
+                                            .expect("Payment index fits into a usize"),
+                                    ),
+                                ));
+                            }
+                        }
+                    }
+
+                    let shielded_inputs = NonEmpty::from_vec(received_notes)
+                        .map(|notes| ShieldedInputs::from_parts(step.anchor_height.into(), notes));
+
+                    let proto_balance = step
+                        .balance
+                        .as_ref()
+                        .ok_or(ProposalDecodingError::BalanceInvalid)?;
+                    let balance = TransactionBalance::new(
+                        proto_balance
+                            .proposed_change
+                            .iter()
+                            .map(|cv| -> Result<ChangeValue, ProposalDecodingError<_>> {
+                                let value = NonNegativeAmount::from_u64(cv.value)
+                                    .map_err(|_| ProposalDecodingError::BalanceInvalid)?;
+                                let memo = cv
+                                    .memo
+                                    .as_ref()
+                                    .map(|bytes| {
+                                        MemoBytes::from_bytes(&bytes.value)
+                                            .map_err(ProposalDecodingError::MemoInvalid)
+                                    })
+                                    .transpose()?;
+                                match (cv.pool_type()?, cv.is_ephemeral) {
+                                    (PoolType::Shielded(ShieldedProtocol::Sapling), false) => {
+                                        Ok(ChangeValue::sapling(value, memo))
+                                    }
+                                    #[cfg(feature = "orchard")]
+                                    (PoolType::Shielded(ShieldedProtocol::Orchard), false) => {
+                                        Ok(ChangeValue::orchard(value, memo))
+                                    }
+                                    (PoolType::Transparent, _) if memo.is_some() => {
+                                        Err(ProposalDecodingError::TransparentMemo)
+                                    }
+                                    #[cfg(feature = "transparent-inputs")]
+                                    (PoolType::Transparent, true) => {
+                                        Ok(ChangeValue::ephemeral_transparent(value))
+                                    }
+                                    (pool, false) => {
+                                        Err(ProposalDecodingError::InvalidChangeRecipient(pool))
+                                    }
+                                    (pool, true) => {
+                                        Err(ProposalDecodingError::InvalidEphemeralRecipient(pool))
+                                    }
+                                }
+                            })
+                            .collect::<Result<Vec<_>, _>>()?,
+                        NonNegativeAmount::from_u64(proto_balance.fee_required)
+                            .map_err(|_| ProposalDecodingError::BalanceInvalid)?,
+                    )
+                    .map_err(|_| ProposalDecodingError::BalanceInvalid)?;
+
+                    let step = Step::from_parts(
+                        &steps,
+                        transaction_request,
+                        payment_pools,
+                        transparent_inputs,
+                        shielded_inputs,
+                        prior_step_inputs,
+                        balance,
+                        step.is_shielding,
+                    )
+                    .map_err(ProposalDecodingError::ProposalInvalid)?;
+
+                    steps.push(step);
+                }
+
+                Proposal::multi_step(
+                    fee_rule,
+                    self.min_target_height.into(),
+                    NonEmpty::from_vec(steps).ok_or(ProposalDecodingError::NoSteps)?,
+                )
+                .map_err(ProposalDecodingError::ProposalInvalid)
+            }
+            other => Err(ProposalDecodingError::VersionInvalid(other)),
+        }
+    }
+}
+
+#[cfg(feature = "lightwalletd-tonic-transport")]
+impl service::compact_tx_streamer_client::CompactTxStreamerClient<tonic::transport::Channel> {
+    /// Attempt to create a new client by connecting to a given endpoint.
+    pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
+    where
+        D: TryInto<tonic::transport::Endpoint>,
+        D::Error: Into<tonic::codegen::StdError>,
+    {
+        let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
+        Ok(Self::new(conn))
     }
 }
diff --git a/zcash_client_backend/src/proto/compact_formats.rs b/zcash_client_backend/src/proto/compact_formats.rs
index 056764b78a..1e688b6014 100644
--- a/zcash_client_backend/src/proto/compact_formats.rs
+++ b/zcash_client_backend/src/proto/compact_formats.rs
@@ -1,7 +1,21 @@
+// This file is @generated by prost-build.
+/// Information about the state of the chain as of a given block.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
+pub struct ChainMetadata {
+    /// the size of the Sapling note commitment tree as of the end of this block
+    #[prost(uint32, tag = "1")]
+    pub sapling_commitment_tree_size: u32,
+    /// the size of the Orchard note commitment tree as of the end of this block
+    #[prost(uint32, tag = "2")]
+    pub orchard_commitment_tree_size: u32,
+}
+/// A compact representation of the shielded data in a Zcash block.
+///
 /// CompactBlock is a packaging of ONLY the data from a block that's needed to:
-///    1. Detect a payment to your shielded Sapling address
-///    2. Detect a spend of your shielded Sapling notes
-///    3. Update your witnesses to generate new Sapling spend proofs.
+///    1. Detect a payment to your Shielded address
+///    2. Detect a spend of your Shielded notes
+///    3. Update your witnesses to generate new spend proofs.
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct CompactBlock {
@@ -26,7 +40,12 @@ pub struct CompactBlock {
     /// zero or more compact transactions from this block
     #[prost(message, repeated, tag = "7")]
     pub vtx: ::prost::alloc::vec::Vec<CompactTx>,
+    /// information about the state of the chain as of this block
+    #[prost(message, optional, tag = "8")]
+    pub chain_metadata: ::core::option::Option<ChainMetadata>,
 }
+/// A compact representation of the shielded data in a Zcash transaction.
+///
 /// CompactTx contains the minimum information for a wallet to know if this transaction
 /// is relevant to it (either pays to it or spends from it) via shielded elements
 /// only. This message will not encode a transparent-to-transparent transaction.
@@ -57,35 +76,35 @@ pub struct CompactTx {
     #[prost(message, repeated, tag = "6")]
     pub actions: ::prost::alloc::vec::Vec<CompactOrchardAction>,
 }
+/// A compact representation of a [Sapling Spend](<https://zips.z.cash/protocol/protocol.pdf#spendencodingandconsensus>).
+///
 /// CompactSaplingSpend is a Sapling Spend Description as described in 7.3 of the Zcash
 /// protocol specification.
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct CompactSaplingSpend {
-    /// nullifier (see the Zcash protocol specification)
+    /// Nullifier (see the Zcash protocol specification)
     #[prost(bytes = "vec", tag = "1")]
     pub nf: ::prost::alloc::vec::Vec<u8>,
 }
-/// output encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the
-/// `encCiphertext` field of a Sapling Output Description. These fields are described in
-/// section 7.4 of the Zcash protocol spec:
-/// <https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus>
-/// Total size is 116 bytes.
+/// A compact representation of a [Sapling Output](<https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus>).
+///
+/// It encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the
+/// `encCiphertext` field of a Sapling Output Description. Total size is 116 bytes.
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct CompactSaplingOutput {
-    /// note commitment u-coordinate
+    /// Note commitment u-coordinate.
     #[prost(bytes = "vec", tag = "1")]
     pub cmu: ::prost::alloc::vec::Vec<u8>,
-    /// ephemeral public key
+    /// Ephemeral public key.
     #[prost(bytes = "vec", tag = "2")]
     pub ephemeral_key: ::prost::alloc::vec::Vec<u8>,
-    /// first 52 bytes of ciphertext
+    /// First 52 bytes of ciphertext.
     #[prost(bytes = "vec", tag = "3")]
     pub ciphertext: ::prost::alloc::vec::Vec<u8>,
 }
-/// <https://github.com/zcash/zips/blob/main/zip-0225.rst#orchard-action-description-orchardaction>
-/// (but not all fields are needed)
+/// A compact representation of an [Orchard Action](<https://zips.z.cash/protocol/protocol.pdf#actionencodingandconsensus>).
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct CompactOrchardAction {
diff --git a/zcash_client_backend/src/proto/proposal.rs b/zcash_client_backend/src/proto/proposal.rs
new file mode 100644
index 0000000000..d4fd13c1e4
--- /dev/null
+++ b/zcash_client_backend/src/proto/proposal.rs
@@ -0,0 +1,236 @@
+// This file is @generated by prost-build.
+/// A data structure that describes a series of transactions to be created.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct Proposal {
+    /// The version of this serialization format.
+    #[prost(uint32, tag = "1")]
+    pub proto_version: u32,
+    /// The fee rule used in constructing this proposal
+    #[prost(enumeration = "FeeRule", tag = "2")]
+    pub fee_rule: i32,
+    /// The target height for which the proposal was constructed
+    ///
+    /// The chain must contain at least this many blocks in order for the proposal to
+    /// be executed.
+    #[prost(uint32, tag = "3")]
+    pub min_target_height: u32,
+    /// The series of transactions to be created.
+    #[prost(message, repeated, tag = "4")]
+    pub steps: ::prost::alloc::vec::Vec<ProposalStep>,
+}
+/// A data structure that describes the inputs to be consumed and outputs to
+/// be produced in a proposed transaction.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ProposalStep {
+    /// ZIP 321 serialized transaction request
+    #[prost(string, tag = "1")]
+    pub transaction_request: ::prost::alloc::string::String,
+    /// The vector of selected payment index / output pool mappings. Payment index
+    /// 0 corresponds to the payment with no explicit index.
+    #[prost(message, repeated, tag = "2")]
+    pub payment_output_pools: ::prost::alloc::vec::Vec<PaymentOutputPool>,
+    /// The anchor height to be used in creating the transaction, if any.
+    /// Setting the anchor height to zero will disallow the use of any shielded
+    /// inputs.
+    #[prost(uint32, tag = "3")]
+    pub anchor_height: u32,
+    /// The inputs to be used in creating the transaction.
+    #[prost(message, repeated, tag = "4")]
+    pub inputs: ::prost::alloc::vec::Vec<ProposedInput>,
+    /// The total value, fee value, and change outputs of the proposed
+    /// transaction
+    #[prost(message, optional, tag = "5")]
+    pub balance: ::core::option::Option<TransactionBalance>,
+    /// A flag indicating whether the step is for a shielding transaction,
+    /// used for determining which OVK to select for wallet-internal outputs.
+    #[prost(bool, tag = "6")]
+    pub is_shielding: bool,
+}
+/// A mapping from ZIP 321 payment index to the output pool that has been chosen
+/// for that payment, based upon the payment address and the selected inputs to
+/// the transaction.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
+pub struct PaymentOutputPool {
+    #[prost(uint32, tag = "1")]
+    pub payment_index: u32,
+    #[prost(enumeration = "ValuePool", tag = "2")]
+    pub value_pool: i32,
+}
+/// The unique identifier and value for each proposed input that does not
+/// require a back-reference to a prior step of the proposal.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ReceivedOutput {
+    #[prost(bytes = "vec", tag = "1")]
+    pub txid: ::prost::alloc::vec::Vec<u8>,
+    #[prost(enumeration = "ValuePool", tag = "2")]
+    pub value_pool: i32,
+    #[prost(uint32, tag = "3")]
+    pub index: u32,
+    #[prost(uint64, tag = "4")]
+    pub value: u64,
+}
+/// A reference to a payment in a prior step of the proposal. This payment must
+/// belong to the wallet.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
+pub struct PriorStepOutput {
+    #[prost(uint32, tag = "1")]
+    pub step_index: u32,
+    #[prost(uint32, tag = "2")]
+    pub payment_index: u32,
+}
+/// A reference to a change or ephemeral output from a prior step of the proposal.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
+pub struct PriorStepChange {
+    #[prost(uint32, tag = "1")]
+    pub step_index: u32,
+    #[prost(uint32, tag = "2")]
+    pub change_index: u32,
+}
+/// The unique identifier and value for an input to be used in the transaction.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ProposedInput {
+    #[prost(oneof = "proposed_input::Value", tags = "1, 2, 3")]
+    pub value: ::core::option::Option<proposed_input::Value>,
+}
+/// Nested message and enum types in `ProposedInput`.
+pub mod proposed_input {
+    #[allow(clippy::derive_partial_eq_without_eq)]
+    #[derive(Clone, PartialEq, ::prost::Oneof)]
+    pub enum Value {
+        #[prost(message, tag = "1")]
+        ReceivedOutput(super::ReceivedOutput),
+        #[prost(message, tag = "2")]
+        PriorStepOutput(super::PriorStepOutput),
+        #[prost(message, tag = "3")]
+        PriorStepChange(super::PriorStepChange),
+    }
+}
+/// The proposed change outputs and fee value.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct TransactionBalance {
+    /// A list of change or ephemeral output values.
+    #[prost(message, repeated, tag = "1")]
+    pub proposed_change: ::prost::alloc::vec::Vec<ChangeValue>,
+    /// The fee to be paid by the proposed transaction, in zatoshis.
+    #[prost(uint64, tag = "2")]
+    pub fee_required: u64,
+}
+/// A proposed change or ephemeral output. If the transparent value pool is
+/// selected, the `memo` field must be null.
+///
+/// When the `isEphemeral` field of a `ChangeValue` is set, it represents
+/// an ephemeral output, which must be spent by a subsequent step. This is
+/// only supported for transparent outputs. Each ephemeral output will be
+/// given a unique t-address.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ChangeValue {
+    /// The value of a change or ephemeral output to be created, in zatoshis.
+    #[prost(uint64, tag = "1")]
+    pub value: u64,
+    /// The value pool in which the change or ephemeral output should be created.
+    #[prost(enumeration = "ValuePool", tag = "2")]
+    pub value_pool: i32,
+    /// The optional memo that should be associated with the newly created output.
+    /// Memos must not be present for transparent outputs.
+    #[prost(message, optional, tag = "3")]
+    pub memo: ::core::option::Option<MemoBytes>,
+    /// Whether this is to be an ephemeral output.
+    #[prost(bool, tag = "4")]
+    pub is_ephemeral: bool,
+}
+/// An object wrapper for memo bytes, to facilitate representing the
+/// `change_memo == None` case.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct MemoBytes {
+    #[prost(bytes = "vec", tag = "1")]
+    pub value: ::prost::alloc::vec::Vec<u8>,
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+#[repr(i32)]
+pub enum ValuePool {
+    /// Protobuf requires that enums have a zero discriminant as the default
+    /// value. However, we need to require that a known value pool is selected,
+    /// and we do not want to fall back to any default, so sending the
+    /// PoolNotSpecified value will be treated as an error.
+    PoolNotSpecified = 0,
+    /// The transparent value pool (P2SH is not distinguished from P2PKH)
+    Transparent = 1,
+    /// The Sapling value pool
+    Sapling = 2,
+    /// The Orchard value pool
+    Orchard = 3,
+}
+impl ValuePool {
+    /// String value of the enum field names used in the ProtoBuf definition.
+    ///
+    /// The values are not transformed in any way and thus are considered stable
+    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+    pub fn as_str_name(&self) -> &'static str {
+        match self {
+            ValuePool::PoolNotSpecified => "PoolNotSpecified",
+            ValuePool::Transparent => "Transparent",
+            ValuePool::Sapling => "Sapling",
+            ValuePool::Orchard => "Orchard",
+        }
+    }
+    /// Creates an enum from field names used in the ProtoBuf definition.
+    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+        match value {
+            "PoolNotSpecified" => Some(Self::PoolNotSpecified),
+            "Transparent" => Some(Self::Transparent),
+            "Sapling" => Some(Self::Sapling),
+            "Orchard" => Some(Self::Orchard),
+            _ => None,
+        }
+    }
+}
+/// The fee rule used in constructing a Proposal
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+#[repr(i32)]
+pub enum FeeRule {
+    /// Protobuf requires that enums have a zero discriminant as the default
+    /// value. However, we need to require that a known fee rule is selected,
+    /// and we do not want to fall back to any default, so sending the
+    /// FeeRuleNotSpecified value will be treated as an error.
+    NotSpecified = 0,
+    /// 10000 ZAT
+    PreZip313 = 1,
+    /// 1000 ZAT
+    Zip313 = 2,
+    /// MAX(10000, 5000 * logical_actions) ZAT
+    Zip317 = 3,
+}
+impl FeeRule {
+    /// String value of the enum field names used in the ProtoBuf definition.
+    ///
+    /// The values are not transformed in any way and thus are considered stable
+    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+    pub fn as_str_name(&self) -> &'static str {
+        match self {
+            FeeRule::NotSpecified => "FeeRuleNotSpecified",
+            FeeRule::PreZip313 => "PreZip313",
+            FeeRule::Zip313 => "Zip313",
+            FeeRule::Zip317 => "Zip317",
+        }
+    }
+    /// Creates an enum from field names used in the ProtoBuf definition.
+    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+        match value {
+            "FeeRuleNotSpecified" => Some(Self::NotSpecified),
+            "PreZip313" => Some(Self::PreZip313),
+            "Zip313" => Some(Self::Zip313),
+            "Zip317" => Some(Self::Zip317),
+            _ => None,
+        }
+    }
+}
diff --git a/zcash_client_backend/src/proto/service.rs b/zcash_client_backend/src/proto/service.rs
index 38b15abdbf..66db72451c 100644
--- a/zcash_client_backend/src/proto/service.rs
+++ b/zcash_client_backend/src/proto/service.rs
@@ -1,3 +1,4 @@
+// This file is @generated by prost-build.
 /// A BlockID message contains identifiers to select a block: a height or a
 /// hash. Specification by hash is not implemented, but may be in the future.
 #[allow(clippy::derive_partial_eq_without_eq)]
@@ -37,6 +38,9 @@ pub struct TxFilter {
 /// RawTransaction contains the complete transaction data. It also optionally includes
 /// the block height in which the transaction was included, or, when returned
 /// by GetMempoolStream(), the latest block height.
+///
+/// FIXME: the documentation here about mempool status contradicts the documentation
+/// for the `height` field. See <https://github.com/zcash/librustzcash/issues/1484>
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct RawTransaction {
@@ -60,11 +64,11 @@ pub struct SendResponse {
 }
 /// Chainspec is a placeholder to allow specification of a particular chain fork.
 #[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct ChainSpec {}
 /// Empty is for gRPCs that take no arguments, currently only GetLightdInfo.
 #[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Empty {}
 /// LightdInfo returns various information about this lightwalletd instance
 /// and the state of the blockchain.
@@ -124,7 +128,7 @@ pub struct TransparentAddressBlockFilter {
 /// can simulate a delay, to create many simultaneous connections. Units
 /// are microseconds.
 #[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Duration {
     #[prost(int64, tag = "1")]
     pub interval_us: i64,
@@ -133,7 +137,7 @@ pub struct Duration {
 /// are executing upon entry and upon exit (after the delay).
 /// This rpc is used for testing only.
 #[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct PingResponse {
     #[prost(int64, tag = "1")]
     pub entry: i64,
@@ -153,7 +157,7 @@ pub struct AddressList {
     pub addresses: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
 }
 #[allow(clippy::derive_partial_eq_without_eq)]
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
 pub struct Balance {
     #[prost(int64, tag = "1")]
     pub value_zat: i64,
@@ -187,6 +191,32 @@ pub struct TreeState {
     #[prost(string, tag = "6")]
     pub orchard_tree: ::prost::alloc::string::String,
 }
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, Copy, PartialEq, ::prost::Message)]
+pub struct GetSubtreeRootsArg {
+    /// Index identifying where to start returning subtree roots
+    #[prost(uint32, tag = "1")]
+    pub start_index: u32,
+    /// Shielded protocol to return subtree roots for
+    #[prost(enumeration = "ShieldedProtocol", tag = "2")]
+    pub shielded_protocol: i32,
+    /// Maximum number of entries to return, or 0 for all entries.
+    #[prost(uint32, tag = "3")]
+    pub max_entries: u32,
+}
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct SubtreeRoot {
+    /// The 32-byte Merkle root of the subtree.
+    #[prost(bytes = "vec", tag = "2")]
+    pub root_hash: ::prost::alloc::vec::Vec<u8>,
+    /// The hash of the block that completed this subtree.
+    #[prost(bytes = "vec", tag = "3")]
+    pub completing_block_hash: ::prost::alloc::vec::Vec<u8>,
+    /// The height of the block that completed this subtree in the main chain.
+    #[prost(uint64, tag = "4")]
+    pub completing_block_height: u64,
+}
 /// Results are sorted by height, which makes it easy to issue another
 /// request that picks up from where the previous left off.
 #[allow(clippy::derive_partial_eq_without_eq)]
@@ -222,7 +252,34 @@ pub struct GetAddressUtxosReplyList {
     #[prost(message, repeated, tag = "1")]
     pub address_utxos: ::prost::alloc::vec::Vec<GetAddressUtxosReply>,
 }
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+#[repr(i32)]
+pub enum ShieldedProtocol {
+    Sapling = 0,
+    Orchard = 1,
+}
+impl ShieldedProtocol {
+    /// String value of the enum field names used in the ProtoBuf definition.
+    ///
+    /// The values are not transformed in any way and thus are considered stable
+    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+    pub fn as_str_name(&self) -> &'static str {
+        match self {
+            ShieldedProtocol::Sapling => "sapling",
+            ShieldedProtocol::Orchard => "orchard",
+        }
+    }
+    /// Creates an enum from field names used in the ProtoBuf definition.
+    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+        match value {
+            "sapling" => Some(Self::Sapling),
+            "orchard" => Some(Self::Orchard),
+            _ => None,
+        }
+    }
+}
 /// Generated client implementations.
+#[cfg(feature = "lightwalletd-tonic")]
 pub mod compact_tx_streamer_client {
     #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
     use tonic::codegen::*;
@@ -231,17 +288,6 @@ pub mod compact_tx_streamer_client {
     pub struct CompactTxStreamerClient<T> {
         inner: tonic::client::Grpc<T>,
     }
-    impl CompactTxStreamerClient<tonic::transport::Channel> {
-        /// Attempt to create a new client by connecting to a given endpoint.
-        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
-        where
-            D: TryInto<tonic::transport::Endpoint>,
-            D::Error: Into<StdError>,
-        {
-            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
-            Ok(Self::new(conn))
-        }
-    }
     impl<T> CompactTxStreamerClient<T>
     where
         T: tonic::client::GrpcService<tonic::body::BoxBody>,
@@ -307,7 +353,7 @@ pub mod compact_tx_streamer_client {
             self.inner = self.inner.max_encoding_message_size(limit);
             self
         }
-        /// Return the height of the tip of the best chain
+        /// Return the BlockID of the block at the tip of the best chain
         pub async fn get_latest_block(
             &mut self,
             request: impl tonic::IntoRequest<super::ChainSpec>,
@@ -366,6 +412,37 @@ pub mod compact_tx_streamer_client {
                 );
             self.inner.unary(req, path, codec).await
         }
+        /// Same as GetBlock except actions contain only nullifiers
+        pub async fn get_block_nullifiers(
+            &mut self,
+            request: impl tonic::IntoRequest<super::BlockId>,
+        ) -> std::result::Result<
+            tonic::Response<crate::proto::compact_formats::CompactBlock>,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::new(
+                        tonic::Code::Unknown,
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic::codec::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/cash.z.wallet.sdk.rpc.CompactTxStreamer/GetBlockNullifiers",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new(
+                        "cash.z.wallet.sdk.rpc.CompactTxStreamer",
+                        "GetBlockNullifiers",
+                    ),
+                );
+            self.inner.unary(req, path, codec).await
+        }
         /// Return a list of consecutive compact blocks
         pub async fn get_block_range(
             &mut self,
@@ -399,6 +476,39 @@ pub mod compact_tx_streamer_client {
                 );
             self.inner.server_streaming(req, path, codec).await
         }
+        /// Same as GetBlockRange except actions contain only nullifiers
+        pub async fn get_block_range_nullifiers(
+            &mut self,
+            request: impl tonic::IntoRequest<super::BlockRange>,
+        ) -> std::result::Result<
+            tonic::Response<
+                tonic::codec::Streaming<crate::proto::compact_formats::CompactBlock>,
+            >,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::new(
+                        tonic::Code::Unknown,
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic::codec::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/cash.z.wallet.sdk.rpc.CompactTxStreamer/GetBlockRangeNullifiers",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new(
+                        "cash.z.wallet.sdk.rpc.CompactTxStreamer",
+                        "GetBlockRangeNullifiers",
+                    ),
+                );
+            self.inner.server_streaming(req, path, codec).await
+        }
         /// Return the requested full (not compact) transaction (as from zcashd)
         pub async fn get_transaction(
             &mut self,
@@ -671,6 +781,38 @@ pub mod compact_tx_streamer_client {
                 );
             self.inner.unary(req, path, codec).await
         }
+        /// Returns a stream of information about roots of subtrees of the Sapling and Orchard
+        /// note commitment trees.
+        pub async fn get_subtree_roots(
+            &mut self,
+            request: impl tonic::IntoRequest<super::GetSubtreeRootsArg>,
+        ) -> std::result::Result<
+            tonic::Response<tonic::codec::Streaming<super::SubtreeRoot>>,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::new(
+                        tonic::Code::Unknown,
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic::codec::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/cash.z.wallet.sdk.rpc.CompactTxStreamer/GetSubtreeRoots",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new(
+                        "cash.z.wallet.sdk.rpc.CompactTxStreamer",
+                        "GetSubtreeRoots",
+                    ),
+                );
+            self.inner.server_streaming(req, path, codec).await
+        }
         pub async fn get_address_utxos(
             &mut self,
             request: impl tonic::IntoRequest<super::GetAddressUtxosArg>,
diff --git a/zcash_client_backend/src/scan.rs b/zcash_client_backend/src/scan.rs
index a568be4f0a..b59d5803fb 100644
--- a/zcash_client_backend/src/scan.rs
+++ b/zcash_client_backend/src/scan.rs
@@ -8,36 +8,105 @@ use std::sync::{
 };
 
 use memuse::DynamicUsage;
-use zcash_note_encryption::{batch, BatchDomain, Domain, ShieldedOutput, COMPACT_NOTE_SIZE};
+use zcash_note_encryption::{
+    batch, BatchDomain, Domain, ShieldedOutput, COMPACT_NOTE_SIZE, ENC_CIPHERTEXT_SIZE,
+};
 use zcash_primitives::{block::BlockHash, transaction::TxId};
 
-/// A decrypted note.
-pub(crate) struct DecryptedNote<A, D: Domain> {
+/// A decrypted transaction output.
+pub(crate) struct DecryptedOutput<IvkTag, D: Domain, M> {
     /// The tag corresponding to the incoming viewing key used to decrypt the note.
-    pub(crate) ivk_tag: A,
+    pub(crate) ivk_tag: IvkTag,
     /// The recipient of the note.
     pub(crate) recipient: D::Recipient,
     /// The note!
     pub(crate) note: D::Note,
+    /// The memo field, or `()` if this is a decrypted compact output.
+    pub(crate) memo: M,
 }
 
-impl<A, D: Domain> fmt::Debug for DecryptedNote<A, D>
+impl<IvkTag, D: Domain, M> fmt::Debug for DecryptedOutput<IvkTag, D, M>
 where
-    A: fmt::Debug,
+    IvkTag: fmt::Debug,
     D::IncomingViewingKey: fmt::Debug,
     D::Recipient: fmt::Debug,
     D::Note: fmt::Debug,
-    D::Memo: fmt::Debug,
+    M: fmt::Debug,
 {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("DecryptedNote")
+        f.debug_struct("DecryptedOutput")
             .field("ivk_tag", &self.ivk_tag)
             .field("recipient", &self.recipient)
             .field("note", &self.note)
+            .field("memo", &self.memo)
             .finish()
     }
 }
 
+/// A decryptor of transaction outputs.
+pub(crate) trait Decryptor<D: BatchDomain, Output> {
+    type Memo;
+
+    fn batch_decrypt<IvkTag: Clone>(
+        tags: &[IvkTag],
+        ivks: &[D::IncomingViewingKey],
+        outputs: &[(D, Output)],
+    ) -> impl Iterator<Item = Option<DecryptedOutput<IvkTag, D, Self::Memo>>>;
+}
+
+/// A decryptor of outputs as encoded in transactions.
+#[allow(dead_code)]
+pub(crate) struct FullDecryptor;
+
+impl<D: BatchDomain, Output: ShieldedOutput<D, ENC_CIPHERTEXT_SIZE>> Decryptor<D, Output>
+    for FullDecryptor
+{
+    type Memo = D::Memo;
+
+    fn batch_decrypt<IvkTag: Clone>(
+        tags: &[IvkTag],
+        ivks: &[D::IncomingViewingKey],
+        outputs: &[(D, Output)],
+    ) -> impl Iterator<Item = Option<DecryptedOutput<IvkTag, D, Self::Memo>>> {
+        batch::try_note_decryption(ivks, outputs)
+            .into_iter()
+            .map(|res| {
+                res.map(|((note, recipient, memo), ivk_idx)| DecryptedOutput {
+                    ivk_tag: tags[ivk_idx].clone(),
+                    recipient,
+                    note,
+                    memo,
+                })
+            })
+    }
+}
+
+/// A decryptor of outputs as encoded in compact blocks.
+pub(crate) struct CompactDecryptor;
+
+impl<D: BatchDomain, Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>> Decryptor<D, Output>
+    for CompactDecryptor
+{
+    type Memo = ();
+
+    fn batch_decrypt<IvkTag: Clone>(
+        tags: &[IvkTag],
+        ivks: &[D::IncomingViewingKey],
+        outputs: &[(D, Output)],
+    ) -> impl Iterator<Item = Option<DecryptedOutput<IvkTag, D, Self::Memo>>> {
+        batch::try_compact_note_decryption(ivks, outputs)
+            .into_iter()
+            .map(|res| {
+                res.map(|((note, recipient), ivk_idx)| DecryptedOutput {
+                    ivk_tag: tags[ivk_idx].clone(),
+                    recipient,
+                    note,
+                    memo: (),
+                })
+            })
+    }
+}
+
 /// A value correlated with an output index.
 struct OutputIndex<V> {
     /// The index of the output within the corresponding shielded bundle.
@@ -46,12 +115,12 @@ struct OutputIndex<V> {
     value: V,
 }
 
-type OutputItem<A, D> = OutputIndex<DecryptedNote<A, D>>;
+type OutputItem<IvkTag, D, M> = OutputIndex<DecryptedOutput<IvkTag, D, M>>;
 
 /// The sender for the result of batch scanning a specific transaction output.
-struct OutputReplier<A, D: Domain>(OutputIndex<channel::Sender<OutputItem<A, D>>>);
+struct OutputReplier<IvkTag, D: Domain, M>(OutputIndex<channel::Sender<OutputItem<IvkTag, D, M>>>);
 
-impl<A, D: Domain> DynamicUsage for OutputReplier<A, D> {
+impl<IvkTag, D: Domain, M> DynamicUsage for OutputReplier<IvkTag, D, M> {
     #[inline(always)]
     fn dynamic_usage(&self) -> usize {
         // We count the memory usage of items in the channel on the receiver side.
@@ -65,9 +134,9 @@ impl<A, D: Domain> DynamicUsage for OutputReplier<A, D> {
 }
 
 /// The receiver for the result of batch scanning a specific transaction.
-struct BatchReceiver<A, D: Domain>(channel::Receiver<OutputItem<A, D>>);
+struct BatchReceiver<IvkTag, D: Domain, M>(channel::Receiver<OutputItem<IvkTag, D, M>>);
 
-impl<A, D: Domain> DynamicUsage for BatchReceiver<A, D> {
+impl<IvkTag, D: Domain, M> DynamicUsage for BatchReceiver<IvkTag, D, M> {
     fn dynamic_usage(&self) -> usize {
         // We count the memory usage of items in the channel on the receiver side.
         let num_items = self.0.len();
@@ -84,7 +153,7 @@ impl<A, D: Domain> DynamicUsage for BatchReceiver<A, D> {
         //   - Space for an item.
         //   - The state of the slot, stored as an AtomicUsize.
         const PTR_SIZE: usize = std::mem::size_of::<usize>();
-        let item_size = std::mem::size_of::<OutputItem<A, D>>();
+        let item_size = std::mem::size_of::<OutputItem<IvkTag, D, M>>();
         const ATOMIC_USIZE_SIZE: usize = std::mem::size_of::<AtomicUsize>();
         let block_size = PTR_SIZE + ITEMS_PER_BLOCK * (item_size + ATOMIC_USIZE_SIZE);
 
@@ -129,6 +198,7 @@ impl<Item: Task> Tasks<Item> for () {
 ///
 /// This struct implements `DynamicUsage` without any item bounds, but that works because
 /// it only implements `Tasks` for items that implement `DynamicUsage`.
+#[allow(dead_code)]
 pub(crate) struct WithUsage {
     // The current heap usage for all running tasks.
     running_usage: Arc<AtomicUsize>,
@@ -208,8 +278,8 @@ impl<Item: Task> Task for WithUsageTask<Item> {
 }
 
 /// A batch of outputs to trial decrypt.
-pub(crate) struct Batch<A, D: BatchDomain, Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>> {
-    tags: Vec<A>,
+pub(crate) struct Batch<IvkTag, D: BatchDomain, Output, Dec: Decryptor<D, Output>> {
+    tags: Vec<IvkTag>,
     ivks: Vec<D::IncomingViewingKey>,
     /// We currently store outputs and repliers as parallel vectors, because
     /// [`batch::try_note_decryption`] accepts a slice of domain/output pairs
@@ -219,15 +289,16 @@ pub(crate) struct Batch<A, D: BatchDomain, Output: ShieldedOutput<D, COMPACT_NOT
     /// all be part of the same struct, which would also track the output index
     /// (that is captured in the outer `OutputIndex` of each `OutputReplier`).
     outputs: Vec<(D, Output)>,
-    repliers: Vec<OutputReplier<A, D>>,
+    repliers: Vec<OutputReplier<IvkTag, D, Dec::Memo>>,
 }
 
-impl<A, D, Output> DynamicUsage for Batch<A, D, Output>
+impl<IvkTag, D, Output, Dec> DynamicUsage for Batch<IvkTag, D, Output, Dec>
 where
-    A: DynamicUsage,
+    IvkTag: DynamicUsage,
     D: BatchDomain + DynamicUsage,
     D::IncomingViewingKey: DynamicUsage,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE> + DynamicUsage,
+    Output: DynamicUsage,
+    Dec: Decryptor<D, Output>,
 {
     fn dynamic_usage(&self) -> usize {
         self.tags.dynamic_usage()
@@ -253,14 +324,14 @@ where
     }
 }
 
-impl<A, D, Output> Batch<A, D, Output>
+impl<IvkTag, D, Output, Dec> Batch<IvkTag, D, Output, Dec>
 where
-    A: Clone,
+    IvkTag: Clone,
     D: BatchDomain,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>,
+    Dec: Decryptor<D, Output>,
 {
     /// Constructs a new batch.
-    fn new(tags: Vec<A>, ivks: Vec<D::IncomingViewingKey>) -> Self {
+    fn new(tags: Vec<IvkTag>, ivks: Vec<D::IncomingViewingKey>) -> Self {
         assert_eq!(tags.len(), ivks.len());
         Self {
             tags,
@@ -276,15 +347,17 @@ where
     }
 }
 
-impl<A, D, Output> Task for Batch<A, D, Output>
+impl<IvkTag, D, Output, Dec> Task for Batch<IvkTag, D, Output, Dec>
 where
-    A: Clone + Send + 'static,
+    IvkTag: Clone + Send + 'static,
     D: BatchDomain + Send + 'static,
     D::IncomingViewingKey: Send,
     D::Memo: Send,
     D::Note: Send,
     D::Recipient: Send,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE> + Send + 'static,
+    Output: Send + 'static,
+    Dec: Decryptor<D, Output> + 'static,
+    Dec::Memo: Send,
 {
     /// Runs the batch of trial decryptions, and reports the results.
     fn run(self) {
@@ -298,20 +371,14 @@ where
 
         assert_eq!(outputs.len(), repliers.len());
 
-        let decryption_results = batch::try_compact_note_decryption(&ivks, &outputs);
-        for (decryption_result, OutputReplier(replier)) in
-            decryption_results.into_iter().zip(repliers.into_iter())
-        {
+        let decryption_results = Dec::batch_decrypt(&tags, &ivks, &outputs);
+        for (decryption_result, OutputReplier(replier)) in decryption_results.zip(repliers) {
             // If `decryption_result` is `None` then we will just drop `replier`,
             // indicating to the parent `BatchRunner` that this output was not for us.
-            if let Some(((note, recipient), ivk_idx)) = decryption_result {
+            if let Some(value) = decryption_result {
                 let result = OutputIndex {
                     output_index: replier.output_index,
-                    value: DecryptedNote {
-                        ivk_tag: tags[ivk_idx].clone(),
-                        recipient,
-                        note,
-                    },
+                    value,
                 };
 
                 if replier.value.send(result).is_err() {
@@ -323,18 +390,27 @@ where
     }
 }
 
-impl<A, D: BatchDomain, Output: ShieldedOutput<D, COMPACT_NOTE_SIZE> + Clone> Batch<A, D, Output> {
+impl<IvkTag, D, Output, Dec> Batch<IvkTag, D, Output, Dec>
+where
+    D: BatchDomain,
+    Output: Clone,
+    Dec: Decryptor<D, Output>,
+{
     /// Adds the given outputs to this batch.
     ///
     /// `replier` will be called with the result of every output.
     fn add_outputs(
         &mut self,
-        domain: impl Fn() -> D,
+        domain: impl Fn(&Output) -> D,
         outputs: &[Output],
-        replier: channel::Sender<OutputItem<A, D>>,
+        replier: channel::Sender<OutputItem<IvkTag, D, Dec::Memo>>,
     ) {
-        self.outputs
-            .extend(outputs.iter().cloned().map(|output| (domain(), output)));
+        self.outputs.extend(
+            outputs
+                .iter()
+                .cloned()
+                .map(|output| (domain(&output), output)),
+        );
         self.repliers.extend((0..outputs.len()).map(|output_index| {
             OutputReplier(OutputIndex {
                 output_index,
@@ -361,28 +437,29 @@ impl DynamicUsage for ResultKey {
 }
 
 /// Logic to run batches of trial decryptions on the global threadpool.
-pub(crate) struct BatchRunner<A, D, Output, T>
+pub(crate) struct BatchRunner<IvkTag, D, Output, Dec, T>
 where
     D: BatchDomain,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>,
-    T: Tasks<Batch<A, D, Output>>,
+    Dec: Decryptor<D, Output>,
+    T: Tasks<Batch<IvkTag, D, Output, Dec>>,
 {
     batch_size_threshold: usize,
     // The batch currently being accumulated.
-    acc: Batch<A, D, Output>,
+    acc: Batch<IvkTag, D, Output, Dec>,
     // The running batches.
     running_tasks: T,
     // Receivers for the results of the running batches.
-    pending_results: HashMap<ResultKey, BatchReceiver<A, D>>,
+    pending_results: HashMap<ResultKey, BatchReceiver<IvkTag, D, Dec::Memo>>,
 }
 
-impl<A, D, Output, T> DynamicUsage for BatchRunner<A, D, Output, T>
+impl<IvkTag, D, Output, Dec, T> DynamicUsage for BatchRunner<IvkTag, D, Output, Dec, T>
 where
-    A: DynamicUsage,
+    IvkTag: DynamicUsage,
     D: BatchDomain + DynamicUsage,
     D::IncomingViewingKey: DynamicUsage,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE> + DynamicUsage,
-    T: Tasks<Batch<A, D, Output>> + DynamicUsage,
+    Output: DynamicUsage,
+    Dec: Decryptor<D, Output>,
+    T: Tasks<Batch<IvkTag, D, Output, Dec>> + DynamicUsage,
 {
     fn dynamic_usage(&self) -> usize {
         self.acc.dynamic_usage()
@@ -408,17 +485,17 @@ where
     }
 }
 
-impl<A, D, Output, T> BatchRunner<A, D, Output, T>
+impl<IvkTag, D, Output, Dec, T> BatchRunner<IvkTag, D, Output, Dec, T>
 where
-    A: Clone,
+    IvkTag: Clone,
     D: BatchDomain,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>,
-    T: Tasks<Batch<A, D, Output>>,
+    Dec: Decryptor<D, Output>,
+    T: Tasks<Batch<IvkTag, D, Output, Dec>>,
 {
     /// Constructs a new batch runner for the given incoming viewing keys.
     pub(crate) fn new(
         batch_size_threshold: usize,
-        ivks: impl Iterator<Item = (A, D::IncomingViewingKey)>,
+        ivks: impl Iterator<Item = (IvkTag, D::IncomingViewingKey)>,
     ) -> Self {
         let (tags, ivks) = ivks.unzip();
         Self {
@@ -430,16 +507,17 @@ where
     }
 }
 
-impl<A, D, Output, T> BatchRunner<A, D, Output, T>
+impl<IvkTag, D, Output, Dec, T> BatchRunner<IvkTag, D, Output, Dec, T>
 where
-    A: Clone + Send + 'static,
+    IvkTag: Clone + Send + 'static,
     D: BatchDomain + Send + 'static,
     D::IncomingViewingKey: Clone + Send,
     D::Memo: Send,
     D::Note: Send,
     D::Recipient: Send,
-    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE> + Clone + Send + 'static,
-    T: Tasks<Batch<A, D, Output>>,
+    Output: Clone + Send + 'static,
+    Dec: Decryptor<D, Output>,
+    T: Tasks<Batch<IvkTag, D, Output, Dec>>,
 {
     /// Batches the given outputs for trial decryption.
     ///
@@ -447,14 +525,14 @@ where
     /// batch, or the all-zeros hash to indicate that no block triggered it (i.e. it was a
     /// mempool change).
     ///
-    /// If after adding the given outputs, the accumulated batch size is at least
-    /// `BATCH_SIZE_THRESHOLD`, `Self::flush` is called. Subsequent calls to
-    /// `Self::add_outputs` will be accumulated into a new batch.
+    /// If after adding the given outputs, the accumulated batch size is at least the size
+    /// threshold that was set via `Self::new`, `Self::flush` is called. Subsequent calls
+    /// to `Self::add_outputs` will be accumulated into a new batch.
     pub(crate) fn add_outputs(
         &mut self,
         block_tag: BlockHash,
         txid: TxId,
-        domain: impl Fn() -> D,
+        domain: impl Fn(&Output) -> D,
         outputs: &[Output],
     ) {
         let (tx, rx) = channel::unbounded();
@@ -487,7 +565,7 @@ where
         &mut self,
         block_tag: BlockHash,
         txid: TxId,
-    ) -> HashMap<(TxId, usize), DecryptedNote<A, D>> {
+    ) -> HashMap<(TxId, usize), DecryptedOutput<IvkTag, D, Dec::Memo>> {
         self.pending_results
             .remove(&ResultKey(block_tag, txid))
             // We won't have a pending result if the transaction didn't have outputs of
diff --git a/zcash_client_backend/src/scanning.rs b/zcash_client_backend/src/scanning.rs
new file mode 100644
index 0000000000..1967b9ff5e
--- /dev/null
+++ b/zcash_client_backend/src/scanning.rs
@@ -0,0 +1,1537 @@
+//! Tools for scanning a compact representation of the Zcash block chain.
+
+use std::collections::{HashMap, HashSet};
+use std::convert::TryFrom;
+use std::fmt::{self, Debug};
+use std::hash::Hash;
+
+use incrementalmerkletree::{Marking, Position, Retention};
+use sapling::{
+    note_encryption::{CompactOutputDescription, SaplingDomain},
+    SaplingIvk,
+};
+use subtle::{ConditionallySelectable, ConstantTimeEq, CtOption};
+
+use tracing::{debug, trace};
+use zcash_keys::keys::UnifiedFullViewingKey;
+use zcash_note_encryption::{batch, BatchDomain, Domain, ShieldedOutput, COMPACT_NOTE_SIZE};
+use zcash_primitives::{
+    consensus::{self, BlockHeight, NetworkUpgrade},
+    transaction::{components::sapling::zip212_enforcement, TxId},
+};
+use zip32::Scope;
+
+use crate::{
+    data_api::{BlockMetadata, ScannedBlock, ScannedBundles},
+    proto::compact_formats::CompactBlock,
+    scan::{Batch, BatchRunner, CompactDecryptor, DecryptedOutput, Tasks},
+    wallet::{WalletOutput, WalletSpend, WalletTx},
+    ShieldedProtocol,
+};
+
+#[cfg(feature = "orchard")]
+use orchard::{
+    note_encryption::{CompactAction, OrchardDomain},
+    tree::MerkleHashOrchard,
+};
+
+#[cfg(not(feature = "orchard"))]
+use std::marker::PhantomData;
+
+/// A key that can be used to perform trial decryption and nullifier
+/// computation for a [`CompactSaplingOutput`] or [`CompactOrchardAction`].
+///
+/// The purpose of this trait is to enable [`scan_block`]
+/// and related methods to be used with either incoming viewing keys
+/// or full viewing keys, with the data returned from trial decryption
+/// being dependent upon the type of key used. In the case that an
+/// incoming viewing key is used, only the note and payment address
+/// will be returned; in the case of a full viewing key, the
+/// nullifier for the note can also be obtained.
+///
+/// [`CompactSaplingOutput`]: crate::proto::compact_formats::CompactSaplingOutput
+/// [`CompactOrchardAction`]: crate::proto::compact_formats::CompactOrchardAction
+/// [`scan_block`]: crate::scanning::scan_block
+pub trait ScanningKeyOps<D: Domain, AccountId, Nf> {
+    /// Prepare the key for use in batch trial decryption.
+    fn prepare(&self) -> D::IncomingViewingKey;
+
+    /// Returns the account identifier for this key. An account identifier corresponds
+    /// to at most a single unified spending key's worth of spend authority, such that
+    /// both received notes and change spendable by that spending authority will be
+    /// interpreted as belonging to that account.
+    fn account_id(&self) -> &AccountId;
+
+    /// Returns the [`zip32::Scope`] for which this key was derived, if known.
+    fn key_scope(&self) -> Option<Scope>;
+
+    /// Produces the nullifier for the specified note and witness, if possible.
+    ///
+    /// IVK-based implementations of this trait cannot successfully derive
+    /// nullifiers, in which this function will always return `None`.
+    fn nf(&self, note: &D::Note, note_position: Position) -> Option<Nf>;
+}
+
+impl<D: Domain, AccountId, Nf, K: ScanningKeyOps<D, AccountId, Nf>> ScanningKeyOps<D, AccountId, Nf>
+    for &K
+{
+    fn prepare(&self) -> D::IncomingViewingKey {
+        (*self).prepare()
+    }
+
+    fn account_id(&self) -> &AccountId {
+        (*self).account_id()
+    }
+
+    fn key_scope(&self) -> Option<Scope> {
+        (*self).key_scope()
+    }
+
+    fn nf(&self, note: &D::Note, note_position: Position) -> Option<Nf> {
+        (*self).nf(note, note_position)
+    }
+}
+
+impl<D: Domain, AccountId, Nf> ScanningKeyOps<D, AccountId, Nf>
+    for Box<dyn ScanningKeyOps<D, AccountId, Nf>>
+{
+    fn prepare(&self) -> D::IncomingViewingKey {
+        self.as_ref().prepare()
+    }
+
+    fn account_id(&self) -> &AccountId {
+        self.as_ref().account_id()
+    }
+
+    fn key_scope(&self) -> Option<Scope> {
+        self.as_ref().key_scope()
+    }
+
+    fn nf(&self, note: &D::Note, note_position: Position) -> Option<Nf> {
+        self.as_ref().nf(note, note_position)
+    }
+}
+
+/// An incoming viewing key, paired with an optional nullifier key and key source metadata.
+pub struct ScanningKey<Ivk, Nk, AccountId> {
+    ivk: Ivk,
+    nk: Option<Nk>,
+    account_id: AccountId,
+    key_scope: Option<Scope>,
+}
+
+impl<AccountId> ScanningKeyOps<SaplingDomain, AccountId, sapling::Nullifier>
+    for ScanningKey<sapling::SaplingIvk, sapling::NullifierDerivingKey, AccountId>
+{
+    fn prepare(&self) -> sapling::note_encryption::PreparedIncomingViewingKey {
+        sapling::note_encryption::PreparedIncomingViewingKey::new(&self.ivk)
+    }
+
+    fn nf(&self, note: &sapling::Note, position: Position) -> Option<sapling::Nullifier> {
+        self.nk.as_ref().map(|key| note.nf(key, position.into()))
+    }
+
+    fn account_id(&self) -> &AccountId {
+        &self.account_id
+    }
+
+    fn key_scope(&self) -> Option<Scope> {
+        self.key_scope
+    }
+}
+
+impl<AccountId> ScanningKeyOps<SaplingDomain, AccountId, sapling::Nullifier>
+    for (AccountId, SaplingIvk)
+{
+    fn prepare(&self) -> sapling::note_encryption::PreparedIncomingViewingKey {
+        sapling::note_encryption::PreparedIncomingViewingKey::new(&self.1)
+    }
+
+    fn nf(&self, _note: &sapling::Note, _position: Position) -> Option<sapling::Nullifier> {
+        None
+    }
+
+    fn account_id(&self) -> &AccountId {
+        &self.0
+    }
+
+    fn key_scope(&self) -> Option<Scope> {
+        None
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl<AccountId> ScanningKeyOps<OrchardDomain, AccountId, orchard::note::Nullifier>
+    for ScanningKey<orchard::keys::IncomingViewingKey, orchard::keys::FullViewingKey, AccountId>
+{
+    fn prepare(&self) -> orchard::keys::PreparedIncomingViewingKey {
+        orchard::keys::PreparedIncomingViewingKey::new(&self.ivk)
+    }
+
+    fn nf(
+        &self,
+        note: &orchard::note::Note,
+        _position: Position,
+    ) -> Option<orchard::note::Nullifier> {
+        self.nk.as_ref().map(|key| note.nullifier(key))
+    }
+
+    fn account_id(&self) -> &AccountId {
+        &self.account_id
+    }
+
+    fn key_scope(&self) -> Option<Scope> {
+        self.key_scope
+    }
+}
+
+/// A set of keys to be used in scanning for decryptable transaction outputs.
+pub struct ScanningKeys<AccountId, IvkTag> {
+    sapling: HashMap<IvkTag, Box<dyn ScanningKeyOps<SaplingDomain, AccountId, sapling::Nullifier>>>,
+    #[cfg(feature = "orchard")]
+    orchard: HashMap<
+        IvkTag,
+        Box<dyn ScanningKeyOps<OrchardDomain, AccountId, orchard::note::Nullifier>>,
+    >,
+}
+
+impl<AccountId, IvkTag> ScanningKeys<AccountId, IvkTag> {
+    /// Constructs a new set of scanning keys.
+    pub fn new(
+        sapling: HashMap<
+            IvkTag,
+            Box<dyn ScanningKeyOps<SaplingDomain, AccountId, sapling::Nullifier>>,
+        >,
+        #[cfg(feature = "orchard")] orchard: HashMap<
+            IvkTag,
+            Box<dyn ScanningKeyOps<OrchardDomain, AccountId, orchard::note::Nullifier>>,
+        >,
+    ) -> Self {
+        Self {
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        }
+    }
+
+    /// Constructs a new empty set of scanning keys.
+    pub fn empty() -> Self {
+        Self {
+            sapling: HashMap::new(),
+            #[cfg(feature = "orchard")]
+            orchard: HashMap::new(),
+        }
+    }
+
+    /// Returns the Sapling keys to be used for incoming note detection.
+    pub fn sapling(
+        &self,
+    ) -> &HashMap<IvkTag, Box<dyn ScanningKeyOps<SaplingDomain, AccountId, sapling::Nullifier>>>
+    {
+        &self.sapling
+    }
+
+    /// Returns the Orchard keys to be used for incoming note detection.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(
+        &self,
+    ) -> &HashMap<IvkTag, Box<dyn ScanningKeyOps<OrchardDomain, AccountId, orchard::note::Nullifier>>>
+    {
+        &self.orchard
+    }
+}
+
+impl<AccountId: Copy + Eq + Hash + 'static> ScanningKeys<AccountId, (AccountId, Scope)> {
+    /// Constructs a [`ScanningKeys`] from an iterator of [`UnifiedFullViewingKey`]s,
+    /// along with the account identifiers corresponding to those UFVKs.
+    pub fn from_account_ufvks(
+        ufvks: impl IntoIterator<Item = (AccountId, UnifiedFullViewingKey)>,
+    ) -> Self {
+        #![allow(clippy::type_complexity)]
+
+        let mut sapling: HashMap<
+            (AccountId, Scope),
+            Box<dyn ScanningKeyOps<SaplingDomain, AccountId, sapling::Nullifier>>,
+        > = HashMap::new();
+        #[cfg(feature = "orchard")]
+        let mut orchard: HashMap<
+            (AccountId, Scope),
+            Box<dyn ScanningKeyOps<OrchardDomain, AccountId, orchard::note::Nullifier>>,
+        > = HashMap::new();
+
+        for (account_id, ufvk) in ufvks {
+            if let Some(dfvk) = ufvk.sapling() {
+                for scope in [Scope::External, Scope::Internal] {
+                    sapling.insert(
+                        (account_id, scope),
+                        Box::new(ScanningKey {
+                            ivk: dfvk.to_ivk(scope),
+                            nk: Some(dfvk.to_nk(scope)),
+                            account_id,
+                            key_scope: Some(scope),
+                        }),
+                    );
+                }
+            }
+
+            #[cfg(feature = "orchard")]
+            if let Some(fvk) = ufvk.orchard() {
+                for scope in [Scope::External, Scope::Internal] {
+                    orchard.insert(
+                        (account_id, scope),
+                        Box::new(ScanningKey {
+                            ivk: fvk.to_ivk(scope),
+                            nk: Some(fvk.clone()),
+                            account_id,
+                            key_scope: Some(scope),
+                        }),
+                    );
+                }
+            }
+        }
+
+        Self {
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        }
+    }
+}
+
+/// The set of nullifiers being tracked by a wallet.
+pub struct Nullifiers<AccountId> {
+    sapling: Vec<(AccountId, sapling::Nullifier)>,
+    #[cfg(feature = "orchard")]
+    orchard: Vec<(AccountId, orchard::note::Nullifier)>,
+}
+
+impl<AccountId> Nullifiers<AccountId> {
+    /// Constructs a new empty set of nullifiers
+    pub fn empty() -> Self {
+        Self {
+            sapling: vec![],
+            #[cfg(feature = "orchard")]
+            orchard: vec![],
+        }
+    }
+
+    /// Construct a nullifier set from its constituent parts.
+    pub(crate) fn new(
+        sapling: Vec<(AccountId, sapling::Nullifier)>,
+        #[cfg(feature = "orchard")] orchard: Vec<(AccountId, orchard::note::Nullifier)>,
+    ) -> Self {
+        Self {
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        }
+    }
+
+    /// Returns the Sapling nullifiers for notes that the wallet is tracking.
+    pub fn sapling(&self) -> &[(AccountId, sapling::Nullifier)] {
+        self.sapling.as_ref()
+    }
+
+    /// Returns the Orchard nullifiers for notes that the wallet is tracking.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> &[(AccountId, orchard::note::Nullifier)] {
+        self.orchard.as_ref()
+    }
+
+    /// Discards Sapling nullifiers from the tracked nullifier set, retaining only those that
+    /// satisfy the given predicate.
+    pub(crate) fn retain_sapling(&mut self, f: impl Fn(&(AccountId, sapling::Nullifier)) -> bool) {
+        self.sapling.retain(f);
+    }
+
+    /// Adds the given nullifiers to the tracked nullifier set.
+    pub(crate) fn extend_sapling(
+        &mut self,
+        nfs: impl IntoIterator<Item = (AccountId, sapling::Nullifier)>,
+    ) {
+        self.sapling.extend(nfs);
+    }
+
+    #[cfg(feature = "orchard")]
+    pub(crate) fn retain_orchard(
+        &mut self,
+        f: impl Fn(&(AccountId, orchard::note::Nullifier)) -> bool,
+    ) {
+        self.orchard.retain(f);
+    }
+
+    #[cfg(feature = "orchard")]
+    pub(crate) fn extend_orchard(
+        &mut self,
+        nfs: impl IntoIterator<Item = (AccountId, orchard::note::Nullifier)>,
+    ) {
+        self.orchard.extend(nfs);
+    }
+}
+
+/// Errors that may occur in chain scanning
+#[derive(Clone, Debug)]
+pub enum ScanError {
+    /// The encoding of a compact Sapling output or compact Orchard action was invalid.
+    EncodingInvalid {
+        at_height: BlockHeight,
+        txid: TxId,
+        pool_type: ShieldedProtocol,
+        index: usize,
+    },
+
+    /// The hash of the parent block given by a proposed new chain tip does not match the hash of
+    /// the current chain tip.
+    PrevHashMismatch { at_height: BlockHeight },
+
+    /// The block height field of the proposed new block is not equal to the height of the previous
+    /// block + 1.
+    BlockHeightDiscontinuity {
+        prev_height: BlockHeight,
+        new_height: BlockHeight,
+    },
+
+    /// The note commitment tree size for the given protocol at the proposed new block is not equal
+    /// to the size at the previous block plus the count of this block's outputs.
+    TreeSizeMismatch {
+        protocol: ShieldedProtocol,
+        at_height: BlockHeight,
+        given: u32,
+        computed: u32,
+    },
+
+    /// The size of the note commitment tree for the given protocol was not provided as part of a
+    /// [`CompactBlock`] being scanned, making it impossible to construct the nullifier for a
+    /// detected note.
+    TreeSizeUnknown {
+        protocol: ShieldedProtocol,
+        at_height: BlockHeight,
+    },
+
+    /// We were provided chain metadata for a block containing note commitment tree metadata
+    /// that is invalidated by the data in the block itself. This may be caused by the presence
+    /// of default values in the chain metadata.
+    TreeSizeInvalid {
+        protocol: ShieldedProtocol,
+        at_height: BlockHeight,
+    },
+}
+
+impl ScanError {
+    /// Returns whether this error is the result of a failed continuity check
+    pub fn is_continuity_error(&self) -> bool {
+        use ScanError::*;
+        match self {
+            EncodingInvalid { .. } => false,
+            PrevHashMismatch { .. } => true,
+            BlockHeightDiscontinuity { .. } => true,
+            TreeSizeMismatch { .. } => true,
+            TreeSizeUnknown { .. } => false,
+            TreeSizeInvalid { .. } => false,
+        }
+    }
+
+    /// Returns the block height at which the scan error occurred
+    pub fn at_height(&self) -> BlockHeight {
+        use ScanError::*;
+        match self {
+            EncodingInvalid { at_height, .. } => *at_height,
+            PrevHashMismatch { at_height } => *at_height,
+            BlockHeightDiscontinuity { new_height, .. } => *new_height,
+            TreeSizeMismatch { at_height, .. } => *at_height,
+            TreeSizeUnknown { at_height, .. } => *at_height,
+            TreeSizeInvalid { at_height, .. } => *at_height,
+        }
+    }
+}
+
+impl fmt::Display for ScanError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        use ScanError::*;
+        match &self {
+            EncodingInvalid { txid, pool_type, index, .. } => write!(
+                f,
+                "{:?} output {} of transaction {} was improperly encoded.",
+                pool_type, index, txid
+            ),
+            PrevHashMismatch { at_height } => write!(
+                f,
+                "The parent hash of proposed block does not correspond to the block hash at height {}.",
+                at_height
+            ),
+            BlockHeightDiscontinuity { prev_height, new_height } => {
+                write!(f, "Block height discontinuity at height {}; previous height was: {}", new_height, prev_height)
+            }
+            TreeSizeMismatch { protocol, at_height, given, computed } => {
+                write!(f, "The {:?} note commitment tree size provided by a compact block did not match the expected size at height {}; given {}, expected {}", protocol, at_height, given, computed)
+            }
+            TreeSizeUnknown { protocol, at_height } => {
+                write!(f, "Unable to determine {:?} note commitment tree size at height {}", protocol, at_height)
+            }
+            TreeSizeInvalid { protocol, at_height } => {
+                write!(f, "Received invalid (potentially default) {:?} note commitment tree size metadata at height {}", protocol, at_height)
+            }
+        }
+    }
+}
+
+/// Scans a [`CompactBlock`] with a set of [`ScanningKeys`].
+///
+/// Returns a vector of [`WalletTx`]s decryptable by any of the given keys. If an output is
+/// decrypted by a full viewing key, the nullifiers of that output will also be computed.
+///
+/// [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
+/// [`WalletTx`]: crate::wallet::WalletTx
+pub fn scan_block<P, AccountId, IvkTag>(
+    params: &P,
+    block: CompactBlock,
+    scanning_keys: &ScanningKeys<AccountId, IvkTag>,
+    nullifiers: &Nullifiers<AccountId>,
+    prior_block_metadata: Option<&BlockMetadata>,
+) -> Result<ScannedBlock<AccountId>, ScanError>
+where
+    P: consensus::Parameters + Send + 'static,
+    AccountId: Default + Eq + Hash + ConditionallySelectable + Send + 'static,
+    IvkTag: Copy + std::hash::Hash + Eq + Send + 'static,
+{
+    scan_block_with_runners::<_, _, _, (), ()>(
+        params,
+        block,
+        scanning_keys,
+        nullifiers,
+        prior_block_metadata,
+        None,
+    )
+}
+
+type TaggedSaplingBatch<IvkTag> = Batch<
+    IvkTag,
+    SaplingDomain,
+    sapling::note_encryption::CompactOutputDescription,
+    CompactDecryptor,
+>;
+type TaggedSaplingBatchRunner<IvkTag, Tasks> = BatchRunner<
+    IvkTag,
+    SaplingDomain,
+    sapling::note_encryption::CompactOutputDescription,
+    CompactDecryptor,
+    Tasks,
+>;
+
+#[cfg(feature = "orchard")]
+type TaggedOrchardBatch<IvkTag> =
+    Batch<IvkTag, OrchardDomain, orchard::note_encryption::CompactAction, CompactDecryptor>;
+#[cfg(feature = "orchard")]
+type TaggedOrchardBatchRunner<IvkTag, Tasks> = BatchRunner<
+    IvkTag,
+    OrchardDomain,
+    orchard::note_encryption::CompactAction,
+    CompactDecryptor,
+    Tasks,
+>;
+
+pub(crate) trait SaplingTasks<IvkTag>: Tasks<TaggedSaplingBatch<IvkTag>> {}
+impl<IvkTag, T: Tasks<TaggedSaplingBatch<IvkTag>>> SaplingTasks<IvkTag> for T {}
+
+#[cfg(not(feature = "orchard"))]
+pub(crate) trait OrchardTasks<IvkTag> {}
+#[cfg(not(feature = "orchard"))]
+impl<IvkTag, T> OrchardTasks<IvkTag> for T {}
+
+#[cfg(feature = "orchard")]
+pub(crate) trait OrchardTasks<IvkTag>: Tasks<TaggedOrchardBatch<IvkTag>> {}
+#[cfg(feature = "orchard")]
+impl<IvkTag, T: Tasks<TaggedOrchardBatch<IvkTag>>> OrchardTasks<IvkTag> for T {}
+
+pub(crate) struct BatchRunners<IvkTag, TS: SaplingTasks<IvkTag>, TO: OrchardTasks<IvkTag>> {
+    sapling: TaggedSaplingBatchRunner<IvkTag, TS>,
+    #[cfg(feature = "orchard")]
+    orchard: TaggedOrchardBatchRunner<IvkTag, TO>,
+    #[cfg(not(feature = "orchard"))]
+    orchard: PhantomData<TO>,
+}
+
+impl<IvkTag, TS, TO> BatchRunners<IvkTag, TS, TO>
+where
+    IvkTag: Clone + Send + 'static,
+    TS: SaplingTasks<IvkTag>,
+    TO: OrchardTasks<IvkTag>,
+{
+    pub(crate) fn for_keys<AccountId>(
+        batch_size_threshold: usize,
+        scanning_keys: &ScanningKeys<AccountId, IvkTag>,
+    ) -> Self {
+        BatchRunners {
+            sapling: BatchRunner::new(
+                batch_size_threshold,
+                scanning_keys
+                    .sapling()
+                    .iter()
+                    .map(|(id, key)| (id.clone(), key.prepare())),
+            ),
+            #[cfg(feature = "orchard")]
+            orchard: BatchRunner::new(
+                batch_size_threshold,
+                scanning_keys
+                    .orchard()
+                    .iter()
+                    .map(|(id, key)| (id.clone(), key.prepare())),
+            ),
+            #[cfg(not(feature = "orchard"))]
+            orchard: PhantomData,
+        }
+    }
+
+    pub(crate) fn flush(&mut self) {
+        self.sapling.flush();
+        #[cfg(feature = "orchard")]
+        self.orchard.flush();
+    }
+
+    #[tracing::instrument(skip_all, fields(height = block.height))]
+    pub(crate) fn add_block<P>(&mut self, params: &P, block: CompactBlock) -> Result<(), ScanError>
+    where
+        P: consensus::Parameters + Send + 'static,
+        IvkTag: Copy + Send + 'static,
+    {
+        let block_hash = block.hash();
+        let block_height = block.height();
+        let zip212_enforcement = zip212_enforcement(params, block_height);
+
+        for tx in block.vtx.into_iter() {
+            let txid = tx.txid();
+
+            self.sapling.add_outputs(
+                block_hash,
+                txid,
+                |_| SaplingDomain::new(zip212_enforcement),
+                &tx.outputs
+                    .iter()
+                    .enumerate()
+                    .map(|(i, output)| {
+                        CompactOutputDescription::try_from(output).map_err(|_| {
+                            ScanError::EncodingInvalid {
+                                at_height: block_height,
+                                txid,
+                                pool_type: ShieldedProtocol::Sapling,
+                                index: i,
+                            }
+                        })
+                    })
+                    .collect::<Result<Vec<_>, _>>()?,
+            );
+
+            #[cfg(feature = "orchard")]
+            self.orchard.add_outputs(
+                block_hash,
+                txid,
+                OrchardDomain::for_compact_action,
+                &tx.actions
+                    .iter()
+                    .enumerate()
+                    .map(|(i, action)| {
+                        CompactAction::try_from(action).map_err(|_| ScanError::EncodingInvalid {
+                            at_height: block_height,
+                            txid,
+                            pool_type: ShieldedProtocol::Orchard,
+                            index: i,
+                        })
+                    })
+                    .collect::<Result<Vec<_>, _>>()?,
+            );
+        }
+
+        Ok(())
+    }
+}
+
+#[tracing::instrument(skip_all, fields(height = block.height))]
+pub(crate) fn scan_block_with_runners<P, AccountId, IvkTag, TS, TO>(
+    params: &P,
+    block: CompactBlock,
+    scanning_keys: &ScanningKeys<AccountId, IvkTag>,
+    nullifiers: &Nullifiers<AccountId>,
+    prior_block_metadata: Option<&BlockMetadata>,
+    mut batch_runners: Option<&mut BatchRunners<IvkTag, TS, TO>>,
+) -> Result<ScannedBlock<AccountId>, ScanError>
+where
+    P: consensus::Parameters + Send + 'static,
+    AccountId: Default + Eq + Hash + ConditionallySelectable + Send + 'static,
+    IvkTag: Copy + std::hash::Hash + Eq + Send + 'static,
+    TS: SaplingTasks<IvkTag> + Sync,
+    TO: OrchardTasks<IvkTag> + Sync,
+{
+    fn check_hash_continuity(
+        block: &CompactBlock,
+        prior_block_metadata: Option<&BlockMetadata>,
+    ) -> Option<ScanError> {
+        if let Some(prev) = prior_block_metadata {
+            if block.height() != prev.block_height() + 1 {
+                debug!(
+                    "Block height discontinuity at {:?}, previous was {:?} ",
+                    block.height(),
+                    prev.block_height()
+                );
+                return Some(ScanError::BlockHeightDiscontinuity {
+                    prev_height: prev.block_height(),
+                    new_height: block.height(),
+                });
+            }
+
+            if block.prev_hash() != prev.block_hash() {
+                debug!("Block hash discontinuity at {:?}", block.height());
+                return Some(ScanError::PrevHashMismatch {
+                    at_height: block.height(),
+                });
+            }
+        }
+
+        None
+    }
+
+    if let Some(scan_error) = check_hash_continuity(&block, prior_block_metadata) {
+        return Err(scan_error);
+    }
+
+    trace!("Block continuity okay at {:?}", block.height());
+
+    let cur_height = block.height();
+    let cur_hash = block.hash();
+    let zip212_enforcement = zip212_enforcement(params, cur_height);
+
+    let mut sapling_commitment_tree_size = prior_block_metadata
+        .and_then(|m| m.sapling_tree_size())
+        .map_or_else(
+            || {
+                block.chain_metadata.as_ref().map_or_else(
+                    || {
+                        // If we're below Sapling activation, or Sapling activation is not set, the tree size is zero
+                        params
+                            .activation_height(NetworkUpgrade::Sapling)
+                            .map_or_else(
+                                || Ok(0),
+                                |sapling_activation| {
+                                    if cur_height < sapling_activation {
+                                        Ok(0)
+                                    } else {
+                                        Err(ScanError::TreeSizeUnknown {
+                                            protocol: ShieldedProtocol::Sapling,
+                                            at_height: cur_height,
+                                        })
+                                    }
+                                },
+                            )
+                    },
+                    |m| {
+                        let sapling_output_count: u32 = block
+                            .vtx
+                            .iter()
+                            .map(|tx| tx.outputs.len())
+                            .sum::<usize>()
+                            .try_into()
+                            .expect("Sapling output count cannot exceed a u32");
+
+                        // The default for m.sapling_commitment_tree_size is zero, so we need to check
+                        // that the subtraction will not underflow; if it would do so, we were given
+                        // invalid chain metadata for a block with Sapling outputs.
+                        m.sapling_commitment_tree_size
+                            .checked_sub(sapling_output_count)
+                            .ok_or(ScanError::TreeSizeInvalid {
+                                protocol: ShieldedProtocol::Sapling,
+                                at_height: cur_height,
+                            })
+                    },
+                )
+            },
+            Ok,
+        )?;
+    let sapling_final_tree_size = sapling_commitment_tree_size
+        + block
+            .vtx
+            .iter()
+            .map(|tx| u32::try_from(tx.outputs.len()).unwrap())
+            .sum::<u32>();
+
+    #[cfg(feature = "orchard")]
+    let mut orchard_commitment_tree_size = prior_block_metadata
+        .and_then(|m| m.orchard_tree_size())
+        .map_or_else(
+            || {
+                block.chain_metadata.as_ref().map_or_else(
+                    || {
+                        // If we're below Orchard activation, or Orchard activation is not set, the tree size is zero
+                        params.activation_height(NetworkUpgrade::Nu5).map_or_else(
+                            || Ok(0),
+                            |orchard_activation| {
+                                if cur_height < orchard_activation {
+                                    Ok(0)
+                                } else {
+                                    Err(ScanError::TreeSizeUnknown {
+                                        protocol: ShieldedProtocol::Orchard,
+                                        at_height: cur_height,
+                                    })
+                                }
+                            },
+                        )
+                    },
+                    |m| {
+                        let orchard_action_count: u32 = block
+                            .vtx
+                            .iter()
+                            .map(|tx| tx.actions.len())
+                            .sum::<usize>()
+                            .try_into()
+                            .expect("Orchard action count cannot exceed a u32");
+
+                        // The default for m.orchard_commitment_tree_size is zero, so we need to check
+                        // that the subtraction will not underflow; if it would do so, we were given
+                        // invalid chain metadata for a block with Orchard actions.
+                        m.orchard_commitment_tree_size
+                            .checked_sub(orchard_action_count)
+                            .ok_or(ScanError::TreeSizeInvalid {
+                                protocol: ShieldedProtocol::Orchard,
+                                at_height: cur_height,
+                            })
+                    },
+                )
+            },
+            Ok,
+        )?;
+    #[cfg(feature = "orchard")]
+    let orchard_final_tree_size = orchard_commitment_tree_size
+        + block
+            .vtx
+            .iter()
+            .map(|tx| u32::try_from(tx.actions.len()).unwrap())
+            .sum::<u32>();
+
+    let mut wtxs: Vec<WalletTx<AccountId>> = vec![];
+    let mut sapling_nullifier_map = Vec::with_capacity(block.vtx.len());
+    let mut sapling_note_commitments: Vec<(sapling::Node, Retention<BlockHeight>)> = vec![];
+
+    #[cfg(feature = "orchard")]
+    let mut orchard_nullifier_map = Vec::with_capacity(block.vtx.len());
+    #[cfg(feature = "orchard")]
+    let mut orchard_note_commitments: Vec<(MerkleHashOrchard, Retention<BlockHeight>)> = vec![];
+
+    for tx in block.vtx.into_iter() {
+        let txid = tx.txid();
+        let tx_index =
+            u16::try_from(tx.index).expect("Cannot fit more than 2^16 transactions in a block");
+
+        let (sapling_spends, sapling_unlinked_nullifiers) = find_spent(
+            &tx.spends,
+            &nullifiers.sapling,
+            |spend| {
+                spend.nf().expect(
+                    "Could not deserialize nullifier for spend from protobuf representation.",
+                )
+            },
+            WalletSpend::from_parts,
+        );
+
+        sapling_nullifier_map.push((txid, tx_index, sapling_unlinked_nullifiers));
+
+        #[cfg(feature = "orchard")]
+        let orchard_spends = {
+            let (orchard_spends, orchard_unlinked_nullifiers) = find_spent(
+                &tx.actions,
+                &nullifiers.orchard,
+                |spend| {
+                    spend.nf().expect(
+                        "Could not deserialize nullifier for spend from protobuf representation.",
+                    )
+                },
+                WalletSpend::from_parts,
+            );
+            orchard_nullifier_map.push((txid, tx_index, orchard_unlinked_nullifiers));
+            orchard_spends
+        };
+
+        // Collect the set of accounts that were spent from in this transaction
+        let spent_from_accounts = sapling_spends.iter().map(|spend| spend.account_id());
+        #[cfg(feature = "orchard")]
+        let spent_from_accounts =
+            spent_from_accounts.chain(orchard_spends.iter().map(|spend| spend.account_id()));
+        let spent_from_accounts = spent_from_accounts.copied().collect::<HashSet<_>>();
+
+        let (sapling_outputs, mut sapling_nc) = find_received(
+            cur_height,
+            sapling_final_tree_size
+                == sapling_commitment_tree_size + u32::try_from(tx.outputs.len()).unwrap(),
+            txid,
+            sapling_commitment_tree_size,
+            &scanning_keys.sapling,
+            &spent_from_accounts,
+            &tx.outputs
+                .iter()
+                .enumerate()
+                .map(|(i, output)| {
+                    Ok((
+                        SaplingDomain::new(zip212_enforcement),
+                        CompactOutputDescription::try_from(output).map_err(|_| {
+                            ScanError::EncodingInvalid {
+                                at_height: cur_height,
+                                txid,
+                                pool_type: ShieldedProtocol::Sapling,
+                                index: i,
+                            }
+                        })?,
+                    ))
+                })
+                .collect::<Result<Vec<_>, _>>()?,
+            batch_runners
+                .as_mut()
+                .map(|runners| |txid| runners.sapling.collect_results(cur_hash, txid)),
+            |output| sapling::Node::from_cmu(&output.cmu),
+        );
+        sapling_note_commitments.append(&mut sapling_nc);
+        let has_sapling = !(sapling_spends.is_empty() && sapling_outputs.is_empty());
+
+        #[cfg(feature = "orchard")]
+        let (orchard_outputs, mut orchard_nc) = find_received(
+            cur_height,
+            orchard_final_tree_size
+                == orchard_commitment_tree_size + u32::try_from(tx.actions.len()).unwrap(),
+            txid,
+            orchard_commitment_tree_size,
+            &scanning_keys.orchard,
+            &spent_from_accounts,
+            &tx.actions
+                .iter()
+                .enumerate()
+                .map(|(i, action)| {
+                    let action = CompactAction::try_from(action).map_err(|_| {
+                        ScanError::EncodingInvalid {
+                            at_height: cur_height,
+                            txid,
+                            pool_type: ShieldedProtocol::Orchard,
+                            index: i,
+                        }
+                    })?;
+                    Ok((OrchardDomain::for_compact_action(&action), action))
+                })
+                .collect::<Result<Vec<_>, _>>()?,
+            batch_runners
+                .as_mut()
+                .map(|runners| |txid| runners.orchard.collect_results(cur_hash, txid)),
+            |output| MerkleHashOrchard::from_cmx(&output.cmx()),
+        );
+        #[cfg(feature = "orchard")]
+        orchard_note_commitments.append(&mut orchard_nc);
+
+        #[cfg(feature = "orchard")]
+        let has_orchard = !(orchard_spends.is_empty() && orchard_outputs.is_empty());
+        #[cfg(not(feature = "orchard"))]
+        let has_orchard = false;
+
+        if has_sapling || has_orchard {
+            wtxs.push(WalletTx::new(
+                txid,
+                tx_index as usize,
+                sapling_spends,
+                sapling_outputs,
+                #[cfg(feature = "orchard")]
+                orchard_spends,
+                #[cfg(feature = "orchard")]
+                orchard_outputs,
+            ));
+        }
+
+        sapling_commitment_tree_size +=
+            u32::try_from(tx.outputs.len()).expect("Sapling output count cannot exceed a u32");
+        #[cfg(feature = "orchard")]
+        {
+            orchard_commitment_tree_size +=
+                u32::try_from(tx.actions.len()).expect("Orchard action count cannot exceed a u32");
+        }
+    }
+
+    if let Some(chain_meta) = block.chain_metadata {
+        if chain_meta.sapling_commitment_tree_size != sapling_commitment_tree_size {
+            return Err(ScanError::TreeSizeMismatch {
+                protocol: ShieldedProtocol::Sapling,
+                at_height: cur_height,
+                given: chain_meta.sapling_commitment_tree_size,
+                computed: sapling_commitment_tree_size,
+            });
+        }
+
+        #[cfg(feature = "orchard")]
+        if chain_meta.orchard_commitment_tree_size != orchard_commitment_tree_size {
+            return Err(ScanError::TreeSizeMismatch {
+                protocol: ShieldedProtocol::Orchard,
+                at_height: cur_height,
+                given: chain_meta.orchard_commitment_tree_size,
+                computed: orchard_commitment_tree_size,
+            });
+        }
+    }
+
+    Ok(ScannedBlock::from_parts(
+        cur_height,
+        cur_hash,
+        block.time,
+        wtxs,
+        ScannedBundles::new(
+            sapling_commitment_tree_size,
+            sapling_note_commitments,
+            sapling_nullifier_map,
+        ),
+        #[cfg(feature = "orchard")]
+        ScannedBundles::new(
+            orchard_commitment_tree_size,
+            orchard_note_commitments,
+            orchard_nullifier_map,
+        ),
+    ))
+}
+
+/// Check for spent notes. The comparison against known-unspent nullifiers is done
+/// in constant time.
+fn find_spent<
+    AccountId: ConditionallySelectable + Default,
+    Spend,
+    Nf: ConstantTimeEq + Copy,
+    WS,
+>(
+    spends: &[Spend],
+    nullifiers: &[(AccountId, Nf)],
+    extract_nf: impl Fn(&Spend) -> Nf,
+    construct_wallet_spend: impl Fn(usize, Nf, AccountId) -> WS,
+) -> (Vec<WS>, Vec<Nf>) {
+    // TODO: this is O(|nullifiers| * |notes|); does using constant-time operations here really
+    // make sense?
+    let mut found_spent = vec![];
+    let mut unlinked_nullifiers = Vec::with_capacity(spends.len());
+    for (index, spend) in spends.iter().enumerate() {
+        let spend_nf = extract_nf(spend);
+
+        // Find whether any tracked nullifier that matches this spend, and produce a
+        // WalletShieldedSpend in constant time.
+        let ct_spend = nullifiers
+            .iter()
+            .map(|&(account, nf)| CtOption::new(account, nf.ct_eq(&spend_nf)))
+            .fold(
+                CtOption::new(AccountId::default(), 0.into()),
+                |first, next| CtOption::conditional_select(&next, &first, first.is_some()),
+            )
+            .map(|account| construct_wallet_spend(index, spend_nf, account));
+
+        if let Some(spend) = ct_spend.into() {
+            found_spent.push(spend);
+        } else {
+            // This nullifier didn't match any we are currently tracking; save it in
+            // case it matches an earlier block range we haven't scanned yet.
+            unlinked_nullifiers.push(spend_nf);
+        }
+    }
+
+    (found_spent, unlinked_nullifiers)
+}
+
+#[allow(clippy::too_many_arguments)]
+#[allow(clippy::type_complexity)]
+fn find_received<
+    AccountId: Copy + Eq + Hash,
+    D: BatchDomain,
+    Nf,
+    IvkTag: Copy + std::hash::Hash + Eq + Send + 'static,
+    SK: ScanningKeyOps<D, AccountId, Nf>,
+    Output: ShieldedOutput<D, COMPACT_NOTE_SIZE>,
+    NoteCommitment,
+>(
+    block_height: BlockHeight,
+    last_commitments_in_block: bool,
+    txid: TxId,
+    commitment_tree_size: u32,
+    keys: &HashMap<IvkTag, SK>,
+    spent_from_accounts: &HashSet<AccountId>,
+    decoded: &[(D, Output)],
+    batch_results: Option<
+        impl FnOnce(TxId) -> HashMap<(TxId, usize), DecryptedOutput<IvkTag, D, ()>>,
+    >,
+    extract_note_commitment: impl Fn(&Output) -> NoteCommitment,
+) -> (
+    Vec<WalletOutput<D::Note, Nf, AccountId>>,
+    Vec<(NoteCommitment, Retention<BlockHeight>)>,
+) {
+    // Check for incoming notes while incrementing tree and witnesses
+    let (decrypted_opts, decrypted_len) = if let Some(collect_results) = batch_results {
+        let mut decrypted = collect_results(txid);
+        let decrypted_len = decrypted.len();
+        (
+            (0..decoded.len())
+                .map(|i| {
+                    decrypted
+                        .remove(&(txid, i))
+                        .map(|d_out| (d_out.ivk_tag, d_out.note))
+                })
+                .collect::<Vec<_>>(),
+            decrypted_len,
+        )
+    } else {
+        let mut ivks = Vec::with_capacity(keys.len());
+        let mut ivk_lookup = Vec::with_capacity(keys.len());
+        for (key_id, key) in keys.iter() {
+            ivks.push(key.prepare());
+            ivk_lookup.push(key_id);
+        }
+
+        let mut decrypted_len = 0;
+        (
+            batch::try_compact_note_decryption(&ivks, decoded)
+                .into_iter()
+                .map(|v| {
+                    v.map(|((note, _), ivk_idx)| {
+                        decrypted_len += 1;
+                        (*ivk_lookup[ivk_idx], note)
+                    })
+                })
+                .collect::<Vec<_>>(),
+            decrypted_len,
+        )
+    };
+
+    let mut shielded_outputs = Vec::with_capacity(decrypted_len);
+    let mut note_commitments = Vec::with_capacity(decoded.len());
+    for (output_idx, ((_, output), decrypted_note)) in
+        decoded.iter().zip(decrypted_opts).enumerate()
+    {
+        // Collect block note commitments
+        let node = extract_note_commitment(output);
+        // If the commitment is the last in the block, ensure that is retained as a checkpoint
+        let is_checkpoint = output_idx + 1 == decoded.len() && last_commitments_in_block;
+        let retention = match (decrypted_note.is_some(), is_checkpoint) {
+            (is_marked, true) => Retention::Checkpoint {
+                id: block_height,
+                marking: if is_marked {
+                    Marking::Marked
+                } else {
+                    Marking::None
+                },
+            },
+            (true, false) => Retention::Marked,
+            (false, false) => Retention::Ephemeral,
+        };
+
+        if let Some((key_id, note)) = decrypted_note {
+            let key = keys
+                .get(&key_id)
+                .expect("Key is available for decrypted output");
+
+            // A note is marked as "change" if the account that received it
+            // also spent notes in the same transaction. This will catch,
+            // for instance:
+            // - Change created by spending fractions of notes.
+            // - Notes created by consolidation transactions.
+            // - Notes sent from one account to itself.
+            let is_change = spent_from_accounts.contains(key.account_id());
+            let note_commitment_tree_position = Position::from(u64::from(
+                commitment_tree_size + u32::try_from(output_idx).unwrap(),
+            ));
+            let nf = key.nf(&note, note_commitment_tree_position);
+
+            shielded_outputs.push(WalletOutput::from_parts(
+                output_idx,
+                output.ephemeral_key(),
+                note,
+                is_change,
+                note_commitment_tree_position,
+                nf,
+                *key.account_id(),
+                key.key_scope(),
+            ));
+        }
+
+        note_commitments.push((node, retention))
+    }
+
+    (shielded_outputs, note_commitments)
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod testing {
+    use group::{
+        ff::{Field, PrimeField},
+        GroupEncoding,
+    };
+    use rand_core::{OsRng, RngCore};
+    use sapling::{
+        constants::SPENDING_KEY_GENERATOR,
+        note_encryption::{sapling_note_encryption, SaplingDomain},
+        util::generate_random_rseed,
+        value::NoteValue,
+        zip32::DiversifiableFullViewingKey,
+        Nullifier,
+    };
+    use zcash_note_encryption::{Domain, COMPACT_NOTE_SIZE};
+    use zcash_primitives::{
+        block::BlockHash,
+        consensus::{BlockHeight, Network},
+        memo::MemoBytes,
+        transaction::components::{amount::NonNegativeAmount, sapling::zip212_enforcement},
+    };
+
+    use crate::proto::compact_formats::{
+        self as compact, CompactBlock, CompactSaplingOutput, CompactSaplingSpend, CompactTx,
+    };
+
+    fn random_compact_tx(mut rng: impl RngCore) -> CompactTx {
+        let fake_nf = {
+            let mut nf = vec![0; 32];
+            rng.fill_bytes(&mut nf);
+            nf
+        };
+        let fake_cmu = {
+            let fake_cmu = bls12_381::Scalar::random(&mut rng);
+            fake_cmu.to_repr().as_ref().to_owned()
+        };
+        let fake_epk = {
+            let mut buffer = [0; 64];
+            rng.fill_bytes(&mut buffer);
+            let fake_esk = jubjub::Fr::from_bytes_wide(&buffer);
+            let fake_epk = SPENDING_KEY_GENERATOR * fake_esk;
+            fake_epk.to_bytes().to_vec()
+        };
+        let cspend = CompactSaplingSpend { nf: fake_nf };
+        let cout = CompactSaplingOutput {
+            cmu: fake_cmu,
+            ephemeral_key: fake_epk,
+            ciphertext: vec![0; COMPACT_NOTE_SIZE],
+        };
+        let mut ctx = CompactTx::default();
+        let mut txid = vec![0; 32];
+        rng.fill_bytes(&mut txid);
+        ctx.hash = txid;
+        ctx.spends.push(cspend);
+        ctx.outputs.push(cout);
+        ctx
+    }
+
+    /// Create a fake CompactBlock at the given height, with a transaction containing a
+    /// single spend of the given nullifier and a single output paying the given address.
+    /// Returns the CompactBlock.
+    ///
+    /// Set `initial_tree_sizes` to `None` to simulate a `CompactBlock` retrieved
+    /// from a `lightwalletd` that is not currently tracking note commitment tree sizes.
+    pub fn fake_compact_block(
+        height: BlockHeight,
+        prev_hash: BlockHash,
+        nf: Nullifier,
+        dfvk: &DiversifiableFullViewingKey,
+        value: NonNegativeAmount,
+        tx_after: bool,
+        initial_tree_sizes: Option<(u32, u32)>,
+    ) -> CompactBlock {
+        let zip212_enforcement = zip212_enforcement(&Network::TestNetwork, height);
+        let to = dfvk.default_address().1;
+
+        // Create a fake Note for the account
+        let mut rng = OsRng;
+        let rseed = generate_random_rseed(zip212_enforcement, &mut rng);
+        let note = sapling::Note::from_parts(to, NoteValue::from_raw(value.into()), rseed);
+        let encryptor = sapling_note_encryption(
+            Some(dfvk.fvk().ovk),
+            note.clone(),
+            *MemoBytes::empty().as_array(),
+            &mut rng,
+        );
+        let cmu = note.cmu().to_bytes().to_vec();
+        let ephemeral_key = SaplingDomain::epk_bytes(encryptor.epk()).0.to_vec();
+        let enc_ciphertext = encryptor.encrypt_note_plaintext();
+
+        // Create a fake CompactBlock containing the note
+        let mut cb = CompactBlock {
+            hash: {
+                let mut hash = vec![0; 32];
+                rng.fill_bytes(&mut hash);
+                hash
+            },
+            prev_hash: prev_hash.0.to_vec(),
+            height: height.into(),
+            ..Default::default()
+        };
+
+        // Add a random Sapling tx before ours
+        {
+            let mut tx = random_compact_tx(&mut rng);
+            tx.index = cb.vtx.len() as u64;
+            cb.vtx.push(tx);
+        }
+
+        let cspend = CompactSaplingSpend { nf: nf.0.to_vec() };
+        let cout = CompactSaplingOutput {
+            cmu,
+            ephemeral_key,
+            ciphertext: enc_ciphertext.as_ref()[..52].to_vec(),
+        };
+        let mut ctx = CompactTx::default();
+        let mut txid = vec![0; 32];
+        rng.fill_bytes(&mut txid);
+        ctx.hash = txid;
+        ctx.spends.push(cspend);
+        ctx.outputs.push(cout);
+        ctx.index = cb.vtx.len() as u64;
+        cb.vtx.push(ctx);
+
+        // Optionally add another random Sapling tx after ours
+        if tx_after {
+            let mut tx = random_compact_tx(&mut rng);
+            tx.index = cb.vtx.len() as u64;
+            cb.vtx.push(tx);
+        }
+
+        cb.chain_metadata =
+            initial_tree_sizes.map(|(initial_sapling_tree_size, initial_orchard_tree_size)| {
+                compact::ChainMetadata {
+                    sapling_commitment_tree_size: initial_sapling_tree_size
+                        + cb.vtx.iter().map(|tx| tx.outputs.len() as u32).sum::<u32>(),
+                    orchard_commitment_tree_size: initial_orchard_tree_size
+                        + cb.vtx.iter().map(|tx| tx.actions.len() as u32).sum::<u32>(),
+                }
+            });
+
+        cb
+    }
+}
+
+#[cfg(test)]
+mod tests {
+
+    use std::convert::Infallible;
+
+    use incrementalmerkletree::{Marking, Position, Retention};
+    use sapling::Nullifier;
+    use zcash_keys::keys::UnifiedSpendingKey;
+    use zcash_primitives::{
+        block::BlockHash,
+        consensus::{BlockHeight, Network},
+        transaction::components::amount::NonNegativeAmount,
+        zip32::AccountId,
+    };
+
+    use crate::{
+        data_api::BlockMetadata,
+        scanning::{BatchRunners, ScanningKeys},
+    };
+
+    use super::{scan_block, scan_block_with_runners, testing::fake_compact_block, Nullifiers};
+
+    #[test]
+    fn scan_block_with_my_tx() {
+        fn go(scan_multithreaded: bool) {
+            let network = Network::TestNetwork;
+            let account = AccountId::ZERO;
+            let usk =
+                UnifiedSpendingKey::from_seed(&network, &[0u8; 32], account).expect("Valid USK");
+            let ufvk = usk.to_unified_full_viewing_key();
+            let sapling_dfvk = ufvk.sapling().expect("Sapling key is present").clone();
+            let scanning_keys = ScanningKeys::from_account_ufvks([(account, ufvk)]);
+
+            let cb = fake_compact_block(
+                1u32.into(),
+                BlockHash([0; 32]),
+                Nullifier([0; 32]),
+                &sapling_dfvk,
+                NonNegativeAmount::const_from_u64(5),
+                false,
+                None,
+            );
+            assert_eq!(cb.vtx.len(), 2);
+
+            let mut batch_runners = if scan_multithreaded {
+                let mut runners = BatchRunners::<_, (), ()>::for_keys(10, &scanning_keys);
+                runners
+                    .add_block(&Network::TestNetwork, cb.clone())
+                    .unwrap();
+                runners.flush();
+
+                Some(runners)
+            } else {
+                None
+            };
+
+            let scanned_block = scan_block_with_runners(
+                &network,
+                cb,
+                &scanning_keys,
+                &Nullifiers::empty(),
+                Some(&BlockMetadata::from_parts(
+                    BlockHeight::from(0),
+                    BlockHash([0u8; 32]),
+                    Some(0),
+                    #[cfg(feature = "orchard")]
+                    Some(0),
+                )),
+                batch_runners.as_mut(),
+            )
+            .unwrap();
+            let txs = scanned_block.transactions();
+            assert_eq!(txs.len(), 1);
+
+            let tx = &txs[0];
+            assert_eq!(tx.block_index(), 1);
+            assert_eq!(tx.sapling_spends().len(), 0);
+            assert_eq!(tx.sapling_outputs().len(), 1);
+            assert_eq!(tx.sapling_outputs()[0].index(), 0);
+            assert_eq!(tx.sapling_outputs()[0].account_id(), &account);
+            assert_eq!(tx.sapling_outputs()[0].note().value().inner(), 5);
+            assert_eq!(
+                tx.sapling_outputs()[0].note_commitment_tree_position(),
+                Position::from(1)
+            );
+
+            assert_eq!(scanned_block.sapling().final_tree_size(), 2);
+            assert_eq!(
+                scanned_block
+                    .sapling()
+                    .commitments()
+                    .iter()
+                    .map(|(_, retention)| *retention)
+                    .collect::<Vec<_>>(),
+                vec![
+                    Retention::Ephemeral,
+                    Retention::Checkpoint {
+                        id: scanned_block.height(),
+                        marking: Marking::Marked
+                    }
+                ]
+            );
+        }
+
+        go(false);
+        go(true);
+    }
+
+    #[test]
+    fn scan_block_with_txs_after_my_tx() {
+        fn go(scan_multithreaded: bool) {
+            let network = Network::TestNetwork;
+            let account = AccountId::ZERO;
+            let usk =
+                UnifiedSpendingKey::from_seed(&network, &[0u8; 32], account).expect("Valid USK");
+            let ufvk = usk.to_unified_full_viewing_key();
+            let sapling_dfvk = ufvk.sapling().expect("Sapling key is present").clone();
+            let scanning_keys = ScanningKeys::from_account_ufvks([(account, ufvk)]);
+
+            let cb = fake_compact_block(
+                1u32.into(),
+                BlockHash([0; 32]),
+                Nullifier([0; 32]),
+                &sapling_dfvk,
+                NonNegativeAmount::const_from_u64(5),
+                true,
+                Some((0, 0)),
+            );
+            assert_eq!(cb.vtx.len(), 3);
+
+            let mut batch_runners = if scan_multithreaded {
+                let mut runners = BatchRunners::<_, (), ()>::for_keys(10, &scanning_keys);
+                runners
+                    .add_block(&Network::TestNetwork, cb.clone())
+                    .unwrap();
+                runners.flush();
+
+                Some(runners)
+            } else {
+                None
+            };
+
+            let scanned_block = scan_block_with_runners(
+                &network,
+                cb,
+                &scanning_keys,
+                &Nullifiers::empty(),
+                None,
+                batch_runners.as_mut(),
+            )
+            .unwrap();
+            let txs = scanned_block.transactions();
+            assert_eq!(txs.len(), 1);
+
+            let tx = &txs[0];
+            assert_eq!(tx.block_index(), 1);
+            assert_eq!(tx.sapling_spends().len(), 0);
+            assert_eq!(tx.sapling_outputs().len(), 1);
+            assert_eq!(tx.sapling_outputs()[0].index(), 0);
+            assert_eq!(tx.sapling_outputs()[0].account_id(), &AccountId::ZERO);
+            assert_eq!(tx.sapling_outputs()[0].note().value().inner(), 5);
+
+            assert_eq!(
+                scanned_block
+                    .sapling()
+                    .commitments()
+                    .iter()
+                    .map(|(_, retention)| *retention)
+                    .collect::<Vec<_>>(),
+                vec![
+                    Retention::Ephemeral,
+                    Retention::Marked,
+                    Retention::Checkpoint {
+                        id: scanned_block.height(),
+                        marking: Marking::None
+                    }
+                ]
+            );
+        }
+
+        go(false);
+        go(true);
+    }
+
+    #[test]
+    fn scan_block_with_my_spend() {
+        let network = Network::TestNetwork;
+        let account = AccountId::try_from(12).unwrap();
+        let usk = UnifiedSpendingKey::from_seed(&network, &[0u8; 32], account).expect("Valid USK");
+        let ufvk = usk.to_unified_full_viewing_key();
+        let scanning_keys = ScanningKeys::<AccountId, Infallible>::empty();
+
+        let nf = Nullifier([7; 32]);
+        let nullifiers = Nullifiers::new(
+            vec![(account, nf)],
+            #[cfg(feature = "orchard")]
+            vec![],
+        );
+
+        let cb = fake_compact_block(
+            1u32.into(),
+            BlockHash([0; 32]),
+            nf,
+            ufvk.sapling().unwrap(),
+            NonNegativeAmount::const_from_u64(5),
+            false,
+            Some((0, 0)),
+        );
+        assert_eq!(cb.vtx.len(), 2);
+
+        let scanned_block = scan_block(&network, cb, &scanning_keys, &nullifiers, None).unwrap();
+        let txs = scanned_block.transactions();
+        assert_eq!(txs.len(), 1);
+
+        let tx = &txs[0];
+        assert_eq!(tx.block_index(), 1);
+        assert_eq!(tx.sapling_spends().len(), 1);
+        assert_eq!(tx.sapling_outputs().len(), 0);
+        assert_eq!(tx.sapling_spends()[0].index(), 0);
+        assert_eq!(tx.sapling_spends()[0].nf(), &nf);
+        assert_eq!(tx.sapling_spends()[0].account_id(), &account);
+
+        assert_eq!(
+            scanned_block
+                .sapling()
+                .commitments()
+                .iter()
+                .map(|(_, retention)| *retention)
+                .collect::<Vec<_>>(),
+            vec![
+                Retention::Ephemeral,
+                Retention::Checkpoint {
+                    id: scanned_block.height(),
+                    marking: Marking::None
+                }
+            ]
+        );
+    }
+}
diff --git a/zcash_client_backend/src/serialization.rs b/zcash_client_backend/src/serialization.rs
new file mode 100644
index 0000000000..b11d1cb24e
--- /dev/null
+++ b/zcash_client_backend/src/serialization.rs
@@ -0,0 +1 @@
+pub mod shardtree;
diff --git a/zcash_client_backend/src/serialization/shardtree.rs b/zcash_client_backend/src/serialization/shardtree.rs
new file mode 100644
index 0000000000..a847d8672f
--- /dev/null
+++ b/zcash_client_backend/src/serialization/shardtree.rs
@@ -0,0 +1,120 @@
+//! Serialization formats for data stored as SQLite BLOBs
+
+use byteorder::{ReadBytesExt, WriteBytesExt};
+use core::ops::Deref;
+use shardtree::{Node, PrunableTree, RetentionFlags, Tree};
+use std::io::{self, Read, Write};
+use std::sync::Arc;
+use zcash_encoding::Optional;
+use zcash_primitives::merkle_tree::HashSer;
+
+const SER_V1: u8 = 1;
+
+const NIL_TAG: u8 = 0;
+const LEAF_TAG: u8 = 1;
+const PARENT_TAG: u8 = 2;
+
+/// Writes a [`PrunableTree`] to the provided [`Write`] instance.
+///
+/// This is the primary method used for ShardTree shard persistence. It writes a version identifier
+/// for the most-current serialized form, followed by the tree data.
+pub fn write_shard<H: HashSer, W: Write>(writer: &mut W, tree: &PrunableTree<H>) -> io::Result<()> {
+    fn write_inner<H: HashSer, W: Write>(
+        mut writer: &mut W,
+        tree: &PrunableTree<H>,
+    ) -> io::Result<()> {
+        match tree.deref() {
+            Node::Parent { ann, left, right } => {
+                writer.write_u8(PARENT_TAG)?;
+                Optional::write(&mut writer, ann.as_ref(), |w, h| {
+                    <H as HashSer>::write(h, w)
+                })?;
+                write_inner(writer, left)?;
+                write_inner(writer, right)?;
+                Ok(())
+            }
+            Node::Leaf { value } => {
+                writer.write_u8(LEAF_TAG)?;
+                value.0.write(&mut writer)?;
+                writer.write_u8(value.1.bits())?;
+                Ok(())
+            }
+            Node::Nil => {
+                writer.write_u8(NIL_TAG)?;
+                Ok(())
+            }
+        }
+    }
+
+    writer.write_u8(SER_V1)?;
+    write_inner(writer, tree)
+}
+
+fn read_shard_v1<H: HashSer, R: Read>(mut reader: &mut R) -> io::Result<PrunableTree<H>> {
+    match reader.read_u8()? {
+        PARENT_TAG => {
+            let ann = Optional::read(&mut reader, <H as HashSer>::read)?.map(Arc::new);
+            let left = read_shard_v1(reader)?;
+            let right = read_shard_v1(reader)?;
+            Ok(Tree::parent(ann, left, right))
+        }
+        LEAF_TAG => {
+            let value = <H as HashSer>::read(&mut reader)?;
+            let flags = reader.read_u8().and_then(|bits| {
+                RetentionFlags::from_bits(bits).ok_or_else(|| {
+                    io::Error::new(
+                        io::ErrorKind::InvalidData,
+                        format!(
+                            "Byte value {} does not correspond to a valid set of retention flags",
+                            bits
+                        ),
+                    )
+                })
+            })?;
+            Ok(Tree::leaf((value, flags)))
+        }
+        NIL_TAG => Ok(Tree::empty()),
+        other => Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("Node tag not recognized: {}", other),
+        )),
+    }
+}
+
+/// Reads a [`PrunableTree`] from the provided [`Read`] instance.
+///
+/// This function operates by first parsing a 1-byte version identifier, and then dispatching to
+/// the correct deserialization function for the observed version, or returns an
+/// [`io::ErrorKind::InvalidData`] error in the case that the version is not recognized.
+pub fn read_shard<H: HashSer, R: Read>(mut reader: R) -> io::Result<PrunableTree<H>> {
+    match reader.read_u8()? {
+        SER_V1 => read_shard_v1(&mut reader),
+        other => Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("Shard serialization version not recognized: {}", other),
+        )),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use incrementalmerkletree::frontier::testing::{arb_test_node, TestNode};
+    use proptest::prelude::*;
+    use shardtree::testing::arb_prunable_tree;
+    use std::io::Cursor;
+
+    use super::{read_shard, write_shard};
+
+    proptest! {
+        #[test]
+        fn check_shard_roundtrip(
+            tree in arb_prunable_tree(arb_test_node(), 8, 32)
+        ) {
+            let mut tree_data = vec![];
+            write_shard(&mut tree_data, &tree).unwrap();
+            let cursor = Cursor::new(tree_data);
+            let tree_result = read_shard::<TestNode, _>(cursor).unwrap();
+            assert_eq!(tree, tree_result);
+        }
+    }
+}
diff --git a/zcash_client_backend/src/sync.rs b/zcash_client_backend/src/sync.rs
new file mode 100644
index 0000000000..2ddce5fbec
--- /dev/null
+++ b/zcash_client_backend/src/sync.rs
@@ -0,0 +1,629 @@
+//! Implementation of the synchronization flow described in the crate root.
+//!
+//! This is currently a simple implementation that does not yet implement a few features:
+//!
+//! - Block batches are not downloaded in parallel with scanning.
+//! - Transactions are not enhanced once detected (that is, after an output is detected in
+//!   a transaction, the full transaction is not downloaded and scanned).
+//! - There is no mechanism for notifying the caller of progress updates.
+//! - There is no mechanism for interrupting the synchronization flow, other than ending
+//!   the process.
+
+use std::fmt;
+
+use futures_util::TryStreamExt;
+use shardtree::error::ShardTreeError;
+use subtle::ConditionallySelectable;
+use tonic::{
+    body::BoxBody,
+    client::GrpcService,
+    codegen::{Body, Bytes, StdError},
+};
+use tracing::{debug, info};
+use zcash_primitives::{
+    consensus::{BlockHeight, Parameters},
+    merkle_tree::HashSer,
+};
+
+use crate::{
+    data_api::{
+        chain::{
+            error::Error as ChainError, scan_cached_blocks, BlockCache, ChainState,
+            CommitmentTreeRoot,
+        },
+        scanning::{ScanPriority, ScanRange},
+        WalletCommitmentTrees, WalletRead, WalletWrite,
+    },
+    proto::service::{self, compact_tx_streamer_client::CompactTxStreamerClient, BlockId},
+    scanning::ScanError,
+};
+
+#[cfg(feature = "orchard")]
+use orchard::tree::MerkleHashOrchard;
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    crate::{encoding::AddressCodec, wallet::WalletTransparentOutput},
+    zcash_primitives::{
+        legacy::Script,
+        transaction::components::transparent::{OutPoint, TxOut},
+    },
+    zcash_protocol::{consensus::NetworkUpgrade, value::Zatoshis},
+};
+
+/// Scans the chain until the wallet is up-to-date.
+pub async fn run<P, ChT, CaT, DbT>(
+    client: &mut CompactTxStreamerClient<ChT>,
+    params: &P,
+    db_cache: &CaT,
+    db_data: &mut DbT,
+    batch_size: u32,
+) -> Result<(), Error<CaT::Error, <DbT as WalletRead>::Error, <DbT as WalletCommitmentTrees>::Error>>
+where
+    P: Parameters + Send + 'static,
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+    CaT: BlockCache,
+    CaT::Error: std::error::Error + Send + Sync + 'static,
+    DbT: WalletWrite + WalletCommitmentTrees,
+    DbT::AccountId: ConditionallySelectable + Default + Send + 'static,
+    <DbT as WalletRead>::Error: std::error::Error + Send + Sync + 'static,
+    <DbT as WalletCommitmentTrees>::Error: std::error::Error + Send + Sync + 'static,
+{
+    #[cfg(feature = "transparent-inputs")]
+    let wallet_birthday = db_data
+        .get_wallet_birthday()
+        .map_err(Error::Wallet)?
+        .unwrap_or_else(|| params.activation_height(NetworkUpgrade::Sapling).unwrap());
+
+    // 1) Download note commitment tree data from lightwalletd
+    // 2) Pass the commitment tree data to the database.
+    update_subtree_roots(client, db_data).await?;
+
+    while running(
+        client,
+        params,
+        db_cache,
+        db_data,
+        batch_size,
+        #[cfg(feature = "transparent-inputs")]
+        wallet_birthday,
+    )
+    .await?
+    {}
+
+    Ok(())
+}
+
+async fn running<P, ChT, CaT, DbT, TrErr>(
+    client: &mut CompactTxStreamerClient<ChT>,
+    params: &P,
+    db_cache: &CaT,
+    db_data: &mut DbT,
+    batch_size: u32,
+    #[cfg(feature = "transparent-inputs")] wallet_birthday: BlockHeight,
+) -> Result<bool, Error<CaT::Error, <DbT as WalletRead>::Error, TrErr>>
+where
+    P: Parameters + Send + 'static,
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+    CaT: BlockCache,
+    CaT::Error: std::error::Error + Send + Sync + 'static,
+    DbT: WalletWrite,
+    DbT::AccountId: ConditionallySelectable + Default + Send + 'static,
+    DbT::Error: std::error::Error + Send + Sync + 'static,
+{
+    // 3) Download chain tip metadata from lightwalletd
+    // 4) Notify the wallet of the updated chain tip.
+    update_chain_tip(client, db_data).await?;
+
+    // Refresh UTXOs for the accounts in the wallet. We do this before we perform
+    // any shielded scanning, to ensure that we discover any UTXOs between the old
+    // fully-scanned height and the current chain tip.
+    #[cfg(feature = "transparent-inputs")]
+    for account_id in db_data.get_account_ids().map_err(Error::Wallet)? {
+        let start_height = db_data
+            .block_fully_scanned()
+            .map_err(Error::Wallet)?
+            .map(|meta| meta.block_height())
+            .unwrap_or(wallet_birthday);
+        info!(
+            "Refreshing UTXOs for {:?} from height {}",
+            account_id, start_height,
+        );
+        refresh_utxos(params, client, db_data, account_id, start_height).await?;
+    }
+
+    // 5) Get the suggested scan ranges from the wallet database
+    let mut scan_ranges = db_data.suggest_scan_ranges().map_err(Error::Wallet)?;
+
+    // Store the handles to cached block deletions (which we spawn into separate
+    // tasks to allow us to continue downloading and scanning other ranges).
+    let mut block_deletions = vec![];
+
+    // 6) Run the following loop until the wallet's view of the chain tip as of
+    //    the previous wallet session is valid.
+    loop {
+        // If there is a range of blocks that needs to be verified, it will always
+        // be returned as the first element of the vector of suggested ranges.
+        match scan_ranges.first() {
+            Some(scan_range) if scan_range.priority() == ScanPriority::Verify => {
+                // Download the blocks in `scan_range` into the block source,
+                // overwriting any existing blocks in this range.
+                download_blocks(client, db_cache, scan_range).await?;
+
+                let chain_state =
+                    download_chain_state(client, scan_range.block_range().start - 1).await?;
+
+                // Scan the downloaded blocks and check for scanning errors that
+                // indicate the wallet's chain tip is out of sync with blockchain
+                // history.
+                let scan_ranges_updated =
+                    scan_blocks(params, db_cache, db_data, &chain_state, scan_range).await?;
+
+                // Delete the now-scanned blocks, because keeping the entire chain
+                // in CompactBlock files on disk is horrendous for the filesystem.
+                block_deletions.push(db_cache.delete(scan_range.clone()));
+
+                if scan_ranges_updated {
+                    // The suggested scan ranges have been updated, so we re-request.
+                    scan_ranges = db_data.suggest_scan_ranges().map_err(Error::Wallet)?;
+                } else {
+                    // At this point, the cache and scanned data are locally
+                    // consistent (though not necessarily consistent with the
+                    // latest chain tip - this would be discovered the next time
+                    // this codepath is executed after new blocks are received) so
+                    // we can break out of the loop.
+                    break;
+                }
+            }
+            _ => {
+                // Nothing to verify; break out of the loop
+                break;
+            }
+        }
+    }
+
+    // 7) Loop over the remaining suggested scan ranges, retrieving the requested data
+    //    and calling `scan_cached_blocks` on each range.
+    let scan_ranges = db_data.suggest_scan_ranges().map_err(Error::Wallet)?;
+    debug!("Suggested ranges: {:?}", scan_ranges);
+    for scan_range in scan_ranges.into_iter().flat_map(|r| {
+        // Limit the number of blocks we download and scan at any one time.
+        (0..).scan(r, |acc, _| {
+            if acc.is_empty() {
+                None
+            } else if let Some((cur, next)) = acc.split_at(acc.block_range().start + batch_size) {
+                *acc = next;
+                Some(cur)
+            } else {
+                let cur = acc.clone();
+                let end = acc.block_range().end;
+                *acc = ScanRange::from_parts(end..end, acc.priority());
+                Some(cur)
+            }
+        })
+    }) {
+        // Download the blocks in `scan_range` into the block source.
+        download_blocks(client, db_cache, &scan_range).await?;
+
+        let chain_state = download_chain_state(client, scan_range.block_range().start - 1).await?;
+
+        // Scan the downloaded blocks.
+        let scan_ranges_updated =
+            scan_blocks(params, db_cache, db_data, &chain_state, &scan_range).await?;
+
+        // Delete the now-scanned blocks.
+        block_deletions.push(db_cache.delete(scan_range));
+
+        if scan_ranges_updated {
+            // The suggested scan ranges have been updated (either due to a continuity
+            // error or because a higher priority range has been added).
+            info!("Waiting for cached blocks to be deleted...");
+            for deletion in block_deletions {
+                deletion.await.map_err(Error::Cache)?;
+            }
+            return Ok(true);
+        }
+    }
+
+    info!("Waiting for cached blocks to be deleted...");
+    for deletion in block_deletions {
+        deletion.await.map_err(Error::Cache)?;
+    }
+    Ok(false)
+}
+
+async fn update_subtree_roots<ChT, DbT, CaErr, DbErr>(
+    client: &mut CompactTxStreamerClient<ChT>,
+    db_data: &mut DbT,
+) -> Result<(), Error<CaErr, DbErr, <DbT as WalletCommitmentTrees>::Error>>
+where
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+    DbT: WalletCommitmentTrees,
+    <DbT as WalletCommitmentTrees>::Error: std::error::Error + Send + Sync + 'static,
+{
+    let mut request = service::GetSubtreeRootsArg::default();
+    request.set_shielded_protocol(service::ShieldedProtocol::Sapling);
+    // Hack to work around a bug in the initial lightwalletd implementation.
+    request.max_entries = 65536;
+
+    let sapling_roots: Vec<CommitmentTreeRoot<sapling::Node>> = client
+        .get_subtree_roots(request)
+        .await?
+        .into_inner()
+        .and_then(|root| async move {
+            let root_hash = sapling::Node::read(&root.root_hash[..])?;
+            Ok(CommitmentTreeRoot::from_parts(
+                BlockHeight::from_u32(root.completing_block_height as u32),
+                root_hash,
+            ))
+        })
+        .try_collect()
+        .await?;
+
+    info!("Sapling tree has {} subtrees", sapling_roots.len());
+    db_data
+        .put_sapling_subtree_roots(0, &sapling_roots)
+        .map_err(Error::WalletTrees)?;
+
+    #[cfg(feature = "orchard")]
+    {
+        let mut request = service::GetSubtreeRootsArg::default();
+        request.set_shielded_protocol(service::ShieldedProtocol::Orchard);
+        // Hack to work around a bug in the initial lightwalletd implementation.
+        request.max_entries = 65536;
+        let orchard_roots: Vec<CommitmentTreeRoot<MerkleHashOrchard>> = client
+            .get_subtree_roots(request)
+            .await?
+            .into_inner()
+            .and_then(|root| async move {
+                let root_hash = MerkleHashOrchard::read(&root.root_hash[..])?;
+                Ok(CommitmentTreeRoot::from_parts(
+                    BlockHeight::from_u32(root.completing_block_height as u32),
+                    root_hash,
+                ))
+            })
+            .try_collect()
+            .await?;
+
+        info!("Orchard tree has {} subtrees", orchard_roots.len());
+        db_data
+            .put_orchard_subtree_roots(0, &orchard_roots)
+            .map_err(Error::WalletTrees)?;
+    }
+
+    Ok(())
+}
+
+async fn update_chain_tip<ChT, DbT, CaErr, TrErr>(
+    client: &mut CompactTxStreamerClient<ChT>,
+    db_data: &mut DbT,
+) -> Result<(), Error<CaErr, <DbT as WalletRead>::Error, TrErr>>
+where
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+    DbT: WalletWrite,
+    DbT::Error: std::error::Error + Send + Sync + 'static,
+{
+    let tip_height: BlockHeight = client
+        .get_latest_block(service::ChainSpec::default())
+        .await?
+        .get_ref()
+        .height
+        .try_into()
+        .map_err(|_| Error::MisbehavingServer)?;
+
+    info!("Latest block height is {}", tip_height);
+    db_data
+        .update_chain_tip(tip_height)
+        .map_err(Error::Wallet)?;
+
+    Ok(())
+}
+
+async fn download_blocks<ChT, CaT, DbErr, TrErr>(
+    client: &mut CompactTxStreamerClient<ChT>,
+    db_cache: &CaT,
+    scan_range: &ScanRange,
+) -> Result<(), Error<CaT::Error, DbErr, TrErr>>
+where
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+    CaT: BlockCache,
+    CaT::Error: std::error::Error + Send + Sync + 'static,
+{
+    info!("Fetching {}", scan_range);
+    let mut start = service::BlockId::default();
+    start.height = scan_range.block_range().start.into();
+    let mut end = service::BlockId::default();
+    end.height = (scan_range.block_range().end - 1).into();
+    let range = service::BlockRange {
+        start: Some(start),
+        end: Some(end),
+    };
+    let compact_blocks = client
+        .get_block_range(range)
+        .await?
+        .into_inner()
+        .try_collect::<Vec<_>>()
+        .await?;
+
+    db_cache
+        .insert(compact_blocks)
+        .await
+        .map_err(Error::Cache)?;
+
+    Ok(())
+}
+
+async fn download_chain_state<ChT, CaErr, DbErr, TrErr>(
+    client: &mut CompactTxStreamerClient<ChT>,
+    block_height: BlockHeight,
+) -> Result<ChainState, Error<CaErr, DbErr, TrErr>>
+where
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+{
+    let tree_state = client
+        .get_tree_state(BlockId {
+            height: block_height.into(),
+            hash: vec![],
+        })
+        .await?;
+
+    tree_state
+        .into_inner()
+        .to_chain_state()
+        .map_err(|_| Error::MisbehavingServer)
+}
+
+/// Scans the given block range and checks for scanning errors that indicate the wallet's
+/// chain tip is out of sync with blockchain history.
+///
+/// Returns `true` if scanning these blocks materially changed the suggested scan ranges.
+async fn scan_blocks<P, CaT, DbT, TrErr>(
+    params: &P,
+    db_cache: &CaT,
+    db_data: &mut DbT,
+    initial_chain_state: &ChainState,
+    scan_range: &ScanRange,
+) -> Result<bool, Error<CaT::Error, <DbT as WalletRead>::Error, TrErr>>
+where
+    P: Parameters + Send + 'static,
+    CaT: BlockCache,
+    CaT::Error: std::error::Error + Send + Sync + 'static,
+    DbT: WalletWrite,
+    DbT::AccountId: ConditionallySelectable + Default + Send + 'static,
+    DbT::Error: std::error::Error + Send + Sync + 'static,
+{
+    info!("Scanning {}", scan_range);
+    let scan_result = scan_cached_blocks(
+        params,
+        db_cache,
+        db_data,
+        scan_range.block_range().start,
+        initial_chain_state,
+        scan_range.len(),
+    );
+
+    match scan_result {
+        Err(ChainError::Scan(err)) if err.is_continuity_error() => {
+            // Pick a height to rewind to, which must be at least one block before the
+            // height at which the error occurred, but may be an earlier height determined
+            // based on heuristics such as the platform, available bandwidth, size of
+            // recent CompactBlocks, etc.
+            let rewind_height = err.at_height().saturating_sub(10);
+            info!(
+                "Chain reorg detected at {}, rewinding to {}",
+                err.at_height(),
+                rewind_height,
+            );
+
+            // Rewind to the chosen height.
+            db_data
+                .truncate_to_height(rewind_height)
+                .map_err(Error::Wallet)?;
+
+            // Delete cached blocks from rewind_height onwards.
+            //
+            // This does imply that assumed-valid blocks will be re-downloaded, but it is
+            // also possible that in the intervening time, a chain reorg has occurred that
+            // orphaned some of those blocks.
+            db_cache
+                .truncate(rewind_height)
+                .await
+                .map_err(Error::Cache)?;
+
+            // The database was truncated, invalidating prior suggested ranges.
+            Ok(true)
+        }
+        Ok(_) => {
+            // If scanning these blocks caused a suggested range to be added that has a
+            // higher priority than the current range, invalidate the current ranges.
+            let latest_ranges = db_data.suggest_scan_ranges().map_err(Error::Wallet)?;
+
+            Ok(if let Some(range) = latest_ranges.first() {
+                range.priority() > scan_range.priority()
+            } else {
+                false
+            })
+        }
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// Refreshes the given account's view of UTXOs that exist starting at the given height.
+///
+/// ## Note about UTXO tracking
+///
+/// (Extracted from [a comment in the Android SDK].)
+///
+/// We no longer clear UTXOs here, as `WalletDb::put_received_transparent_utxo` now uses
+/// an upsert instead of an insert. This means that now-spent UTXOs would previously have
+/// been deleted, but now are left in the database (like shielded notes).
+///
+/// Due to the fact that the `lightwalletd` query only returns _current_ UTXOs, we don't
+/// learn about recently-spent UTXOs here, so the transparent balance does not get updated
+/// here.
+///
+/// Instead, when a received shielded note is "enhanced" by downloading the full
+/// transaction, we mark any UTXOs spent in that transaction as spent in the database.
+/// This relies on two current properties:
+/// - UTXOs are only ever spent in shielding transactions.
+/// - At least one shielded note from each shielding transaction is always enhanced.
+///
+/// However, for greater reliability, we may want to alter the Data Access API to support
+/// "inferring spentness" from what is _not_ returned as a UTXO, or alternatively fetch
+/// TXOs from `lightwalletd` instead of just UTXOs.
+///
+/// [a comment in the Android SDK]: https://github.com/Electric-Coin-Company/zcash-android-wallet-sdk/blob/855204fc8ae4057fdac939f98df4aa38c8e662f1/sdk-lib/src/main/java/cash/z/ecc/android/sdk/block/processor/CompactBlockProcessor.kt#L979-L991
+#[cfg(feature = "transparent-inputs")]
+async fn refresh_utxos<P, ChT, DbT, CaErr, TrErr>(
+    params: &P,
+    client: &mut CompactTxStreamerClient<ChT>,
+    db_data: &mut DbT,
+    account_id: DbT::AccountId,
+    start_height: BlockHeight,
+) -> Result<(), Error<CaErr, <DbT as WalletRead>::Error, TrErr>>
+where
+    P: Parameters + Send + 'static,
+    ChT: GrpcService<BoxBody>,
+    ChT::Error: Into<StdError>,
+    ChT::ResponseBody: Body<Data = Bytes> + Send + 'static,
+    <ChT::ResponseBody as Body>::Error: Into<StdError> + Send,
+    DbT: WalletWrite,
+    DbT::Error: std::error::Error + Send + Sync + 'static,
+{
+    let request = service::GetAddressUtxosArg {
+        addresses: db_data
+            .get_transparent_receivers(account_id)
+            .map_err(Error::Wallet)?
+            .into_keys()
+            .map(|addr| addr.encode(params))
+            .collect(),
+        start_height: start_height.into(),
+        max_entries: 0,
+    };
+
+    if request.addresses.is_empty() {
+        info!("{:?} has no transparent receivers", account_id);
+    } else {
+        client
+            .get_address_utxos_stream(request)
+            .await?
+            .into_inner()
+            .map_err(Error::Server)
+            .and_then(|reply| async move {
+                WalletTransparentOutput::from_parts(
+                    OutPoint::new(
+                        reply.txid[..]
+                            .try_into()
+                            .map_err(|_| Error::MisbehavingServer)?,
+                        reply
+                            .index
+                            .try_into()
+                            .map_err(|_| Error::MisbehavingServer)?,
+                    ),
+                    TxOut {
+                        value: Zatoshis::from_nonnegative_i64(reply.value_zat)
+                            .map_err(|_| Error::MisbehavingServer)?,
+                        script_pubkey: Script(reply.script),
+                    },
+                    Some(
+                        BlockHeight::try_from(reply.height)
+                            .map_err(|_| Error::MisbehavingServer)?,
+                    ),
+                )
+                .ok_or(Error::MisbehavingServer)
+            })
+            .try_for_each(|output| {
+                let res = db_data.put_received_transparent_utxo(&output).map(|_| ());
+                async move { res.map_err(Error::Wallet) }
+            })
+            .await?;
+    }
+
+    Ok(())
+}
+
+/// Errors that can occur while syncing.
+#[derive(Debug)]
+pub enum Error<CaErr, DbErr, TrErr> {
+    /// An error while interacting with a [`BlockCache`].
+    Cache(CaErr),
+    /// The lightwalletd server returned invalid information, and is misbehaving.
+    MisbehavingServer,
+    /// An error while scanning blocks.
+    Scan(ScanError),
+    /// An error while communicating with the lightwalletd server.
+    Server(tonic::Status),
+    /// An error while interacting with a wallet database via [`WalletRead`] or
+    /// [`WalletWrite`].
+    Wallet(DbErr),
+    /// An error while interacting with a wallet database via [`WalletCommitmentTrees`].
+    WalletTrees(ShardTreeError<TrErr>),
+}
+
+impl<CaErr, DbErr, TrErr> fmt::Display for Error<CaErr, DbErr, TrErr>
+where
+    CaErr: fmt::Display,
+    DbErr: fmt::Display,
+    TrErr: fmt::Display,
+{
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::Cache(e) => write!(f, "Error while interacting with block cache: {}", e),
+            Error::MisbehavingServer => write!(f, "lightwalletd server is misbehaving"),
+            Error::Scan(e) => write!(f, "Error while scanning blocks: {}", e),
+            Error::Server(e) => write!(
+                f,
+                "Error while communicating with lightwalletd server: {}",
+                e
+            ),
+            Error::Wallet(e) => write!(f, "Error while interacting with wallet database: {}", e),
+            Error::WalletTrees(e) => write!(
+                f,
+                "Error while interacting with wallet commitment trees: {}",
+                e
+            ),
+        }
+    }
+}
+
+impl<CaErr, DbErr, TrErr> std::error::Error for Error<CaErr, DbErr, TrErr>
+where
+    CaErr: std::error::Error,
+    DbErr: std::error::Error,
+    TrErr: std::error::Error,
+{
+}
+
+impl<CaErr, DbErr, TrErr> From<ChainError<DbErr, CaErr>> for Error<CaErr, DbErr, TrErr> {
+    fn from(e: ChainError<DbErr, CaErr>) -> Self {
+        match e {
+            ChainError::Wallet(e) => Error::Wallet(e),
+            ChainError::BlockSource(e) => Error::Cache(e),
+            ChainError::Scan(e) => Error::Scan(e),
+        }
+    }
+}
+
+impl<CaErr, DbErr, TrErr> From<tonic::Status> for Error<CaErr, DbErr, TrErr> {
+    fn from(status: tonic::Status) -> Self {
+        Error::Server(status)
+    }
+}
diff --git a/zcash_client_backend/src/tor.rs b/zcash_client_backend/src/tor.rs
new file mode 100644
index 0000000000..8c900ab5c7
--- /dev/null
+++ b/zcash_client_backend/src/tor.rs
@@ -0,0 +1,139 @@
+//! Tor support for Zcash wallets.
+
+use std::{fmt, io, path::Path};
+
+use arti_client::{config::TorClientConfigBuilder, TorClient};
+use tor_rtcompat::PreferredRuntime;
+use tracing::debug;
+
+#[cfg(feature = "lightwalletd-tonic-tls-webpki-roots")]
+mod grpc;
+
+pub mod http;
+
+/// A Tor client that exposes capabilities designed for Zcash wallets.
+#[derive(Clone)]
+pub struct Client {
+    inner: TorClient<PreferredRuntime>,
+}
+
+impl Client {
+    /// Creates and bootstraps a Tor client.
+    ///
+    /// The client's persistent data and cache are both stored in the given directory.
+    /// Preserving the contents of this directory will speed up subsequent calls to
+    /// `Client::create`.
+    ///
+    /// Returns an error if `tor_dir` does not exist, or if bootstrapping fails.
+    pub async fn create(tor_dir: &Path) -> Result<Self, Error> {
+        let runtime = PreferredRuntime::current()?;
+
+        if !tokio::fs::try_exists(tor_dir).await? {
+            return Err(Error::MissingTorDirectory);
+        }
+
+        let config = TorClientConfigBuilder::from_directories(
+            tor_dir.join("arti-data"),
+            tor_dir.join("arti-cache"),
+        )
+        .build()
+        .expect("all required fields initialized");
+
+        let client_builder = TorClient::with_runtime(runtime).config(config);
+
+        debug!("Bootstrapping Tor");
+        let inner = client_builder.create_bootstrapped().await?;
+        debug!("Tor bootstrapped");
+
+        Ok(Self { inner })
+    }
+
+    /// Returns a new isolated `tor::Client` handle.
+    ///
+    /// The two `tor::Client`s will share internal state and configuration, but their
+    /// streams will never share circuits with one another.
+    ///
+    /// Use this method when you want separate parts of your program to each have a
+    /// `tor::Client` handle, but where you don't want their activities to be linkable to
+    /// one another over the Tor network.
+    ///
+    /// Calling this method is usually preferable to creating a completely separate
+    /// `tor::Client` instance, since it can share its internals with the existing
+    /// `tor::Client`.
+    ///
+    /// (Connections made with clones of the returned `tor::Client` may share circuits
+    /// with each other.)
+    #[must_use]
+    pub fn isolated_client(&self) -> Self {
+        Self {
+            inner: self.inner.isolated_client(),
+        }
+    }
+}
+
+/// Errors that can occur while creating or using a Tor [`Client`].
+#[derive(Debug)]
+pub enum Error {
+    /// The directory passed to [`Client::create`] does not exist.
+    MissingTorDirectory,
+    #[cfg(feature = "lightwalletd-tonic-tls-webpki-roots")]
+    /// An error occurred while using gRPC-over-Tor.
+    Grpc(self::grpc::GrpcError),
+    /// An error occurred while using HTTP-over-Tor.
+    Http(self::http::HttpError),
+    /// An IO error occurred while interacting with the filesystem.
+    Io(io::Error),
+    /// A Tor-specific error.
+    Tor(arti_client::Error),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::MissingTorDirectory => write!(f, "Tor directory is missing"),
+            #[cfg(feature = "lightwalletd-tonic-tls-webpki-roots")]
+            Error::Grpc(e) => write!(f, "gRPC-over-Tor error: {}", e),
+            Error::Http(e) => write!(f, "HTTP-over-Tor error: {}", e),
+            Error::Io(e) => write!(f, "IO error: {}", e),
+            Error::Tor(e) => write!(f, "Tor error: {}", e),
+        }
+    }
+}
+
+impl std::error::Error for Error {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Error::MissingTorDirectory => None,
+            #[cfg(feature = "lightwalletd-tonic-tls-webpki-roots")]
+            Error::Grpc(e) => Some(e),
+            Error::Http(e) => Some(e),
+            Error::Io(e) => Some(e),
+            Error::Tor(e) => Some(e),
+        }
+    }
+}
+
+#[cfg(feature = "lightwalletd-tonic-tls-webpki-roots")]
+impl From<self::grpc::GrpcError> for Error {
+    fn from(e: self::grpc::GrpcError) -> Self {
+        Error::Grpc(e)
+    }
+}
+
+impl From<self::http::HttpError> for Error {
+    fn from(e: self::http::HttpError) -> Self {
+        Error::Http(e)
+    }
+}
+
+impl From<io::Error> for Error {
+    fn from(e: io::Error) -> Self {
+        Error::Io(e)
+    }
+}
+
+impl From<arti_client::Error> for Error {
+    fn from(e: arti_client::Error) -> Self {
+        Error::Tor(e)
+    }
+}
diff --git a/zcash_client_backend/src/tor/grpc.rs b/zcash_client_backend/src/tor/grpc.rs
new file mode 100644
index 0000000000..fb8d77477c
--- /dev/null
+++ b/zcash_client_backend/src/tor/grpc.rs
@@ -0,0 +1,106 @@
+use std::{
+    fmt,
+    future::Future,
+    pin::Pin,
+    task::{Context, Poll},
+};
+
+use arti_client::DataStream;
+use hyper_util::rt::TokioIo;
+use tonic::transport::{Channel, ClientTlsConfig, Endpoint, Uri};
+use tower::Service;
+use tracing::debug;
+
+use super::{http, Client, Error};
+use crate::proto::service::compact_tx_streamer_client::CompactTxStreamerClient;
+
+impl Client {
+    /// Connects to the `lightwalletd` server at the given endpoint.
+    pub async fn connect_to_lightwalletd(
+        &self,
+        endpoint: Uri,
+    ) -> Result<CompactTxStreamerClient<Channel>, Error> {
+        let is_https = http::url_is_https(&endpoint)?;
+
+        let channel = Endpoint::from(endpoint);
+        let channel = if is_https {
+            channel
+                .tls_config(ClientTlsConfig::new().with_webpki_roots())
+                .map_err(GrpcError::Tonic)?
+        } else {
+            channel
+        };
+
+        let conn = channel
+            .connect_with_connector(self.http_tcp_connector())
+            .await
+            .map_err(GrpcError::Tonic)?;
+
+        Ok(CompactTxStreamerClient::new(conn))
+    }
+
+    fn http_tcp_connector(&self) -> HttpTcpConnector {
+        HttpTcpConnector {
+            client: self.clone(),
+        }
+    }
+}
+
+struct HttpTcpConnector {
+    client: Client,
+}
+
+impl Service<Uri> for HttpTcpConnector {
+    type Response = TokioIo<DataStream>;
+    type Error = Error;
+    type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;
+
+    fn poll_ready(&mut self, _: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        Poll::Ready(Ok(()))
+    }
+
+    fn call(&mut self, endpoint: Uri) -> Self::Future {
+        let parsed = http::parse_url(&endpoint);
+        let client = self.client.clone();
+
+        let fut = async move {
+            let (_, host, port) = parsed?;
+
+            debug!("Connecting through Tor to {}:{}", host, port);
+            let stream = client.inner.connect((host.as_str(), port)).await?;
+
+            Ok(TokioIo::new(stream))
+        };
+
+        Box::pin(fut)
+    }
+}
+
+/// Errors that can occurr while using HTTP-over-Tor.
+#[derive(Debug)]
+pub enum GrpcError {
+    /// A [`tonic`] error.
+    Tonic(tonic::transport::Error),
+}
+
+impl fmt::Display for GrpcError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            GrpcError::Tonic(e) => write!(f, "Hyper error: {}", e),
+        }
+    }
+}
+
+impl std::error::Error for GrpcError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            GrpcError::Tonic(e) => Some(e),
+        }
+    }
+}
+
+impl From<tonic::transport::Error> for GrpcError {
+    fn from(e: tonic::transport::Error) -> Self {
+        GrpcError::Tonic(e)
+    }
+}
diff --git a/zcash_client_backend/src/tor/http.rs b/zcash_client_backend/src/tor/http.rs
new file mode 100644
index 0000000000..fb040e6ec6
--- /dev/null
+++ b/zcash_client_backend/src/tor/http.rs
@@ -0,0 +1,219 @@
+//! HTTP requests over Tor.
+
+use std::{fmt, future::Future, io, sync::Arc};
+
+use futures_util::task::SpawnExt;
+use http_body_util::{BodyExt, Empty};
+use hyper::{
+    body::{Buf, Bytes, Incoming},
+    client::conn,
+    http::{request::Builder, uri::Scheme},
+    Request, Response, Uri,
+};
+use hyper_util::rt::TokioIo;
+use serde::de::DeserializeOwned;
+use tokio::io::{AsyncRead, AsyncWrite};
+use tokio_rustls::{
+    rustls::{ClientConfig, OwnedTrustAnchor, RootCertStore, ServerName},
+    TlsConnector,
+};
+use tor_rtcompat::PreferredRuntime;
+use tracing::{debug, error};
+
+use super::{Client, Error};
+
+pub mod cryptex;
+
+pub(super) fn url_is_https(url: &Uri) -> Result<bool, HttpError> {
+    Ok(url.scheme().ok_or_else(|| HttpError::NonHttpUrl)? == &Scheme::HTTPS)
+}
+
+pub(super) fn parse_url(url: &Uri) -> Result<(bool, String, u16), Error> {
+    let is_https = url_is_https(url)?;
+
+    let host = url.host().ok_or_else(|| HttpError::NonHttpUrl)?.to_string();
+
+    let port = match url.port_u16() {
+        Some(port) => port,
+        None if is_https => 443,
+        None => 80,
+    };
+
+    Ok((is_https, host, port))
+}
+
+impl Client {
+    #[tracing::instrument(skip(self, h, f))]
+    async fn get<T, F: Future<Output = Result<T, Error>>>(
+        &self,
+        url: Uri,
+        h: impl FnOnce(Builder) -> Builder,
+        f: impl FnOnce(Incoming) -> F,
+    ) -> Result<Response<T>, Error> {
+        let (is_https, host, port) = parse_url(&url)?;
+
+        // Connect to the server.
+        debug!("Connecting through Tor to {}:{}", host, port);
+        let stream = self.inner.connect((host.as_str(), port)).await?;
+
+        if is_https {
+            // On apple-darwin targets there's an issue with the native TLS implementation
+            // when used over Tor circuits. We use Rustls instead.
+            //
+            // https://gitlab.torproject.org/tpo/core/arti/-/issues/715
+            let mut root_store = RootCertStore::empty();
+            root_store.add_trust_anchors(webpki_roots::TLS_SERVER_ROOTS.iter().map(|root| {
+                OwnedTrustAnchor::from_subject_spki_name_constraints(
+                    root.subject,
+                    root.spki,
+                    root.name_constraints,
+                )
+            }));
+            let config = ClientConfig::builder()
+                .with_safe_defaults()
+                .with_root_certificates(root_store)
+                .with_no_client_auth();
+            let connector = TlsConnector::from(Arc::new(config));
+            let dnsname = ServerName::try_from(host.as_str()).expect("Already checked");
+            let stream = connector
+                .connect(dnsname, stream)
+                .await
+                .map_err(HttpError::Tls)?;
+            make_http_request(stream, url, h, f).await
+        } else {
+            make_http_request(stream, url, h, f).await
+        }
+    }
+
+    async fn get_json<T: DeserializeOwned>(&self, url: Uri) -> Result<Response<T>, Error> {
+        self.get(
+            url,
+            |builder| builder.header(hyper::header::ACCEPT, "application/json"),
+            |body| async {
+                Ok(serde_json::from_reader(
+                    body.collect()
+                        .await
+                        .map_err(HttpError::from)?
+                        .aggregate()
+                        .reader(),
+                )
+                .map_err(HttpError::from)?)
+            },
+        )
+        .await
+    }
+}
+
+async fn make_http_request<T, F: Future<Output = Result<T, Error>>>(
+    stream: impl AsyncRead + AsyncWrite + Unpin + Send + 'static,
+    url: Uri,
+    h: impl FnOnce(Builder) -> Builder,
+    f: impl FnOnce(Incoming) -> F,
+) -> Result<Response<T>, Error> {
+    debug!("Making request");
+    let (mut sender, connection) = conn::http1::handshake(TokioIo::new(stream))
+        .await
+        .map_err(HttpError::from)?;
+
+    // Spawn a task to poll the connection and drive the HTTP state.
+    PreferredRuntime::current()?
+        .spawn(async move {
+            if let Err(e) = connection.await {
+                error!("Connection failed: {}", e);
+            }
+        })
+        .map_err(HttpError::from)?;
+
+    let req = h(Request::builder()
+        .header(
+            hyper::header::HOST,
+            url.authority().expect("Already checked").as_str(),
+        )
+        .uri(url))
+    .body(Empty::<Bytes>::new())
+    .map_err(HttpError::from)?;
+    let (parts, body) = sender
+        .send_request(req)
+        .await
+        .map_err(HttpError::from)?
+        .into_parts();
+    debug!("Response status code: {}", parts.status);
+
+    if parts.status.is_success() {
+        Ok(Response::from_parts(parts, f(body).await?))
+    } else {
+        Err(Error::Http(HttpError::Unsuccessful(parts.status)))
+    }
+}
+
+/// Errors that can occurr while using HTTP-over-Tor.
+#[derive(Debug)]
+pub enum HttpError {
+    /// A non-HTTP URL was encountered.
+    NonHttpUrl,
+    /// An HTTP error.
+    Http(hyper::http::Error),
+    /// A [`hyper`] error.
+    Hyper(hyper::Error),
+    /// A JSON parsing error.
+    Json(serde_json::Error),
+    /// An error occurred while spawning a background worker task for driving the HTTP
+    /// connection.
+    Spawn(futures_util::task::SpawnError),
+    /// A TLS-specific IO error.
+    Tls(io::Error),
+    /// The status code indicated that the request was unsuccessful.
+    Unsuccessful(hyper::http::StatusCode),
+}
+
+impl fmt::Display for HttpError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            HttpError::NonHttpUrl => write!(f, "Only HTTP or HTTPS URLs are supported"),
+            HttpError::Http(e) => write!(f, "HTTP error: {}", e),
+            HttpError::Hyper(e) => write!(f, "Hyper error: {}", e),
+            HttpError::Json(e) => write!(f, "Failed to parse JSON: {}", e),
+            HttpError::Spawn(e) => write!(f, "Failed to spawn task: {}", e),
+            HttpError::Tls(e) => write!(f, "TLS error: {}", e),
+            HttpError::Unsuccessful(status) => write!(f, "Request was unsuccessful ({:?})", status),
+        }
+    }
+}
+
+impl std::error::Error for HttpError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            HttpError::NonHttpUrl => None,
+            HttpError::Http(e) => Some(e),
+            HttpError::Hyper(e) => Some(e),
+            HttpError::Json(e) => Some(e),
+            HttpError::Spawn(e) => Some(e),
+            HttpError::Tls(e) => Some(e),
+            HttpError::Unsuccessful(_) => None,
+        }
+    }
+}
+
+impl From<hyper::http::Error> for HttpError {
+    fn from(e: hyper::http::Error) -> Self {
+        HttpError::Http(e)
+    }
+}
+
+impl From<hyper::Error> for HttpError {
+    fn from(e: hyper::Error) -> Self {
+        HttpError::Hyper(e)
+    }
+}
+
+impl From<serde_json::Error> for HttpError {
+    fn from(e: serde_json::Error) -> Self {
+        HttpError::Json(e)
+    }
+}
+
+impl From<futures_util::task::SpawnError> for HttpError {
+    fn from(e: futures_util::task::SpawnError) -> Self {
+        HttpError::Spawn(e)
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex.rs b/zcash_client_backend/src/tor/http/cryptex.rs
new file mode 100644
index 0000000000..f2662418ea
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex.rs
@@ -0,0 +1,198 @@
+//! Cryptocurrency exchange rate APIs.
+
+use futures_util::{future::join_all, join};
+use rand::{seq::IteratorRandom, thread_rng};
+use rust_decimal::Decimal;
+use tracing::{error, trace};
+
+use crate::tor::{Client, Error};
+
+mod binance;
+mod coinbase;
+mod gate_io;
+mod gemini;
+mod ku_coin;
+mod mexc;
+
+/// Exchanges for which we know how to query data over Tor.
+pub mod exchanges {
+    pub use super::binance::Binance;
+    pub use super::coinbase::Coinbase;
+    pub use super::gate_io::GateIo;
+    pub use super::gemini::Gemini;
+    pub use super::ku_coin::KuCoin;
+    pub use super::mexc::Mexc;
+}
+
+/// An exchange that can be queried for ZEC data.
+#[trait_variant::make(Exchange: Send)]
+#[dynosaur::dynosaur(DynExchange = dyn Exchange)]
+#[dynosaur::dynosaur(DynLocalExchange = dyn LocalExchange)]
+pub trait LocalExchange {
+    /// Queries data about the USD/ZEC pair.
+    ///
+    /// The returned bid and ask data must be denominated in USD, i.e. the latest bid and
+    /// ask for 1 ZEC.
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error>;
+}
+
+/// Data queried from an [`Exchange`].
+#[derive(Debug)]
+pub struct ExchangeData {
+    /// The highest current bid.
+    pub bid: Decimal,
+
+    /// The lowest current ask.
+    pub ask: Decimal,
+}
+
+impl ExchangeData {
+    /// Returns the mid-point between current best bid and current best ask, to avoid
+    /// manipulation by targeted trade fulfilment.
+    fn exchange_rate(&self) -> Decimal {
+        (self.bid + self.ask) / Decimal::TWO
+    }
+}
+
+/// A set of [`Exchange`]s that can be queried for ZEC data.
+pub struct Exchanges {
+    trusted: Box<DynExchange<'static>>,
+    others: Vec<Box<DynExchange<'static>>>,
+}
+
+impl Exchanges {
+    /// Unauthenticated connections to all known exchanges with USD/ZEC pairs.
+    ///
+    /// Gemini is treated as a "trusted" data source due to being a NYDFS-regulated
+    /// exchange.
+    pub fn unauthenticated_known_with_gemini_trusted() -> Self {
+        Self::builder(exchanges::Gemini::unauthenticated())
+            .with(exchanges::Binance::unauthenticated())
+            .with(exchanges::Coinbase::unauthenticated())
+            .with(exchanges::GateIo::unauthenticated())
+            .with(exchanges::KuCoin::unauthenticated())
+            .with(exchanges::Mexc::unauthenticated())
+            .build()
+    }
+
+    /// Returns an `Exchanges` builder.
+    ///
+    /// The `trusted` exchange will always have its data used, _if_ data is successfully
+    /// obtained via Tor (i.e. no transient failures).
+    pub fn builder(trusted: impl Exchange + 'static) -> ExchangesBuilder {
+        ExchangesBuilder::new(trusted)
+    }
+}
+
+/// Builder type for [`Exchanges`].
+///
+/// Every [`Exchanges`] is configured with a "trusted" [`Exchange`] that will always have
+/// its data used, if data is successfully obtained via Tor (i.e. no transient failures).
+/// Additional data sources can be provided to [`ExchangesBuilder::with`] for resiliency
+/// against transient network failures or adversarial market manipulation on individual
+/// sources.
+///
+/// The number of times [`ExchangesBuilder::with`] is called will affect the behaviour of
+/// the final [`Exchanges`]:
+/// - With no additional sources, the trusted [`Exchange`] is used on its own.
+/// - With one additional source, the trusted [`Exchange`] is used preferentially,
+///   with the additional source as a backup if the trusted source cannot be queried.
+/// - With two or more additional sources, a minimum of three successful responses are
+///   required from any of the sources.
+pub struct ExchangesBuilder(Exchanges);
+
+impl ExchangesBuilder {
+    /// Constructs a new [`Exchanges`] builder.
+    ///
+    /// The `trusted` exchange will always have its data used, _if_ data is successfully
+    /// obtained via Tor (i.e. no transient failures).
+    pub fn new(trusted: impl Exchange + 'static) -> Self {
+        Self(Exchanges {
+            trusted: DynExchange::boxed(trusted),
+            others: vec![],
+        })
+    }
+
+    /// Adds another [`Exchange`] as a data source.
+    pub fn with(mut self, other: impl Exchange + 'static) -> Self {
+        self.0.others.push(DynExchange::boxed(other));
+        self
+    }
+
+    /// Builds the [`Exchanges`].
+    pub fn build(self) -> Exchanges {
+        self.0
+    }
+}
+
+impl Client {
+    /// Fetches the latest USD/ZEC exchange rate, derived from the given exchanges.
+    ///
+    /// Returns:
+    /// - `Ok(rate)` if at least one exchange request succeeds.
+    /// - `Err(_)` if none of the exchange queries succeed.
+    pub async fn get_latest_zec_to_usd_rate(
+        &self,
+        exchanges: &Exchanges,
+    ) -> Result<Decimal, Error> {
+        // Fetch the data in parallel.
+        let res = join!(
+            exchanges.trusted.query_zec_to_usd(self),
+            join_all(exchanges.others.iter().map(|e| e.query_zec_to_usd(self)))
+        );
+        trace!(?res, "Data results");
+        let (trusted_res, other_res) = res;
+
+        // Split into successful queries and errors.
+        let mut rates: Vec<Decimal> = vec![];
+        let mut errors = vec![];
+        for res in other_res {
+            match res {
+                Ok(d) => rates.push(d.exchange_rate()),
+                Err(e) => errors.push(e),
+            }
+        }
+
+        // "Never go to sea with two chronometers; take one or three."
+        // Randomly drop one rate if necessary to have an odd number of rates, as long as
+        // we have either at least three rates, or fewer than three sources.
+        if exchanges.others.len() >= 2 && rates.len() + usize::from(trusted_res.is_ok()) < 3 {
+            error!("Too many exchange requests failed");
+            return Err(errors
+                .into_iter()
+                .next()
+                .expect("At least one request failed"));
+        }
+        let evict_random = |s: &mut Vec<Decimal>| {
+            if let Some(index) = (0..s.len()).choose(&mut thread_rng()) {
+                s.remove(index);
+            }
+        };
+        match trusted_res {
+            Ok(trusted) => {
+                if rates.len() % 2 != 0 {
+                    evict_random(&mut rates);
+                }
+                rates.push(trusted.exchange_rate());
+            }
+            Err(e) => {
+                if rates.len() % 2 == 0 {
+                    evict_random(&mut rates);
+                }
+                errors.push(e);
+            }
+        }
+
+        // If all of the requests failed, log all errors and return one of them.
+        if rates.is_empty() {
+            error!("All exchange requests failed");
+            Err(errors.into_iter().next().expect("All requests failed"))
+        } else {
+            // We have an odd number of rates; take the median.
+            assert!(rates.len() % 2 != 0);
+            rates.sort();
+            let median = rates.len() / 2;
+            Ok(rates[median])
+        }
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex/binance.rs b/zcash_client_backend/src/tor/http/cryptex/binance.rs
new file mode 100644
index 0000000000..aa1645e82a
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex/binance.rs
@@ -0,0 +1,63 @@
+use rust_decimal::Decimal;
+use serde::Deserialize;
+
+use super::{Exchange, ExchangeData};
+use crate::tor::{Client, Error};
+
+/// Querier for the Binance exchange.
+pub struct Binance {
+    _private: (),
+}
+
+impl Binance {
+    /// Prepares for unauthenticated connections to Binance.
+    pub fn unauthenticated() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[allow(dead_code)]
+#[allow(non_snake_case)]
+struct BinanceData {
+    symbol: String,
+    priceChange: Decimal,
+    priceChangePercent: Decimal,
+    weightedAvgPrice: Decimal,
+    prevClosePrice: Decimal,
+    lastPrice: Decimal,
+    lastQty: Decimal,
+    bidPrice: Decimal,
+    bidQty: Decimal,
+    askPrice: Decimal,
+    askQty: Decimal,
+    openPrice: Decimal,
+    highPrice: Decimal,
+    lowPrice: Decimal,
+    volume: Decimal,
+    quoteVolume: Decimal,
+    openTime: u64,
+    closeTime: u64,
+    firstId: u32,
+    lastId: u32,
+    count: u32,
+}
+
+impl Exchange for Binance {
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error> {
+        // API documentation:
+        // https://binance-docs.github.io/apidocs/spot/en/#24hr-ticker-price-change-statistics
+        let res = client
+            .get_json::<BinanceData>(
+                "https://api.binance.com/api/v3/ticker/24hr?symbol=ZECUSDT"
+                    .parse()
+                    .unwrap(),
+            )
+            .await?;
+        let data = res.into_body();
+        Ok(ExchangeData {
+            bid: data.bidPrice,
+            ask: data.askPrice,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex/coinbase.rs b/zcash_client_backend/src/tor/http/cryptex/coinbase.rs
new file mode 100644
index 0000000000..190d3650eb
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex/coinbase.rs
@@ -0,0 +1,51 @@
+use rust_decimal::Decimal;
+use serde::Deserialize;
+
+use super::{Exchange, ExchangeData};
+use crate::tor::{Client, Error};
+
+/// Querier for the Coinbase exchange.
+pub struct Coinbase {
+    _private: (),
+}
+
+impl Coinbase {
+    /// Prepares for unauthenticated connections to Coinbase.
+    pub fn unauthenticated() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+struct CoinbaseData {
+    ask: Decimal,
+    bid: Decimal,
+    volume: Decimal,
+    trade_id: u32,
+    price: Decimal,
+    size: Decimal,
+    time: String,
+    rfq_volume: Option<Decimal>,
+    conversions_volume: Option<Decimal>,
+}
+
+impl Exchange for Coinbase {
+    #[allow(dead_code)]
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error> {
+        // API documentation:
+        // https://docs.cdp.coinbase.com/exchange/reference/exchangerestapi_getproductticker
+        let res = client
+            .get_json::<CoinbaseData>(
+                "https://api.exchange.coinbase.com/products/ZEC-USD/ticker"
+                    .parse()
+                    .unwrap(),
+            )
+            .await?;
+        let data = res.into_body();
+        Ok(ExchangeData {
+            bid: data.bid,
+            ask: data.ask,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex/gate_io.rs b/zcash_client_backend/src/tor/http/cryptex/gate_io.rs
new file mode 100644
index 0000000000..382517de12
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex/gate_io.rs
@@ -0,0 +1,54 @@
+use hyper::StatusCode;
+use rust_decimal::Decimal;
+use serde::Deserialize;
+
+use super::{Exchange, ExchangeData};
+use crate::tor::{Client, Error};
+
+/// Querier for the Gate.io exchange.
+pub struct GateIo {
+    _private: (),
+}
+
+impl GateIo {
+    /// Prepares for unauthenticated connections to Gate.io.
+    pub fn unauthenticated() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+struct GateIoData {
+    currency_pair: String,
+    last: Decimal,
+    lowest_ask: Decimal,
+    highest_bid: Decimal,
+    change_percentage: Decimal,
+    base_volume: Decimal,
+    quote_volume: Decimal,
+    high_24h: Decimal,
+    low_24h: Decimal,
+}
+
+impl Exchange for GateIo {
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error> {
+        // API documentation:
+        // https://www.gate.io/docs/developers/apiv4/#retrieve-ticker-information
+        let res = client
+            .get_json::<Vec<GateIoData>>(
+                "https://api.gateio.ws/api/v4/spot/tickers?currency_pair=ZEC_USDT"
+                    .parse()
+                    .unwrap(),
+            )
+            .await?;
+        let data = res.into_body().into_iter().next().ok_or(Error::Http(
+            super::super::HttpError::Unsuccessful(StatusCode::GONE),
+        ))?;
+
+        Ok(ExchangeData {
+            bid: data.highest_bid,
+            ask: data.lowest_ask,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex/gemini.rs b/zcash_client_backend/src/tor/http/cryptex/gemini.rs
new file mode 100644
index 0000000000..856634b21e
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex/gemini.rs
@@ -0,0 +1,45 @@
+use rust_decimal::Decimal;
+use serde::Deserialize;
+
+use super::{Exchange, ExchangeData};
+use crate::tor::{Client, Error};
+
+/// Querier for the Gemini exchange.
+pub struct Gemini {
+    _private: (),
+}
+
+impl Gemini {
+    /// Prepares for unauthenticated connections to Gemini.
+    pub fn unauthenticated() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+struct GeminiData {
+    symbol: String,
+    open: Decimal,
+    high: Decimal,
+    low: Decimal,
+    close: Decimal,
+    changes: Vec<Decimal>,
+    bid: Decimal,
+    ask: Decimal,
+}
+
+impl Exchange for Gemini {
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error> {
+        // API documentation:
+        // https://docs.gemini.com/rest-api/#ticker-v2
+        let res = client
+            .get_json::<GeminiData>("https://api.gemini.com/v2/ticker/zecusd".parse().unwrap())
+            .await?;
+        let data = res.into_body();
+        Ok(ExchangeData {
+            bid: data.bid,
+            ask: data.ask,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex/ku_coin.rs b/zcash_client_backend/src/tor/http/cryptex/ku_coin.rs
new file mode 100644
index 0000000000..3301367050
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex/ku_coin.rs
@@ -0,0 +1,65 @@
+use rust_decimal::Decimal;
+use serde::Deserialize;
+
+use super::{Exchange, ExchangeData};
+use crate::tor::{Client, Error};
+
+/// Querier for the KuCoin exchange.
+pub struct KuCoin {
+    _private: (),
+}
+
+impl KuCoin {
+    /// Prepares for unauthenticated connections to KuCoin.
+    pub fn unauthenticated() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+#[allow(non_snake_case)]
+struct KuCoinData {
+    time: u64,
+    symbol: String,
+    buy: Decimal,
+    sell: Decimal,
+    changeRate: Decimal,
+    changePrice: Decimal,
+    high: Decimal,
+    low: Decimal,
+    vol: Decimal,
+    volValue: Decimal,
+    last: Decimal,
+    averagePrice: Decimal,
+    takerFeeRate: Decimal,
+    makerFeeRate: Decimal,
+    takerCoefficient: Decimal,
+    makerCoefficient: Decimal,
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+struct KuCoinResponse {
+    code: String,
+    data: KuCoinData,
+}
+
+impl Exchange for KuCoin {
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error> {
+        // API documentation:
+        // https://www.kucoin.com/docs/rest/spot-trading/market-data/get-24hr-stats
+        let res = client
+            .get_json::<KuCoinResponse>(
+                "https://api.kucoin.com/api/v1/market/stats?symbol=ZEC-USDT"
+                    .parse()
+                    .unwrap(),
+            )
+            .await?;
+        let data = res.into_body().data;
+        Ok(ExchangeData {
+            bid: data.buy,
+            ask: data.sell,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/tor/http/cryptex/mexc.rs b/zcash_client_backend/src/tor/http/cryptex/mexc.rs
new file mode 100644
index 0000000000..278fec6939
--- /dev/null
+++ b/zcash_client_backend/src/tor/http/cryptex/mexc.rs
@@ -0,0 +1,58 @@
+use rust_decimal::Decimal;
+use serde::Deserialize;
+
+use super::{Exchange, ExchangeData};
+use crate::tor::{Client, Error};
+
+/// Querier for the MEXC exchange.
+pub struct Mexc {
+    _private: (),
+}
+
+impl Mexc {
+    /// Prepares for unauthenticated connections to MEXC.
+    pub fn unauthenticated() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+#[allow(non_snake_case)]
+struct MexcData {
+    symbol: String,
+    priceChange: Decimal,
+    priceChangePercent: Decimal,
+    prevClosePrice: Decimal,
+    lastPrice: Decimal,
+    bidPrice: Decimal,
+    bidQty: Decimal,
+    askPrice: Decimal,
+    askQty: Decimal,
+    openPrice: Decimal,
+    highPrice: Decimal,
+    lowPrice: Decimal,
+    volume: Decimal,
+    quoteVolume: Decimal,
+    openTime: u64,
+    closeTime: u64,
+}
+
+impl Exchange for Mexc {
+    async fn query_zec_to_usd(&self, client: &Client) -> Result<ExchangeData, Error> {
+        // API documentation:
+        // https://mexcdevelop.github.io/apidocs/spot_v3_en/#24hr-ticker-price-change-statistics
+        let res = client
+            .get_json::<MexcData>(
+                "https://api.mexc.com/api/v3/ticker/24hr?symbol=ZECUSDT"
+                    .parse()
+                    .unwrap(),
+            )
+            .await?;
+        let data = res.into_body();
+        Ok(ExchangeData {
+            bid: data.bidPrice,
+            ask: data.askPrice,
+        })
+    }
+}
diff --git a/zcash_client_backend/src/wallet.rs b/zcash_client_backend/src/wallet.rs
index ba58340b3d..f3bca04baa 100644
--- a/zcash_client_backend/src/wallet.rs
+++ b/zcash_client_backend/src/wallet.rs
@@ -1,38 +1,255 @@
 //! Structs representing transaction data scanned from the block chain by a wallet or
 //! light client.
 
+use incrementalmerkletree::Position;
+use zcash_address::ZcashAddress;
 use zcash_note_encryption::EphemeralKeyBytes;
 use zcash_primitives::{
     consensus::BlockHeight,
-    keys::OutgoingViewingKey,
     legacy::TransparentAddress,
-    sapling,
     transaction::{
         components::{
-            sapling::fees as sapling_fees,
-            transparent::{self, OutPoint, TxOut},
-            Amount,
+            amount::NonNegativeAmount,
+            transparent::{OutPoint, TxOut},
         },
+        fees::transparent as transparent_fees,
         TxId,
     },
-    zip32::AccountId,
+    zip32::Scope,
 };
+use zcash_protocol::value::BalanceError;
 
-/// A subset of a [`Transaction`] relevant to wallets and light clients.
+use crate::{fees::sapling as sapling_fees, PoolType, ShieldedProtocol};
+
+#[cfg(feature = "orchard")]
+use crate::fees::orchard as orchard_fees;
+
+#[cfg(feature = "transparent-inputs")]
+use zcash_primitives::legacy::keys::{NonHardenedChildIndex, TransparentKeyScope};
+
+/// A unique identifier for a shielded transaction output
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub struct NoteId {
+    txid: TxId,
+    protocol: ShieldedProtocol,
+    output_index: u16,
+}
+
+impl NoteId {
+    /// Constructs a new `NoteId` from its parts.
+    pub fn new(txid: TxId, protocol: ShieldedProtocol, output_index: u16) -> Self {
+        Self {
+            txid,
+            protocol,
+            output_index,
+        }
+    }
+
+    /// Returns the ID of the transaction containing this note.
+    pub fn txid(&self) -> &TxId {
+        &self.txid
+    }
+
+    /// Returns the shielded protocol used by this note.
+    pub fn protocol(&self) -> ShieldedProtocol {
+        self.protocol
+    }
+
+    /// Returns the index of this note within its transaction's corresponding list of
+    /// shielded outputs.
+    pub fn output_index(&self) -> u16 {
+        self.output_index
+    }
+}
+
+/// A type that represents the recipient of a transaction output:
+/// * a recipient address;
+/// * for external unified addresses, the pool to which the payment is sent;
+/// * for ephemeral transparent addresses, the internal account ID and metadata about the outpoint;
+/// * for wallet-internal outputs, the internal account ID and metadata about the note.
+#[derive(Debug, Clone)]
+pub enum Recipient<AccountId, N, O> {
+    External(ZcashAddress, PoolType),
+    EphemeralTransparent {
+        receiving_account: AccountId,
+        ephemeral_address: TransparentAddress,
+        outpoint_metadata: O,
+    },
+    InternalAccount {
+        receiving_account: AccountId,
+        external_address: Option<ZcashAddress>,
+        note: N,
+    },
+}
+
+impl<AccountId, N, O> Recipient<AccountId, N, O> {
+    /// Return a copy of this `Recipient` with `f` applied to the note metadata, if any.
+    pub fn map_internal_account_note<B, F: FnOnce(N) -> B>(
+        self,
+        f: F,
+    ) -> Recipient<AccountId, B, O> {
+        match self {
+            Recipient::External(addr, pool) => Recipient::External(addr, pool),
+            Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata,
+            } => Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata,
+            },
+            Recipient::InternalAccount {
+                receiving_account,
+                external_address,
+                note,
+            } => Recipient::InternalAccount {
+                receiving_account,
+                external_address,
+                note: f(note),
+            },
+        }
+    }
+
+    /// Return a copy of this `Recipient` with `f` applied to the output metadata, if any.
+    pub fn map_ephemeral_transparent_outpoint<B, F: FnOnce(O) -> B>(
+        self,
+        f: F,
+    ) -> Recipient<AccountId, N, B> {
+        match self {
+            Recipient::External(addr, pool) => Recipient::External(addr, pool),
+            Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata,
+            } => Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata: f(outpoint_metadata),
+            },
+            Recipient::InternalAccount {
+                receiving_account,
+                external_address,
+                note,
+            } => Recipient::InternalAccount {
+                receiving_account,
+                external_address,
+                note,
+            },
+        }
+    }
+}
+
+impl<AccountId, N, O> Recipient<AccountId, Option<N>, O> {
+    /// Return a copy of this `Recipient` with optional note metadata transposed to
+    /// an optional result.
+    pub fn internal_account_note_transpose_option(self) -> Option<Recipient<AccountId, N, O>> {
+        match self {
+            Recipient::External(addr, pool) => Some(Recipient::External(addr, pool)),
+            Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata,
+            } => Some(Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata,
+            }),
+            Recipient::InternalAccount {
+                receiving_account,
+                external_address,
+                note,
+            } => note.map(|n0| Recipient::InternalAccount {
+                receiving_account,
+                external_address,
+                note: n0,
+            }),
+        }
+    }
+}
+
+/// The shielded subset of a [`Transaction`]'s data that is relevant to a particular wallet.
 ///
 /// [`Transaction`]: zcash_primitives::transaction::Transaction
-pub struct WalletTx<N> {
-    pub txid: TxId,
-    pub index: usize,
-    pub sapling_spends: Vec<WalletSaplingSpend>,
-    pub sapling_outputs: Vec<WalletSaplingOutput<N>>,
+pub struct WalletTx<AccountId> {
+    txid: TxId,
+    block_index: usize,
+    sapling_spends: Vec<WalletSaplingSpend<AccountId>>,
+    sapling_outputs: Vec<WalletSaplingOutput<AccountId>>,
+    #[cfg(feature = "orchard")]
+    orchard_spends: Vec<WalletOrchardSpend<AccountId>>,
+    #[cfg(feature = "orchard")]
+    orchard_outputs: Vec<WalletOrchardOutput<AccountId>>,
 }
 
-#[derive(Debug, Clone)]
+impl<AccountId> WalletTx<AccountId> {
+    /// Constructs a new [`WalletTx`] from its constituent parts.
+    pub fn new(
+        txid: TxId,
+        block_index: usize,
+        sapling_spends: Vec<WalletSaplingSpend<AccountId>>,
+        sapling_outputs: Vec<WalletSaplingOutput<AccountId>>,
+        #[cfg(feature = "orchard")] orchard_spends: Vec<
+            WalletSpend<orchard::note::Nullifier, AccountId>,
+        >,
+        #[cfg(feature = "orchard")] orchard_outputs: Vec<WalletOrchardOutput<AccountId>>,
+    ) -> Self {
+        Self {
+            txid,
+            block_index,
+            sapling_spends,
+            sapling_outputs,
+            #[cfg(feature = "orchard")]
+            orchard_spends,
+            #[cfg(feature = "orchard")]
+            orchard_outputs,
+        }
+    }
+
+    /// Returns the [`TxId`] for the corresponding [`Transaction`].
+    ///
+    /// [`Transaction`]: zcash_primitives::transaction::Transaction
+    pub fn txid(&self) -> TxId {
+        self.txid
+    }
+
+    /// Returns the index of the transaction in the containing block.
+    pub fn block_index(&self) -> usize {
+        self.block_index
+    }
+
+    /// Returns a record for each Sapling note belonging to the wallet that was spent in the
+    /// transaction.
+    pub fn sapling_spends(&self) -> &[WalletSaplingSpend<AccountId>] {
+        self.sapling_spends.as_ref()
+    }
+
+    /// Returns a record for each Sapling note received or produced by the wallet in the
+    /// transaction.
+    pub fn sapling_outputs(&self) -> &[WalletSaplingOutput<AccountId>] {
+        self.sapling_outputs.as_ref()
+    }
+
+    /// Returns a record for each Orchard note belonging to the wallet that was spent in the
+    /// transaction.
+    #[cfg(feature = "orchard")]
+    pub fn orchard_spends(&self) -> &[WalletOrchardSpend<AccountId>] {
+        self.orchard_spends.as_ref()
+    }
+
+    /// Returns a record for each Orchard note received or produced by the wallet in the
+    /// transaction.
+    #[cfg(feature = "orchard")]
+    pub fn orchard_outputs(&self) -> &[WalletOrchardOutput<AccountId>] {
+        self.orchard_outputs.as_ref()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct WalletTransparentOutput {
     outpoint: OutPoint,
     txout: TxOut,
-    height: BlockHeight,
+    mined_height: Option<BlockHeight>,
     recipient_address: TransparentAddress,
 }
 
@@ -40,14 +257,14 @@ impl WalletTransparentOutput {
     pub fn from_parts(
         outpoint: OutPoint,
         txout: TxOut,
-        height: BlockHeight,
+        mined_height: Option<BlockHeight>,
     ) -> Option<WalletTransparentOutput> {
         txout
             .recipient_address()
             .map(|recipient_address| WalletTransparentOutput {
                 outpoint,
                 txout,
-                height,
+                mined_height,
                 recipient_address,
             })
     }
@@ -60,20 +277,20 @@ impl WalletTransparentOutput {
         &self.txout
     }
 
-    pub fn height(&self) -> BlockHeight {
-        self.height
+    pub fn mined_height(&self) -> Option<BlockHeight> {
+        self.mined_height
     }
 
     pub fn recipient_address(&self) -> &TransparentAddress {
         &self.recipient_address
     }
 
-    pub fn value(&self) -> Amount {
+    pub fn value(&self) -> NonNegativeAmount {
         self.txout.value
     }
 }
 
-impl transparent::fees::InputView for WalletTransparentOutput {
+impl transparent_fees::InputView for WalletTransparentOutput {
     fn outpoint(&self) -> &OutPoint {
         &self.outpoint
     }
@@ -82,116 +299,294 @@ impl transparent::fees::InputView for WalletTransparentOutput {
     }
 }
 
-/// A subset of a [`SpendDescription`] relevant to wallets and light clients.
-///
-/// [`SpendDescription`]: zcash_primitives::transaction::components::SpendDescription
-pub struct WalletSaplingSpend {
+/// A reference to a spent note belonging to the wallet within a transaction.
+pub struct WalletSpend<Nf, AccountId> {
     index: usize,
-    nf: sapling::Nullifier,
-    account: AccountId,
+    nf: Nf,
+    account_id: AccountId,
 }
 
-impl WalletSaplingSpend {
-    pub fn from_parts(index: usize, nf: sapling::Nullifier, account: AccountId) -> Self {
-        Self { index, nf, account }
+impl<Nf, AccountId> WalletSpend<Nf, AccountId> {
+    /// Constructs a `WalletSpend` from its constituent parts.
+    pub fn from_parts(index: usize, nf: Nf, account_id: AccountId) -> Self {
+        Self {
+            index,
+            nf,
+            account_id,
+        }
     }
 
+    /// Returns the index of the Sapling spend or Orchard action within the transaction that
+    /// created this spend.
     pub fn index(&self) -> usize {
         self.index
     }
-    pub fn nf(&self) -> &sapling::Nullifier {
+    /// Returns the nullifier of the spent note.
+    pub fn nf(&self) -> &Nf {
         &self.nf
     }
-    pub fn account(&self) -> AccountId {
-        self.account
+    /// Returns the identifier to the account_id to which the note belonged.
+    pub fn account_id(&self) -> &AccountId {
+        &self.account_id
     }
 }
 
-/// A subset of an [`OutputDescription`] relevant to wallets and light clients.
-///
-/// [`OutputDescription`]: zcash_primitives::transaction::components::OutputDescription
-pub struct WalletSaplingOutput<N> {
+/// A type alias for Sapling [`WalletSpend`]s.
+pub type WalletSaplingSpend<AccountId> = WalletSpend<sapling::Nullifier, AccountId>;
+
+/// A type alias for Orchard [`WalletSpend`]s.
+#[cfg(feature = "orchard")]
+pub type WalletOrchardSpend<AccountId> = WalletSpend<orchard::note::Nullifier, AccountId>;
+
+/// An output that was successfully decrypted in the process of wallet scanning.
+pub struct WalletOutput<Note, Nullifier, AccountId> {
     index: usize,
-    cmu: sapling::note::ExtractedNoteCommitment,
     ephemeral_key: EphemeralKeyBytes,
-    account: AccountId,
-    note: sapling::Note,
+    note: Note,
     is_change: bool,
-    witness: sapling::IncrementalWitness,
-    nf: N,
+    note_commitment_tree_position: Position,
+    nf: Option<Nullifier>,
+    account_id: AccountId,
+    recipient_key_scope: Option<zip32::Scope>,
 }
 
-impl<N> WalletSaplingOutput<N> {
-    /// Constructs a new `WalletSaplingOutput` value from its constituent parts.
+impl<Note, Nullifier, AccountId> WalletOutput<Note, Nullifier, AccountId> {
+    /// Constructs a new `WalletOutput` value from its constituent parts.
     #[allow(clippy::too_many_arguments)]
     pub fn from_parts(
         index: usize,
-        cmu: sapling::note::ExtractedNoteCommitment,
         ephemeral_key: EphemeralKeyBytes,
-        account: AccountId,
-        note: sapling::Note,
+        note: Note,
         is_change: bool,
-        witness: sapling::IncrementalWitness,
-        nf: N,
+        note_commitment_tree_position: Position,
+        nf: Option<Nullifier>,
+        account_id: AccountId,
+        recipient_key_scope: Option<zip32::Scope>,
     ) -> Self {
         Self {
             index,
-            cmu,
             ephemeral_key,
-            account,
             note,
             is_change,
-            witness,
+            note_commitment_tree_position,
             nf,
+            account_id,
+            recipient_key_scope,
         }
     }
 
+    /// The index of the output or action in the transaction that created this output.
     pub fn index(&self) -> usize {
         self.index
     }
-    pub fn cmu(&self) -> &sapling::note::ExtractedNoteCommitment {
-        &self.cmu
-    }
+    /// The [`EphemeralKeyBytes`] used in the decryption of the note.
     pub fn ephemeral_key(&self) -> &EphemeralKeyBytes {
         &self.ephemeral_key
     }
-    pub fn account(&self) -> AccountId {
-        self.account
-    }
-    pub fn note(&self) -> &sapling::Note {
+    /// The note.
+    pub fn note(&self) -> &Note {
         &self.note
     }
+    /// A flag indicating whether the process of note decryption determined that this
+    /// output should be classified as change.
     pub fn is_change(&self) -> bool {
         self.is_change
     }
-    pub fn witness(&self) -> &sapling::IncrementalWitness {
-        &self.witness
+    /// The position of the note in the global note commitment tree.
+    pub fn note_commitment_tree_position(&self) -> Position {
+        self.note_commitment_tree_position
     }
-    pub fn witness_mut(&mut self) -> &mut sapling::IncrementalWitness {
-        &mut self.witness
+    /// The nullifier for the note, if the key used to decrypt the note was able to compute it.
+    pub fn nf(&self) -> Option<&Nullifier> {
+        self.nf.as_ref()
     }
-    pub fn nf(&self) -> &N {
-        &self.nf
+    /// The identifier for the account to which the output belongs.
+    pub fn account_id(&self) -> &AccountId {
+        &self.account_id
+    }
+    /// The ZIP 32 scope for which the viewing key that decrypted this output was derived, if
+    /// known.
+    pub fn recipient_key_scope(&self) -> Option<zip32::Scope> {
+        self.recipient_key_scope
+    }
+}
+
+/// A subset of an [`OutputDescription`] relevant to wallets and light clients.
+///
+/// [`OutputDescription`]: sapling::bundle::OutputDescription
+pub type WalletSaplingOutput<AccountId> =
+    WalletOutput<sapling::Note, sapling::Nullifier, AccountId>;
+
+/// The output part of an Orchard [`Action`] that was decrypted in the process of scanning.
+///
+/// [`Action`]: orchard::Action
+#[cfg(feature = "orchard")]
+pub type WalletOrchardOutput<AccountId> =
+    WalletOutput<orchard::note::Note, orchard::note::Nullifier, AccountId>;
+
+/// An enumeration of supported shielded note types for use in [`ReceivedNote`]
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Note {
+    Sapling(sapling::Note),
+    #[cfg(feature = "orchard")]
+    Orchard(orchard::Note),
+}
+
+impl Note {
+    pub fn value(&self) -> NonNegativeAmount {
+        match self {
+            Note::Sapling(n) => n.value().inner().try_into().expect(
+                "Sapling notes must have values in the range of valid non-negative ZEC values.",
+            ),
+            #[cfg(feature = "orchard")]
+            Note::Orchard(n) => NonNegativeAmount::from_u64(n.value().inner()).expect(
+                "Orchard notes must have values in the range of valid non-negative ZEC values.",
+            ),
+        }
+    }
+
+    /// Returns the shielded protocol used by this note.
+    pub fn protocol(&self) -> ShieldedProtocol {
+        match self {
+            Note::Sapling(_) => ShieldedProtocol::Sapling,
+            #[cfg(feature = "orchard")]
+            Note::Orchard(_) => ShieldedProtocol::Orchard,
+        }
     }
 }
 
 /// Information about a note that is tracked by the wallet that is available for spending,
 /// with sufficient information for use in note selection.
-pub struct ReceivedSaplingNote<NoteRef> {
-    pub note_id: NoteRef,
-    pub diversifier: sapling::Diversifier,
-    pub note_value: Amount,
-    pub rseed: sapling::Rseed,
-    pub witness: sapling::IncrementalWitness,
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ReceivedNote<NoteRef, NoteT> {
+    note_id: NoteRef,
+    txid: TxId,
+    output_index: u16,
+    note: NoteT,
+    spending_key_scope: Scope,
+    note_commitment_tree_position: Position,
+}
+
+impl<NoteRef, NoteT> ReceivedNote<NoteRef, NoteT> {
+    pub fn from_parts(
+        note_id: NoteRef,
+        txid: TxId,
+        output_index: u16,
+        note: NoteT,
+        spending_key_scope: Scope,
+        note_commitment_tree_position: Position,
+    ) -> Self {
+        ReceivedNote {
+            note_id,
+            txid,
+            output_index,
+            note,
+            spending_key_scope,
+            note_commitment_tree_position,
+        }
+    }
+
+    pub fn internal_note_id(&self) -> &NoteRef {
+        &self.note_id
+    }
+    pub fn txid(&self) -> &TxId {
+        &self.txid
+    }
+    pub fn output_index(&self) -> u16 {
+        self.output_index
+    }
+    pub fn note(&self) -> &NoteT {
+        &self.note
+    }
+    pub fn spending_key_scope(&self) -> Scope {
+        self.spending_key_scope
+    }
+    pub fn note_commitment_tree_position(&self) -> Position {
+        self.note_commitment_tree_position
+    }
+
+    /// Map over the `note` field of this data structure.
+    ///
+    /// Consume this value, applying the provided function to the value of its `note` field and
+    /// returning a new `ReceivedNote` with the result as its `note` field value.
+    pub fn map_note<N, F: Fn(NoteT) -> N>(self, f: F) -> ReceivedNote<NoteRef, N> {
+        ReceivedNote {
+            note_id: self.note_id,
+            txid: self.txid,
+            output_index: self.output_index,
+            note: f(self.note),
+            spending_key_scope: self.spending_key_scope,
+            note_commitment_tree_position: self.note_commitment_tree_position,
+        }
+    }
 }
 
-impl<NoteRef> sapling_fees::InputView<NoteRef> for ReceivedSaplingNote<NoteRef> {
+impl<NoteRef> ReceivedNote<NoteRef, sapling::Note> {
+    pub fn note_value(&self) -> Result<NonNegativeAmount, BalanceError> {
+        self.note.value().inner().try_into()
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl<NoteRef> ReceivedNote<NoteRef, orchard::note::Note> {
+    pub fn note_value(&self) -> Result<NonNegativeAmount, BalanceError> {
+        self.note.value().inner().try_into()
+    }
+}
+
+impl<NoteRef> sapling_fees::InputView<NoteRef> for (NoteRef, sapling::value::NoteValue) {
+    fn note_id(&self) -> &NoteRef {
+        &self.0
+    }
+
+    fn value(&self) -> NonNegativeAmount {
+        self.1
+            .inner()
+            .try_into()
+            .expect("Sapling note values are indirectly checked by consensus.")
+    }
+}
+
+impl<NoteRef> sapling_fees::InputView<NoteRef> for ReceivedNote<NoteRef, sapling::Note> {
+    fn note_id(&self) -> &NoteRef {
+        &self.note_id
+    }
+
+    fn value(&self) -> NonNegativeAmount {
+        self.note
+            .value()
+            .inner()
+            .try_into()
+            .expect("Sapling note values are indirectly checked by consensus.")
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl<NoteRef> orchard_fees::InputView<NoteRef> for (NoteRef, orchard::value::NoteValue) {
+    fn note_id(&self) -> &NoteRef {
+        &self.0
+    }
+
+    fn value(&self) -> NonNegativeAmount {
+        self.1
+            .inner()
+            .try_into()
+            .expect("Orchard note values are indirectly checked by consensus.")
+    }
+}
+
+#[cfg(feature = "orchard")]
+impl<NoteRef> orchard_fees::InputView<NoteRef> for ReceivedNote<NoteRef, orchard::Note> {
     fn note_id(&self) -> &NoteRef {
         &self.note_id
     }
 
-    fn value(&self) -> Amount {
-        self.note_value
+    fn value(&self) -> NonNegativeAmount {
+        self.note
+            .value()
+            .inner()
+            .try_into()
+            .expect("Orchard note values are indirectly checked by consensus.")
     }
 }
 
@@ -202,23 +597,70 @@ impl<NoteRef> sapling_fees::InputView<NoteRef> for ReceivedSaplingNote<NoteRef>
 /// viewing key, refer to [ZIP 310].
 ///
 /// [ZIP 310]: https://zips.z.cash/zip-0310
+#[derive(Debug, Clone)]
 pub enum OvkPolicy {
-    /// Use the outgoing viewing key from the sender's [`ExtendedFullViewingKey`].
+    /// Use the outgoing viewing key from the sender's [`UnifiedFullViewingKey`].
     ///
     /// Transaction outputs will be decryptable by the sender, in addition to the
     /// recipients.
     ///
-    /// [`ExtendedFullViewingKey`]: zcash_primitives::zip32::ExtendedFullViewingKey
+    /// [`UnifiedFullViewingKey`]: zcash_keys::keys::UnifiedFullViewingKey
     Sender,
 
-    /// Use a custom outgoing viewing key. This might for instance be derived from a
-    /// separate seed than the wallet's spending keys.
+    /// Use custom outgoing viewing keys. These might for instance be derived from a
+    /// different seed than the wallet's spending keys.
     ///
     /// Transaction outputs will be decryptable by the recipients, and whoever controls
-    /// the provided outgoing viewing key.
-    Custom(OutgoingViewingKey),
-
-    /// Use no outgoing viewing key. Transaction outputs will be decryptable by their
+    /// the provided outgoing viewing keys.
+    Custom {
+        sapling: sapling::keys::OutgoingViewingKey,
+        #[cfg(feature = "orchard")]
+        orchard: orchard::keys::OutgoingViewingKey,
+    },
+    /// Use no outgoing viewing keys. Transaction outputs will be decryptable by their
     /// recipients, but not by the sender.
     Discard,
 }
+
+impl OvkPolicy {
+    /// Constructs an [`OvkPolicy::Custom`] value from a single arbitrary 32-byte key.
+    ///
+    /// Outputs of transactions created with this OVK policy will be recoverable using
+    /// this key irrespective of the output pool.
+    pub fn custom_from_common_bytes(key: &[u8; 32]) -> Self {
+        OvkPolicy::Custom {
+            sapling: sapling::keys::OutgoingViewingKey(*key),
+            #[cfg(feature = "orchard")]
+            orchard: orchard::keys::OutgoingViewingKey::from(*key),
+        }
+    }
+}
+
+/// Metadata related to the ZIP 32 derivation of a transparent address.
+/// This is implicitly scoped to an account.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[cfg(feature = "transparent-inputs")]
+pub struct TransparentAddressMetadata {
+    scope: TransparentKeyScope,
+    address_index: NonHardenedChildIndex,
+}
+
+#[cfg(feature = "transparent-inputs")]
+impl TransparentAddressMetadata {
+    /// Returns a `TransparentAddressMetadata` in the given scope for the
+    /// given address index.
+    pub fn new(scope: TransparentKeyScope, address_index: NonHardenedChildIndex) -> Self {
+        Self {
+            scope,
+            address_index,
+        }
+    }
+
+    pub fn scope(&self) -> TransparentKeyScope {
+        self.scope
+    }
+
+    pub fn address_index(&self) -> NonHardenedChildIndex {
+        self.address_index
+    }
+}
diff --git a/zcash_client_backend/src/welding_rig.rs b/zcash_client_backend/src/welding_rig.rs
deleted file mode 100644
index 1906c133e6..0000000000
--- a/zcash_client_backend/src/welding_rig.rs
+++ /dev/null
@@ -1,672 +0,0 @@
-//! Tools for scanning a compact representation of the Zcash block chain.
-
-use std::collections::{HashMap, HashSet};
-use std::convert::TryFrom;
-
-use subtle::{ConditionallySelectable, ConstantTimeEq, CtOption};
-use zcash_note_encryption::batch;
-use zcash_primitives::{
-    consensus,
-    sapling::{
-        self,
-        note_encryption::{PreparedIncomingViewingKey, SaplingDomain},
-        Node, Note, Nullifier, NullifierDerivingKey, SaplingIvk,
-    },
-    transaction::components::sapling::CompactOutputDescription,
-    zip32::{sapling::DiversifiableFullViewingKey, AccountId, Scope},
-};
-
-use crate::{
-    proto::compact_formats::CompactBlock,
-    scan::{Batch, BatchRunner, Tasks},
-    wallet::{WalletSaplingOutput, WalletSaplingSpend, WalletTx},
-};
-
-/// A key that can be used to perform trial decryption and nullifier
-/// computation for a Sapling [`CompactSaplingOutput`]
-///
-/// The purpose of this trait is to enable [`scan_block`]
-/// and related methods to be used with either incoming viewing keys
-/// or full viewing keys, with the data returned from trial decryption
-/// being dependent upon the type of key used. In the case that an
-/// incoming viewing key is used, only the note and payment address
-/// will be returned; in the case of a full viewing key, the
-/// nullifier for the note can also be obtained.
-///
-/// [`CompactSaplingOutput`]: crate::proto::compact_formats::CompactSaplingOutput
-/// [`scan_block`]: crate::welding_rig::scan_block
-pub trait ScanningKey {
-    /// The type representing the scope of the scanning key.
-    type Scope: Clone + Eq + std::hash::Hash + Send + 'static;
-
-    /// The type of key that is used to decrypt Sapling outputs;
-    type SaplingNk: Clone;
-
-    type SaplingKeys: IntoIterator<Item = (Self::Scope, SaplingIvk, Self::SaplingNk)>;
-
-    /// The type of nullifier extracted when a note is successfully
-    /// obtained by trial decryption.
-    type Nf;
-
-    /// Obtain the underlying Sapling incoming viewing key(s) for this scanning key.
-    fn to_sapling_keys(&self) -> Self::SaplingKeys;
-
-    /// Produces the nullifier for the specified note and witness, if possible.
-    ///
-    /// IVK-based implementations of this trait cannot successfully derive
-    /// nullifiers, in which case `Self::Nf` should be set to the unit type
-    /// and this function is a no-op.
-    fn sapling_nf(
-        key: &Self::SaplingNk,
-        note: &Note,
-        witness: &sapling::IncrementalWitness,
-    ) -> Self::Nf;
-}
-
-impl ScanningKey for DiversifiableFullViewingKey {
-    type Scope = Scope;
-    type SaplingNk = NullifierDerivingKey;
-    type SaplingKeys = [(Self::Scope, SaplingIvk, Self::SaplingNk); 2];
-    type Nf = sapling::Nullifier;
-
-    fn to_sapling_keys(&self) -> Self::SaplingKeys {
-        [
-            (
-                Scope::External,
-                self.to_ivk(Scope::External),
-                self.to_nk(Scope::External),
-            ),
-            (
-                Scope::Internal,
-                self.to_ivk(Scope::Internal),
-                self.to_nk(Scope::Internal),
-            ),
-        ]
-    }
-
-    fn sapling_nf(
-        key: &Self::SaplingNk,
-        note: &Note,
-        witness: &sapling::IncrementalWitness,
-    ) -> Self::Nf {
-        note.nf(
-            key,
-            u64::try_from(witness.position())
-                .expect("Sapling note commitment tree position must fit into a u64"),
-        )
-    }
-}
-
-/// The [`ScanningKey`] implementation for [`SaplingIvk`]s.
-/// Nullifiers cannot be derived when scanning with these keys.
-///
-/// [`SaplingIvk`]: zcash_primitives::sapling::SaplingIvk
-impl ScanningKey for SaplingIvk {
-    type Scope = ();
-    type SaplingNk = ();
-    type SaplingKeys = [(Self::Scope, SaplingIvk, Self::SaplingNk); 1];
-    type Nf = ();
-
-    fn to_sapling_keys(&self) -> Self::SaplingKeys {
-        [((), self.clone(), ())]
-    }
-
-    fn sapling_nf(_key: &Self::SaplingNk, _note: &Note, _witness: &sapling::IncrementalWitness) {}
-}
-
-/// Scans a [`CompactBlock`] with a set of [`ScanningKey`]s.
-///
-/// Returns a vector of [`WalletTx`]s belonging to any of the given
-/// [`ScanningKey`]s. If scanning with a full viewing key, the nullifiers
-/// of the resulting [`WalletSaplingOutput`]s will also be computed.
-///
-/// The given [`CommitmentTree`] and existing [`IncrementalWitness`]es are
-/// incremented appropriately.
-///
-/// The implementation of [`ScanningKey`] may either support or omit the computation of
-/// the nullifiers for received notes; the implementation for [`ExtendedFullViewingKey`]
-/// will derive the nullifiers for received notes and return them as part of the resulting
-/// [`WalletSaplingOutput`]s, whereas the implementation for [`SaplingIvk`] cannot
-/// do so and will return the unit value in those outputs instead.
-///
-/// [`ExtendedFullViewingKey`]: zcash_primitives::zip32::ExtendedFullViewingKey
-/// [`SaplingIvk`]: zcash_primitives::sapling::SaplingIvk
-/// [`CompactBlock`]: crate::proto::compact_formats::CompactBlock
-/// [`ScanningKey`]: crate::welding_rig::ScanningKey
-/// [`CommitmentTree`]: zcash_primitives::sapling::CommitmentTree
-/// [`IncrementalWitness`]: zcash_primitives::sapling::IncrementalWitness
-/// [`WalletSaplingOutput`]: crate::wallet::WalletSaplingOutput
-/// [`WalletTx`]: crate::wallet::WalletTx
-pub fn scan_block<P: consensus::Parameters + Send + 'static, K: ScanningKey>(
-    params: &P,
-    block: CompactBlock,
-    vks: &[(&AccountId, &K)],
-    nullifiers: &[(AccountId, Nullifier)],
-    tree: &mut sapling::CommitmentTree,
-    existing_witnesses: &mut [&mut sapling::IncrementalWitness],
-) -> Vec<WalletTx<K::Nf>> {
-    scan_block_with_runner::<_, _, ()>(
-        params,
-        block,
-        vks,
-        nullifiers,
-        tree,
-        existing_witnesses,
-        None,
-    )
-}
-
-type TaggedBatch<P, S> = Batch<(AccountId, S), SaplingDomain<P>, CompactOutputDescription>;
-type TaggedBatchRunner<P, S, T> =
-    BatchRunner<(AccountId, S), SaplingDomain<P>, CompactOutputDescription, T>;
-
-#[tracing::instrument(skip_all, fields(height = block.height))]
-pub(crate) fn add_block_to_runner<P, S, T>(
-    params: &P,
-    block: CompactBlock,
-    batch_runner: &mut TaggedBatchRunner<P, S, T>,
-) where
-    P: consensus::Parameters + Send + 'static,
-    S: Clone + Send + 'static,
-    T: Tasks<TaggedBatch<P, S>>,
-{
-    let block_hash = block.hash();
-    let block_height = block.height();
-
-    for tx in block.vtx.into_iter() {
-        let txid = tx.txid();
-        let outputs = tx
-            .outputs
-            .into_iter()
-            .map(|output| {
-                CompactOutputDescription::try_from(output)
-                    .expect("Invalid output found in compact block decoding.")
-            })
-            .collect::<Vec<_>>();
-
-        batch_runner.add_outputs(
-            block_hash,
-            txid,
-            || SaplingDomain::for_height(params.clone(), block_height),
-            &outputs,
-        )
-    }
-}
-
-#[tracing::instrument(skip_all, fields(height = block.height))]
-pub(crate) fn scan_block_with_runner<
-    P: consensus::Parameters + Send + 'static,
-    K: ScanningKey,
-    T: Tasks<TaggedBatch<P, K::Scope>> + Sync,
->(
-    params: &P,
-    block: CompactBlock,
-    vks: &[(&AccountId, &K)],
-    nullifiers: &[(AccountId, Nullifier)],
-    tree: &mut sapling::CommitmentTree,
-    existing_witnesses: &mut [&mut sapling::IncrementalWitness],
-    mut batch_runner: Option<&mut TaggedBatchRunner<P, K::Scope, T>>,
-) -> Vec<WalletTx<K::Nf>> {
-    let mut wtxs: Vec<WalletTx<K::Nf>> = vec![];
-    let block_height = block.height();
-    let block_hash = block.hash();
-
-    for tx in block.vtx.into_iter() {
-        let txid = tx.txid();
-        let index = tx.index as usize;
-
-        // Check for spent notes
-        // The only step that is not constant-time is the filter() at the end.
-        let shielded_spends: Vec<_> = tx
-            .spends
-            .into_iter()
-            .enumerate()
-            .map(|(index, spend)| {
-                let spend_nf = spend.nf().expect(
-                    "Could not deserialize nullifier for spend from protobuf representation.",
-                );
-                // Find the first tracked nullifier that matches this spend, and produce
-                // a WalletShieldedSpend if there is a match, in constant time.
-                nullifiers
-                    .iter()
-                    .map(|&(account, nf)| CtOption::new(account, nf.ct_eq(&spend_nf)))
-                    .fold(
-                        CtOption::new(AccountId::from(0), 0.into()),
-                        |first, next| CtOption::conditional_select(&next, &first, first.is_some()),
-                    )
-                    .map(|account| WalletSaplingSpend::from_parts(index, spend_nf, account))
-            })
-            .filter(|spend| spend.is_some().into())
-            .map(|spend| spend.unwrap())
-            .collect();
-
-        // Collect the set of accounts that were spent from in this transaction
-        let spent_from_accounts: HashSet<_> = shielded_spends
-            .iter()
-            .map(|spend| spend.account())
-            .collect();
-
-        // Check for incoming notes while incrementing tree and witnesses
-        let mut shielded_outputs: Vec<WalletSaplingOutput<K::Nf>> = vec![];
-        {
-            // Grab mutable references to new witnesses from previous transactions
-            // in this block so that we can update them. Scoped so we don't hold
-            // mutable references to wtxs for too long.
-            let mut block_witnesses: Vec<_> = wtxs
-                .iter_mut()
-                .flat_map(|tx| {
-                    tx.sapling_outputs
-                        .iter_mut()
-                        .map(|output| output.witness_mut())
-                })
-                .collect();
-
-            let decoded = &tx
-                .outputs
-                .into_iter()
-                .map(|output| {
-                    (
-                        SaplingDomain::for_height(params.clone(), block_height),
-                        CompactOutputDescription::try_from(output)
-                            .expect("Invalid output found in compact block decoding."),
-                    )
-                })
-                .collect::<Vec<_>>();
-
-            let decrypted: Vec<_> = if let Some(runner) = batch_runner.as_mut() {
-                let vks = vks
-                    .iter()
-                    .flat_map(|(a, k)| {
-                        k.to_sapling_keys()
-                            .into_iter()
-                            .map(move |(scope, _, nk)| ((**a, scope), nk))
-                    })
-                    .collect::<HashMap<_, _>>();
-
-                let mut decrypted = runner.collect_results(block_hash, txid);
-                (0..decoded.len())
-                    .map(|i| {
-                        decrypted.remove(&(txid, i)).map(|d_note| {
-                            let a = d_note.ivk_tag.0;
-                            let nk = vks.get(&d_note.ivk_tag).expect(
-                                "The batch runner and scan_block must use the same set of IVKs.",
-                            );
-
-                            ((d_note.note, d_note.recipient), a, (*nk).clone())
-                        })
-                    })
-                    .collect()
-            } else {
-                let vks = vks
-                    .iter()
-                    .flat_map(|(a, k)| {
-                        k.to_sapling_keys()
-                            .into_iter()
-                            .map(move |(_, ivk, nk)| (**a, ivk, nk))
-                    })
-                    .collect::<Vec<_>>();
-
-                let ivks = vks
-                    .iter()
-                    .map(|(_, ivk, _)| ivk)
-                    .map(PreparedIncomingViewingKey::new)
-                    .collect::<Vec<_>>();
-
-                batch::try_compact_note_decryption(&ivks, decoded)
-                    .into_iter()
-                    .map(|v| {
-                        v.map(|(note_data, ivk_idx)| {
-                            let (account, _, nk) = &vks[ivk_idx];
-                            (note_data, *account, (*nk).clone())
-                        })
-                    })
-                    .collect()
-            };
-
-            for (index, ((_, output), dec_output)) in decoded.iter().zip(decrypted).enumerate() {
-                // Grab mutable references to new witnesses from previous outputs
-                // in this transaction so that we can update them. Scoped so we
-                // don't hold mutable references to shielded_outputs for too long.
-                let new_witnesses: Vec<_> = shielded_outputs
-                    .iter_mut()
-                    .map(|out| out.witness_mut())
-                    .collect();
-
-                // Increment tree and witnesses
-                let node = Node::from_cmu(&output.cmu);
-                for witness in &mut *existing_witnesses {
-                    witness.append(node).unwrap();
-                }
-                for witness in &mut block_witnesses {
-                    witness.append(node).unwrap();
-                }
-                for witness in new_witnesses {
-                    witness.append(node).unwrap();
-                }
-                tree.append(node).unwrap();
-
-                if let Some(((note, _), account, nk)) = dec_output {
-                    // A note is marked as "change" if the account that received it
-                    // also spent notes in the same transaction. This will catch,
-                    // for instance:
-                    // - Change created by spending fractions of notes.
-                    // - Notes created by consolidation transactions.
-                    // - Notes sent from one account to itself.
-                    let is_change = spent_from_accounts.contains(&account);
-                    let witness = sapling::IncrementalWitness::from_tree(tree.clone());
-                    let nf = K::sapling_nf(&nk, &note, &witness);
-
-                    shielded_outputs.push(WalletSaplingOutput::from_parts(
-                        index,
-                        output.cmu,
-                        output.ephemeral_key.clone(),
-                        account,
-                        note,
-                        is_change,
-                        witness,
-                        nf,
-                    ))
-                }
-            }
-        }
-
-        if !(shielded_spends.is_empty() && shielded_outputs.is_empty()) {
-            wtxs.push(WalletTx {
-                txid,
-                index,
-                sapling_spends: shielded_spends,
-                sapling_outputs: shielded_outputs,
-            });
-        }
-    }
-
-    wtxs
-}
-
-#[cfg(test)]
-mod tests {
-    use group::{
-        ff::{Field, PrimeField},
-        GroupEncoding,
-    };
-    use rand_core::{OsRng, RngCore};
-    use zcash_note_encryption::Domain;
-    use zcash_primitives::{
-        consensus::{BlockHeight, Network},
-        constants::SPENDING_KEY_GENERATOR,
-        memo::MemoBytes,
-        sapling::{
-            note_encryption::{sapling_note_encryption, PreparedIncomingViewingKey, SaplingDomain},
-            util::generate_random_rseed,
-            value::NoteValue,
-            CommitmentTree, Note, Nullifier, SaplingIvk,
-        },
-        transaction::components::Amount,
-        zip32::{AccountId, DiversifiableFullViewingKey, ExtendedSpendingKey},
-    };
-
-    use crate::{
-        proto::compact_formats::{
-            CompactBlock, CompactSaplingOutput, CompactSaplingSpend, CompactTx,
-        },
-        scan::BatchRunner,
-    };
-
-    use super::{add_block_to_runner, scan_block, scan_block_with_runner, ScanningKey};
-
-    fn random_compact_tx(mut rng: impl RngCore) -> CompactTx {
-        let fake_nf = {
-            let mut nf = vec![0; 32];
-            rng.fill_bytes(&mut nf);
-            nf
-        };
-        let fake_cmu = {
-            let fake_cmu = bls12_381::Scalar::random(&mut rng);
-            fake_cmu.to_repr().as_ref().to_owned()
-        };
-        let fake_epk = {
-            let mut buffer = [0; 64];
-            rng.fill_bytes(&mut buffer);
-            let fake_esk = jubjub::Fr::from_bytes_wide(&buffer);
-            let fake_epk = SPENDING_KEY_GENERATOR * fake_esk;
-            fake_epk.to_bytes().to_vec()
-        };
-        let cspend = CompactSaplingSpend { nf: fake_nf };
-        let cout = CompactSaplingOutput {
-            cmu: fake_cmu,
-            ephemeral_key: fake_epk,
-            ciphertext: vec![0; 52],
-        };
-        let mut ctx = CompactTx::default();
-        let mut txid = vec![0; 32];
-        rng.fill_bytes(&mut txid);
-        ctx.hash = txid;
-        ctx.spends.push(cspend);
-        ctx.outputs.push(cout);
-        ctx
-    }
-
-    /// Create a fake CompactBlock at the given height, with a transaction containing a
-    /// single spend of the given nullifier and a single output paying the given address.
-    /// Returns the CompactBlock.
-    fn fake_compact_block(
-        height: BlockHeight,
-        nf: Nullifier,
-        dfvk: &DiversifiableFullViewingKey,
-        value: Amount,
-        tx_after: bool,
-    ) -> CompactBlock {
-        let to = dfvk.default_address().1;
-
-        // Create a fake Note for the account
-        let mut rng = OsRng;
-        let rseed = generate_random_rseed(&Network::TestNetwork, height, &mut rng);
-        let note = Note::from_parts(to, NoteValue::from_raw(value.into()), rseed);
-        let encryptor = sapling_note_encryption::<_, Network>(
-            Some(dfvk.fvk().ovk),
-            note.clone(),
-            MemoBytes::empty(),
-            &mut rng,
-        );
-        let cmu = note.cmu().to_bytes().to_vec();
-        let ephemeral_key = SaplingDomain::<Network>::epk_bytes(encryptor.epk())
-            .0
-            .to_vec();
-        let enc_ciphertext = encryptor.encrypt_note_plaintext();
-
-        // Create a fake CompactBlock containing the note
-        let mut cb = CompactBlock {
-            hash: {
-                let mut hash = vec![0; 32];
-                rng.fill_bytes(&mut hash);
-                hash
-            },
-            height: height.into(),
-            ..Default::default()
-        };
-
-        // Add a random Sapling tx before ours
-        {
-            let mut tx = random_compact_tx(&mut rng);
-            tx.index = cb.vtx.len() as u64;
-            cb.vtx.push(tx);
-        }
-
-        let cspend = CompactSaplingSpend { nf: nf.0.to_vec() };
-        let cout = CompactSaplingOutput {
-            cmu,
-            ephemeral_key,
-            ciphertext: enc_ciphertext.as_ref()[..52].to_vec(),
-        };
-        let mut ctx = CompactTx::default();
-        let mut txid = vec![0; 32];
-        rng.fill_bytes(&mut txid);
-        ctx.hash = txid;
-        ctx.spends.push(cspend);
-        ctx.outputs.push(cout);
-        ctx.index = cb.vtx.len() as u64;
-        cb.vtx.push(ctx);
-
-        // Optionally add another random Sapling tx after ours
-        if tx_after {
-            let mut tx = random_compact_tx(&mut rng);
-            tx.index = cb.vtx.len() as u64;
-            cb.vtx.push(tx);
-        }
-
-        cb
-    }
-
-    #[test]
-    fn scan_block_with_my_tx() {
-        fn go(scan_multithreaded: bool) {
-            let account = AccountId::from(0);
-            let extsk = ExtendedSpendingKey::master(&[]);
-            let dfvk = extsk.to_diversifiable_full_viewing_key();
-
-            let cb = fake_compact_block(
-                1u32.into(),
-                Nullifier([0; 32]),
-                &dfvk,
-                Amount::from_u64(5).unwrap(),
-                false,
-            );
-            assert_eq!(cb.vtx.len(), 2);
-
-            let mut tree = CommitmentTree::empty();
-            let mut batch_runner = if scan_multithreaded {
-                let mut runner = BatchRunner::<_, _, _, ()>::new(
-                    10,
-                    dfvk.to_sapling_keys()
-                        .iter()
-                        .map(|(scope, ivk, _)| ((account, *scope), ivk))
-                        .map(|(tag, ivk)| (tag, PreparedIncomingViewingKey::new(ivk))),
-                );
-
-                add_block_to_runner(&Network::TestNetwork, cb.clone(), &mut runner);
-                runner.flush();
-
-                Some(runner)
-            } else {
-                None
-            };
-
-            let txs = scan_block_with_runner(
-                &Network::TestNetwork,
-                cb,
-                &[(&account, &dfvk)],
-                &[],
-                &mut tree,
-                &mut [],
-                batch_runner.as_mut(),
-            );
-            assert_eq!(txs.len(), 1);
-
-            let tx = &txs[0];
-            assert_eq!(tx.index, 1);
-            assert_eq!(tx.sapling_spends.len(), 0);
-            assert_eq!(tx.sapling_outputs.len(), 1);
-            assert_eq!(tx.sapling_outputs[0].index(), 0);
-            assert_eq!(tx.sapling_outputs[0].account(), account);
-            assert_eq!(tx.sapling_outputs[0].note().value().inner(), 5);
-
-            // Check that the witness root matches
-            assert_eq!(tx.sapling_outputs[0].witness().root(), tree.root());
-        }
-
-        go(false);
-        go(true);
-    }
-
-    #[test]
-    fn scan_block_with_txs_after_my_tx() {
-        fn go(scan_multithreaded: bool) {
-            let account = AccountId::from(0);
-            let extsk = ExtendedSpendingKey::master(&[]);
-            let dfvk = extsk.to_diversifiable_full_viewing_key();
-
-            let cb = fake_compact_block(
-                1u32.into(),
-                Nullifier([0; 32]),
-                &dfvk,
-                Amount::from_u64(5).unwrap(),
-                true,
-            );
-            assert_eq!(cb.vtx.len(), 3);
-
-            let mut tree = CommitmentTree::empty();
-            let mut batch_runner = if scan_multithreaded {
-                let mut runner = BatchRunner::<_, _, _, ()>::new(
-                    10,
-                    dfvk.to_sapling_keys()
-                        .iter()
-                        .map(|(scope, ivk, _)| ((account, *scope), ivk))
-                        .map(|(tag, ivk)| (tag, PreparedIncomingViewingKey::new(ivk))),
-                );
-
-                add_block_to_runner(&Network::TestNetwork, cb.clone(), &mut runner);
-                runner.flush();
-
-                Some(runner)
-            } else {
-                None
-            };
-
-            let txs = scan_block_with_runner(
-                &Network::TestNetwork,
-                cb,
-                &[(&AccountId::from(0), &dfvk)],
-                &[],
-                &mut tree,
-                &mut [],
-                batch_runner.as_mut(),
-            );
-            assert_eq!(txs.len(), 1);
-
-            let tx = &txs[0];
-            assert_eq!(tx.index, 1);
-            assert_eq!(tx.sapling_spends.len(), 0);
-            assert_eq!(tx.sapling_outputs.len(), 1);
-            assert_eq!(tx.sapling_outputs[0].index(), 0);
-            assert_eq!(tx.sapling_outputs[0].account(), AccountId::from(0));
-            assert_eq!(tx.sapling_outputs[0].note().value().inner(), 5);
-
-            // Check that the witness root matches
-            assert_eq!(tx.sapling_outputs[0].witness().root(), tree.root());
-        }
-
-        go(false);
-        go(true);
-    }
-
-    #[test]
-    fn scan_block_with_my_spend() {
-        let extsk = ExtendedSpendingKey::master(&[]);
-        let dfvk = extsk.to_diversifiable_full_viewing_key();
-        let nf = Nullifier([7; 32]);
-        let account = AccountId::from(12);
-
-        let cb = fake_compact_block(1u32.into(), nf, &dfvk, Amount::from_u64(5).unwrap(), false);
-        assert_eq!(cb.vtx.len(), 2);
-        let vks: Vec<(&AccountId, &SaplingIvk)> = vec![];
-
-        let mut tree = CommitmentTree::empty();
-        let txs = scan_block(
-            &Network::TestNetwork,
-            cb,
-            &vks[..],
-            &[(account, nf)],
-            &mut tree,
-            &mut [],
-        );
-        assert_eq!(txs.len(), 1);
-
-        let tx = &txs[0];
-        assert_eq!(tx.index, 1);
-        assert_eq!(tx.sapling_spends.len(), 1);
-        assert_eq!(tx.sapling_outputs.len(), 0);
-        assert_eq!(tx.sapling_spends[0].index(), 0);
-        assert_eq!(tx.sapling_spends[0].nf(), &nf);
-        assert_eq!(tx.sapling_spends[0].account(), account);
-    }
-}
diff --git a/zcash_client_sqlite/CHANGELOG.md b/zcash_client_sqlite/CHANGELOG.md
index d72fe90ac0..40d73275eb 100644
--- a/zcash_client_sqlite/CHANGELOG.md
+++ b/zcash_client_sqlite/CHANGELOG.md
@@ -6,13 +6,288 @@ and this library adheres to Rust's notion of
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+### Added
+- `zcash_client_sqlite::AccountUuid`
+
+### Changed
+- The `v_transactions` view has been modified:
+  - The `account_id` column has been replaced with `account_uuid`.
+- The `v_tx_outputs` view has been modified:
+  - The `from_account_id` column has been replaced with `from_account_uuid`.
+  - The `to_account_id` column has been replaced with `to_account_uuid`.
+- The `WalletRead` and `InputSource` impls for `WalletDb` now set the `AccountId`
+  associated type to `AccountUuid`.
+- Variants of `SqliteClientError` have changed:
+  - The `AccountCollision` and `ReachedGapLimit` now carry `AccountUuid` values
+    instead of `AccountId`s.
+  - `SqliteClientError::AccountIdDiscontinuity` has been removed as it is now
+    unused.
+  - `SqliteClientError::AccountIdOutOfRange` has been renamed to
+    `Zip32AccountIndexOutOfRange`.
+
+### Removed
+- `zcash_client_sqlite::AccountId` (use `AccountUuid` instead).
+
+## [0.13.0] - 2024-11-14
+
+### Added
+- Exposed `AccountId::from_u32` and `AccountId::as_u32` conversions under the
+  `unstable` feature flag.
+
+### Changed
+- MSRV is now 1.77.0.
+- Migrated to `zcash_primitives 0.20`, `zcash_keys 0.5`,
+  `zcash_client_backend 0.15`.
+- Migrated from `schemer` to our fork `schemerz`.
+- Migrated to `rusqlite 0.32`.
+- `error::SqliteClientError` has additional variant `NoteFilterInvalid`
+
+## [0.12.2] - 2024-10-21
+
+### Fixed
+- Fixes an error in determining the minimum checkpoint height to which it's
+  possible to rewind in the case of a reorg, when no other truncation height
+  information is available.
+
+## [0.12.1] - 2024-10-10
+
+### Fixed
+- An error in scan progress computation was fixed. As part of this fix, wallet
+  summary information is now only returned in the case that some note
+  commitment tree size information can be determined, either from subtree root
+  download or from downloaded block data. NOTE: The recovery progress ratio may
+  be present as `0:0` in the case that the recovery range contains no notes;
+  this was not adequately documented in the previous release.
+
+## [0.12.0] - 2024-10-04
+
+### Added
+- `impl WalletTest for WalletDb` is now available under the `test-dependencies`
+  feature flag.
+
+### Changed
+- Migrated to `zcash_client_backend 0.14`, `orchard 0.10`,
+  `sapling-crypto 0.3`, `shardtree 0.5`, `zcash_address 0.6`,
+  `zcash_primitives 0.19`, `zcash_proofs 0.19`, `zcash_protocol 0.4`.
+- `zcash_client_sqlite::error::SqliteClientError::RequestedRewindInvalid`
+  is now a structured variant.
+
+## [0.11.2] - 2024-08-21
+
+### Changed
+- The `v_tx_outputs` view was modified slightly to support older versions of
+  `sqlite`. Queries to the exposed `v_tx_outputs` and `v_transactions` views
+  are supported for SQLite versions back to `3.19.x`.
+- `zcash_client_sqlite::wallet::init::WalletMigrationError` has an additional
+  variant, `DatabaseNotSupported`. The `init_wallet_db` function now checks
+  that the sqlite version in use is compatible with the features required by
+  the wallet and returns this error if not. SQLite version `3.35` or higher
+  is required for use with `zcash_client_sqlite`.
+
+## [0.11.1] - 2024-08-21
+
+### Fixed
+- The dependencies of the `tx_retrieval_queue` migration have been fixed to
+  enable migrating wallets containing certain kinds of transactions.
+
+## [0.11.0] - 2024-08-20
+
+`zcash_client_sqlite` now provides capabilities for the management of ephemeral
+transparent addresses in support of the creation of ZIP 320 transaction pairs.
+
+In addition, `zcash_client_sqlite` now provides improved tracking of transparent
+wallet history in support of the API changes in `zcash_client_backend 0.13`,
+and the `v_transactions` view has been modified to provide additional metadata
+about the relationship of each transaction to the wallet, in particular whether
+or not the transaction represents a wallet-internal shielding operation.
+
+### Changed
+- MSRV is now 1.70.0.
+- Updated dependencies:
+  - `zcash_address 0.4`
+  - `zcash_client_backend 0.13`
+  - `zcash_encoding 0.2.1`
+  - `zcash_keys 0.3`
+  - `zcash_primitives 0.16`
+  - `zcash_protocol 0.2`
+- `zcash_client_sqlite::error::SqliteClientError` has a new `ReachedGapLimit` and
+  `EphemeralAddressReuse` variants when the "transparent-inputs" feature is enabled.
+- `zcash_client_sqlite::error::SqliteClientError` has changed variants:
+  - Removed `HdwalletError`.
+  - Added `AccountCollision`.
+  - Added `TransparentDerivation`.
+- The `v_transactions` view has been modified:
+  - The `block` column has been renamed to `mined_height`.
+  - A `spent_note_count` column has been added.
+  - An `is_shielding` column has been added, which is true for transactions where the
+    spends from the wallet are all transparent, and the outputs to the wallet are all
+    shielded.
+- The `v_tx_outputs` view has been modified:
+  - The result can now include transparent outputs with unknown height.
+
+### Fixed
+- The `to_address` column of the `v_tx_outputs` view is now `NULL` for
+  transparent outputs received by the wallet. This column is only intended to
+  contain addresses for outputs sent to external recipients. The fix aligns
+  received transparent outputs with received shielded outputs (which have always
+  returned `NULL`).
+
+## [0.10.3] - 2024-04-08
+
+### Added
+- Added a migration to ensure that the default address for existing wallets is
+  upgraded to include an Orchard receiver.
+
+### Fixed
+- A bug in the SQL query for `WalletDb::get_account_birthday` was fixed.
+
+## [0.10.2] - 2024-03-27
+
+### Fixed
+- A bug in the SQL query for `WalletDb::get_unspent_transparent_output` was fixed.
+
+## [0.10.1] - 2024-03-25
+
+### Fixed
+- The `sent_notes` table's `received_note` constraint was excessively restrictive
+ after zcash/librustzcash#1306. Any databases that have migrations from
+ zcash_client_sqlite 0.10.0 applied should be wiped and restored from seed.
+ In order to ensure that the incorrect migration is not used, the migration
+ id for the `full_account_ids` migration has been changed from
+ `0x1b104345_f27e_42da_a9e3_1de22694da43` to `0x6d02ec76_8720_4cc6_b646_c4e2ce69221c`
+
+## [0.10.0] - 2024-03-25
+
+This version was yanked, use 0.10.1 instead.
+
+### Added
+- A new `orchard` feature flag has been added to make it possible to
+  build client code without `orchard` dependendencies.
+- `zcash_client_sqlite::AccountId`
+- `zcash_client_sqlite::wallet::Account`
+- `impl From<zcash_keys::keys::AddressGenerationError> for SqliteClientError`
+
+### Changed
+- Many places that `AccountId` appeared in the API changed from
+  using `zcash_primitives::zip32::AccountId` to using an opaque `zcash_client_sqlite::AccountId`
+  type.
+  - The enum variant `zcash_client_sqlite::error::SqliteClientError::AccountUnknown`
+    no longer has a `zcash_primitives::zip32::AccountId` data value.
+  - Changes to the implementation of the `WalletWrite` trait:
+    - `create_account` function returns a unique identifier for the new account (as before),
+      except that this ID no longer happens to match the ZIP-32 account index.
+      To get the ZIP-32 account index, use the new `WalletRead::get_account` function.
+  - Two columns in the `transactions` view were renamed. They refer to the primary key field in the `accounts` table, which no longer equates to a ZIP-32 account index.
+    - `to_account` -> `to_account_id`
+    - `from_account` -> `from_account_id`
+- `zcash_client_sqlite::error::SqliteClientError` has changed variants:
+  - Added `AddressGeneration`
+  - Added `UnknownZip32Derivation`
+  - Added `BadAccountData`
+  - Removed `DiversifierIndexOutOfRange`
+  - Removed `InvalidNoteId`
+- `zcash_client_sqlite::wallet`:
+  - `init::WalletMigrationError` has added variants:
+    - `WalletMigrationError::AddressGeneration`
+    - `WalletMigrationError::CannotRevert`
+    - `WalletMigrationError::SeedNotRelevant`
+- The `v_transactions` and `v_tx_outputs` views now include Orchard notes.
+
+## [0.9.1] - 2024-03-09
+
+### Fixed
+- Documentation now correctly builds with all feature flags.
+
+## [0.9.0] - 2024-03-01
+
+### Changed
+- Migrated to `orchard 0.7`, `zcash_primitives 0.14`, `zcash_client_backend 0.11`.
+- `zcash_client_sqlite::error::SqliteClientError` has new error variants:
+  - `SqliteClientError::UnsupportedPoolType`
+  - `SqliteClientError::BalanceError`
+  - The `Bech32DecodeError` variant has been replaced with a more general
+    `DecodingError` type.
+
+## [0.8.1] - 2023-10-18
+
+### Fixed
+- Fixed a bug in `v_transactions` that was omitting value from identically-valued notes
+
+## [0.8.0] - 2023-09-25
+
+### Notable Changes
+- The `v_transactions` and `v_tx_outputs` views have changed in terms of what
+  columns are returned, and which result columns may be null. Please see the
+  `Changed` section below for additional details.
+
+### Added
+- `zcash_client_sqlite::commitment_tree` Types related to management of note
+  commitment trees using the `shardtree` crate.
+- A new default-enabled feature flag `multicore`. This allows users to disable
+  multicore support by setting `default_features = false` on their
+  `zcash_primitives`, `zcash_proofs`, and `zcash_client_sqlite` dependencies.
+- `zcash_client_sqlite::ReceivedNoteId`
+- `zcash_client_sqlite::wallet::commitment_tree` A new module containing a
+  sqlite-backed implementation of `shardtree::store::ShardStore`.
+- `impl zcash_client_backend::data_api::WalletCommitmentTrees for WalletDb`
+
 ### Changed
 - MSRV is now 1.65.0.
-- Bumped dependencies to `hdwallet 0.4`, `incrementalmerkletree 0.4`, `bs58 0.5`,
-  `zcash_primitives 0.12`
+- Bumped dependencies to `hdwallet 0.4`, `incrementalmerkletree 0.5`, `bs58 0.5`,
+  `prost 0.12`, `rusqlite 0.29`, `schemer-rusqlite 0.2.2`, `time 0.3.22`,
+  `tempfile 3.5`, `zcash_address 0.3`, `zcash_note_encryption 0.4`,
+  `zcash_primitives 0.13`, `zcash_client_backend 0.10`.
+- Added dependencies on `shardtree 0.0`, `zcash_encoding 0.2`, `byteorder 1`
+- A `CommitmentTree` variant has been added to `zcash_client_sqlite::wallet::init::WalletMigrationError`
+- `min_confirmations` parameter values are now more strongly enforced. Previously,
+  a note could be spent with fewer than `min_confirmations` confirmations if the
+  wallet did not contain enough observed blocks to satisfy the `min_confirmations`
+  value specified; this situation is now treated as an error.
+- `zcash_client_sqlite::error::SqliteClientError` has new error variants:
+  - `SqliteClientError::AccountUnknown`
+  - `SqliteClientError::BlockConflict`
+  - `SqliteClientError::CacheMiss`
+  - `SqliteClientError::ChainHeightUnknown`
+  - `SqliteClientError::CommitmentTree`
+  - `SqliteClientError::NonSequentialBlocks`
+- `zcash_client_backend::FsBlockDbError` has a new error variant:
+  - `FsBlockDbError::CacheMiss`
+- `zcash_client_sqlite::FsBlockDb::write_block_metadata` now overwrites any
+  existing metadata entries that have the same height as a new entry.
+- The `v_transactions` and `v_tx_outputs` views no longer return the
+  internal database identifier for the transaction. The `txid` column should
+  be used instead. The `tx_index`, `expiry_height`, `raw`, `fee_paid`, and
+  `expired_unmined` columns will be null for received transparent
+  transactions, in addition to the other columns that were previously
+  permitted to be null.
 
 ### Removed
 - The empty `wallet::transact` module has been removed.
+- `zcash_client_sqlite::NoteId` has been replaced with `zcash_client_sqlite::ReceivedNoteId`
+  as the `SentNoteId` variant is now unused following changes to
+  `zcash_client_backend::data_api::WalletRead`.
+- `zcash_client_sqlite::wallet::init::{init_blocks_table, init_accounts_table}`
+  have been removed. `zcash_client_backend::data_api::WalletWrite::create_account`
+  should be used instead; the initialization of the note commitment tree
+  previously performed by `init_blocks_table` is now handled by passing an
+  `AccountBirthday` containing the note commitment tree frontier as of the
+  end of the birthday height block to `create_account` instead.
+- `zcash_client_sqlite::DataConnStmtCache` has been removed in favor of using
+  `rusqlite` caching for prepared statements.
+- `zcash_client_sqlite::prepared` has been entirely removed.
+
+### Fixed
+- Fixed an off-by-one error in the `BlockSource` implementation for the SQLite-backed
+ `BlockDb` block database which could result in blocks being skipped at the start of
+ scan ranges.
+- `zcash_client_sqlite::{BlockDb, FsBlockDb}::with_blocks` now return an error
+  if `from_height` is set to a block height that does not exist in the cache.
+- `WalletDb::get_transaction` no longer returns an error when called on a transaction
+  that has not yet been mined, unless the transaction's consensus branch ID cannot be
+  determined by other means.
+- Fixed an error in `v_transactions` wherein received transparent outputs did not
+  result in a transaction entry appearing in the transaction history.
 
 ## [0.7.1] - 2023-05-17
 
diff --git a/zcash_client_sqlite/Cargo.toml b/zcash_client_sqlite/Cargo.toml
index c58dba2a7d..9606b9ac3d 100644
--- a/zcash_client_sqlite/Cargo.toml
+++ b/zcash_client_sqlite/Cargo.toml
@@ -1,69 +1,137 @@
 [package]
 name = "zcash_client_sqlite"
 description = "An SQLite-based Zcash light client"
-version = "0.7.1"
+version = "0.13.0"
 authors = [
     "Jack Grigg <jack@z.cash>",
     "Kris Nuttycombe <kris@electriccoin.co>"
 ]
 homepage = "https://github.com/zcash/librustzcash"
-repository = "https://github.com/zcash/librustzcash"
+repository.workspace = true
 readme = "README.md"
-license = "MIT OR Apache-2.0"
-edition = "2021"
-rust-version = "1.65"
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
+
+[package.metadata.docs.rs]
+# Manually specify features while `orchard` is not in the public API.
+#all-features = true
+features = [
+    "multicore",
+    "test-dependencies",
+    "transparent-inputs",
+    "unstable",
+]
+rustdoc-args = ["--cfg", "docsrs"]
 
 [dependencies]
-incrementalmerkletree = { version = "0.4", features = ["legacy-api"] }
-zcash_client_backend = { version = "0.9", path = "../zcash_client_backend" }
-zcash_primitives = { version = "0.12", path = "../zcash_primitives", default-features = false }
+zcash_address.workspace = true
+zcash_client_backend = { workspace = true, features = ["unstable-serialization", "unstable-spanning-tree"] }
+zcash_encoding.workspace = true
+zcash_keys = { workspace = true, features = ["sapling"] }
+zcash_primitives.workspace = true
+zcash_protocol.workspace = true
+zip32.workspace = true
 
 # Dependencies exposed in a public API:
 # (Breaking upgrades to these require a breaking upgrade to this crate.)
 # - Errors
-bs58 = { version = "0.5", features = ["check"] }
-hdwallet = { version = "0.4", optional = true }
+bip32 = { workspace = true, optional = true }
+bs58.workspace = true
 
 # - Logging and metrics
-tracing = "0.1"
+tracing.workspace = true
 
-# - Protobuf interfaces
-prost = "0.11"
+# - Serialization
+byteorder.workspace = true
+nonempty.workspace = true
+prost.workspace = true
+group.workspace = true
+jubjub.workspace = true
 
 # - Secret management
-secrecy = "0.8"
+secrecy.workspace = true
+subtle.workspace = true
+
+# - Static assertions
+static_assertions.workspace = true
+
+# - Shielded protocols
+orchard = { workspace = true, optional = true }
+sapling.workspace = true
+
+# - Note commitment trees
+incrementalmerkletree.workspace = true
+shardtree = { workspace = true, features = ["legacy-api"] }
 
 # - SQLite databases
-group = "0.13"
-jubjub = "0.10"
-rusqlite = { version = "0.25", features = ["bundled", "time", "array"] }
-schemer = "0.2"
-schemer-rusqlite = "0.2.1"
-time = "0.2"
-uuid = "1.1"
+rusqlite = { workspace = true, features = ["time", "array", "uuid"] }
+schemerz.workspace = true
+schemerz-rusqlite.workspace = true
+time.workspace = true
+uuid = { workspace = true, features = ["v4"] }
+regex = "1.4"
 
 # Dependencies used internally:
 # (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+document-features.workspace = true
+maybe-rayon.workspace = true
 
 [dev-dependencies]
-assert_matches = "1.5"
-proptest = "1.0.0"
-rand_core = "0.6"
-regex = "1.4"
+ambassador.workspace = true
+assert_matches.workspace = true
+bls12_381.workspace = true
+incrementalmerkletree = { workspace = true, features = ["test-dependencies"] }
+incrementalmerkletree-testing.workspace = true
+pasta_curves.workspace = true
+shardtree = { workspace = true, features = ["legacy-api", "test-dependencies"] }
+orchard = { workspace = true, features = ["test-dependencies"] }
+proptest.workspace = true
+rand_chacha.workspace = true
+rand_core.workspace = true
 tempfile = "3.5.0"
-zcash_note_encryption = "0.4"
-zcash_proofs = { version = "0.12", path = "../zcash_proofs" }
-zcash_primitives = { version = "0.12", path = "../zcash_primitives", features = ["test-dependencies"] }
-zcash_address = { version = "0.3", path = "../components/zcash_address", features = ["test-dependencies"] }
+zcash_keys = { workspace = true, features = ["test-dependencies"] }
+zcash_note_encryption.workspace = true
+zcash_proofs = { workspace = true, features = ["bundled-prover"] }
+zcash_primitives = { workspace = true, features = ["test-dependencies", "non-standard-fees"] }
+zcash_protocol = { workspace = true, features = ["local-consensus"] }
+zcash_client_backend = { workspace = true, features = ["test-dependencies", "unstable-serialization", "unstable-spanning-tree"] }
+zcash_address = { workspace = true, features = ["test-dependencies"] }
+zip321 = { workspace = true }
 
 [features]
-mainnet = []
+default = ["multicore"]
+
+## Enables multithreading support for creating proofs and building subtrees.
+multicore = ["maybe-rayon/threads", "zcash_primitives/multicore"]
+
+## Enables support for storing data related to the sending and receiving of 
+## Orchard funds.
+orchard = ["dep:orchard", "zcash_client_backend/orchard", "zcash_keys/orchard"]
+
+## Exposes APIs that are useful for testing, such as `proptest` strategies.
 test-dependencies = [
+    "incrementalmerkletree/test-dependencies",
     "zcash_primitives/test-dependencies",
     "zcash_client_backend/test-dependencies",
+    "incrementalmerkletree/test-dependencies",
+]
+
+## Enables receiving transparent funds and sending to transparent recipients
+transparent-inputs = [
+  "dep:bip32",
+  "zcash_keys/transparent-inputs",
+  "zcash_client_backend/transparent-inputs"
 ]
-transparent-inputs = ["hdwallet", "zcash_client_backend/transparent-inputs"]
+
+#! ### Experimental features
+
+## Exposes unstable APIs. Their behaviour may change at any time.
 unstable = ["zcash_client_backend/unstable"]
 
+## A feature used to isolate tests that are expensive to run. Test-only.
+expensive-tests = []
+
 [lib]
 bench = false
diff --git a/zcash_client_sqlite/README.md b/zcash_client_sqlite/README.md
index fb71ab098b..af077e8d59 100644
--- a/zcash_client_sqlite/README.md
+++ b/zcash_client_sqlite/README.md
@@ -24,16 +24,6 @@ Licensed under either of
 
 at your option.
 
-Downstream code forks should note that 'zcash_client_sqlite' depends on the
-'orchard' crate, which is licensed under the
-[Bootstrap Open Source License](https://github.com/zcash/orchard/blob/main/LICENSE-BOSL).
-A license exception is provided allowing some derived works that are linked or
-combined with the 'orchard' crate to be copied or distributed under the original
-licenses (in this case MIT / Apache 2.0), provided that the included portions of
-the 'orchard' code remain subject to BOSL.
-See https://github.com/zcash/orchard/blob/main/COPYING for details of which
-derived works can make use of this exception.
-
 ### Contribution
 
 Unless you explicitly state otherwise, any contribution intentionally
diff --git a/zcash_client_sqlite/src/chain.rs b/zcash_client_sqlite/src/chain.rs
index fc9e8d09f2..42e111d629 100644
--- a/zcash_client_sqlite/src/chain.rs
+++ b/zcash_client_sqlite/src/chain.rs
@@ -23,19 +23,19 @@ pub mod migrations;
 
 /// Implements a traversal of `limit` blocks of the block cache database.
 ///
-/// Starting at the next block above `last_scanned_height`, the `with_row` callback is invoked with
-/// each block retrieved from the backing store. If the `limit` value provided is `None`, all
-/// blocks are traversed up to the maximum height.
-pub(crate) fn blockdb_with_blocks<F, DbErrT, NoteRef>(
+/// Starting at `from_height`, the `with_row` callback is invoked with each block retrieved from
+/// the backing store. If the `limit` value provided is `None`, all blocks are traversed up to the
+/// maximum height.
+pub(crate) fn blockdb_with_blocks<F, DbErrT>(
     block_source: &BlockDb,
-    last_scanned_height: Option<BlockHeight>,
-    limit: Option<u32>,
+    from_height: Option<BlockHeight>,
+    limit: Option<usize>,
     mut with_row: F,
-) -> Result<(), Error<DbErrT, SqliteClientError, NoteRef>>
+) -> Result<(), Error<DbErrT, SqliteClientError>>
 where
-    F: FnMut(CompactBlock) -> Result<(), Error<DbErrT, SqliteClientError, NoteRef>>,
+    F: FnMut(CompactBlock) -> Result<(), Error<DbErrT, SqliteClientError>>,
 {
-    fn to_chain_error<D, E: Into<SqliteClientError>, N>(err: E) -> Error<D, SqliteClientError, N> {
+    fn to_chain_error<D, E: Into<SqliteClientError>>(err: E) -> Error<D, SqliteClientError> {
         Error::BlockSource(err.into())
     }
 
@@ -43,21 +43,35 @@ where
     let mut stmt_blocks = block_source
         .0
         .prepare(
-            "SELECT height, data FROM compactblocks 
-            WHERE height > ? 
+            "SELECT height, data FROM compactblocks
+            WHERE height >= ?
             ORDER BY height ASC LIMIT ?",
         )
         .map_err(to_chain_error)?;
 
     let mut rows = stmt_blocks
         .query(params![
-            last_scanned_height.map_or(0u32, u32::from),
-            limit.unwrap_or(u32::max_value()),
+            from_height.map_or(0u32, u32::from),
+            limit
+                .and_then(|l| u32::try_from(l).ok())
+                .unwrap_or(u32::MAX)
         ])
         .map_err(to_chain_error)?;
 
+    // Only look for the `from_height` in the scanned blocks if it is set.
+    let mut from_height_found = from_height.is_none();
     while let Some(row) = rows.next().map_err(to_chain_error)? {
         let height = BlockHeight::from_u32(row.get(0).map_err(to_chain_error)?);
+        if !from_height_found {
+            // We will only perform this check on the first row.
+            let from_height = from_height.expect("can only reach here if set");
+            if from_height != height {
+                return Err(to_chain_error(SqliteClientError::CacheMiss(from_height)));
+            } else {
+                from_height_found = true;
+            }
+        }
+
         let data: Vec<u8> = row.get(1).map_err(to_chain_error)?;
         let block = CompactBlock::decode(&data[..]).map_err(to_chain_error)?;
         if block.height() != height {
@@ -71,6 +85,11 @@ where
         with_row(block)?;
     }
 
+    if !from_height_found {
+        let from_height = from_height.expect("can only reach here if set");
+        return Err(to_chain_error(SqliteClientError::CacheMiss(from_height)));
+    }
+
     Ok(())
 }
 
@@ -101,21 +120,40 @@ pub(crate) fn blockmetadb_insert(
     conn: &Connection,
     block_meta: &[BlockMeta],
 ) -> Result<(), rusqlite::Error> {
+    use rusqlite::named_params;
+
     let mut stmt_insert = conn.prepare(
-        "INSERT INTO compactblocks_meta (height, blockhash, time, sapling_outputs_count, orchard_actions_count)
-        VALUES (?, ?, ?, ?, ?)"
+        "INSERT INTO compactblocks_meta (
+            height,
+            blockhash,
+            time,
+            sapling_outputs_count,
+            orchard_actions_count
+        )
+        VALUES (
+            :height,
+            :blockhash,
+            :time,
+            :sapling_outputs_count,
+            :orchard_actions_count
+        )
+        ON CONFLICT (height) DO UPDATE
+        SET blockhash = :blockhash,
+            time = :time,
+            sapling_outputs_count = :sapling_outputs_count,
+            orchard_actions_count = :orchard_actions_count",
     )?;
 
     conn.execute("BEGIN IMMEDIATE", [])?;
     let result = block_meta
         .iter()
         .map(|m| {
-            stmt_insert.execute(params![
-                u32::from(m.height),
-                &m.block_hash.0[..],
-                m.block_time,
-                m.sapling_outputs_count,
-                m.orchard_actions_count,
+            stmt_insert.execute(named_params![
+                ":height": u32::from(m.height),
+                ":blockhash": &m.block_hash.0[..],
+                ":time": m.block_time,
+                ":sapling_outputs_count": m.sapling_outputs_count,
+                ":orchard_actions_count": m.orchard_actions_count,
             ])
         })
         .collect::<Result<Vec<_>, _>>();
@@ -191,20 +229,20 @@ pub(crate) fn blockmetadb_find_block(
 /// Implements a traversal of `limit` blocks of the filesystem-backed
 /// block cache.
 ///
-/// Starting at the next block height above `last_scanned_height`, the `with_row` callback is
-/// invoked with each block retrieved from the backing store. If the `limit` value provided is
-/// `None`, all blocks are traversed up to the maximum height for which metadata is available.
+/// Starting at `from_height`, the `with_row` callback is invoked with each block retrieved from
+/// the backing store. If the `limit` value provided is `None`, all blocks are traversed up to the
+/// maximum height for which metadata is available.
 #[cfg(feature = "unstable")]
-pub(crate) fn fsblockdb_with_blocks<F, DbErrT, NoteRef>(
+pub(crate) fn fsblockdb_with_blocks<F, DbErrT>(
     cache: &FsBlockDb,
-    last_scanned_height: Option<BlockHeight>,
-    limit: Option<u32>,
+    from_height: Option<BlockHeight>,
+    limit: Option<usize>,
     mut with_block: F,
-) -> Result<(), Error<DbErrT, FsBlockDbError, NoteRef>>
+) -> Result<(), Error<DbErrT, FsBlockDbError>>
 where
-    F: FnMut(CompactBlock) -> Result<(), Error<DbErrT, FsBlockDbError, NoteRef>>,
+    F: FnMut(CompactBlock) -> Result<(), Error<DbErrT, FsBlockDbError>>,
 {
-    fn to_chain_error<D, E: Into<FsBlockDbError>, N>(err: E) -> Error<D, FsBlockDbError, N> {
+    fn to_chain_error<D, E: Into<FsBlockDbError>>(err: E) -> Error<D, FsBlockDbError> {
         Error::BlockSource(err.into())
     }
 
@@ -214,7 +252,7 @@ where
         .prepare(
             "SELECT height, blockhash, time, sapling_outputs_count, orchard_actions_count
              FROM compactblocks_meta
-             WHERE height > ?
+             WHERE height >= ?
              ORDER BY height ASC LIMIT ?",
         )
         .map_err(to_chain_error)?;
@@ -222,8 +260,10 @@ where
     let rows = stmt_blocks
         .query_map(
             params![
-                last_scanned_height.map_or(0u32, u32::from),
-                limit.unwrap_or(u32::max_value()),
+                from_height.map_or(0u32, u32::from),
+                limit
+                    .and_then(|l| u32::try_from(l).ok())
+                    .unwrap_or(u32::MAX)
             ],
             |row| {
                 Ok(BlockMeta {
@@ -237,8 +277,20 @@ where
         )
         .map_err(to_chain_error)?;
 
+    // Only look for the `from_height` in the scanned blocks if it is set.
+    let mut from_height_found = from_height.is_none();
     for row_result in rows {
         let cbr = row_result.map_err(to_chain_error)?;
+        if !from_height_found {
+            // We will only perform this check on the first row.
+            let from_height = from_height.expect("can only reach here if set");
+            if from_height != cbr.height {
+                return Err(to_chain_error(FsBlockDbError::CacheMiss(from_height)));
+            } else {
+                from_height_found = true;
+            }
+        }
+
         let mut block_file =
             File::open(cbr.block_file_path(&cache.blocks_dir)).map_err(to_chain_error)?;
         let mut block_data = vec![];
@@ -259,481 +311,109 @@ where
         with_block(block)?;
     }
 
+    if !from_height_found {
+        let from_height = from_height.expect("can only reach here if set");
+        return Err(to_chain_error(FsBlockDbError::CacheMiss(from_height)));
+    }
+
     Ok(())
 }
 
 #[cfg(test)]
-#[allow(deprecated)]
 mod tests {
-    use secrecy::Secret;
-    use tempfile::NamedTempFile;
-
-    use zcash_primitives::{
-        block::BlockHash, transaction::components::Amount, zip32::ExtendedSpendingKey,
-    };
-
-    use zcash_client_backend::data_api::chain::{
-        error::{Cause, Error},
-        scan_cached_blocks, validate_chain,
-    };
-    use zcash_client_backend::data_api::WalletRead;
-
-    use crate::{
-        chain::init::init_cache_database,
-        tests::{
-            self, fake_compact_block, fake_compact_block_spending, init_test_accounts_table,
-            insert_into_cache, sapling_activation_height, AddressType,
-        },
-        wallet::{get_balance, init::init_wallet_db, truncate_to_height},
-        AccountId, BlockDb, WalletDb,
-    };
+    use zcash_client_backend::data_api::testing::sapling::SaplingPoolTester;
+
+    use crate::testing;
+
+    #[cfg(feature = "orchard")]
+    use zcash_client_backend::data_api::testing::orchard::OrchardPoolTester;
 
     #[test]
-    fn valid_chain_states() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Empty chain should return None
-        assert_matches!(db_data.get_max_height_hash(), Ok(None));
-
-        // Create a fake CompactBlock sending value to the address
-        let fake_block_hash = BlockHash([0; 32]);
-        let fake_block_height = sapling_activation_height();
-
-        let (cb, _) = fake_compact_block(
-            fake_block_height,
-            fake_block_hash,
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(5).unwrap(),
-        );
-
-        insert_into_cache(&db_cache, &cb);
-
-        // Cache-only chain should be valid
-        let validate_chain_result = validate_chain(
-            &db_cache,
-            Some((fake_block_height, fake_block_hash)),
-            Some(1),
-        );
-
-        assert_matches!(validate_chain_result, Ok(()));
-
-        // Scan the cache
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Data-only chain should be valid
-        validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None).unwrap();
-
-        // Create a second fake CompactBlock sending more value to the address
-        let (cb2, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(7).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb2);
-
-        // Data+cache chain should be valid
-        validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None).unwrap();
-
-        // Scan the cache again
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Data-only chain should be valid
-        validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None).unwrap();
+    fn valid_chain_states_sapling() {
+        testing::pool::valid_chain_states::<SaplingPoolTester>()
     }
 
     #[test]
-    fn invalid_chain_cache_disconnected() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Create some fake CompactBlocks
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(5).unwrap(),
-        );
-        let (cb2, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(7).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb);
-        insert_into_cache(&db_cache, &cb2);
-
-        // Scan the cache
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Data-only chain should be valid
-        validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None).unwrap();
-
-        // Create more fake CompactBlocks that don't connect to the scanned ones
-        let (cb3, _) = fake_compact_block(
-            sapling_activation_height() + 2,
-            BlockHash([1; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(8).unwrap(),
-        );
-        let (cb4, _) = fake_compact_block(
-            sapling_activation_height() + 3,
-            cb3.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(3).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb3);
-        insert_into_cache(&db_cache, &cb4);
-
-        // Data+cache chain should be invalid at the data/cache boundary
-        let val_result = validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None);
-
-        assert_matches!(val_result, Err(Error::Chain(e)) if e.at_height() == sapling_activation_height() + 2);
+    #[cfg(feature = "orchard")]
+    fn valid_chain_states_orchard() {
+        testing::pool::valid_chain_states::<OrchardPoolTester>()
     }
 
     #[test]
-    fn invalid_chain_cache_reorg() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Create some fake CompactBlocks
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(5).unwrap(),
-        );
-        let (cb2, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(7).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb);
-        insert_into_cache(&db_cache, &cb2);
-
-        // Scan the cache
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Data-only chain should be valid
-        validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None).unwrap();
-
-        // Create more fake CompactBlocks that contain a reorg
-        let (cb3, _) = fake_compact_block(
-            sapling_activation_height() + 2,
-            cb2.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(8).unwrap(),
-        );
-        let (cb4, _) = fake_compact_block(
-            sapling_activation_height() + 3,
-            BlockHash([1; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            Amount::from_u64(3).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb3);
-        insert_into_cache(&db_cache, &cb4);
-
-        // Data+cache chain should be invalid inside the cache
-        let val_result = validate_chain(&db_cache, db_data.get_max_height_hash().unwrap(), None);
-
-        assert_matches!(val_result, Err(Error::Chain(e)) if e.at_height() == sapling_activation_height() + 3);
+    #[cfg(feature = "orchard")]
+    fn invalid_chain_cache_disconnected_sapling() {
+        testing::pool::invalid_chain_cache_disconnected::<SaplingPoolTester>()
     }
 
     #[test]
-    fn data_db_truncation() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Account balance should be zero
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::zero()
-        );
-
-        // Create fake CompactBlocks sending value to the address
-        let value = Amount::from_u64(5).unwrap();
-        let value2 = Amount::from_u64(7).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-
-        let (cb2, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value2,
-        );
-        insert_into_cache(&db_cache, &cb);
-        insert_into_cache(&db_cache, &cb2);
-
-        // Scan the cache
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Account balance should reflect both received notes
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            (value + value2).unwrap()
-        );
-
-        // "Rewind" to height of last scanned block
-        truncate_to_height(&db_data, sapling_activation_height() + 1).unwrap();
-
-        // Account balance should be unaltered
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            (value + value2).unwrap()
-        );
-
-        // Rewind so that one block is dropped
-        truncate_to_height(&db_data, sapling_activation_height()).unwrap();
-
-        // Account balance should only contain the first received note
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-
-        // Scan the cache again
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Account balance should again reflect both received notes
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            (value + value2).unwrap()
-        );
+    #[cfg(feature = "orchard")]
+    fn invalid_chain_cache_disconnected_orchard() {
+        testing::pool::invalid_chain_cache_disconnected::<OrchardPoolTester>()
     }
 
     #[test]
-    fn scan_cached_blocks_requires_sequential_blocks() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Create a block with height SAPLING_ACTIVATION_HEIGHT
-        let value = Amount::from_u64(50000).unwrap();
-        let (cb1, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb1);
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-
-        // We cannot scan a block of height SAPLING_ACTIVATION_HEIGHT + 2 next
-        let (cb2, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb1.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        let (cb3, _) = fake_compact_block(
-            sapling_activation_height() + 2,
-            cb2.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb3);
-        match scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None) {
-            Err(Error::Chain(e)) => {
-                assert_matches!(
-                    e.cause(),
-                    Cause::BlockHeightDiscontinuity(h) if *h
-                        == sapling_activation_height() + 2
-                );
-            }
-            Ok(_) | Err(_) => panic!("Should have failed"),
-        }
+    fn data_db_truncation_sapling() {
+        testing::pool::data_db_truncation::<SaplingPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn data_db_truncation_orchard() {
+        testing::pool::data_db_truncation::<OrchardPoolTester>()
+    }
 
-        // If we add a block of height SAPLING_ACTIVATION_HEIGHT + 1, we can now scan both
-        insert_into_cache(&db_cache, &cb2);
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::from_u64(150_000).unwrap()
-        );
+    #[test]
+    fn reorg_to_checkpoint_sapling() {
+        testing::pool::reorg_to_checkpoint::<SaplingPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn reorg_to_checkpoint_orchard() {
+        testing::pool::reorg_to_checkpoint::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn scan_cached_blocks_allows_blocks_out_of_order_sapling() {
+        testing::pool::scan_cached_blocks_allows_blocks_out_of_order::<SaplingPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn scan_cached_blocks_allows_blocks_out_of_order_orchard() {
+        testing::pool::scan_cached_blocks_allows_blocks_out_of_order::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn scan_cached_blocks_finds_received_notes_sapling() {
+        testing::pool::scan_cached_blocks_finds_received_notes::<SaplingPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn scan_cached_blocks_finds_received_notes_orchard() {
+        testing::pool::scan_cached_blocks_finds_received_notes::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn scan_cached_blocks_finds_change_notes_sapling() {
+        testing::pool::scan_cached_blocks_finds_change_notes::<SaplingPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn scan_cached_blocks_finds_change_notes_orchard() {
+        testing::pool::scan_cached_blocks_finds_change_notes::<OrchardPoolTester>()
     }
 
     #[test]
-    fn scan_cached_blocks_finds_received_notes() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Account balance should be zero
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::zero()
-        );
-
-        // Create a fake CompactBlock sending value to the address
-        let value = Amount::from_u64(5).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-
-        // Scan the cache
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Account balance should reflect the received note
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-
-        // Create a second fake CompactBlock sending more value to the address
-        let value2 = Amount::from_u64(7).unwrap();
-        let (cb2, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value2,
-        );
-        insert_into_cache(&db_cache, &cb2);
-
-        // Scan the cache again
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Account balance should reflect both received notes
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            (value + value2).unwrap()
-        );
+    fn scan_cached_blocks_detects_spends_out_of_order_sapling() {
+        testing::pool::scan_cached_blocks_detects_spends_out_of_order::<SaplingPoolTester>()
     }
 
     #[test]
-    fn scan_cached_blocks_finds_change_notes() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let (dfvk, _taddr) = init_test_accounts_table(&db_data);
-
-        // Account balance should be zero
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::zero()
-        );
-
-        // Create a fake CompactBlock sending value to the address
-        let value = Amount::from_u64(5).unwrap();
-        let (cb, nf) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-
-        // Scan the cache
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Account balance should reflect the received note
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-
-        // Create a second fake CompactBlock spending value from the address
-        let extsk2 = ExtendedSpendingKey::master(&[0]);
-        let to2 = extsk2.default_address().1;
-        let value2 = Amount::from_u64(2).unwrap();
-        insert_into_cache(
-            &db_cache,
-            &fake_compact_block_spending(
-                sapling_activation_height() + 1,
-                cb.hash(),
-                (nf, value),
-                &dfvk,
-                to2,
-                value2,
-            ),
-        );
-
-        // Scan the cache again
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Account balance should equal the change
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            (value - value2).unwrap()
-        );
+    #[cfg(feature = "orchard")]
+    fn scan_cached_blocks_detects_spends_out_of_order_orchard() {
+        testing::pool::scan_cached_blocks_detects_spends_out_of_order::<OrchardPoolTester>()
     }
 }
diff --git a/zcash_client_sqlite/src/chain/init.rs b/zcash_client_sqlite/src/chain/init.rs
index 53f6d50aed..944d724fa0 100644
--- a/zcash_client_sqlite/src/chain/init.rs
+++ b/zcash_client_sqlite/src/chain/init.rs
@@ -5,8 +5,8 @@ use crate::BlockDb;
 use {
     super::migrations,
     crate::FsBlockDb,
-    schemer::{Migrator, MigratorError},
-    schemer_rusqlite::RusqliteAdapter,
+    schemerz::{Migrator, MigratorError},
+    schemerz_rusqlite::RusqliteAdapter,
 };
 
 /// Sets up the internal structure of the cache database.
@@ -55,13 +55,15 @@ pub fn init_cache_database(db_cache: &BlockDb) -> Result<(), rusqlite::Error> {
 /// init_blockmeta_db(&mut db).unwrap();
 /// ```
 #[cfg(feature = "unstable")]
-pub fn init_blockmeta_db(db: &mut FsBlockDb) -> Result<(), MigratorError<rusqlite::Error>> {
+pub fn init_blockmeta_db(
+    db: &mut FsBlockDb,
+) -> Result<(), MigratorError<uuid::Uuid, rusqlite::Error>> {
     let adapter = RusqliteAdapter::new(&mut db.conn, Some("schemer_migrations".to_string()));
     adapter.init().expect("Migrations table setup succeeds.");
 
     let mut migrator = Migrator::new(adapter);
     migrator
-        .register_multiple(migrations::blockmeta::all_migrations())
+        .register_multiple(migrations::blockmeta::all_migrations().into_iter())
         .expect("Migration registration should have been successful.");
     migrator.up(None)?;
     Ok(())
diff --git a/zcash_client_sqlite/src/chain/migrations/blockmeta.rs b/zcash_client_sqlite/src/chain/migrations/blockmeta.rs
index 854ccd6fcf..6ab2387c6f 100644
--- a/zcash_client_sqlite/src/chain/migrations/blockmeta.rs
+++ b/zcash_client_sqlite/src/chain/migrations/blockmeta.rs
@@ -1,4 +1,4 @@
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
 
 pub fn all_migrations() -> Vec<Box<dyn RusqliteMigration<Error = rusqlite::Error>>> {
     vec![Box::new(init::Migration {})]
@@ -6,8 +6,8 @@ pub fn all_migrations() -> Vec<Box<dyn RusqliteMigration<Error = rusqlite::Error
 
 pub mod init {
     use rusqlite::{self};
-    use schemer::{self, migration};
-    use schemer_rusqlite::RusqliteMigration;
+    use schemerz::{self, migration};
+    use schemerz_rusqlite::RusqliteMigration;
     use uuid::Uuid;
 
     pub struct Migration;
@@ -24,7 +24,7 @@ pub mod init {
 
     migration!(
         Migration,
-        &format!("{}", MIGRATION_ID),
+        MIGRATION_ID,
         [],
         "Initialize the cachemeta database."
     );
diff --git a/zcash_client_sqlite/src/error.rs b/zcash_client_sqlite/src/error.rs
index cfd326b9c5..407358eb95 100644
--- a/zcash_client_sqlite/src/error.rs
+++ b/zcash_client_sqlite/src/error.rs
@@ -3,13 +3,21 @@
 use std::error;
 use std::fmt;
 
-use zcash_client_backend::encoding::{Bech32DecodeError, TransparentCodecError};
-use zcash_primitives::{consensus::BlockHeight, zip32::AccountId};
+use shardtree::error::ShardTreeError;
+use zcash_address::ParseError;
+use zcash_client_backend::data_api::NoteFilter;
+use zcash_client_backend::PoolType;
+use zcash_keys::keys::AddressGenerationError;
+use zcash_primitives::zip32;
+use zcash_primitives::{consensus::BlockHeight, transaction::components::amount::BalanceError};
 
-use crate::PRUNING_HEIGHT;
+use crate::{wallet::commitment_tree, AccountUuid};
 
 #[cfg(feature = "transparent-inputs")]
-use zcash_primitives::legacy::TransparentAddress;
+use {
+    zcash_client_backend::encoding::TransparentCodecError,
+    zcash_primitives::{legacy::TransparentAddress, transaction::TxId},
+};
 
 /// The primary error type for the SQLite wallet backend.
 #[derive(Debug)]
@@ -23,22 +31,19 @@ pub enum SqliteClientError {
     /// The rcm value for a note cannot be decoded to a valid JubJub point.
     InvalidNote,
 
-    /// The note id associated with a witness being stored corresponds to a
-    /// sent note, not a received note.
-    InvalidNoteId,
-
     /// Illegal attempt to reinitialize an already-initialized wallet database.
     TableNotEmpty,
 
-    /// A Bech32-encoded key or address decoding error
-    Bech32DecodeError(Bech32DecodeError),
+    /// A Zcash key or address decoding error
+    DecodingError(ParseError),
 
     /// An error produced in legacy transparent address derivation
     #[cfg(feature = "transparent-inputs")]
-    HdwalletError(hdwallet::error::Error),
+    TransparentDerivation(bip32::Error),
 
     /// An error encountered in decoding a transparent address from its
     /// serialized form.
+    #[cfg(feature = "transparent-inputs")]
     TransparentAddress(TransparentCodecError),
 
     /// Wrapper for rusqlite errors.
@@ -50,39 +55,92 @@ pub enum SqliteClientError {
     /// A received memo cannot be interpreted as a UTF-8 string.
     InvalidMemo(zcash_primitives::memo::Error),
 
-    /// A requested rewind would violate invariants of the
-    /// storage layer. The payload returned with this error is
-    /// (safe rewind height, requested height).
-    RequestedRewindInvalid(BlockHeight, BlockHeight),
+    /// An attempt to update block data would overwrite the current hash for a block with a
+    /// different hash. This indicates that a required rewind was not performed.
+    BlockConflict(BlockHeight),
+
+    /// A range of blocks provided to the database as a unit was non-sequential
+    NonSequentialBlocks,
+
+    /// A requested rewind would violate invariants of the storage layer. The payload returned with
+    /// this error is (safe rewind height, requested height). If no safe rewind height can be
+    /// determined, the safe rewind height member will be `None`.
+    RequestedRewindInvalid {
+        safe_rewind_height: Option<BlockHeight>,
+        requested_height: BlockHeight,
+    },
 
-    /// The space of allocatable diversifier indices has been exhausted for
-    /// the given account.
-    DiversifierIndexOutOfRange,
+    /// An error occurred in generating a Zcash address.
+    AddressGeneration(AddressGenerationError),
 
-    /// An error occurred deriving a spending key from a seed and an account
-    /// identifier.
-    KeyDerivationError(AccountId),
+    /// The account for which information was requested does not belong to the wallet.
+    AccountUnknown,
 
-    /// A caller attempted to initialize the accounts table with a discontinuous
-    /// set of account identifiers.
-    AccountIdDiscontinuity,
+    /// The account being added collides with an existing account in the wallet with the given ID.
+    /// The collision can be on the seed and ZIP-32 account index, or a shared FVK component.
+    AccountCollision(AccountUuid),
 
-    /// A caller attempted to construct a new account with an invalid account identifier.
-    AccountIdOutOfRange,
+    /// The account was imported, and ZIP-32 derivation information is not known for it.
+    UnknownZip32Derivation,
+
+    /// An error occurred deriving a spending key from a seed and a ZIP-32 account index.
+    KeyDerivationError(zip32::AccountId),
+
+    /// An error occurred while processing an account due to a failure in deriving the account's keys.
+    BadAccountData(String),
+
+    /// A caller attempted to construct a new account with an invalid ZIP 32 account identifier.
+    Zip32AccountIndexOutOfRange,
 
     /// The address associated with a record being inserted was not recognized as
-    /// belonging to the wallet
+    /// belonging to the wallet.
     #[cfg(feature = "transparent-inputs")]
     AddressNotRecognized(TransparentAddress),
+
+    /// An error occurred in inserting data into or accessing data from one of the wallet's note
+    /// commitment trees.
+    CommitmentTree(ShardTreeError<commitment_tree::Error>),
+
+    /// The block at the specified height was not available from the block cache.
+    CacheMiss(BlockHeight),
+
+    /// The height of the chain was not available; a call to [`WalletWrite::update_chain_tip`] is
+    /// required before the requested operation can succeed.
+    ///
+    /// [`WalletWrite::update_chain_tip`]:
+    /// zcash_client_backend::data_api::WalletWrite::update_chain_tip
+    ChainHeightUnknown,
+
+    /// Unsupported pool type
+    UnsupportedPoolType(PoolType),
+
+    /// An error occurred in computing wallet balance
+    BalanceError(BalanceError),
+
+    /// A note selection query contained an invalid constant or was otherwise not supported.
+    NoteFilterInvalid(NoteFilter),
+
+    /// The proposal cannot be constructed until transactions with previously reserved
+    /// ephemeral address outputs have been mined. The parameters are the account UUID and
+    /// the index that could not safely be reserved.
+    #[cfg(feature = "transparent-inputs")]
+    ReachedGapLimit(AccountUuid, u32),
+
+    /// An ephemeral address would be reused. The parameters are the address in string
+    /// form, and the txid of the earliest transaction in which it is known to have been
+    /// used.
+    #[cfg(feature = "transparent-inputs")]
+    EphemeralAddressReuse(String, TxId),
 }
 
 impl error::Error for SqliteClientError {
     fn source(&self) -> Option<&(dyn error::Error + 'static)> {
         match &self {
             SqliteClientError::InvalidMemo(e) => Some(e),
-            SqliteClientError::Bech32DecodeError(Bech32DecodeError::Bech32Error(e)) => Some(e),
             SqliteClientError::DbError(e) => Some(e),
             SqliteClientError::Io(e) => Some(e),
+            SqliteClientError::BalanceError(e) => Some(e),
+            SqliteClientError::AddressGeneration(e) => Some(e),
             _ => None,
         }
     }
@@ -96,24 +154,45 @@ impl fmt::Display for SqliteClientError {
             }
             SqliteClientError::Protobuf(e) => write!(f, "Failed to parse protobuf-encoded record: {}", e),
             SqliteClientError::InvalidNote => write!(f, "Invalid note"),
-            SqliteClientError::InvalidNoteId =>
-                write!(f, "The note ID associated with an inserted witness must correspond to a received note."),
-            SqliteClientError::RequestedRewindInvalid(h, r) =>
-                write!(f, "A rewind must be either of less than {} blocks, or at least back to block {} for your wallet; the requested height was {}.", PRUNING_HEIGHT, h, r),
-            SqliteClientError::Bech32DecodeError(e) => write!(f, "{}", e),
+            SqliteClientError::RequestedRewindInvalid { safe_rewind_height,  requested_height } => write!(
+                f,
+                "A rewind for your wallet may only target height {} or greater; the requested height was {}.",
+                safe_rewind_height.map_or("<unavailable>".to_owned(), |h0| format!("{}", h0)),
+               requested_height
+            ),
+            SqliteClientError::DecodingError(e) => write!(f, "{}", e),
+            #[cfg(feature = "transparent-inputs")]
+            SqliteClientError::TransparentDerivation(e) => write!(f, "{:?}", e),
             #[cfg(feature = "transparent-inputs")]
-            SqliteClientError::HdwalletError(e) => write!(f, "{:?}", e),
             SqliteClientError::TransparentAddress(e) => write!(f, "{}", e),
             SqliteClientError::TableNotEmpty => write!(f, "Table is not empty"),
             SqliteClientError::DbError(e) => write!(f, "{}", e),
             SqliteClientError::Io(e) => write!(f, "{}", e),
             SqliteClientError::InvalidMemo(e) => write!(f, "{}", e),
-            SqliteClientError::DiversifierIndexOutOfRange => write!(f, "The space of available diversifier indices is exhausted"),
-            SqliteClientError::KeyDerivationError(acct_id) => write!(f, "Key derivation failed for account {:?}", acct_id),
-            SqliteClientError::AccountIdDiscontinuity => write!(f, "Wallet account identifiers must be sequential."),
-            SqliteClientError::AccountIdOutOfRange => write!(f, "Wallet account identifiers must be less than 0x7FFFFFFF."),
+            SqliteClientError::BlockConflict(h) => write!(f, "A block hash conflict occurred at height {}; rewind required.", u32::from(*h)),
+            SqliteClientError::NonSequentialBlocks => write!(f, "`put_blocks` requires that the provided block range be sequential"),
+            SqliteClientError::AddressGeneration(e) => write!(f, "{}", e),
+            SqliteClientError::AccountUnknown => write!(f, "The account with the given ID does not belong to this wallet."),
+            SqliteClientError::UnknownZip32Derivation => write!(f, "ZIP-32 derivation information is not known for this account."),
+            SqliteClientError::KeyDerivationError(zip32_index) => write!(f, "Key derivation failed for ZIP 32 account index {}", u32::from(*zip32_index)),
+            SqliteClientError::BadAccountData(e) => write!(f, "Failed to add account: {}", e),
+            SqliteClientError::Zip32AccountIndexOutOfRange => write!(f, "ZIP 32 account identifiers must be less than 0x7FFFFFFF."),
+            SqliteClientError::AccountCollision(account_uuid) => write!(f, "An account corresponding to the data provided already exists in the wallet with UUID {account_uuid:?}."),
             #[cfg(feature = "transparent-inputs")]
             SqliteClientError::AddressNotRecognized(_) => write!(f, "The address associated with a received txo is not identifiable as belonging to the wallet."),
+            SqliteClientError::CommitmentTree(err) => write!(f, "An error occurred accessing or updating note commitment tree data: {}.", err),
+            SqliteClientError::CacheMiss(height) => write!(f, "Requested height {} does not exist in the block cache.", height),
+            SqliteClientError::ChainHeightUnknown => write!(f, "Chain height unknown; please call `update_chain_tip`"),
+            SqliteClientError::UnsupportedPoolType(t) => write!(f, "Pool type is not currently supported: {}", t),
+            SqliteClientError::BalanceError(e) => write!(f, "Balance error: {}", e),
+            SqliteClientError::NoteFilterInvalid(s) => write!(f, "Could not evaluate filter query: {:?}", s),
+            #[cfg(feature = "transparent-inputs")]
+            SqliteClientError::ReachedGapLimit(account_id, bad_index) => write!(f,
+                "The proposal cannot be constructed until transactions with previously reserved ephemeral address outputs have been mined. \
+                 The ephemeral address in account {account_id:?} at index {bad_index} could not be safely reserved.",
+            ),
+            #[cfg(feature = "transparent-inputs")]
+            SqliteClientError::EphemeralAddressReuse(address_str, txid) => write!(f, "The ephemeral address {address_str} previously used in txid {txid} would be reused."),
         }
     }
 }
@@ -129,10 +208,9 @@ impl From<std::io::Error> for SqliteClientError {
         SqliteClientError::Io(e)
     }
 }
-
-impl From<Bech32DecodeError> for SqliteClientError {
-    fn from(e: Bech32DecodeError) -> Self {
-        SqliteClientError::Bech32DecodeError(e)
+impl From<ParseError> for SqliteClientError {
+    fn from(e: ParseError) -> Self {
+        SqliteClientError::DecodingError(e)
     }
 }
 
@@ -143,12 +221,13 @@ impl From<prost::DecodeError> for SqliteClientError {
 }
 
 #[cfg(feature = "transparent-inputs")]
-impl From<hdwallet::error::Error> for SqliteClientError {
-    fn from(e: hdwallet::error::Error) -> Self {
-        SqliteClientError::HdwalletError(e)
+impl From<bip32::Error> for SqliteClientError {
+    fn from(e: bip32::Error) -> Self {
+        SqliteClientError::TransparentDerivation(e)
     }
 }
 
+#[cfg(feature = "transparent-inputs")]
 impl From<TransparentCodecError> for SqliteClientError {
     fn from(e: TransparentCodecError) -> Self {
         SqliteClientError::TransparentAddress(e)
@@ -160,3 +239,21 @@ impl From<zcash_primitives::memo::Error> for SqliteClientError {
         SqliteClientError::InvalidMemo(e)
     }
 }
+
+impl From<ShardTreeError<commitment_tree::Error>> for SqliteClientError {
+    fn from(e: ShardTreeError<commitment_tree::Error>) -> Self {
+        SqliteClientError::CommitmentTree(e)
+    }
+}
+
+impl From<BalanceError> for SqliteClientError {
+    fn from(e: BalanceError) -> Self {
+        SqliteClientError::BalanceError(e)
+    }
+}
+
+impl From<AddressGenerationError> for SqliteClientError {
+    fn from(e: AddressGenerationError) -> Self {
+        SqliteClientError::AddressGeneration(e)
+    }
+}
diff --git a/zcash_client_sqlite/src/lib.rs b/zcash_client_sqlite/src/lib.rs
index 60cc142ae0..9fe3fe45eb 100644
--- a/zcash_client_sqlite/src/lib.rs
+++ b/zcash_client_sqlite/src/lib.rs
@@ -18,10 +18,8 @@
 //!   **MUST NOT** write to the database without using these APIs. Callers **MAY** read
 //!   the database directly in order to extract information for display to users.
 //!
-//! # Features
-//!
-//! The `mainnet` feature configures the light client for use with the Zcash mainnet. By
-//! default, the light client is configured for use with the Zcash testnet.
+//! ## Feature flags
+#![doc = document_features::document_features!()]
 //!
 //! [`WalletRead`]: zcash_client_backend::data_api::WalletRead
 //! [`WalletWrite`]: zcash_client_backend::data_api::WalletWrite
@@ -29,41 +27,95 @@
 //! [`CompactBlock`]: zcash_client_backend::proto::compact_formats::CompactBlock
 //! [`init_cache_database`]: crate::chain::init::init_cache_database
 
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
 // Catch documentation errors caused by code changes.
 #![deny(rustdoc::broken_intra_doc_links)]
 
-use rusqlite::Connection;
+use incrementalmerkletree::{Marking, Position, Retention};
+use nonempty::NonEmpty;
+use rusqlite::{self, Connection};
 use secrecy::{ExposeSecret, SecretVec};
-use std::collections::HashMap;
-use std::fmt;
-use std::path::Path;
-
-use zcash_primitives::{
-    block::BlockHash,
-    consensus::{self, BlockHeight},
-    legacy::TransparentAddress,
-    memo::{Memo, MemoBytes},
-    sapling::{self},
-    transaction::{
-        components::{amount::Amount, OutPoint},
-        Transaction, TxId,
-    },
-    zip32::{AccountId, DiversifierIndex, ExtendedFullViewingKey},
+use shardtree::{error::ShardTreeError, ShardTree};
+use std::{
+    borrow::Borrow, collections::HashMap, convert::AsRef, fmt, num::NonZeroU32, ops::Range,
+    path::Path,
 };
+use subtle::ConditionallySelectable;
+use tracing::{debug, trace, warn};
+use uuid::Uuid;
 
 use zcash_client_backend::{
-    address::{AddressMetadata, UnifiedAddress},
+    address::UnifiedAddress,
     data_api::{
-        self, chain::BlockSource, DecryptedTransaction, NullifierQuery, PoolType, PrunedBlock,
-        Recipient, SentTransaction, WalletRead, WalletWrite,
+        self,
+        chain::{BlockSource, ChainState, CommitmentTreeRoot},
+        scanning::{ScanPriority, ScanRange},
+        Account, AccountBirthday, AccountMeta, AccountPurpose, AccountSource, BlockMetadata,
+        DecryptedTransaction, InputSource, NoteFilter, NullifierQuery, ScannedBlock, SeedRelevance,
+        SentTransaction, SpendableNotes, TransactionDataRequest, WalletCommitmentTrees, WalletRead,
+        WalletSummary, WalletWrite, Zip32Derivation, SAPLING_SHARD_HEIGHT,
+    },
+    keys::{
+        AddressGenerationError, UnifiedAddressRequest, UnifiedFullViewingKey, UnifiedSpendingKey,
     },
-    keys::{UnifiedFullViewingKey, UnifiedSpendingKey},
     proto::compact_formats::CompactBlock,
-    wallet::{ReceivedSaplingNote, WalletTransparentOutput},
-    DecryptedOutput, TransferType,
+    wallet::{Note, NoteId, ReceivedNote, WalletTransparentOutput},
+    ShieldedProtocol, TransferType,
+};
+
+use zcash_primitives::{
+    block::BlockHash,
+    consensus::{self, BlockHeight},
+    memo::Memo,
+    transaction::{components::amount::NonNegativeAmount, Transaction, TxId},
+    zip32::{self, DiversifierIndex},
 };
+use zip32::fingerprint::SeedFingerprint;
 
-use crate::error::SqliteClientError;
+use crate::{error::SqliteClientError, wallet::commitment_tree::SqliteShardStore};
+
+#[cfg(any(test, feature = "test-dependencies", not(feature = "orchard")))]
+use zcash_protocol::PoolType;
+
+#[cfg(feature = "orchard")]
+use {
+    incrementalmerkletree::frontier::Frontier,
+    shardtree::store::{Checkpoint, ShardStore},
+    std::collections::BTreeMap,
+    zcash_client_backend::data_api::ORCHARD_SHARD_HEIGHT,
+};
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    zcash_client_backend::wallet::TransparentAddressMetadata,
+    zcash_keys::encoding::AddressCodec,
+    zcash_primitives::{legacy::TransparentAddress, transaction::components::OutPoint},
+};
+
+#[cfg(feature = "multicore")]
+use maybe_rayon::{
+    prelude::{IndexedParallelIterator, ParallelIterator},
+    slice::ParallelSliceMut,
+};
+
+#[cfg(any(test, feature = "test-dependencies"))]
+use {
+    zcash_client_backend::data_api::{testing::TransactionSummary, OutputOfSentTx, WalletTest},
+    zcash_keys::address::Address,
+};
+
+/// `maybe-rayon` doesn't provide this as a fallback, so we have to.
+#[cfg(not(feature = "multicore"))]
+trait ParallelSliceMut<T> {
+    fn par_chunks_mut(&mut self, chunk_size: usize) -> std::slice::ChunksMut<'_, T>;
+}
+#[cfg(not(feature = "multicore"))]
+impl<T> ParallelSliceMut<T> for [T] {
+    fn par_chunks_mut(&mut self, chunk_size: usize) -> std::slice::ChunksMut<'_, T> {
+        self.chunks_mut(chunk_size)
+    }
+}
 
 #[cfg(feature = "unstable")]
 use {
@@ -72,47 +124,140 @@ use {
     std::{fs, io},
 };
 
-mod prepared;
-pub use prepared::DataConnStmtCache;
-
 pub mod chain;
 pub mod error;
 pub mod wallet;
+use wallet::{
+    commitment_tree::{self, put_shard_roots},
+    common::spendable_notes_meta,
+    SubtreeProgressEstimator,
+};
+
+#[cfg(test)]
+mod testing;
 
 /// The maximum number of blocks the wallet is allowed to rewind. This is
 /// consistent with the bound in zcashd, and allows block data deeper than
 /// this delta from the chain tip to be pruned.
-pub(crate) const PRUNING_HEIGHT: u32 = 100;
+pub(crate) const PRUNING_DEPTH: u32 = 100;
 
-/// A newtype wrapper for sqlite primary key values for the notes
-/// table.
-#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord)]
-pub enum NoteId {
-    SentNoteId(i64),
-    ReceivedNoteId(i64),
+/// The number of blocks to verify ahead when the chain tip is updated.
+pub(crate) const VERIFY_LOOKAHEAD: u32 = 10;
+
+pub(crate) const SAPLING_TABLES_PREFIX: &str = "sapling";
+
+#[cfg(feature = "orchard")]
+pub(crate) const ORCHARD_TABLES_PREFIX: &str = "orchard";
+
+#[cfg(not(feature = "orchard"))]
+pub(crate) const UA_ORCHARD: bool = false;
+#[cfg(feature = "orchard")]
+pub(crate) const UA_ORCHARD: bool = true;
+
+#[cfg(not(feature = "transparent-inputs"))]
+pub(crate) const UA_TRANSPARENT: bool = false;
+#[cfg(feature = "transparent-inputs")]
+pub(crate) const UA_TRANSPARENT: bool = true;
+
+pub(crate) const DEFAULT_UA_REQUEST: UnifiedAddressRequest =
+    UnifiedAddressRequest::unsafe_new(UA_ORCHARD, true, UA_TRANSPARENT);
+
+/// Unique identifier for a specific account tracked by a [`WalletDb`].
+///
+/// Account identifiers are "one-way stable": a given identifier always points to a
+/// specific viewing key within a specific [`WalletDb`] instance, but the same viewing key
+/// may have multiple account identifiers over time. In particular, this crate upholds the
+/// following properties:
+///
+/// - When an account starts being tracked within a [`WalletDb`] instance (via APIs like
+///   [`WalletWrite::create_account`], [`WalletWrite::import_account_hd`], or
+///   [`WalletWrite::import_account_ufvk`]), a new `AccountUuid` is generated.
+/// - If an `AccountUuid` is present within a [`WalletDb`], it always points to the same
+///   account.
+///
+/// What this means is that account identifiers are not stable across "wallet recreation
+/// events". Examples of these include:
+/// - Restoring a wallet from a backed-up seed.
+/// - Importing the same viewing key into two different wallet instances.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash, Default)]
+pub struct AccountUuid(Uuid);
+
+impl ConditionallySelectable for AccountUuid {
+    fn conditional_select(a: &Self, b: &Self, choice: subtle::Choice) -> Self {
+        AccountUuid(Uuid::from_u128(
+            ConditionallySelectable::conditional_select(&a.0.as_u128(), &b.0.as_u128(), choice),
+        ))
+    }
+}
+
+impl AccountUuid {
+    /// Constructs an `AccountUuid` from a bare [`Uuid`] value.
+    ///
+    /// The resulting identifier is not guaranteed to correspond to any account stored in
+    /// a [`WalletDb`].
+    pub fn from_uuid(value: Uuid) -> Self {
+        AccountUuid(value)
+    }
+
+    /// Exposes the opaque account identifier from its typesafe wrapper.
+    pub fn expose_uuid(&self) -> Uuid {
+        self.0
+    }
 }
 
-impl fmt::Display for NoteId {
+/// A typesafe wrapper for the primary key identifier for a row in the `accounts` table.
+///
+/// This is an ephemeral value for efficiently and generically working with accounts in a
+/// [`WalletDb`]. To reference accounts in external contexts, use [`AccountUuid`].
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Hash, Default)]
+pub(crate) struct AccountRef(u32);
+
+/// This implementation is retained under `#[cfg(test)]` for pre-AccountUuid testing.
+#[cfg(test)]
+impl ConditionallySelectable for AccountRef {
+    fn conditional_select(a: &Self, b: &Self, choice: subtle::Choice) -> Self {
+        AccountRef(ConditionallySelectable::conditional_select(
+            &a.0, &b.0, choice,
+        ))
+    }
+}
+
+/// An opaque type for received note identifiers.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub struct ReceivedNoteId(pub(crate) ShieldedProtocol, pub(crate) i64);
+
+impl fmt::Display for ReceivedNoteId {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match self {
-            NoteId::SentNoteId(id) => write!(f, "Sent Note {}", id),
-            NoteId::ReceivedNoteId(id) => write!(f, "Received Note {}", id),
+            ReceivedNoteId(protocol, id) => write!(f, "Received {:?} Note: {}", protocol, id),
         }
     }
 }
 
-/// A newtype wrapper for sqlite primary key values for the utxos
-/// table.
+/// A newtype wrapper for sqlite primary key values for the utxos table.
 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
 pub struct UtxoId(pub i64);
 
+/// A newtype wrapper for sqlite primary key values for the transactions table.
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+struct TxRef(pub i64);
+
 /// A wrapper for the SQLite connection to the wallet database.
-pub struct WalletDb<P> {
-    conn: Connection,
+pub struct WalletDb<C, P> {
+    conn: C,
     params: P,
 }
 
-impl<P: consensus::Parameters> WalletDb<P> {
+/// A wrapper for a SQLite transaction affecting the wallet database.
+pub struct SqlTransaction<'conn>(pub(crate) &'conn rusqlite::Transaction<'conn>);
+
+impl Borrow<rusqlite::Connection> for SqlTransaction<'_> {
+    fn borrow(&self) -> &rusqlite::Connection {
+        self.0
+    }
+}
+
+impl<P: consensus::Parameters + Clone> WalletDb<Connection, P> {
     /// Construct a connection to the wallet database stored at the specified path.
     pub fn for_path<F: AsRef<Path>>(path: F, params: P) -> Result<Self, rusqlite::Error> {
         Connection::open(path).and_then(move |conn| {
@@ -121,604 +266,1402 @@ impl<P: consensus::Parameters> WalletDb<P> {
         })
     }
 
-    /// Given a wallet database connection, obtain a handle for the write operations
-    /// for that database. This operation may eagerly initialize and cache sqlite
-    /// prepared statements that are used in write operations.
-    pub fn get_update_ops(&self) -> Result<DataConnStmtCache<'_, P>, SqliteClientError> {
-        DataConnStmtCache::new(self)
+    pub fn transactionally<F, A, E: From<rusqlite::Error>>(&mut self, f: F) -> Result<A, E>
+    where
+        F: FnOnce(&mut WalletDb<SqlTransaction<'_>, P>) -> Result<A, E>,
+    {
+        let tx = self.conn.transaction()?;
+        let mut wdb = WalletDb {
+            conn: SqlTransaction(&tx),
+            params: self.params.clone(),
+        };
+        let result = f(&mut wdb)?;
+        tx.commit()?;
+        Ok(result)
     }
 }
 
-impl<P: consensus::Parameters> WalletRead for WalletDb<P> {
+impl<C: Borrow<rusqlite::Connection>, P: consensus::Parameters> InputSource for WalletDb<C, P> {
     type Error = SqliteClientError;
-    type NoteRef = NoteId;
-    type TxRef = i64;
+    type NoteRef = ReceivedNoteId;
+    type AccountId = AccountUuid;
 
-    fn block_height_extrema(&self) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error> {
-        wallet::block_height_extrema(self).map_err(SqliteClientError::from)
-    }
+    fn get_spendable_note(
+        &self,
+        txid: &TxId,
+        protocol: ShieldedProtocol,
+        index: u32,
+    ) -> Result<Option<ReceivedNote<Self::NoteRef, Note>>, Self::Error> {
+        match protocol {
+            ShieldedProtocol::Sapling => wallet::sapling::get_spendable_sapling_note(
+                self.conn.borrow(),
+                &self.params,
+                txid,
+                index,
+            )
+            .map(|opt| opt.map(|n| n.map_note(Note::Sapling))),
+            ShieldedProtocol::Orchard => {
+                #[cfg(feature = "orchard")]
+                return wallet::orchard::get_spendable_orchard_note(
+                    self.conn.borrow(),
+                    &self.params,
+                    txid,
+                    index,
+                )
+                .map(|opt| opt.map(|n| n.map_note(Note::Orchard)));
 
-    fn get_min_unspent_height(&self) -> Result<Option<BlockHeight>, Self::Error> {
-        wallet::get_min_unspent_height(self).map_err(SqliteClientError::from)
+                #[cfg(not(feature = "orchard"))]
+                return Err(SqliteClientError::UnsupportedPoolType(PoolType::ORCHARD));
+            }
+        }
     }
 
-    fn get_block_hash(&self, block_height: BlockHeight) -> Result<Option<BlockHash>, Self::Error> {
-        wallet::get_block_hash(self, block_height).map_err(SqliteClientError::from)
+    fn select_spendable_notes(
+        &self,
+        account: Self::AccountId,
+        target_value: NonNegativeAmount,
+        sources: &[ShieldedProtocol],
+        anchor_height: BlockHeight,
+        exclude: &[Self::NoteRef],
+    ) -> Result<SpendableNotes<Self::NoteRef>, Self::Error> {
+        Ok(SpendableNotes::new(
+            if sources.contains(&ShieldedProtocol::Sapling) {
+                wallet::sapling::select_spendable_sapling_notes(
+                    self.conn.borrow(),
+                    &self.params,
+                    account,
+                    target_value,
+                    anchor_height,
+                    exclude,
+                )?
+            } else {
+                vec![]
+            },
+            #[cfg(feature = "orchard")]
+            if sources.contains(&ShieldedProtocol::Orchard) {
+                wallet::orchard::select_spendable_orchard_notes(
+                    self.conn.borrow(),
+                    &self.params,
+                    account,
+                    target_value,
+                    anchor_height,
+                    exclude,
+                )?
+            } else {
+                vec![]
+            },
+        ))
     }
 
-    fn get_tx_height(&self, txid: TxId) -> Result<Option<BlockHeight>, Self::Error> {
-        wallet::get_tx_height(self, txid).map_err(SqliteClientError::from)
+    #[cfg(feature = "transparent-inputs")]
+    fn get_unspent_transparent_output(
+        &self,
+        outpoint: &OutPoint,
+    ) -> Result<Option<WalletTransparentOutput>, Self::Error> {
+        wallet::transparent::get_wallet_transparent_output(self.conn.borrow(), outpoint, false)
     }
 
-    fn get_unified_full_viewing_keys(
+    #[cfg(feature = "transparent-inputs")]
+    fn get_spendable_transparent_outputs(
         &self,
-    ) -> Result<HashMap<AccountId, UnifiedFullViewingKey>, Self::Error> {
-        wallet::get_unified_full_viewing_keys(self)
+        address: &TransparentAddress,
+        target_height: BlockHeight,
+        min_confirmations: u32,
+    ) -> Result<Vec<WalletTransparentOutput>, Self::Error> {
+        wallet::transparent::get_spendable_transparent_outputs(
+            self.conn.borrow(),
+            &self.params,
+            address,
+            target_height,
+            min_confirmations,
+        )
     }
 
-    fn get_account_for_ufvk(
+    /// Returns metadata for the spendable notes in the wallet.
+    fn get_account_metadata(
         &self,
-        ufvk: &UnifiedFullViewingKey,
-    ) -> Result<Option<AccountId>, Self::Error> {
-        wallet::get_account_for_ufvk(self, ufvk)
+        account_id: Self::AccountId,
+        selector: &NoteFilter,
+        exclude: &[Self::NoteRef],
+    ) -> Result<AccountMeta, Self::Error> {
+        let chain_tip_height = wallet::chain_tip_height(self.conn.borrow())?
+            .ok_or(SqliteClientError::ChainHeightUnknown)?;
+
+        let sapling_pool_meta = spendable_notes_meta(
+            self.conn.borrow(),
+            ShieldedProtocol::Sapling,
+            chain_tip_height,
+            account_id,
+            selector,
+            exclude,
+        )?;
+
+        #[cfg(feature = "orchard")]
+        let orchard_pool_meta = spendable_notes_meta(
+            self.conn.borrow(),
+            ShieldedProtocol::Orchard,
+            chain_tip_height,
+            account_id,
+            selector,
+            exclude,
+        )?;
+        #[cfg(not(feature = "orchard"))]
+        let orchard_pool_meta = None;
+
+        Ok(AccountMeta::new(sapling_pool_meta, orchard_pool_meta))
     }
+}
 
-    fn get_current_address(
-        &self,
-        account: AccountId,
-    ) -> Result<Option<UnifiedAddress>, Self::Error> {
-        wallet::get_current_address(self, account).map(|res| res.map(|(addr, _)| addr))
+impl<C: Borrow<rusqlite::Connection>, P: consensus::Parameters> WalletRead for WalletDb<C, P> {
+    type Error = SqliteClientError;
+    type AccountId = AccountUuid;
+    type Account = wallet::Account;
+
+    fn get_account_ids(&self) -> Result<Vec<Self::AccountId>, Self::Error> {
+        Ok(wallet::get_account_ids(self.conn.borrow())?)
     }
 
-    fn is_valid_account_extfvk(
+    fn get_account(
         &self,
-        account: AccountId,
-        extfvk: &ExtendedFullViewingKey,
-    ) -> Result<bool, Self::Error> {
-        wallet::is_valid_account_extfvk(self, account, extfvk)
+        account_id: Self::AccountId,
+    ) -> Result<Option<Self::Account>, Self::Error> {
+        wallet::get_account(self.conn.borrow(), &self.params, account_id)
     }
 
-    fn get_balance_at(
+    fn get_derived_account(
         &self,
-        account: AccountId,
-        anchor_height: BlockHeight,
-    ) -> Result<Amount, Self::Error> {
-        wallet::get_balance_at(self, account, anchor_height)
+        seed: &SeedFingerprint,
+        account_id: zip32::AccountId,
+    ) -> Result<Option<Self::Account>, Self::Error> {
+        wallet::get_derived_account(self.conn.borrow(), &self.params, seed, account_id)
     }
 
-    fn get_transaction(&self, id_tx: i64) -> Result<Transaction, Self::Error> {
-        wallet::get_transaction(self, id_tx)
+    fn validate_seed(
+        &self,
+        account_id: Self::AccountId,
+        seed: &SecretVec<u8>,
+    ) -> Result<bool, Self::Error> {
+        if let Some(account) = self.get_account(account_id)? {
+            if let AccountSource::Derived { derivation, .. } = account.source() {
+                wallet::seed_matches_derived_account(
+                    &self.params,
+                    seed,
+                    derivation.seed_fingerprint(),
+                    derivation.account_index(),
+                    &account.uivk(),
+                )
+            } else {
+                Err(SqliteClientError::UnknownZip32Derivation)
+            }
+        } else {
+            // Missing account is documented to return false.
+            Ok(false)
+        }
     }
 
-    fn get_memo(&self, id_note: Self::NoteRef) -> Result<Option<Memo>, Self::Error> {
-        match id_note {
-            NoteId::SentNoteId(id_note) => wallet::get_sent_memo(self, id_note),
-            NoteId::ReceivedNoteId(id_note) => wallet::get_received_memo(self, id_note),
+    fn seed_relevance_to_derived_accounts(
+        &self,
+        seed: &SecretVec<u8>,
+    ) -> Result<SeedRelevance<Self::AccountId>, Self::Error> {
+        let mut has_accounts = false;
+        let mut has_derived = false;
+        let mut relevant_account_ids = vec![];
+
+        for account_id in self.get_account_ids()? {
+            has_accounts = true;
+            let account = self.get_account(account_id)?.expect("account ID exists");
+
+            // If the account is imported, the seed _might_ be relevant, but the only
+            // way we could determine that is by brute-forcing the ZIP 32 account
+            // index space, which we're not going to do. The method name indicates to
+            // the caller that we only check derived accounts.
+            if let AccountSource::Derived { derivation, .. } = account.source() {
+                has_derived = true;
+
+                if wallet::seed_matches_derived_account(
+                    &self.params,
+                    seed,
+                    derivation.seed_fingerprint(),
+                    derivation.account_index(),
+                    &account.uivk(),
+                )? {
+                    // The seed is relevant to this account.
+                    relevant_account_ids.push(account_id);
+                }
+            }
         }
+
+        Ok(
+            if let Some(account_ids) = NonEmpty::from_vec(relevant_account_ids) {
+                SeedRelevance::Relevant { account_ids }
+            } else if has_derived {
+                SeedRelevance::NotRelevant
+            } else if has_accounts {
+                SeedRelevance::NoDerivedAccounts
+            } else {
+                SeedRelevance::NoAccounts
+            },
+        )
     }
 
-    fn get_commitment_tree(
+    fn get_account_for_ufvk(
         &self,
-        block_height: BlockHeight,
-    ) -> Result<Option<sapling::CommitmentTree>, Self::Error> {
-        wallet::sapling::get_sapling_commitment_tree(self, block_height)
+        ufvk: &UnifiedFullViewingKey,
+    ) -> Result<Option<Self::Account>, Self::Error> {
+        wallet::get_account_for_ufvk(self.conn.borrow(), &self.params, ufvk)
     }
 
-    #[allow(clippy::type_complexity)]
-    fn get_witnesses(
+    fn get_current_address(
         &self,
-        block_height: BlockHeight,
-    ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error> {
-        wallet::sapling::get_sapling_witnesses(self, block_height)
+        account: Self::AccountId,
+    ) -> Result<Option<UnifiedAddress>, Self::Error> {
+        wallet::get_current_address(self.conn.borrow(), &self.params, account)
+            .map(|res| res.map(|(addr, _)| addr))
     }
 
-    fn get_sapling_nullifiers(
-        &self,
-        query: data_api::NullifierQuery,
-    ) -> Result<Vec<(AccountId, sapling::Nullifier)>, Self::Error> {
-        match query {
-            NullifierQuery::Unspent => wallet::sapling::get_sapling_nullifiers(self),
-            NullifierQuery::All => wallet::sapling::get_all_sapling_nullifiers(self),
-        }
+    fn get_account_birthday(&self, account: Self::AccountId) -> Result<BlockHeight, Self::Error> {
+        wallet::account_birthday(self.conn.borrow(), account).map_err(SqliteClientError::from)
     }
 
-    fn get_spendable_sapling_notes(
-        &self,
-        account: AccountId,
-        anchor_height: BlockHeight,
-        exclude: &[Self::NoteRef],
-    ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error> {
-        wallet::sapling::get_spendable_sapling_notes(self, account, anchor_height, exclude)
+    fn get_wallet_birthday(&self) -> Result<Option<BlockHeight>, Self::Error> {
+        wallet::wallet_birthday(self.conn.borrow()).map_err(SqliteClientError::from)
     }
 
-    fn select_spendable_sapling_notes(
+    fn get_wallet_summary(
         &self,
-        account: AccountId,
-        target_value: Amount,
-        anchor_height: BlockHeight,
-        exclude: &[Self::NoteRef],
-    ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error> {
-        wallet::sapling::select_spendable_sapling_notes(
-            self,
-            account,
-            target_value,
-            anchor_height,
-            exclude,
+        min_confirmations: u32,
+    ) -> Result<Option<WalletSummary<Self::AccountId>>, Self::Error> {
+        // This will return a runtime error if we call `get_wallet_summary` from two
+        // threads at the same time, as transactions cannot nest.
+        wallet::get_wallet_summary(
+            &self.conn.borrow().unchecked_transaction()?,
+            &self.params,
+            min_confirmations,
+            &SubtreeProgressEstimator,
         )
     }
 
-    fn get_transparent_receivers(
-        &self,
-        _account: AccountId,
-    ) -> Result<HashMap<TransparentAddress, AddressMetadata>, Self::Error> {
-        #[cfg(feature = "transparent-inputs")]
-        return wallet::get_transparent_receivers(&self.params, &self.conn, _account);
-
-        #[cfg(not(feature = "transparent-inputs"))]
-        panic!(
-            "The wallet must be compiled with the transparent-inputs feature to use this method."
-        );
+    fn chain_height(&self) -> Result<Option<BlockHeight>, Self::Error> {
+        wallet::chain_tip_height(self.conn.borrow()).map_err(SqliteClientError::from)
     }
 
-    fn get_unspent_transparent_outputs(
-        &self,
-        _address: &TransparentAddress,
-        _max_height: BlockHeight,
-        _exclude: &[OutPoint],
-    ) -> Result<Vec<WalletTransparentOutput>, Self::Error> {
-        #[cfg(feature = "transparent-inputs")]
-        return wallet::get_unspent_transparent_outputs(self, _address, _max_height, _exclude);
-
-        #[cfg(not(feature = "transparent-inputs"))]
-        panic!(
-            "The wallet must be compiled with the transparent-inputs feature to use this method."
-        );
+    fn get_block_hash(&self, block_height: BlockHeight) -> Result<Option<BlockHash>, Self::Error> {
+        wallet::get_block_hash(self.conn.borrow(), block_height).map_err(SqliteClientError::from)
     }
 
-    fn get_transparent_balances(
-        &self,
-        _account: AccountId,
-        _max_height: BlockHeight,
-    ) -> Result<HashMap<TransparentAddress, Amount>, Self::Error> {
-        #[cfg(feature = "transparent-inputs")]
-        return wallet::get_transparent_balances(self, _account, _max_height);
+    fn block_metadata(&self, height: BlockHeight) -> Result<Option<BlockMetadata>, Self::Error> {
+        wallet::block_metadata(self.conn.borrow(), &self.params, height)
+    }
 
-        #[cfg(not(feature = "transparent-inputs"))]
-        panic!(
-            "The wallet must be compiled with the transparent-inputs feature to use this method."
-        );
+    fn block_fully_scanned(&self) -> Result<Option<BlockMetadata>, Self::Error> {
+        wallet::block_fully_scanned(self.conn.borrow(), &self.params)
     }
-}
 
-impl<'a, P: consensus::Parameters> WalletRead for DataConnStmtCache<'a, P> {
-    type Error = SqliteClientError;
-    type NoteRef = NoteId;
-    type TxRef = i64;
+    fn get_max_height_hash(&self) -> Result<Option<(BlockHeight, BlockHash)>, Self::Error> {
+        wallet::get_max_height_hash(self.conn.borrow()).map_err(SqliteClientError::from)
+    }
 
-    fn block_height_extrema(&self) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error> {
-        self.wallet_db.block_height_extrema()
+    fn block_max_scanned(&self) -> Result<Option<BlockMetadata>, Self::Error> {
+        wallet::block_max_scanned(self.conn.borrow(), &self.params)
     }
 
-    fn get_min_unspent_height(&self) -> Result<Option<BlockHeight>, Self::Error> {
-        self.wallet_db.get_min_unspent_height()
+    fn suggest_scan_ranges(&self) -> Result<Vec<ScanRange>, Self::Error> {
+        wallet::scanning::suggest_scan_ranges(self.conn.borrow(), ScanPriority::Historic)
+            .map_err(SqliteClientError::from)
     }
 
-    fn get_block_hash(&self, block_height: BlockHeight) -> Result<Option<BlockHash>, Self::Error> {
-        self.wallet_db.get_block_hash(block_height)
+    fn get_target_and_anchor_heights(
+        &self,
+        min_confirmations: NonZeroU32,
+    ) -> Result<Option<(BlockHeight, BlockHeight)>, Self::Error> {
+        wallet::get_target_and_anchor_heights(self.conn.borrow(), min_confirmations)
+            .map_err(SqliteClientError::from)
     }
 
     fn get_tx_height(&self, txid: TxId) -> Result<Option<BlockHeight>, Self::Error> {
-        self.wallet_db.get_tx_height(txid)
+        wallet::get_tx_height(self.conn.borrow(), txid).map_err(SqliteClientError::from)
     }
 
     fn get_unified_full_viewing_keys(
         &self,
-    ) -> Result<HashMap<AccountId, UnifiedFullViewingKey>, Self::Error> {
-        self.wallet_db.get_unified_full_viewing_keys()
+    ) -> Result<HashMap<Self::AccountId, UnifiedFullViewingKey>, Self::Error> {
+        wallet::get_unified_full_viewing_keys(self.conn.borrow(), &self.params)
     }
 
-    fn get_account_for_ufvk(
-        &self,
-        ufvk: &UnifiedFullViewingKey,
-    ) -> Result<Option<AccountId>, Self::Error> {
-        self.wallet_db.get_account_for_ufvk(ufvk)
+    fn get_memo(&self, note_id: NoteId) -> Result<Option<Memo>, Self::Error> {
+        let sent_memo = wallet::get_sent_memo(self.conn.borrow(), note_id)?;
+        if sent_memo.is_some() {
+            Ok(sent_memo)
+        } else {
+            wallet::get_received_memo(self.conn.borrow(), note_id)
+        }
     }
 
-    fn get_current_address(
-        &self,
-        account: AccountId,
-    ) -> Result<Option<UnifiedAddress>, Self::Error> {
-        self.wallet_db.get_current_address(account)
+    fn get_transaction(&self, txid: TxId) -> Result<Option<Transaction>, Self::Error> {
+        wallet::get_transaction(self.conn.borrow(), &self.params, txid)
+            .map(|res| res.map(|(_, tx)| tx))
     }
 
-    fn is_valid_account_extfvk(
+    fn get_sapling_nullifiers(
         &self,
-        account: AccountId,
-        extfvk: &ExtendedFullViewingKey,
-    ) -> Result<bool, Self::Error> {
-        self.wallet_db.is_valid_account_extfvk(account, extfvk)
+        query: NullifierQuery,
+    ) -> Result<Vec<(Self::AccountId, sapling::Nullifier)>, Self::Error> {
+        wallet::sapling::get_sapling_nullifiers(self.conn.borrow(), query)
     }
 
-    fn get_balance_at(
+    #[cfg(feature = "orchard")]
+    fn get_orchard_nullifiers(
         &self,
-        account: AccountId,
-        anchor_height: BlockHeight,
-    ) -> Result<Amount, Self::Error> {
-        self.wallet_db.get_balance_at(account, anchor_height)
+        query: NullifierQuery,
+    ) -> Result<Vec<(Self::AccountId, orchard::note::Nullifier)>, Self::Error> {
+        wallet::orchard::get_orchard_nullifiers(self.conn.borrow(), query)
     }
 
-    fn get_transaction(&self, id_tx: i64) -> Result<Transaction, Self::Error> {
-        self.wallet_db.get_transaction(id_tx)
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_receivers(
+        &self,
+        account: Self::AccountId,
+    ) -> Result<HashMap<TransparentAddress, Option<TransparentAddressMetadata>>, Self::Error> {
+        wallet::transparent::get_transparent_receivers(self.conn.borrow(), &self.params, account)
     }
 
-    fn get_memo(&self, id_note: Self::NoteRef) -> Result<Option<Memo>, Self::Error> {
-        self.wallet_db.get_memo(id_note)
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_balances(
+        &self,
+        account: Self::AccountId,
+        max_height: BlockHeight,
+    ) -> Result<HashMap<TransparentAddress, NonNegativeAmount>, Self::Error> {
+        wallet::transparent::get_transparent_balances(
+            self.conn.borrow(),
+            &self.params,
+            account,
+            max_height,
+        )
     }
 
-    fn get_commitment_tree(
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_address_metadata(
         &self,
-        block_height: BlockHeight,
-    ) -> Result<Option<sapling::CommitmentTree>, Self::Error> {
-        self.wallet_db.get_commitment_tree(block_height)
+        account: Self::AccountId,
+        address: &TransparentAddress,
+    ) -> Result<Option<TransparentAddressMetadata>, Self::Error> {
+        wallet::transparent::get_transparent_address_metadata(
+            self.conn.borrow(),
+            &self.params,
+            account,
+            address,
+        )
     }
 
-    #[allow(clippy::type_complexity)]
-    fn get_witnesses(
+    #[cfg(feature = "transparent-inputs")]
+    fn get_known_ephemeral_addresses(
         &self,
-        block_height: BlockHeight,
-    ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error> {
-        self.wallet_db.get_witnesses(block_height)
+        account: Self::AccountId,
+        index_range: Option<Range<u32>>,
+    ) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, Self::Error> {
+        let account_id = wallet::get_account_ref(self.conn.borrow(), account)?;
+        wallet::transparent::ephemeral::get_known_ephemeral_addresses(
+            self.conn.borrow(),
+            &self.params,
+            account_id,
+            index_range,
+        )
     }
 
-    fn get_sapling_nullifiers(
+    #[cfg(feature = "transparent-inputs")]
+    fn find_account_for_ephemeral_address(
         &self,
-        query: data_api::NullifierQuery,
-    ) -> Result<Vec<(AccountId, sapling::Nullifier)>, Self::Error> {
-        self.wallet_db.get_sapling_nullifiers(query)
+        address: &TransparentAddress,
+    ) -> Result<Option<Self::AccountId>, Self::Error> {
+        wallet::transparent::ephemeral::find_account_for_ephemeral_address_str(
+            self.conn.borrow(),
+            &address.encode(&self.params),
+        )
     }
 
-    fn get_spendable_sapling_notes(
-        &self,
-        account: AccountId,
-        anchor_height: BlockHeight,
-        exclude: &[Self::NoteRef],
-    ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error> {
-        self.wallet_db
-            .get_spendable_sapling_notes(account, anchor_height, exclude)
+    fn transaction_data_requests(&self) -> Result<Vec<TransactionDataRequest>, Self::Error> {
+        let iter = wallet::transaction_data_requests(self.conn.borrow())?.into_iter();
+
+        #[cfg(feature = "transparent-inputs")]
+        let iter = iter.chain(wallet::transparent::transaction_data_requests(
+            self.conn.borrow(),
+            &self.params,
+        )?);
+
+        Ok(iter.collect())
     }
+}
 
-    fn select_spendable_sapling_notes(
+#[cfg(any(test, feature = "test-dependencies"))]
+impl<C: Borrow<rusqlite::Connection>, P: consensus::Parameters> WalletTest for WalletDb<C, P> {
+    fn get_tx_history(
         &self,
-        account: AccountId,
-        target_value: Amount,
-        anchor_height: BlockHeight,
-        exclude: &[Self::NoteRef],
-    ) -> Result<Vec<ReceivedSaplingNote<Self::NoteRef>>, Self::Error> {
-        self.wallet_db
-            .select_spendable_sapling_notes(account, target_value, anchor_height, exclude)
+    ) -> Result<Vec<TransactionSummary<<Self as WalletRead>::AccountId>>, <Self as WalletRead>::Error>
+    {
+        wallet::testing::get_tx_history(self.conn.borrow())
     }
 
-    fn get_transparent_receivers(
+    fn get_sent_note_ids(
+        &self,
+        txid: &TxId,
+        protocol: ShieldedProtocol,
+    ) -> Result<Vec<NoteId>, <Self as WalletRead>::Error> {
+        use crate::wallet::pool_code;
+        use rusqlite::named_params;
+
+        let mut stmt_sent_notes = self.conn.borrow().prepare(
+            "SELECT output_index
+             FROM sent_notes
+             JOIN transactions ON transactions.id_tx = sent_notes.tx
+             WHERE transactions.txid = :txid
+             AND sent_notes.output_pool = :pool_code",
+        )?;
+
+        let note_ids = stmt_sent_notes
+            .query_map(
+                named_params! {
+                    ":txid": txid.as_ref(),
+                    ":pool_code": pool_code(PoolType::Shielded(protocol)),
+                },
+                |row| Ok(NoteId::new(*txid, protocol, row.get(0)?)),
+            )?
+            .collect::<Result<_, _>>()?;
+
+        Ok(note_ids)
+    }
+
+    fn get_sent_outputs(
         &self,
-        account: AccountId,
-    ) -> Result<HashMap<TransparentAddress, AddressMetadata>, Self::Error> {
-        self.wallet_db.get_transparent_receivers(account)
+        txid: &TxId,
+    ) -> Result<Vec<OutputOfSentTx>, <Self as WalletRead>::Error> {
+        let mut stmt_sent = self
+            .conn.borrow()
+            .prepare(
+                "SELECT value, to_address, ephemeral_addresses.address, ephemeral_addresses.address_index
+                 FROM sent_notes
+                 JOIN transactions ON transactions.id_tx = sent_notes.tx
+                 LEFT JOIN ephemeral_addresses ON ephemeral_addresses.used_in_tx = sent_notes.tx
+                 WHERE transactions.txid = ?
+                 ORDER BY value",
+            )?;
+
+        let sends = stmt_sent
+            .query_map(rusqlite::params![txid.as_ref()], |row| {
+                let v = row.get(0)?;
+                let to_address = row
+                    .get::<_, Option<String>>(1)?
+                    .and_then(|s| Address::decode(&self.params, &s));
+                let ephemeral_address = row
+                    .get::<_, Option<String>>(2)?
+                    .and_then(|s| Address::decode(&self.params, &s));
+                let address_index: Option<u32> = row.get(3)?;
+                Ok((v, to_address, ephemeral_address.zip(address_index)))
+            })?
+            .map(|res| {
+                let (amount, external_recipient, ephemeral_address) = res?;
+                Ok::<_, <Self as WalletRead>::Error>(OutputOfSentTx::from_parts(
+                    NonNegativeAmount::from_u64(amount)?,
+                    external_recipient,
+                    ephemeral_address,
+                ))
+            })
+            .collect::<Result<_, _>>()?;
+
+        Ok(sends)
     }
 
-    fn get_unspent_transparent_outputs(
+    fn get_checkpoint_history(
         &self,
-        address: &TransparentAddress,
-        max_height: BlockHeight,
-        exclude: &[OutPoint],
-    ) -> Result<Vec<WalletTransparentOutput>, Self::Error> {
-        self.wallet_db
-            .get_unspent_transparent_outputs(address, max_height, exclude)
+        protocol: &ShieldedProtocol,
+    ) -> Result<
+        Vec<(BlockHeight, Option<incrementalmerkletree::Position>)>,
+        <Self as WalletRead>::Error,
+    > {
+        wallet::testing::get_checkpoint_history(self.conn.borrow(), protocol)
     }
 
-    fn get_transparent_balances(
+    #[cfg(feature = "transparent-inputs")]
+    fn get_transparent_output(
         &self,
-        account: AccountId,
-        max_height: BlockHeight,
-    ) -> Result<HashMap<TransparentAddress, Amount>, Self::Error> {
-        self.wallet_db.get_transparent_balances(account, max_height)
+        outpoint: &OutPoint,
+        allow_unspendable: bool,
+    ) -> Result<Option<WalletTransparentOutput>, <Self as InputSource>::Error> {
+        wallet::transparent::get_wallet_transparent_output(
+            self.conn.borrow(),
+            outpoint,
+            allow_unspendable,
+        )
     }
-}
 
-impl<'a, P: consensus::Parameters> DataConnStmtCache<'a, P> {
-    fn transactionally<F, A>(&mut self, f: F) -> Result<A, SqliteClientError>
-    where
-        F: FnOnce(&mut Self) -> Result<A, SqliteClientError>,
-    {
-        self.wallet_db.conn.execute("BEGIN IMMEDIATE", [])?;
-        match f(self) {
-            Ok(result) => {
-                self.wallet_db.conn.execute("COMMIT", [])?;
-                Ok(result)
-            }
-            Err(error) => {
-                match self.wallet_db.conn.execute("ROLLBACK", []) {
-                    Ok(_) => Err(error),
-                    Err(e) =>
-                        // Panicking here is probably the right thing to do, because it
-                        // means the database is corrupt.
-                        panic!(
-                            "Rollback failed with error {} while attempting to recover from error {}; database is likely corrupt.",
-                            e,
-                            error
-                        )
-                }
-            }
-        }
+    fn get_notes(
+        &self,
+        protocol: ShieldedProtocol,
+    ) -> Result<Vec<ReceivedNote<Self::NoteRef, Note>>, <Self as InputSource>::Error> {
+        let (table_prefix, index_col, _) = wallet::common::per_protocol_names(protocol);
+        let mut stmt_received_notes = self.conn.borrow().prepare(&format!(
+            "SELECT txid, {index_col}
+             FROM {table_prefix}_received_notes rn
+             INNER JOIN transactions ON transactions.id_tx = rn.tx
+             WHERE transactions.block IS NOT NULL
+             AND recipient_key_scope IS NOT NULL
+             AND nf IS NOT NULL
+             AND commitment_tree_position IS NOT NULL"
+        ))?;
+
+        let result = stmt_received_notes
+            .query_map([], |row| {
+                let txid: [u8; 32] = row.get(0)?;
+                let output_index: u32 = row.get(1)?;
+                let note = self
+                    .get_spendable_note(&TxId::from_bytes(txid), protocol, output_index)
+                    .unwrap()
+                    .unwrap();
+                Ok(note)
+            })?
+            .collect::<Result<Vec<_>, _>>()?;
+
+        Ok(result)
     }
 }
 
-impl<'a, P: consensus::Parameters> WalletWrite for DataConnStmtCache<'a, P> {
+impl<P: consensus::Parameters> WalletWrite for WalletDb<rusqlite::Connection, P> {
     type UtxoRef = UtxoId;
 
     fn create_account(
         &mut self,
+        account_name: &str,
         seed: &SecretVec<u8>,
-    ) -> Result<(AccountId, UnifiedSpendingKey), Self::Error> {
-        self.transactionally(|stmts| {
-            let account = wallet::get_max_account_id(stmts.wallet_db)?
-                .map(|a| AccountId::from(u32::from(a) + 1))
-                .unwrap_or_else(|| AccountId::from(0));
-
-            if u32::from(account) >= 0x7FFFFFFF {
-                return Err(SqliteClientError::AccountIdOutOfRange);
-            }
+        birthday: &AccountBirthday,
+        key_source: Option<&str>,
+    ) -> Result<(Self::AccountId, UnifiedSpendingKey), Self::Error> {
+        self.transactionally(|wdb| {
+            let seed_fingerprint =
+                SeedFingerprint::from_seed(seed.expose_secret()).ok_or_else(|| {
+                    SqliteClientError::BadAccountData(
+                        "Seed must be between 32 and 252 bytes in length.".to_owned(),
+                    )
+                })?;
+            let zip32_account_index =
+                wallet::max_zip32_account_index(wdb.conn.0, &seed_fingerprint)?
+                    .map(|a| {
+                        a.next()
+                            .ok_or(SqliteClientError::Zip32AccountIndexOutOfRange)
+                    })
+                    .transpose()?
+                    .unwrap_or(zip32::AccountId::ZERO);
 
             let usk = UnifiedSpendingKey::from_seed(
-                &stmts.wallet_db.params,
+                &wdb.params,
                 seed.expose_secret(),
-                account,
+                zip32_account_index,
             )
-            .map_err(|_| SqliteClientError::KeyDerivationError(account))?;
+            .map_err(|_| SqliteClientError::KeyDerivationError(zip32_account_index))?;
+            let ufvk = usk.to_unified_full_viewing_key();
+
+            let account = wallet::add_account(
+                wdb.conn.0,
+                &wdb.params,
+                account_name,
+                &AccountSource::Derived {
+                    derivation: Zip32Derivation::new(seed_fingerprint, zip32_account_index),
+                    key_source: key_source.map(|s| s.to_owned()),
+                },
+                wallet::ViewingKey::Full(Box::new(ufvk)),
+                birthday,
+            )?;
+
+            Ok((account.id(), usk))
+        })
+    }
+
+    fn import_account_hd(
+        &mut self,
+        account_name: &str,
+        seed: &SecretVec<u8>,
+        account_index: zip32::AccountId,
+        birthday: &AccountBirthday,
+        key_source: Option<&str>,
+    ) -> Result<(Self::Account, UnifiedSpendingKey), Self::Error> {
+        self.transactionally(|wdb| {
+            let seed_fingerprint =
+                SeedFingerprint::from_seed(seed.expose_secret()).ok_or_else(|| {
+                    SqliteClientError::BadAccountData(
+                        "Seed must be between 32 and 252 bytes in length.".to_owned(),
+                    )
+                })?;
+
+            let usk =
+                UnifiedSpendingKey::from_seed(&wdb.params, seed.expose_secret(), account_index)
+                    .map_err(|_| SqliteClientError::KeyDerivationError(account_index))?;
             let ufvk = usk.to_unified_full_viewing_key();
 
-            wallet::add_account(stmts.wallet_db, account, &ufvk)?;
+            let account = wallet::add_account(
+                wdb.conn.0,
+                &wdb.params,
+                account_name,
+                &AccountSource::Derived {
+                    derivation: Zip32Derivation::new(seed_fingerprint, account_index),
+                    key_source: key_source.map(|s| s.to_owned()),
+                },
+                wallet::ViewingKey::Full(Box::new(ufvk)),
+                birthday,
+            )?;
 
             Ok((account, usk))
         })
     }
 
+    fn import_account_ufvk(
+        &mut self,
+        account_name: &str,
+        ufvk: &UnifiedFullViewingKey,
+        birthday: &AccountBirthday,
+        purpose: AccountPurpose,
+        key_source: Option<&str>,
+    ) -> Result<Self::Account, Self::Error> {
+        self.transactionally(|wdb| {
+            wallet::add_account(
+                wdb.conn.0,
+                &wdb.params,
+                account_name,
+                &AccountSource::Imported {
+                    purpose,
+                    key_source: key_source.map(|s| s.to_owned()),
+                },
+                wallet::ViewingKey::Full(Box::new(ufvk.to_owned())),
+                birthday,
+            )
+        })
+    }
+
     fn get_next_available_address(
         &mut self,
-        account: AccountId,
+        account_uuid: Self::AccountId,
+        request: UnifiedAddressRequest,
     ) -> Result<Option<UnifiedAddress>, Self::Error> {
-        match self.get_unified_full_viewing_keys()?.get(&account) {
-            Some(ufvk) => {
-                let search_from = match wallet::get_current_address(self.wallet_db, account)? {
-                    Some((_, mut last_diversifier_index)) => {
-                        last_diversifier_index
-                            .increment()
-                            .map_err(|_| SqliteClientError::DiversifierIndexOutOfRange)?;
-                        last_diversifier_index
-                    }
-                    None => DiversifierIndex::default(),
-                };
+        self.transactionally(
+            |wdb| match wdb.get_unified_full_viewing_keys()?.get(&account_uuid) {
+                Some(ufvk) => {
+                    let search_from =
+                        match wallet::get_current_address(wdb.conn.0, &wdb.params, account_uuid)? {
+                            Some((_, mut last_diversifier_index)) => {
+                                last_diversifier_index.increment().map_err(|_| {
+                                    AddressGenerationError::DiversifierSpaceExhausted
+                                })?;
+                                last_diversifier_index
+                            }
+                            None => DiversifierIndex::default(),
+                        };
 
-                let (addr, diversifier_index) = ufvk
-                    .find_address(search_from)
-                    .ok_or(SqliteClientError::DiversifierIndexOutOfRange)?;
+                    let (addr, diversifier_index) = ufvk.find_address(search_from, request)?;
 
-                self.stmt_insert_address(account, diversifier_index, &addr)?;
+                    let account_id = wallet::get_account_ref(wdb.conn.0, account_uuid)?;
+                    wallet::insert_address(
+                        wdb.conn.0,
+                        &wdb.params,
+                        account_id,
+                        diversifier_index,
+                        &addr,
+                    )?;
 
-                Ok(Some(addr))
-            }
-            None => Ok(None),
-        }
+                    Ok(Some(addr))
+                }
+                None => Ok(None),
+            },
+        )
+    }
+
+    fn update_chain_tip(&mut self, tip_height: BlockHeight) -> Result<(), Self::Error> {
+        let tx = self.conn.transaction()?;
+        wallet::scanning::update_chain_tip(&tx, &self.params, tip_height)?;
+        tx.commit()?;
+        Ok(())
     }
 
-    #[tracing::instrument(skip_all, fields(height = u32::from(block.block_height)))]
+    #[tracing::instrument(skip_all, fields(height = blocks.first().map(|b| u32::from(b.height())), count = blocks.len()))]
     #[allow(clippy::type_complexity)]
-    fn advance_by_block(
+    fn put_blocks(
         &mut self,
-        block: &PrunedBlock,
-        updated_witnesses: &[(Self::NoteRef, sapling::IncrementalWitness)],
-    ) -> Result<Vec<(Self::NoteRef, sapling::IncrementalWitness)>, Self::Error> {
-        // database updates for each block are transactional
-        self.transactionally(|up| {
-            // Insert the block into the database.
-            wallet::insert_block(
-                up,
-                block.block_height,
-                block.block_hash,
-                block.block_time,
-                block.commitment_tree,
-            )?;
+        from_state: &ChainState,
+        blocks: Vec<ScannedBlock<Self::AccountId>>,
+    ) -> Result<(), Self::Error> {
+        struct BlockPositions {
+            height: BlockHeight,
+            sapling_start_position: Position,
+            #[cfg(feature = "orchard")]
+            orchard_start_position: Position,
+        }
 
-            let mut new_witnesses = vec![];
-            for tx in block.transactions {
-                let tx_row = wallet::put_tx_meta(up, tx, block.block_height)?;
+        if blocks.is_empty() {
+            return Ok(());
+        }
 
-                // Mark notes as spent and remove them from the scanning cache
-                for spend in &tx.sapling_spends {
-                    wallet::sapling::mark_sapling_note_spent(up, tx_row, spend.nf())?;
+        self.transactionally(|wdb| {
+            let initial_block = blocks.first().expect("blocks is known to be nonempty");
+            assert!(from_state.block_height() + 1 == initial_block.height());
+
+            let start_positions = BlockPositions {
+                height: initial_block.height(),
+                sapling_start_position: Position::from(
+                    u64::from(initial_block.sapling().final_tree_size())
+                        - u64::try_from(initial_block.sapling().commitments().len()).unwrap(),
+                ),
+                #[cfg(feature = "orchard")]
+                orchard_start_position: Position::from(
+                    u64::from(initial_block.orchard().final_tree_size())
+                        - u64::try_from(initial_block.orchard().commitments().len()).unwrap(),
+                ),
+            };
+
+            let mut sapling_commitments = vec![];
+            #[cfg(feature = "orchard")]
+            let mut orchard_commitments = vec![];
+            let mut last_scanned_height = None;
+            let mut note_positions = vec![];
+            for block in blocks.into_iter() {
+                if last_scanned_height
+                    .iter()
+                    .any(|prev| block.height() != *prev + 1)
+                {
+                    return Err(SqliteClientError::NonSequentialBlocks);
                 }
 
-                for output in &tx.sapling_outputs {
-                    let received_note_id = wallet::sapling::put_received_note(up, output, tx_row)?;
+                // Insert the block into the database.
+                wallet::put_block(
+                    wdb.conn.0,
+                    block.height(),
+                    block.block_hash(),
+                    block.block_time(),
+                    block.sapling().final_tree_size(),
+                    block.sapling().commitments().len().try_into().unwrap(),
+                    #[cfg(feature = "orchard")]
+                    block.orchard().final_tree_size(),
+                    #[cfg(feature = "orchard")]
+                    block.orchard().commitments().len().try_into().unwrap(),
+                )?;
+
+                for tx in block.transactions() {
+                    let tx_row = wallet::put_tx_meta(wdb.conn.0, tx, block.height())?;
+                    wallet::queue_tx_retrieval(wdb.conn.0, std::iter::once(tx.txid()), None)?;
+
+                    // Mark notes as spent and remove them from the scanning cache
+                    for spend in tx.sapling_spends() {
+                        wallet::sapling::mark_sapling_note_spent(wdb.conn.0, tx_row, spend.nf())?;
+                    }
+                    #[cfg(feature = "orchard")]
+                    for spend in tx.orchard_spends() {
+                        wallet::orchard::mark_orchard_note_spent(wdb.conn.0, tx_row, spend.nf())?;
+                    }
 
-                    // Save witness for note.
-                    new_witnesses.push((received_note_id, output.witness().clone()));
+                    for output in tx.sapling_outputs() {
+                        // Check whether this note was spent in a later block range that
+                        // we previously scanned.
+                        let spent_in = output
+                            .nf()
+                            .map(|nf| {
+                                wallet::query_nullifier_map(
+                                    wdb.conn.0,
+                                    ShieldedProtocol::Sapling,
+                                    nf,
+                                )
+                            })
+                            .transpose()?
+                            .flatten();
+
+                        wallet::sapling::put_received_note(wdb.conn.0, output, tx_row, spent_in)?;
+                    }
+                    #[cfg(feature = "orchard")]
+                    for output in tx.orchard_outputs() {
+                        // Check whether this note was spent in a later block range that
+                        // we previously scanned.
+                        let spent_in = output
+                            .nf()
+                            .map(|nf| {
+                                wallet::query_nullifier_map(
+                                    wdb.conn.0,
+                                    ShieldedProtocol::Orchard,
+                                    &nf.to_bytes(),
+                                )
+                            })
+                            .transpose()?
+                            .flatten();
+
+                        wallet::orchard::put_received_note(wdb.conn.0, output, tx_row, spent_in)?;
+                    }
                 }
-            }
 
-            // Insert current new_witnesses into the database.
-            for (received_note_id, witness) in updated_witnesses.iter().chain(new_witnesses.iter())
-            {
-                if let NoteId::ReceivedNoteId(rnid) = *received_note_id {
-                    wallet::sapling::insert_witness(up, rnid, witness, block.block_height)?;
-                } else {
-                    return Err(SqliteClientError::InvalidNoteId);
-                }
+                // Insert the new nullifiers from this block into the nullifier map.
+                wallet::insert_nullifier_map(
+                    wdb.conn.0,
+                    block.height(),
+                    ShieldedProtocol::Sapling,
+                    block.sapling().nullifier_map(),
+                )?;
+                #[cfg(feature = "orchard")]
+                wallet::insert_nullifier_map(
+                    wdb.conn.0,
+                    block.height(),
+                    ShieldedProtocol::Orchard,
+                    &block
+                        .orchard()
+                        .nullifier_map()
+                        .iter()
+                        .map(|(txid, idx, nfs)| {
+                            (*txid, *idx, nfs.iter().map(|nf| nf.to_bytes()).collect())
+                        })
+                        .collect::<Vec<_>>(),
+                )?;
+
+                note_positions.extend(block.transactions().iter().flat_map(|wtx| {
+                    let iter = wtx.sapling_outputs().iter().map(|out| {
+                        (
+                            ShieldedProtocol::Sapling,
+                            out.note_commitment_tree_position(),
+                        )
+                    });
+                    #[cfg(feature = "orchard")]
+                    let iter = iter.chain(wtx.orchard_outputs().iter().map(|out| {
+                        (
+                            ShieldedProtocol::Orchard,
+                            out.note_commitment_tree_position(),
+                        )
+                    }));
+
+                    iter
+                }));
+
+                last_scanned_height = Some(block.height());
+                let block_commitments = block.into_commitments();
+                trace!(
+                    "Sapling commitments for {:?}: {:?}",
+                    last_scanned_height,
+                    block_commitments
+                        .sapling
+                        .iter()
+                        .map(|(_, r)| *r)
+                        .collect::<Vec<_>>()
+                );
+                #[cfg(feature = "orchard")]
+                trace!(
+                    "Orchard commitments for {:?}: {:?}",
+                    last_scanned_height,
+                    block_commitments
+                        .orchard
+                        .iter()
+                        .map(|(_, r)| *r)
+                        .collect::<Vec<_>>()
+                );
+
+                sapling_commitments.extend(block_commitments.sapling.into_iter().map(Some));
+                #[cfg(feature = "orchard")]
+                orchard_commitments.extend(block_commitments.orchard.into_iter().map(Some));
             }
 
-            // Prune the stored witnesses (we only expect rollbacks of at most PRUNING_HEIGHT blocks).
-            wallet::prune_witnesses(up, block.block_height - PRUNING_HEIGHT)?;
-
-            // Update now-expired transactions that didn't get mined.
-            wallet::update_expired_notes(up, block.block_height)?;
-
-            Ok(new_witnesses)
-        })
-    }
+            // Prune the nullifier map of entries we no longer need.
+            if let Some(meta) = wdb.block_fully_scanned()? {
+                wallet::prune_nullifier_map(
+                    wdb.conn.0,
+                    meta.block_height().saturating_sub(PRUNING_DEPTH),
+                )?;
+            }
 
-    fn store_decrypted_tx(
-        &mut self,
-        d_tx: DecryptedTransaction,
-    ) -> Result<Self::TxRef, Self::Error> {
-        self.transactionally(|up| {
-            let tx_ref = wallet::put_tx_data(up, d_tx.tx, None, None)?;
-
-            let mut spending_account_id: Option<AccountId> = None;
-            for output in d_tx.sapling_outputs {
-                match output.transfer_type {
-                    TransferType::Outgoing | TransferType::WalletInternal => {
-                        let recipient = if output.transfer_type == TransferType::Outgoing {
-                            Recipient::Sapling(output.note.recipient())
-                        } else {
-                            Recipient::InternalAccount(output.account, PoolType::Sapling)
-                        };
+            // We will have a start position and a last scanned height in all cases where
+            // `blocks` is non-empty.
+            if let Some(last_scanned_height) = last_scanned_height {
+                // Create subtrees from the note commitments in parallel.
+                const CHUNK_SIZE: usize = 1024;
+                let sapling_subtrees = sapling_commitments
+                    .par_chunks_mut(CHUNK_SIZE)
+                    .enumerate()
+                    .filter_map(|(i, chunk)| {
+                        let start =
+                            start_positions.sapling_start_position + (i * CHUNK_SIZE) as u64;
+                        let end = start + chunk.len() as u64;
+
+                        shardtree::LocatedTree::from_iter(
+                            start..end,
+                            SAPLING_SHARD_HEIGHT.into(),
+                            chunk.iter_mut().map(|n| n.take().expect("always Some")),
+                        )
+                    })
+                    .map(|res| (res.subtree, res.checkpoints))
+                    .collect::<Vec<_>>();
+
+                #[cfg(feature = "orchard")]
+                let orchard_subtrees = orchard_commitments
+                    .par_chunks_mut(CHUNK_SIZE)
+                    .enumerate()
+                    .filter_map(|(i, chunk)| {
+                        let start =
+                            start_positions.orchard_start_position + (i * CHUNK_SIZE) as u64;
+                        let end = start + chunk.len() as u64;
+
+                        shardtree::LocatedTree::from_iter(
+                            start..end,
+                            ORCHARD_SHARD_HEIGHT.into(),
+                            chunk.iter_mut().map(|n| n.take().expect("always Some")),
+                        )
+                    })
+                    .map(|res| (res.subtree, res.checkpoints))
+                    .collect::<Vec<_>>();
+
+                // Collect the complete set of Sapling checkpoints
+                #[cfg(feature = "orchard")]
+                let sapling_checkpoint_positions: BTreeMap<BlockHeight, Position> =
+                    sapling_subtrees
+                        .iter()
+                        .flat_map(|(_, checkpoints)| checkpoints.iter())
+                        .map(|(k, v)| (*k, *v))
+                        .collect();
+
+                #[cfg(feature = "orchard")]
+                let orchard_checkpoint_positions: BTreeMap<BlockHeight, Position> =
+                    orchard_subtrees
+                        .iter()
+                        .flat_map(|(_, checkpoints)| checkpoints.iter())
+                        .map(|(k, v)| (*k, *v))
+                        .collect();
+
+                #[cfg(feature = "orchard")]
+                fn ensure_checkpoints<
+                    'a,
+                    H,
+                    I: Iterator<Item = &'a BlockHeight>,
+                    const DEPTH: u8,
+                >(
+                    // An iterator of checkpoints heights for which we wish to ensure that
+                    // checkpoints exists.
+                    ensure_heights: I,
+                    // The map of checkpoint positions from which we will draw note commitment tree
+                    // position information for the newly created checkpoints.
+                    existing_checkpoint_positions: &BTreeMap<BlockHeight, Position>,
+                    // The frontier whose position will be used for an inserted checkpoint when
+                    // there is no preceding checkpoint in existing_checkpoint_positions.
+                    state_final_tree: &Frontier<H, DEPTH>,
+                ) -> Vec<(BlockHeight, Checkpoint)> {
+                    ensure_heights
+                        .flat_map(|ensure_height| {
+                            existing_checkpoint_positions
+                                .range::<BlockHeight, _>(..=*ensure_height)
+                                .last()
+                                .map_or_else(
+                                    || {
+                                        Some((
+                                            *ensure_height,
+                                            state_final_tree
+                                                .value()
+                                                .map_or_else(Checkpoint::tree_empty, |t| {
+                                                    Checkpoint::at_position(t.position())
+                                                }),
+                                        ))
+                                    },
+                                    |(existing_checkpoint_height, position)| {
+                                        if *existing_checkpoint_height < *ensure_height {
+                                            Some((
+                                                *ensure_height,
+                                                Checkpoint::at_position(*position),
+                                            ))
+                                        } else {
+                                            // The checkpoint already exists, so we don't need to
+                                            // do anything.
+                                            None
+                                        }
+                                    },
+                                )
+                                .into_iter()
+                        })
+                        .collect::<Vec<_>>()
+                }
 
-                        wallet::put_sent_output(
-                            up,
-                            output.account,
-                            tx_ref,
-                            output.index,
-                            &recipient,
-                            Amount::from_u64(output.note.value().inner()).map_err(|_|
-                                SqliteClientError::CorruptedData("Note value is not a valid Zcash amount.".to_string()))?,
-                            Some(&output.memo),
+                #[cfg(feature = "orchard")]
+                let (missing_sapling_checkpoints, missing_orchard_checkpoints) = (
+                    ensure_checkpoints(
+                        orchard_checkpoint_positions.keys(),
+                        &sapling_checkpoint_positions,
+                        from_state.final_sapling_tree(),
+                    ),
+                    ensure_checkpoints(
+                        sapling_checkpoint_positions.keys(),
+                        &orchard_checkpoint_positions,
+                        from_state.final_orchard_tree(),
+                    ),
+                );
+
+                // Update the Sapling note commitment tree with all newly read note commitments
+                {
+                    let mut sapling_subtrees_iter = sapling_subtrees.into_iter();
+                    wdb.with_sapling_tree_mut::<_, _, Self::Error>(|sapling_tree| {
+                        debug!(
+                            "Sapling initial tree size at {:?}: {:?}",
+                            from_state.block_height(),
+                            from_state.final_sapling_tree().tree_size()
+                        );
+                        // We insert the frontier with `Checkpoint` retention because we need to be
+                        // able to truncate the tree back to this point.
+                        sapling_tree.insert_frontier(
+                            from_state.final_sapling_tree().clone(),
+                            Retention::Checkpoint {
+                                id: from_state.block_height(),
+                                marking: Marking::Reference,
+                            },
                         )?;
 
-                        if matches!(recipient, Recipient::InternalAccount(_, _)) {
-                            wallet::sapling::put_received_note(up, output, tx_ref)?;
+                        for (tree, checkpoints) in &mut sapling_subtrees_iter {
+                            sapling_tree.insert_tree(tree, checkpoints)?;
                         }
-                    }
-                    TransferType::Incoming => {
-                        match spending_account_id {
-                            Some(id) =>
-                                if id != output.account {
-                                    panic!("Unable to determine a unique account identifier for z->t spend.");
+
+                        // Ensure we have a Sapling checkpoint for each checkpointed Orchard block height.
+                        // We skip all checkpoints below the minimum retained checkpoint in the
+                        // Sapling tree, because branches below this height may be pruned.
+                        #[cfg(feature = "orchard")]
+                        {
+                            let min_checkpoint_height = sapling_tree
+                                .store()
+                                .min_checkpoint_id()
+                                .map_err(ShardTreeError::Storage)?
+                                .expect(
+                                    "At least one checkpoint was inserted (by insert_frontier)",
+                                );
+
+                            for (height, checkpoint) in &missing_sapling_checkpoints {
+                                if *height > min_checkpoint_height {
+                                    sapling_tree
+                                        .store_mut()
+                                        .add_checkpoint(*height, checkpoint.clone())
+                                        .map_err(ShardTreeError::Storage)?;
                                 }
-                            None => {
-                                spending_account_id = Some(output.account);
                             }
                         }
 
-                        wallet::sapling::put_received_note(up, output, tx_ref)?;
-                    }
+                        Ok(())
+                    })?;
                 }
-            }
 
-            // If any of the utxos spent in the transaction are ours, mark them as spent.
-            #[cfg(feature = "transparent-inputs")]
-            for txin in d_tx.tx.transparent_bundle().iter().flat_map(|b| b.vin.iter()) {
-                wallet::mark_transparent_utxo_spent(up, tx_ref, &txin.prevout)?;
-            }
+                // Update the Orchard note commitment tree with all newly read note commitments
+                #[cfg(feature = "orchard")]
+                {
+                    let mut orchard_subtrees = orchard_subtrees.into_iter();
+                    wdb.with_orchard_tree_mut::<_, _, Self::Error>(|orchard_tree| {
+                        debug!(
+                            "Orchard initial tree size at {:?}: {:?}",
+                            from_state.block_height(),
+                            from_state.final_orchard_tree().tree_size()
+                        );
+                        // We insert the frontier with `Checkpoint` retention because we need to be
+                        // able to truncate the tree back to this point.
+                        orchard_tree.insert_frontier(
+                            from_state.final_orchard_tree().clone(),
+                            Retention::Checkpoint {
+                                id: from_state.block_height(),
+                                marking: Marking::Reference,
+                            },
+                        )?;
 
-            // If we have some transparent outputs:
-            if !d_tx.tx.transparent_bundle().iter().any(|b| b.vout.is_empty()) {
-                let nullifiers = self.wallet_db.get_sapling_nullifiers(data_api::NullifierQuery::All)?;
-                // If the transaction contains shielded spends from our wallet, we will store z->t
-                // transactions we observe in the same way they would be stored by
-                // create_spend_to_address.
-                if let Some((account_id, _)) = nullifiers.iter().find(
-                    |(_, nf)|
-                        d_tx.tx.sapling_bundle().iter().flat_map(|b| b.shielded_spends().iter())
-                        .any(|input| nf == input.nullifier())
-                ) {
-                    for (output_index, txout) in d_tx.tx.transparent_bundle().iter().flat_map(|b| b.vout.iter()).enumerate() {
-                        if let Some(address) = txout.recipient_address() {
-                            wallet::put_sent_output(
-                                up,
-                                *account_id,
-                                tx_ref,
-                                output_index,
-                                &Recipient::Transparent(address),
-                                txout.value,
-                                None
-                            )?;
+                        for (tree, checkpoints) in &mut orchard_subtrees {
+                            orchard_tree.insert_tree(tree, checkpoints)?;
                         }
-                    }
-                }
-            }
-            Ok(tx_ref)
-        })
-    }
 
-    fn store_sent_tx(&mut self, sent_tx: &SentTransaction) -> Result<Self::TxRef, Self::Error> {
-        // Update the database atomically, to ensure the result is internally consistent.
-        self.transactionally(|up| {
-            let tx_ref = wallet::put_tx_data(
-                up,
-                sent_tx.tx,
-                Some(sent_tx.fee_amount),
-                Some(sent_tx.created),
-            )?;
-
-            // Mark notes as spent.
-            //
-            // This locks the notes so they aren't selected again by a subsequent call to
-            // create_spend_to_address() before this transaction has been mined (at which point the notes
-            // get re-marked as spent).
-            //
-            // Assumes that create_spend_to_address() will never be called in parallel, which is a
-            // reasonable assumption for a light client such as a mobile phone.
-            if let Some(bundle) = sent_tx.tx.sapling_bundle() {
-                for spend in bundle.shielded_spends() {
-                    wallet::sapling::mark_sapling_note_spent(up, tx_ref, spend.nullifier())?;
+                        // Ensure we have an Orchard checkpoint for each checkpointed Sapling block height.
+                        // We skip all checkpoints below the minimum retained checkpoint in the
+                        // Orchard tree, because branches below this height may be pruned.
+                        {
+                            let min_checkpoint_height = orchard_tree
+                                .store()
+                                .min_checkpoint_id()
+                                .map_err(ShardTreeError::Storage)?
+                                .expect(
+                                    "At least one checkpoint was inserted (by insert_frontier)",
+                                );
+
+                            for (height, checkpoint) in &missing_orchard_checkpoints {
+                                if *height > min_checkpoint_height {
+                                    debug!(
+                                        "Adding missing Orchard checkpoint for height: {:?}: {:?}",
+                                        height,
+                                        checkpoint.position()
+                                    );
+                                    orchard_tree
+                                        .store_mut()
+                                        .add_checkpoint(*height, checkpoint.clone())
+                                        .map_err(ShardTreeError::Storage)?;
+                                }
+                            }
+                        }
+                        Ok(())
+                    })?;
                 }
-            }
-
-            #[cfg(feature = "transparent-inputs")]
-            for utxo_outpoint in &sent_tx.utxos_spent {
-                wallet::mark_transparent_utxo_spent(up, tx_ref, utxo_outpoint)?;
-            }
 
-            for output in &sent_tx.outputs {
-                wallet::insert_sent_output(up, tx_ref, sent_tx.account, output)?;
-
-                if let Some((account, note)) = output.sapling_change_to() {
-                    wallet::sapling::put_received_note(
-                        up,
-                        &DecryptedOutput {
-                            index: output.output_index(),
-                            note: note.clone(),
-                            account: *account,
-                            memo: output
-                                .memo()
-                                .map_or_else(MemoBytes::empty, |memo| memo.clone()),
-                            transfer_type: TransferType::WalletInternal,
-                        },
-                        tx_ref,
-                    )?;
-                }
+                wallet::scanning::scan_complete(
+                    wdb.conn.0,
+                    &wdb.params,
+                    Range {
+                        start: start_positions.height,
+                        end: last_scanned_height + 1,
+                    },
+                    &note_positions,
+                )?;
             }
 
-            // Return the row number of the transaction, so the caller can fetch it for sending.
-            Ok(tx_ref)
+            Ok(())
         })
     }
 
-    fn truncate_to_height(&mut self, block_height: BlockHeight) -> Result<(), Self::Error> {
-        wallet::truncate_to_height(self.wallet_db, block_height)
-    }
-
     fn put_received_transparent_utxo(
         &mut self,
         _output: &WalletTransparentOutput,
     ) -> Result<Self::UtxoRef, Self::Error> {
         #[cfg(feature = "transparent-inputs")]
-        return wallet::put_received_transparent_utxo(self, _output);
+        return wallet::transparent::put_received_transparent_utxo(
+            &self.conn,
+            &self.params,
+            _output,
+        );
 
         #[cfg(not(feature = "transparent-inputs"))]
         panic!(
             "The wallet must be compiled with the transparent-inputs feature to use this method."
         );
     }
+
+    fn store_decrypted_tx(
+        &mut self,
+        d_tx: DecryptedTransaction<Self::AccountId>,
+    ) -> Result<(), Self::Error> {
+        self.transactionally(|wdb| wallet::store_decrypted_tx(wdb.conn.0, &wdb.params, d_tx))
+    }
+
+    fn store_transactions_to_be_sent(
+        &mut self,
+        transactions: &[SentTransaction<Self::AccountId>],
+    ) -> Result<(), Self::Error> {
+        self.transactionally(|wdb| {
+            for sent_tx in transactions {
+                wallet::store_transaction_to_be_sent(wdb, sent_tx)?;
+            }
+            Ok(())
+        })
+    }
+
+    fn truncate_to_height(&mut self, max_height: BlockHeight) -> Result<BlockHeight, Self::Error> {
+        self.transactionally(|wdb| wallet::truncate_to_height(wdb.conn.0, &wdb.params, max_height))
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn reserve_next_n_ephemeral_addresses(
+        &mut self,
+        account_id: Self::AccountId,
+        n: usize,
+    ) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, Self::Error> {
+        self.transactionally(|wdb| {
+            let account_id = wallet::get_account_ref(wdb.conn.0, account_id)?;
+            wallet::transparent::ephemeral::reserve_next_n_ephemeral_addresses(
+                wdb.conn.0,
+                &wdb.params,
+                account_id,
+                n,
+            )
+        })
+    }
+
+    fn set_transaction_status(
+        &mut self,
+        txid: TxId,
+        status: data_api::TransactionStatus,
+    ) -> Result<(), Self::Error> {
+        self.transactionally(|wdb| wallet::set_transaction_status(wdb.conn.0, txid, status))
+    }
+}
+
+impl<P: consensus::Parameters> WalletCommitmentTrees for WalletDb<rusqlite::Connection, P> {
+    type Error = commitment_tree::Error;
+    type SaplingShardStore<'a> =
+        SqliteShardStore<&'a rusqlite::Transaction<'a>, sapling::Node, SAPLING_SHARD_HEIGHT>;
+
+    fn with_sapling_tree_mut<F, A, E>(&mut self, mut callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::SaplingShardStore<'a>,
+                { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+                SAPLING_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Self::Error>>,
+    {
+        let tx = self
+            .conn
+            .transaction()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        let shard_store = SqliteShardStore::from_connection(&tx, SAPLING_TABLES_PREFIX)
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        let result = {
+            let mut shardtree = ShardTree::new(shard_store, PRUNING_DEPTH.try_into().unwrap());
+            callback(&mut shardtree)?
+        };
+
+        tx.commit()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        Ok(result)
+    }
+
+    fn put_sapling_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<sapling::Node>],
+    ) -> Result<(), ShardTreeError<Self::Error>> {
+        let tx = self
+            .conn
+            .transaction()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        put_shard_roots::<_, { sapling::NOTE_COMMITMENT_TREE_DEPTH }, SAPLING_SHARD_HEIGHT>(
+            &tx,
+            SAPLING_TABLES_PREFIX,
+            start_index,
+            roots,
+        )?;
+        tx.commit()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        Ok(())
+    }
+
+    #[cfg(feature = "orchard")]
+    type OrchardShardStore<'a> = SqliteShardStore<
+        &'a rusqlite::Transaction<'a>,
+        orchard::tree::MerkleHashOrchard,
+        ORCHARD_SHARD_HEIGHT,
+    >;
+
+    #[cfg(feature = "orchard")]
+    fn with_orchard_tree_mut<F, A, E>(&mut self, mut callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::OrchardShardStore<'a>,
+                { ORCHARD_SHARD_HEIGHT * 2 },
+                ORCHARD_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Self::Error>>,
+    {
+        let tx = self
+            .conn
+            .transaction()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        let shard_store = SqliteShardStore::from_connection(&tx, ORCHARD_TABLES_PREFIX)
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        let result = {
+            let mut shardtree = ShardTree::new(shard_store, PRUNING_DEPTH.try_into().unwrap());
+            callback(&mut shardtree)?
+        };
+
+        tx.commit()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        Ok(result)
+    }
+
+    #[cfg(feature = "orchard")]
+    fn put_orchard_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<orchard::tree::MerkleHashOrchard>],
+    ) -> Result<(), ShardTreeError<Self::Error>> {
+        let tx = self
+            .conn
+            .transaction()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        put_shard_roots::<_, { ORCHARD_SHARD_HEIGHT * 2 }, ORCHARD_SHARD_HEIGHT>(
+            &tx,
+            ORCHARD_TABLES_PREFIX,
+            start_index,
+            roots,
+        )?;
+        tx.commit()
+            .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?;
+        Ok(())
+    }
+}
+
+impl<'conn, P: consensus::Parameters> WalletCommitmentTrees for WalletDb<SqlTransaction<'conn>, P> {
+    type Error = commitment_tree::Error;
+    type SaplingShardStore<'a> =
+        SqliteShardStore<&'a rusqlite::Transaction<'a>, sapling::Node, SAPLING_SHARD_HEIGHT>;
+
+    fn with_sapling_tree_mut<F, A, E>(&mut self, mut callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::SaplingShardStore<'a>,
+                { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+                SAPLING_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<commitment_tree::Error>>,
+    {
+        let mut shardtree = ShardTree::new(
+            SqliteShardStore::from_connection(self.conn.0, SAPLING_TABLES_PREFIX)
+                .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?,
+            PRUNING_DEPTH.try_into().unwrap(),
+        );
+        let result = callback(&mut shardtree)?;
+
+        Ok(result)
+    }
+
+    fn put_sapling_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<sapling::Node>],
+    ) -> Result<(), ShardTreeError<Self::Error>> {
+        put_shard_roots::<_, { sapling::NOTE_COMMITMENT_TREE_DEPTH }, SAPLING_SHARD_HEIGHT>(
+            self.conn.0,
+            SAPLING_TABLES_PREFIX,
+            start_index,
+            roots,
+        )
+    }
+
+    #[cfg(feature = "orchard")]
+    type OrchardShardStore<'a> = SqliteShardStore<
+        &'a rusqlite::Transaction<'a>,
+        orchard::tree::MerkleHashOrchard,
+        ORCHARD_SHARD_HEIGHT,
+    >;
+
+    #[cfg(feature = "orchard")]
+    fn with_orchard_tree_mut<F, A, E>(&mut self, mut callback: F) -> Result<A, E>
+    where
+        for<'a> F: FnMut(
+            &'a mut ShardTree<
+                Self::OrchardShardStore<'a>,
+                { ORCHARD_SHARD_HEIGHT * 2 },
+                ORCHARD_SHARD_HEIGHT,
+            >,
+        ) -> Result<A, E>,
+        E: From<ShardTreeError<Self::Error>>,
+    {
+        let mut shardtree = ShardTree::new(
+            SqliteShardStore::from_connection(self.conn.0, ORCHARD_TABLES_PREFIX)
+                .map_err(|e| ShardTreeError::Storage(commitment_tree::Error::Query(e)))?,
+            PRUNING_DEPTH.try_into().unwrap(),
+        );
+        let result = callback(&mut shardtree)?;
+
+        Ok(result)
+    }
+
+    #[cfg(feature = "orchard")]
+    fn put_orchard_subtree_roots(
+        &mut self,
+        start_index: u64,
+        roots: &[CommitmentTreeRoot<orchard::tree::MerkleHashOrchard>],
+    ) -> Result<(), ShardTreeError<Self::Error>> {
+        put_shard_roots::<_, { orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 }, ORCHARD_SHARD_HEIGHT>(
+            self.conn.0,
+            ORCHARD_TABLES_PREFIX,
+            start_index,
+            roots,
+        )
+    }
 }
 
 /// A handle for the SQLite block source.
@@ -734,17 +1677,14 @@ impl BlockDb {
 impl BlockSource for BlockDb {
     type Error = SqliteClientError;
 
-    fn with_blocks<F, DbErrT, NoteRef>(
+    fn with_blocks<F, DbErrT>(
         &self,
         from_height: Option<BlockHeight>,
-        limit: Option<u32>,
+        limit: Option<usize>,
         with_row: F,
-    ) -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error, NoteRef>>
+    ) -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error>>
     where
-        F: FnMut(
-            CompactBlock,
-        )
-            -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error, NoteRef>>,
+        F: FnMut(CompactBlock) -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error>>,
     {
         chain::blockdb_with_blocks(self, from_height, limit, with_row)
     }
@@ -765,7 +1705,7 @@ impl BlockSource for BlockDb {
 ///
 /// This block source is intended to be used with the following data flow:
 /// * When the cache is being filled:
-///   * The caller requests the current maximum height height at which cached data is available
+///   * The caller requests the current maximum height at which cached data is available
 ///     using [`FsBlockDb::get_max_cached_height`]. If no cached data is available, the caller
 ///     can use the wallet's synced-to height for the following operations instead.
 ///   * (recommended for privacy) the caller should round the returned height down to some 100- /
@@ -806,6 +1746,7 @@ pub enum FsBlockDbError {
     InvalidBlockstoreRoot(PathBuf),
     InvalidBlockPath(PathBuf),
     CorruptedData(String),
+    CacheMiss(BlockHeight),
 }
 
 #[cfg(feature = "unstable")]
@@ -839,7 +1780,7 @@ impl FsBlockDb {
     /// files as described for [`FsBlockDb`].
     ///
     /// An application using this constructor should ensure that they call
-    /// [`zcash_client_sqlite::chain::init::init_blockmetadb`] at application startup to ensure
+    /// [`crate::chain::init::init_blockmeta_db`] at application startup to ensure
     /// that the resulting metadata database is properly initialized and has had all required
     /// migrations applied before use.
     pub fn for_path<P: AsRef<Path>>(fsblockdb_root: P) -> Result<Self, FsBlockDbError> {
@@ -864,7 +1805,8 @@ impl FsBlockDb {
         Ok(chain::blockmetadb_get_max_cached_height(&self.conn)?)
     }
 
-    /// Adds a set of block metadata entries to the metadata database.
+    /// Adds a set of block metadata entries to the metadata database, overwriting any
+    /// existing entries at the given block heights.
     ///
     /// This will return an error if any block file corresponding to one of these metadata records
     /// is absent from the blocks directory.
@@ -915,17 +1857,14 @@ impl FsBlockDb {
 impl BlockSource for FsBlockDb {
     type Error = FsBlockDbError;
 
-    fn with_blocks<F, DbErrT, NoteRef>(
+    fn with_blocks<F, DbErrT>(
         &self,
         from_height: Option<BlockHeight>,
-        limit: Option<u32>,
+        limit: Option<usize>,
         with_row: F,
-    ) -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error, NoteRef>>
+    ) -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error>>
     where
-        F: FnMut(
-            CompactBlock,
-        )
-            -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error, NoteRef>>,
+        F: FnMut(CompactBlock) -> Result<(), data_api::chain::error::Error<DbErrT, Self::Error>>,
     {
         fsblockdb_with_blocks(self, from_height, limit, with_row)
     }
@@ -972,6 +1911,13 @@ impl std::fmt::Display for FsBlockDbError {
                     e,
                 )
             }
+            FsBlockDbError::CacheMiss(height) => {
+                write!(
+                    f,
+                    "Requested height {} does not exist in the block cache",
+                    height
+                )
+            }
         }
     }
 }
@@ -982,353 +1928,328 @@ extern crate assert_matches;
 
 #[cfg(test)]
 mod tests {
-    use prost::Message;
-    use rand_core::{OsRng, RngCore};
-    use rusqlite::params;
-    use std::collections::HashMap;
-
-    #[cfg(feature = "unstable")]
-    use std::{fs::File, path::Path};
-
-    #[cfg(feature = "transparent-inputs")]
-    use zcash_primitives::{legacy, legacy::keys::IncomingViewingKey};
-
-    use zcash_note_encryption::Domain;
-    use zcash_primitives::{
-        block::BlockHash,
-        consensus::{BlockHeight, Network, NetworkUpgrade, Parameters},
-        legacy::TransparentAddress,
-        memo::MemoBytes,
-        sapling::{
-            note_encryption::{sapling_note_encryption, SaplingDomain},
-            util::generate_random_rseed,
-            value::NoteValue,
-            Note, Nullifier, PaymentAddress,
-        },
-        transaction::components::Amount,
-        zip32::{sapling::DiversifiableFullViewingKey, DiversifierIndex},
-    };
-
-    use zcash_client_backend::{
-        data_api::{WalletRead, WalletWrite},
-        keys::{sapling, UnifiedFullViewingKey},
-        proto::compact_formats::{
-            CompactBlock, CompactSaplingOutput, CompactSaplingSpend, CompactTx,
-        },
+    use secrecy::{ExposeSecret, Secret, SecretVec};
+    use uuid::Uuid;
+    use zcash_client_backend::data_api::{
+        chain::ChainState,
+        testing::{TestBuilder, TestState},
+        Account, AccountBirthday, AccountPurpose, AccountSource, WalletRead, WalletTest,
+        WalletWrite,
     };
+    use zcash_keys::keys::{UnifiedFullViewingKey, UnifiedSpendingKey};
+    use zcash_primitives::block::BlockHash;
+    use zcash_protocol::consensus;
 
     use crate::{
-        wallet::init::{init_accounts_table, init_wallet_db},
-        AccountId, WalletDb,
+        error::SqliteClientError, testing::db::TestDbFactory, AccountUuid, DEFAULT_UA_REQUEST,
     };
 
-    use super::BlockDb;
-
     #[cfg(feature = "unstable")]
-    use super::{
-        chain::{init::init_blockmeta_db, BlockMeta},
-        FsBlockDb,
+    use {
+        zcash_client_backend::keys::sapling,
+        zcash_primitives::transaction::components::amount::NonNegativeAmount,
     };
 
-    #[cfg(feature = "mainnet")]
-    pub(crate) fn network() -> Network {
-        Network::MainNetwork
-    }
+    #[test]
+    fn validate_seed() {
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+        let account = st.test_account().unwrap();
+
+        assert!({
+            st.wallet()
+                .validate_seed(account.id(), st.test_seed().unwrap())
+                .unwrap()
+        });
 
-    #[cfg(not(feature = "mainnet"))]
-    pub(crate) fn network() -> Network {
-        Network::TestNetwork
-    }
+        // check that passing an invalid account results in a failure
+        assert!({
+            let wrong_account_uuid = AccountUuid(Uuid::nil());
+            !st.wallet()
+                .validate_seed(wrong_account_uuid, st.test_seed().unwrap())
+                .unwrap()
+        });
 
-    #[cfg(feature = "mainnet")]
-    pub(crate) fn sapling_activation_height() -> BlockHeight {
-        Network::MainNetwork
-            .activation_height(NetworkUpgrade::Sapling)
-            .unwrap()
+        // check that passing an invalid seed results in a failure
+        assert!({
+            !st.wallet()
+                .validate_seed(account.id(), &SecretVec::new(vec![1u8; 32]))
+                .unwrap()
+        });
     }
 
-    #[cfg(not(feature = "mainnet"))]
-    pub(crate) fn sapling_activation_height() -> BlockHeight {
-        Network::TestNetwork
-            .activation_height(NetworkUpgrade::Sapling)
-            .unwrap()
+    #[test]
+    pub(crate) fn get_next_available_address() {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+        let account = st.test_account().cloned().unwrap();
+
+        let current_addr = st.wallet().get_current_address(account.id()).unwrap();
+        assert!(current_addr.is_some());
+
+        let addr2 = st
+            .wallet_mut()
+            .get_next_available_address(account.id(), DEFAULT_UA_REQUEST)
+            .unwrap();
+        assert!(addr2.is_some());
+        assert_ne!(current_addr, addr2);
+
+        let addr2_cur = st.wallet().get_current_address(account.id()).unwrap();
+        assert_eq!(addr2, addr2_cur);
     }
 
-    #[cfg(test)]
-    pub(crate) fn init_test_accounts_table(
-        db_data: &WalletDb<Network>,
-    ) -> (DiversifiableFullViewingKey, Option<TransparentAddress>) {
-        let (ufvk, taddr) = init_test_accounts_table_ufvk(db_data);
-        (ufvk.sapling().unwrap().clone(), taddr)
+    #[test]
+    pub(crate) fn import_account_hd_0() {
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .set_account_index(zip32::AccountId::ZERO)
+            .build();
+        assert_matches!(
+            st.test_account().unwrap().account().source(),
+            AccountSource::Derived { derivation, .. } if derivation.account_index() == zip32::AccountId::ZERO);
     }
 
-    #[cfg(test)]
-    pub(crate) fn init_test_accounts_table_ufvk(
-        db_data: &WalletDb<Network>,
-    ) -> (UnifiedFullViewingKey, Option<TransparentAddress>) {
-        let seed = [0u8; 32];
-        let account = AccountId::from(0);
-        let extsk = sapling::spending_key(&seed, network().coin_type(), account);
-        let dfvk = extsk.to_diversifiable_full_viewing_key();
+    #[test]
+    pub(crate) fn import_account_hd_1_then_2() {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
 
-        #[cfg(feature = "transparent-inputs")]
-        let (tkey, taddr) = {
-            let tkey = legacy::keys::AccountPrivKey::from_seed(&network(), &seed, account)
-                .unwrap()
-                .to_account_pubkey();
-            let taddr = tkey.derive_external_ivk().unwrap().default_address().0;
-            (Some(tkey), Some(taddr))
-        };
+        let birthday = AccountBirthday::from_parts(
+            ChainState::empty(st.network().sapling.unwrap() - 1, BlockHash([0; 32])),
+            None,
+        );
 
-        #[cfg(not(feature = "transparent-inputs"))]
-        let taddr = None;
+        let seed = Secret::new(vec![0u8; 32]);
+        let zip32_index_1 = zip32::AccountId::ZERO.next().unwrap();
 
-        let ufvk = UnifiedFullViewingKey::new(
-            #[cfg(feature = "transparent-inputs")]
-            tkey,
-            Some(dfvk),
-            None,
-        )
-        .unwrap();
-
-        let ufvks = HashMap::from([(account, ufvk.clone())]);
-        init_accounts_table(db_data, &ufvks).unwrap();
-
-        (ufvk, taddr)
-    }
-
-    #[allow(dead_code)]
-    pub(crate) enum AddressType {
-        DefaultExternal,
-        DiversifiedExternal(DiversifierIndex),
-        Internal,
-    }
-
-    /// Create a fake CompactBlock at the given height, containing a single output paying
-    /// an address. Returns the CompactBlock and the nullifier for the new note.
-    pub(crate) fn fake_compact_block(
-        height: BlockHeight,
-        prev_hash: BlockHash,
-        dfvk: &DiversifiableFullViewingKey,
-        req: AddressType,
-        value: Amount,
-    ) -> (CompactBlock, Nullifier) {
-        let to = match req {
-            AddressType::DefaultExternal => dfvk.default_address().1,
-            AddressType::DiversifiedExternal(idx) => dfvk.find_address(idx).unwrap().1,
-            AddressType::Internal => dfvk.change_address().1,
-        };
+        let first = st
+            .wallet_mut()
+            .import_account_hd("", &seed, zip32_index_1, &birthday, None)
+            .unwrap();
+        assert_matches!(
+            first.0.source(),
+            AccountSource::Derived { derivation, .. } if derivation.account_index() == zip32_index_1);
+
+        let zip32_index_2 = zip32_index_1.next().unwrap();
+        let second = st
+            .wallet_mut()
+            .import_account_hd("", &seed, zip32_index_2, &birthday, None)
+            .unwrap();
+        assert_matches!(
+            second.0.source(),
+            AccountSource::Derived { derivation, .. } if derivation.account_index() == zip32_index_2);
+    }
 
-        // Create a fake Note for the account
-        let mut rng = OsRng;
-        let rseed = generate_random_rseed(&network(), height, &mut rng);
-        let note = Note::from_parts(to, NoteValue::from_raw(value.into()), rseed);
-        let encryptor = sapling_note_encryption::<_, Network>(
-            Some(dfvk.fvk().ovk),
-            note.clone(),
-            MemoBytes::empty(),
-            &mut rng,
+    fn check_collisions<C, DbT: WalletTest + WalletWrite, P: consensus::Parameters>(
+        st: &mut TestState<C, DbT, P>,
+        ufvk: &UnifiedFullViewingKey,
+        birthday: &AccountBirthday,
+        is_account_collision: impl Fn(&<DbT as WalletRead>::Error) -> bool,
+    ) where
+        DbT::Account: core::fmt::Debug,
+    {
+        assert_matches!(
+            st.wallet_mut()
+                .import_account_ufvk("", ufvk, birthday, AccountPurpose::Spending { derivation: None }, None),
+            Err(e) if is_account_collision(&e)
         );
-        let cmu = note.cmu().to_bytes().to_vec();
-        let ephemeral_key = SaplingDomain::<Network>::epk_bytes(encryptor.epk())
-            .0
-            .to_vec();
-        let enc_ciphertext = encryptor.encrypt_note_plaintext();
-
-        // Create a fake CompactBlock containing the note
-        let cout = CompactSaplingOutput {
-            cmu,
-            ephemeral_key,
-            ciphertext: enc_ciphertext.as_ref()[..52].to_vec(),
-        };
-        let mut ctx = CompactTx::default();
-        let mut txid = vec![0; 32];
-        rng.fill_bytes(&mut txid);
-        ctx.hash = txid;
-        ctx.outputs.push(cout);
-        let mut cb = CompactBlock {
-            hash: {
-                let mut hash = vec![0; 32];
-                rng.fill_bytes(&mut hash);
-                hash
-            },
-            height: height.into(),
-            ..Default::default()
-        };
-        cb.prev_hash.extend_from_slice(&prev_hash.0);
-        cb.vtx.push(ctx);
-        (cb, note.nf(&dfvk.fvk().vk.nk, 0))
-    }
-
-    /// Create a fake CompactBlock at the given height, spending a single note from the
-    /// given address.
-    pub(crate) fn fake_compact_block_spending(
-        height: BlockHeight,
-        prev_hash: BlockHash,
-        (nf, in_value): (Nullifier, Amount),
-        dfvk: &DiversifiableFullViewingKey,
-        to: PaymentAddress,
-        value: Amount,
-    ) -> CompactBlock {
-        let mut rng = OsRng;
-        let rseed = generate_random_rseed(&network(), height, &mut rng);
-
-        // Create a fake CompactBlock containing the note
-        let cspend = CompactSaplingSpend { nf: nf.to_vec() };
-        let mut ctx = CompactTx::default();
-        let mut txid = vec![0; 32];
-        rng.fill_bytes(&mut txid);
-        ctx.hash = txid;
-        ctx.spends.push(cspend);
-
-        // Create a fake Note for the payment
-        ctx.outputs.push({
-            let note = Note::from_parts(to, NoteValue::from_raw(value.into()), rseed);
-            let encryptor = sapling_note_encryption::<_, Network>(
-                Some(dfvk.fvk().ovk),
-                note.clone(),
-                MemoBytes::empty(),
-                &mut rng,
-            );
-            let cmu = note.cmu().to_bytes().to_vec();
-            let ephemeral_key = SaplingDomain::<Network>::epk_bytes(encryptor.epk())
-                .0
-                .to_vec();
-            let enc_ciphertext = encryptor.encrypt_note_plaintext();
 
-            CompactSaplingOutput {
-                cmu,
-                ephemeral_key,
-                ciphertext: enc_ciphertext.as_ref()[..52].to_vec(),
-            }
-        });
-
-        // Create a fake Note for the change
-        ctx.outputs.push({
-            let change_addr = dfvk.default_address().1;
-            let rseed = generate_random_rseed(&network(), height, &mut rng);
-            let note = Note::from_parts(
-                change_addr,
-                NoteValue::from_raw((in_value - value).unwrap().into()),
-                rseed,
-            );
-            let encryptor = sapling_note_encryption::<_, Network>(
-                Some(dfvk.fvk().ovk),
-                note.clone(),
-                MemoBytes::empty(),
-                &mut rng,
+        // Remove the transparent component so that we don't have a match on the full UFVK.
+        // That should still produce an AccountCollision error.
+        #[cfg(feature = "transparent-inputs")]
+        {
+            assert!(ufvk.transparent().is_some());
+            let subset_ufvk = UnifiedFullViewingKey::new(
+                None,
+                ufvk.sapling().cloned(),
+                #[cfg(feature = "orchard")]
+                ufvk.orchard().cloned(),
+            )
+            .unwrap();
+            assert_matches!(
+                st.wallet_mut().import_account_ufvk(
+                    "",
+                    &subset_ufvk,
+                    birthday,
+                    AccountPurpose::Spending { derivation: None },
+                    None,
+                ),
+                Err(e) if is_account_collision(&e)
             );
-            let cmu = note.cmu().to_bytes().to_vec();
-            let ephemeral_key = SaplingDomain::<Network>::epk_bytes(encryptor.epk())
-                .0
-                .to_vec();
-            let enc_ciphertext = encryptor.encrypt_note_plaintext();
-
-            CompactSaplingOutput {
-                cmu,
-                ephemeral_key,
-                ciphertext: enc_ciphertext.as_ref()[..52].to_vec(),
-            }
-        });
+        }
 
-        let mut cb = CompactBlock {
-            hash: {
-                let mut hash = vec![0; 32];
-                rng.fill_bytes(&mut hash);
-                hash
-            },
-            height: height.into(),
-            ..Default::default()
-        };
-        cb.prev_hash.extend_from_slice(&prev_hash.0);
-        cb.vtx.push(ctx);
-        cb
-    }
-
-    /// Insert a fake CompactBlock into the cache DB.
-    pub(crate) fn insert_into_cache(db_cache: &BlockDb, cb: &CompactBlock) {
-        let cb_bytes = cb.encode_to_vec();
-        db_cache
-            .0
-            .prepare("INSERT INTO compactblocks (height, data) VALUES (?, ?)")
-            .unwrap()
-            .execute(params![u32::from(cb.height()), cb_bytes,])
+        // Remove the Orchard component so that we don't have a match on the full UFVK.
+        // That should still produce an AccountCollision error.
+        #[cfg(feature = "orchard")]
+        {
+            assert!(ufvk.orchard().is_some());
+            let subset_ufvk = UnifiedFullViewingKey::new(
+                #[cfg(feature = "transparent-inputs")]
+                ufvk.transparent().cloned(),
+                ufvk.sapling().cloned(),
+                None,
+            )
             .unwrap();
+            assert_matches!(
+                st.wallet_mut().import_account_ufvk(
+                    "",
+                    &subset_ufvk,
+                    birthday,
+                    AccountPurpose::Spending { derivation: None },
+                    None,
+                ),
+                Err(e) if is_account_collision(&e)
+            );
+        }
     }
 
-    #[cfg(feature = "unstable")]
-    pub(crate) fn store_in_fsblockdb<P: AsRef<Path>>(
-        fsblockdb_root: P,
-        cb: &CompactBlock,
-    ) -> BlockMeta {
-        use std::io::Write;
-
-        let meta = BlockMeta {
-            height: cb.height(),
-            block_hash: cb.hash(),
-            block_time: cb.time,
-            sapling_outputs_count: cb.vtx.iter().map(|tx| tx.outputs.len() as u32).sum(),
-            orchard_actions_count: cb.vtx.iter().map(|tx| tx.actions.len() as u32).sum(),
-        };
+    #[test]
+    pub(crate) fn import_account_hd_1_then_conflicts() {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
+
+        let birthday = AccountBirthday::from_parts(
+            ChainState::empty(st.network().sapling.unwrap() - 1, BlockHash([0; 32])),
+            None,
+        );
 
-        let blocks_dir = fsblockdb_root.as_ref().join("blocks");
-        let block_path = meta.block_file_path(&blocks_dir);
+        let seed = Secret::new(vec![0u8; 32]);
+        let zip32_index_1 = zip32::AccountId::ZERO.next().unwrap();
 
-        File::create(block_path)
-            .unwrap()
-            .write_all(&cb.encode_to_vec())
+        let (first_account, _) = st
+            .wallet_mut()
+            .import_account_hd("", &seed, zip32_index_1, &birthday, None)
             .unwrap();
+        let ufvk = first_account.ufvk().unwrap();
 
-        meta
+        assert_matches!(
+            st.wallet_mut().import_account_hd("", &seed, zip32_index_1, &birthday, None),
+            Err(SqliteClientError::AccountCollision(id)) if id == first_account.id());
+
+        check_collisions(
+            &mut st,
+            ufvk,
+            &birthday,
+            |e| matches!(e, SqliteClientError::AccountCollision(id) if *id == first_account.id()),
+        );
     }
 
     #[test]
-    pub(crate) fn get_next_available_address() {
-        use tempfile::NamedTempFile;
+    pub(crate) fn import_account_ufvk_then_conflicts() {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
 
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), network()).unwrap();
+        let birthday = AccountBirthday::from_parts(
+            ChainState::empty(st.network().sapling.unwrap() - 1, BlockHash([0; 32])),
+            None,
+        );
 
-        let account = AccountId::from(0);
-        init_wallet_db(&mut db_data, None).unwrap();
-        let _ = init_test_accounts_table_ufvk(&db_data);
+        let seed = Secret::new(vec![0u8; 32]);
+        let zip32_index_0 = zip32::AccountId::ZERO;
+        let usk = UnifiedSpendingKey::from_seed(st.network(), seed.expose_secret(), zip32_index_0)
+            .unwrap();
+        let ufvk = usk.to_unified_full_viewing_key();
+
+        let account = st
+            .wallet_mut()
+            .import_account_ufvk(
+                "",
+                &ufvk,
+                &birthday,
+                AccountPurpose::Spending { derivation: None },
+                None,
+            )
+            .unwrap();
+        assert_eq!(
+            ufvk.encode(st.network()),
+            account.ufvk().unwrap().encode(st.network())
+        );
 
-        let current_addr = db_data.get_current_address(account).unwrap();
-        assert!(current_addr.is_some());
+        assert_matches!(
+            account.source(),
+            AccountSource::Imported {
+                purpose: AccountPurpose::Spending { .. },
+                ..
+            }
+        );
 
-        let mut update_ops = db_data.get_update_ops().unwrap();
-        let addr2 = update_ops.get_next_available_address(account).unwrap();
-        assert!(addr2.is_some());
-        assert_ne!(current_addr, addr2);
+        assert_matches!(
+            st.wallet_mut().import_account_hd("", &seed, zip32_index_0, &birthday, None),
+            Err(SqliteClientError::AccountCollision(id)) if id == account.id());
 
-        let addr2_cur = db_data.get_current_address(account).unwrap();
-        assert_eq!(addr2, addr2_cur);
+        check_collisions(
+            &mut st,
+            &ufvk,
+            &birthday,
+            |e| matches!(e, SqliteClientError::AccountCollision(id) if *id == account.id()),
+        );
     }
 
-    #[cfg(feature = "transparent-inputs")]
     #[test]
-    fn transparent_receivers() {
-        use secrecy::Secret;
-        use tempfile::NamedTempFile;
+    pub(crate) fn create_account_then_conflicts() {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
 
-        use crate::{chain::init::init_cache_database, wallet::init::init_wallet_db};
-
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
-        init_cache_database(&db_cache).unwrap();
+        let birthday = AccountBirthday::from_parts(
+            ChainState::empty(st.network().sapling.unwrap() - 1, BlockHash([0; 32])),
+            None,
+        );
 
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
+        let seed = Secret::new(vec![0u8; 32]);
+        let zip32_index_0 = zip32::AccountId::ZERO;
+        let seed_based = st
+            .wallet_mut()
+            .create_account("", &seed, &birthday, None)
+            .unwrap();
+        let seed_based_account = st.wallet().get_account(seed_based.0).unwrap().unwrap();
+        let ufvk = seed_based_account.ufvk().unwrap();
+
+        assert_matches!(
+            st.wallet_mut().import_account_hd("", &seed, zip32_index_0, &birthday, None),
+            Err(SqliteClientError::AccountCollision(id)) if id == seed_based.0);
+
+        check_collisions(
+            &mut st,
+            ufvk,
+            &birthday,
+            |e| matches!(e, SqliteClientError::AccountCollision(id) if *id == seed_based.0),
+        );
+    }
 
+    #[cfg(feature = "transparent-inputs")]
+    #[test]
+    fn transparent_receivers() {
         // Add an account to the wallet.
-        let (ufvk, taddr) = init_test_accounts_table_ufvk(&db_data);
-        let taddr = taddr.unwrap();
 
-        let receivers = db_data.get_transparent_receivers(0.into()).unwrap();
+        use crate::testing::BlockCache;
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+        let account = st.test_account().unwrap();
+        let ufvk = account.usk().to_unified_full_viewing_key();
+        let (taddr, _) = account.usk().default_transparent_address();
+
+        let receivers = st.wallet().get_transparent_receivers(account.id()).unwrap();
 
         // The receiver for the default UA should be in the set.
-        assert!(receivers.contains_key(ufvk.default_address().0.transparent().unwrap()));
+        assert!(receivers.contains_key(
+            ufvk.default_address(DEFAULT_UA_REQUEST)
+                .expect("A valid default address exists for the UFVK")
+                .0
+                .transparent()
+                .unwrap()
+        ));
 
         // The default t-addr should be in the set.
         assert!(receivers.contains_key(&taddr));
@@ -1337,72 +2258,53 @@ mod tests {
     #[cfg(feature = "unstable")]
     #[test]
     pub(crate) fn fsblockdb_api() {
-        // Initialise a BlockMeta DB in a new directory.
-        let fsblockdb_root = tempfile::tempdir().unwrap();
-        let mut db_meta = FsBlockDb::for_path(&fsblockdb_root).unwrap();
-        init_blockmeta_db(&mut db_meta).unwrap();
+        use zcash_client_backend::data_api::testing::AddressType;
+        use zcash_primitives::zip32;
+        use zcash_protocol::consensus::NetworkConstants;
+
+        use crate::testing::FsBlockCache;
+
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(FsBlockCache::new())
+            .build();
 
         // The BlockMeta DB starts off empty.
-        assert_eq!(db_meta.get_max_cached_height().unwrap(), None);
+        assert_eq!(st.cache().get_max_cached_height().unwrap(), None);
 
         // Generate some fake CompactBlocks.
         let seed = [0u8; 32];
-        let account = AccountId::from(0);
-        let extsk = sapling::spending_key(&seed, network().coin_type(), account);
+        let hd_account_index = zip32::AccountId::ZERO;
+        let extsk = sapling::spending_key(&seed, st.network().coin_type(), hd_account_index);
         let dfvk = extsk.to_diversifiable_full_viewing_key();
-        let (cb1, _) = fake_compact_block(
-            BlockHeight::from_u32(1),
-            BlockHash([1; 32]),
+        let (h1, meta1, _) = st.generate_next_block(
             &dfvk,
             AddressType::DefaultExternal,
-            Amount::from_u64(5).unwrap(),
+            NonNegativeAmount::const_from_u64(5),
         );
-        let (cb2, _) = fake_compact_block(
-            BlockHeight::from_u32(2),
-            BlockHash([2; 32]),
+        let (h2, meta2, _) = st.generate_next_block(
             &dfvk,
             AddressType::DefaultExternal,
-            Amount::from_u64(10).unwrap(),
+            NonNegativeAmount::const_from_u64(10),
         );
 
-        // Write the CompactBlocks to the BlockMeta DB's corresponding disk storage.
-        let meta1 = store_in_fsblockdb(&fsblockdb_root, &cb1);
-        let meta2 = store_in_fsblockdb(&fsblockdb_root, &cb2);
-
         // The BlockMeta DB is not updated until we do so explicitly.
-        assert_eq!(db_meta.get_max_cached_height().unwrap(), None);
+        assert_eq!(st.cache().get_max_cached_height().unwrap(), None);
 
         // Inform the BlockMeta DB about the newly-persisted CompactBlocks.
-        db_meta.write_block_metadata(&[meta1, meta2]).unwrap();
+        st.cache().write_block_metadata(&[meta1, meta2]).unwrap();
 
         // The BlockMeta DB now sees blocks up to height 2.
-        assert_eq!(
-            db_meta.get_max_cached_height().unwrap(),
-            Some(BlockHeight::from_u32(2)),
-        );
-        assert_eq!(
-            db_meta.find_block(BlockHeight::from_u32(1)).unwrap(),
-            Some(meta1),
-        );
-        assert_eq!(
-            db_meta.find_block(BlockHeight::from_u32(2)).unwrap(),
-            Some(meta2),
-        );
-        assert_eq!(db_meta.find_block(BlockHeight::from_u32(3)).unwrap(), None);
+        assert_eq!(st.cache().get_max_cached_height().unwrap(), Some(h2),);
+        assert_eq!(st.cache().find_block(h1).unwrap(), Some(meta1));
+        assert_eq!(st.cache().find_block(h2).unwrap(), Some(meta2));
+        assert_eq!(st.cache().find_block(h2 + 1).unwrap(), None);
 
         // Rewinding to height 1 should cause the metadata for height 2 to be deleted.
-        db_meta
-            .truncate_to_height(BlockHeight::from_u32(1))
-            .unwrap();
-        assert_eq!(
-            db_meta.get_max_cached_height().unwrap(),
-            Some(BlockHeight::from_u32(1)),
-        );
-        assert_eq!(
-            db_meta.find_block(BlockHeight::from_u32(1)).unwrap(),
-            Some(meta1),
-        );
-        assert_eq!(db_meta.find_block(BlockHeight::from_u32(2)).unwrap(), None);
-        assert_eq!(db_meta.find_block(BlockHeight::from_u32(3)).unwrap(), None);
+        st.cache().truncate_to_height(h1).unwrap();
+        assert_eq!(st.cache().get_max_cached_height().unwrap(), Some(h1));
+        assert_eq!(st.cache().find_block(h1).unwrap(), Some(meta1));
+        assert_eq!(st.cache().find_block(h2).unwrap(), None);
+        assert_eq!(st.cache().find_block(h2 + 1).unwrap(), None);
     }
 }
diff --git a/zcash_client_sqlite/src/prepared.rs b/zcash_client_sqlite/src/prepared.rs
deleted file mode 100644
index da97faa6cb..0000000000
--- a/zcash_client_sqlite/src/prepared.rs
+++ /dev/null
@@ -1,812 +0,0 @@
-//! Prepared SQL statements used by the wallet.
-//!
-//! Some `rusqlite` crate APIs are only available on prepared statements; these are stored
-//! inside the [`DataConnStmtCache`]. When adding a new prepared statement:
-//!
-//! - Add it as a private field of `DataConnStmtCache`.
-//! - Build the statement in [`DataConnStmtCache::new`].
-//! - Add a crate-private helper method to `DataConnStmtCache` for running the statement.
-
-use rusqlite::{named_params, params, Statement, ToSql};
-use zcash_primitives::{
-    block::BlockHash,
-    consensus::{self, BlockHeight},
-    memo::MemoBytes,
-    merkle_tree::{write_commitment_tree, write_incremental_witness},
-    sapling::{self, Diversifier, Nullifier},
-    transaction::{components::Amount, TxId},
-    zip32::{AccountId, DiversifierIndex},
-};
-
-use zcash_client_backend::{
-    address::UnifiedAddress,
-    data_api::{PoolType, Recipient},
-    encoding::AddressCodec,
-};
-
-use crate::{error::SqliteClientError, wallet::pool_code, NoteId, WalletDb};
-
-#[cfg(feature = "transparent-inputs")]
-use {
-    crate::UtxoId, rusqlite::OptionalExtension,
-    zcash_client_backend::wallet::WalletTransparentOutput,
-    zcash_primitives::transaction::components::transparent::OutPoint,
-};
-
-pub(crate) struct InsertAddress<'a> {
-    stmt: Statement<'a>,
-}
-
-impl<'a> InsertAddress<'a> {
-    pub(crate) fn new(conn: &'a rusqlite::Connection) -> Result<Self, rusqlite::Error> {
-        Ok(InsertAddress {
-            stmt: conn.prepare(
-                "INSERT INTO addresses (
-                    account,
-                    diversifier_index_be,
-                    address,
-                    cached_transparent_receiver_address
-                )
-                VALUES (
-                    :account,
-                    :diversifier_index_be,
-                    :address,
-                    :cached_transparent_receiver_address
-                )",
-            )?,
-        })
-    }
-
-    /// Adds the given address and diversifier index to the addresses table.
-    ///
-    /// Returns the database row for the newly-inserted address.
-    pub(crate) fn execute<P: consensus::Parameters>(
-        &mut self,
-        params: &P,
-        account: AccountId,
-        mut diversifier_index: DiversifierIndex,
-        address: &UnifiedAddress,
-    ) -> Result<(), rusqlite::Error> {
-        // the diversifier index is stored in big-endian order to allow sorting
-        diversifier_index.0.reverse();
-        self.stmt.execute(named_params![
-            ":account": &u32::from(account),
-            ":diversifier_index_be": &&diversifier_index.0[..],
-            ":address": &address.encode(params),
-            ":cached_transparent_receiver_address": &address.transparent().map(|r| r.encode(params)),
-        ])?;
-
-        Ok(())
-    }
-}
-
-/// The primary type used to implement [`WalletWrite`] for the SQLite database.
-///
-/// A data structure that stores the SQLite prepared statements that are
-/// required for the implementation of [`WalletWrite`] against the backing
-/// store.
-///
-/// [`WalletWrite`]: zcash_client_backend::data_api::WalletWrite
-pub struct DataConnStmtCache<'a, P> {
-    pub(crate) wallet_db: &'a WalletDb<P>,
-    stmt_insert_block: Statement<'a>,
-
-    stmt_insert_tx_meta: Statement<'a>,
-    stmt_update_tx_meta: Statement<'a>,
-
-    stmt_insert_tx_data: Statement<'a>,
-    stmt_update_tx_data: Statement<'a>,
-    stmt_select_tx_ref: Statement<'a>,
-
-    stmt_mark_sapling_note_spent: Statement<'a>,
-    #[cfg(feature = "transparent-inputs")]
-    stmt_mark_transparent_utxo_spent: Statement<'a>,
-
-    #[cfg(feature = "transparent-inputs")]
-    stmt_insert_received_transparent_utxo: Statement<'a>,
-    #[cfg(feature = "transparent-inputs")]
-    stmt_update_received_transparent_utxo: Statement<'a>,
-    #[cfg(feature = "transparent-inputs")]
-    stmt_insert_legacy_transparent_utxo: Statement<'a>,
-    #[cfg(feature = "transparent-inputs")]
-    stmt_update_legacy_transparent_utxo: Statement<'a>,
-    stmt_insert_received_note: Statement<'a>,
-    stmt_update_received_note: Statement<'a>,
-    stmt_select_received_note: Statement<'a>,
-
-    stmt_insert_sent_output: Statement<'a>,
-    stmt_update_sent_output: Statement<'a>,
-
-    stmt_insert_witness: Statement<'a>,
-    stmt_prune_witnesses: Statement<'a>,
-    stmt_update_expired: Statement<'a>,
-
-    stmt_insert_address: InsertAddress<'a>,
-}
-
-impl<'a, P> DataConnStmtCache<'a, P> {
-    pub(crate) fn new(wallet_db: &'a WalletDb<P>) -> Result<Self, SqliteClientError> {
-        Ok(
-            DataConnStmtCache {
-                wallet_db,
-                stmt_insert_block: wallet_db.conn.prepare(
-                    "INSERT INTO blocks (height, hash, time, sapling_tree)
-                    VALUES (?, ?, ?, ?)",
-                )?,
-                stmt_insert_tx_meta: wallet_db.conn.prepare(
-                    "INSERT INTO transactions (txid, block, tx_index)
-                    VALUES (?, ?, ?)",
-                )?,
-                stmt_update_tx_meta: wallet_db.conn.prepare(
-                    "UPDATE transactions
-                    SET block = ?, tx_index = ? WHERE txid = ?",
-                )?,
-                stmt_insert_tx_data: wallet_db.conn.prepare(
-                    "INSERT INTO transactions (txid, created, expiry_height, raw, fee)
-                    VALUES (?, ?, ?, ?, ?)",
-                )?,
-                stmt_update_tx_data: wallet_db.conn.prepare(
-                    "UPDATE transactions
-                    SET expiry_height = :expiry_height,
-                        raw = :raw,
-                        fee = IFNULL(:fee, fee)
-                    WHERE txid = :txid",
-                )?,
-                stmt_select_tx_ref: wallet_db.conn.prepare(
-                    "SELECT id_tx FROM transactions WHERE txid = ?",
-                )?,
-                stmt_mark_sapling_note_spent: wallet_db.conn.prepare(
-                    "UPDATE sapling_received_notes SET spent = ? WHERE nf = ?"
-                )?,
-                #[cfg(feature = "transparent-inputs")]
-                stmt_mark_transparent_utxo_spent: wallet_db.conn.prepare(
-                    "UPDATE utxos SET spent_in_tx = :spent_in_tx
-                    WHERE prevout_txid = :prevout_txid
-                    AND prevout_idx = :prevout_idx"
-                )?,
-                #[cfg(feature = "transparent-inputs")]
-                stmt_insert_received_transparent_utxo: wallet_db.conn.prepare(
-                    "INSERT INTO utxos (
-                        received_by_account, address,
-                        prevout_txid, prevout_idx, script,
-                        value_zat, height)
-                    SELECT
-                        addresses.account, :address,
-                        :prevout_txid, :prevout_idx, :script,
-                        :value_zat, :height
-                    FROM addresses
-                    WHERE addresses.cached_transparent_receiver_address = :address
-                    RETURNING id_utxo"
-                )?,
-                #[cfg(feature = "transparent-inputs")]
-                stmt_update_received_transparent_utxo: wallet_db.conn.prepare(
-                    "UPDATE utxos
-                    SET received_by_account = addresses.account,
-                        height = :height,
-                        address = :address,
-                        script = :script,
-                        value_zat = :value_zat
-                    FROM addresses
-                    WHERE prevout_txid = :prevout_txid
-                      AND prevout_idx = :prevout_idx
-                      AND addresses.cached_transparent_receiver_address = :address
-                    RETURNING id_utxo"
-                )?,
-                #[cfg(feature = "transparent-inputs")]
-                stmt_insert_legacy_transparent_utxo: wallet_db.conn.prepare(
-                    "INSERT INTO utxos (
-                        received_by_account, address,
-                        prevout_txid, prevout_idx, script,
-                        value_zat, height)
-                    VALUES
-                        (:received_by_account, :address,
-                        :prevout_txid, :prevout_idx, :script,
-                        :value_zat, :height)
-                    RETURNING id_utxo"
-                )?,
-                #[cfg(feature = "transparent-inputs")]
-                stmt_update_legacy_transparent_utxo: wallet_db.conn.prepare(
-                    "UPDATE utxos
-                    SET received_by_account = :received_by_account,
-                        height = :height,
-                        address = :address,
-                        script = :script,
-                        value_zat = :value_zat
-                    WHERE prevout_txid = :prevout_txid
-                      AND prevout_idx = :prevout_idx
-                    RETURNING id_utxo"
-                )?,
-                stmt_insert_received_note: wallet_db.conn.prepare(
-                    "INSERT INTO sapling_received_notes (tx, output_index, account, diversifier, value, rcm, memo, nf, is_change)
-                    VALUES (:tx, :output_index, :account, :diversifier, :value, :rcm, :memo, :nf, :is_change)",
-                )?,
-                stmt_update_received_note: wallet_db.conn.prepare(
-                    "UPDATE sapling_received_notes
-                    SET account = :account,
-                        diversifier = :diversifier,
-                        value = :value,
-                        rcm = :rcm,
-                        nf = IFNULL(:nf, nf),
-                        memo = IFNULL(:memo, memo),
-                        is_change = IFNULL(:is_change, is_change)
-                    WHERE tx = :tx AND output_index = :output_index",
-                )?,
-                stmt_select_received_note: wallet_db.conn.prepare(
-                    "SELECT id_note FROM sapling_received_notes WHERE tx = ? AND output_index = ?"
-                )?,
-                stmt_update_sent_output: wallet_db.conn.prepare(
-                    "UPDATE sent_notes
-                    SET from_account = :from_account,
-                        to_address = :to_address,
-                        to_account = :to_account,
-                        value = :value,
-                        memo = IFNULL(:memo, memo)
-                    WHERE tx = :tx
-                      AND output_pool = :output_pool
-                      AND output_index = :output_index",
-                )?,
-                stmt_insert_sent_output: wallet_db.conn.prepare(
-                    "INSERT INTO sent_notes (
-                        tx, output_pool, output_index, from_account,
-                        to_address, to_account, value, memo)
-                    VALUES (
-                        :tx, :output_pool, :output_index, :from_account,
-                        :to_address, :to_account, :value, :memo)"
-                )?,
-                stmt_insert_witness: wallet_db.conn.prepare(
-                    "INSERT INTO sapling_witnesses (note, block, witness)
-                    VALUES (?, ?, ?)",
-                )?,
-                stmt_prune_witnesses: wallet_db.conn.prepare(
-                    "DELETE FROM sapling_witnesses WHERE block < ?"
-                )?,
-                stmt_update_expired: wallet_db.conn.prepare(
-                    "UPDATE sapling_received_notes SET spent = NULL WHERE EXISTS (
-                        SELECT id_tx FROM transactions
-                        WHERE id_tx = sapling_received_notes.spent AND block IS NULL AND expiry_height < ?
-                    )",
-                )?,
-                stmt_insert_address: InsertAddress::new(&wallet_db.conn)?
-            }
-        )
-    }
-
-    /// Inserts information about a scanned block into the database.
-    pub fn stmt_insert_block(
-        &mut self,
-        block_height: BlockHeight,
-        block_hash: BlockHash,
-        block_time: u32,
-        commitment_tree: &sapling::CommitmentTree,
-    ) -> Result<(), SqliteClientError> {
-        let mut encoded_tree = Vec::new();
-        write_commitment_tree(commitment_tree, &mut encoded_tree).unwrap();
-
-        self.stmt_insert_block.execute(params![
-            u32::from(block_height),
-            &block_hash.0[..],
-            block_time,
-            encoded_tree
-        ])?;
-
-        Ok(())
-    }
-
-    /// Inserts the given transaction and its block metadata into the wallet.
-    ///
-    /// Returns the database row for the newly-inserted transaction, or an error if the
-    /// transaction exists.
-    pub(crate) fn stmt_insert_tx_meta(
-        &mut self,
-        txid: &TxId,
-        height: BlockHeight,
-        tx_index: usize,
-    ) -> Result<i64, SqliteClientError> {
-        self.stmt_insert_tx_meta.execute(params![
-            &txid.as_ref()[..],
-            u32::from(height),
-            (tx_index as i64),
-        ])?;
-
-        Ok(self.wallet_db.conn.last_insert_rowid())
-    }
-
-    /// Updates the block metadata for the given transaction.
-    ///
-    /// Returns `false` if the transaction doesn't exist in the wallet.
-    pub(crate) fn stmt_update_tx_meta(
-        &mut self,
-        height: BlockHeight,
-        tx_index: usize,
-        txid: &TxId,
-    ) -> Result<bool, SqliteClientError> {
-        match self.stmt_update_tx_meta.execute(params![
-            u32::from(height),
-            (tx_index as i64),
-            &txid.as_ref()[..],
-        ])? {
-            0 => Ok(false),
-            1 => Ok(true),
-            _ => unreachable!("txid column is marked as UNIQUE"),
-        }
-    }
-
-    /// Inserts the given transaction and its data into the wallet.
-    ///
-    /// Returns the database row for the newly-inserted transaction, or an error if the
-    /// transaction exists.
-    pub(crate) fn stmt_insert_tx_data(
-        &mut self,
-        txid: &TxId,
-        created_at: Option<time::OffsetDateTime>,
-        expiry_height: BlockHeight,
-        raw_tx: &[u8],
-        fee: Option<Amount>,
-    ) -> Result<i64, SqliteClientError> {
-        self.stmt_insert_tx_data.execute(params![
-            &txid.as_ref()[..],
-            created_at,
-            u32::from(expiry_height),
-            raw_tx,
-            fee.map(i64::from)
-        ])?;
-
-        Ok(self.wallet_db.conn.last_insert_rowid())
-    }
-
-    /// Updates the data for the given transaction.
-    ///
-    /// Returns `false` if the transaction doesn't exist in the wallet.
-    pub(crate) fn stmt_update_tx_data(
-        &mut self,
-        expiry_height: BlockHeight,
-        raw_tx: &[u8],
-        fee: Option<Amount>,
-        txid: &TxId,
-    ) -> Result<bool, SqliteClientError> {
-        let sql_args: &[(&str, &dyn ToSql)] = &[
-            (":expiry_height", &u32::from(expiry_height)),
-            (":raw", &raw_tx),
-            (":fee", &fee.map(i64::from)),
-            (":txid", &&txid.as_ref()[..]),
-        ];
-        match self.stmt_update_tx_data.execute(sql_args)? {
-            0 => Ok(false),
-            1 => Ok(true),
-            _ => unreachable!("txid column is marked as UNIQUE"),
-        }
-    }
-
-    /// Finds the database row for the given `txid`, if the transaction is in the wallet.
-    pub(crate) fn stmt_select_tx_ref(&mut self, txid: &TxId) -> Result<i64, SqliteClientError> {
-        self.stmt_select_tx_ref
-            .query_row([&txid.as_ref()[..]], |row| row.get(0))
-            .map_err(SqliteClientError::from)
-    }
-
-    /// Marks a given nullifier as having been revealed in the construction of the
-    /// specified transaction.
-    ///
-    /// Marking a note spent in this fashion does NOT imply that the spending transaction
-    /// has been mined.
-    ///
-    /// Returns `false` if the nullifier does not correspond to any received note.
-    pub(crate) fn stmt_mark_sapling_note_spent(
-        &mut self,
-        tx_ref: i64,
-        nf: &Nullifier,
-    ) -> Result<bool, SqliteClientError> {
-        match self
-            .stmt_mark_sapling_note_spent
-            .execute(params![tx_ref, &nf.0[..]])?
-        {
-            0 => Ok(false),
-            1 => Ok(true),
-            _ => unreachable!("nf column is marked as UNIQUE"),
-        }
-    }
-
-    /// Marks the given UTXO as having been spent.
-    ///
-    /// Returns `false` if `outpoint` does not correspond to any tracked UTXO.
-    #[cfg(feature = "transparent-inputs")]
-    pub(crate) fn stmt_mark_transparent_utxo_spent(
-        &mut self,
-        tx_ref: i64,
-        outpoint: &OutPoint,
-    ) -> Result<bool, SqliteClientError> {
-        let sql_args: &[(&str, &dyn ToSql)] = &[
-            (":spent_in_tx", &tx_ref),
-            (":prevout_txid", &outpoint.hash().to_vec()),
-            (":prevout_idx", &outpoint.n()),
-        ];
-
-        match self.stmt_mark_transparent_utxo_spent.execute(sql_args)? {
-            0 => Ok(false),
-            1 => Ok(true),
-            _ => unreachable!("tx_outpoint constraint is marked as UNIQUE"),
-        }
-    }
-}
-
-impl<'a, P: consensus::Parameters> DataConnStmtCache<'a, P> {
-    /// Inserts a sent note into the wallet database.
-    ///
-    /// `output_index` is the index within the transaction that contains the recipient output:
-    ///
-    /// - If `to` is a Unified address, this is an index into the outputs of the transaction
-    ///   within the bundle associated with the recipient's output pool.
-    /// - If `to` is a Sapling address, this is an index into the Sapling outputs of the
-    ///   transaction.
-    /// - If `to` is a transparent address, this is an index into the transparent outputs of
-    ///   the transaction.
-    /// - If `to` is an internal account, this is an index into the Sapling outputs of the
-    ///   transaction.
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn stmt_insert_sent_output(
-        &mut self,
-        tx_ref: i64,
-        output_index: usize,
-        from_account: AccountId,
-        to: &Recipient,
-        value: Amount,
-        memo: Option<&MemoBytes>,
-    ) -> Result<(), SqliteClientError> {
-        let (to_address, to_account, pool_type) = match to {
-            Recipient::Transparent(addr) => (
-                Some(addr.encode(&self.wallet_db.params)),
-                None,
-                PoolType::Transparent,
-            ),
-            Recipient::Sapling(addr) => (
-                Some(addr.encode(&self.wallet_db.params)),
-                None,
-                PoolType::Sapling,
-            ),
-            Recipient::Unified(addr, pool) => {
-                (Some(addr.encode(&self.wallet_db.params)), None, *pool)
-            }
-            Recipient::InternalAccount(id, pool) => (None, Some(u32::from(*id)), *pool),
-        };
-
-        self.stmt_insert_sent_output.execute(named_params![
-            ":tx": &tx_ref,
-            ":output_pool": &pool_code(pool_type),
-            ":output_index": &i64::try_from(output_index).unwrap(),
-            ":from_account": &u32::from(from_account),
-            ":to_address": &to_address,
-            ":to_account": &to_account,
-            ":value": &i64::from(value),
-            ":memo": &memo.filter(|m| *m != &MemoBytes::empty()).map(|m| m.as_slice()),
-        ])?;
-
-        Ok(())
-    }
-
-    /// Updates the data for the given sent note.
-    ///
-    /// Returns `false` if the transaction doesn't exist in the wallet.
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn stmt_update_sent_output(
-        &mut self,
-        from_account: AccountId,
-        to: &Recipient,
-        value: Amount,
-        memo: Option<&MemoBytes>,
-        tx_ref: i64,
-        output_index: usize,
-    ) -> Result<bool, SqliteClientError> {
-        let (to_address, to_account, pool_type) = match to {
-            Recipient::Transparent(addr) => (
-                Some(addr.encode(&self.wallet_db.params)),
-                None,
-                PoolType::Transparent,
-            ),
-            Recipient::Sapling(addr) => (
-                Some(addr.encode(&self.wallet_db.params)),
-                None,
-                PoolType::Sapling,
-            ),
-            Recipient::Unified(addr, pool) => {
-                (Some(addr.encode(&self.wallet_db.params)), None, *pool)
-            }
-            Recipient::InternalAccount(id, pool) => (None, Some(u32::from(*id)), *pool),
-        };
-
-        match self.stmt_update_sent_output.execute(named_params![
-            ":from_account": &u32::from(from_account),
-            ":to_address": &to_address,
-            ":to_account": &to_account,
-            ":value": &i64::from(value),
-            ":memo": &memo.filter(|m| *m != &MemoBytes::empty()).map(|m| m.as_slice()),
-            ":tx": &tx_ref,
-            ":output_pool": &pool_code(pool_type),
-            ":output_index": &i64::try_from(output_index).unwrap(),
-        ])? {
-            0 => Ok(false),
-            1 => Ok(true),
-            _ => unreachable!("tx_output constraint is marked as UNIQUE"),
-        }
-    }
-
-    /// Adds the given received UTXO to the datastore.
-    ///
-    /// Returns the database identifier for the newly-inserted UTXO if the address to which the
-    /// UTXO was sent corresponds to a cached transparent receiver in the addresses table, or
-    /// Ok(None) if the address is unknown. Returns an error if the UTXO exists.
-    #[cfg(feature = "transparent-inputs")]
-    pub(crate) fn stmt_insert_received_transparent_utxo(
-        &mut self,
-        output: &WalletTransparentOutput,
-    ) -> Result<Option<UtxoId>, SqliteClientError> {
-        self.stmt_insert_received_transparent_utxo
-            .query_row(
-                named_params![
-                    ":address": &output.recipient_address().encode(&self.wallet_db.params),
-                    ":prevout_txid": &output.outpoint().hash().to_vec(),
-                    ":prevout_idx": &output.outpoint().n(),
-                    ":script": &output.txout().script_pubkey.0,
-                    ":value_zat": &i64::from(output.txout().value),
-                    ":height": &u32::from(output.height()),
-                ],
-                |row| {
-                    let id = row.get(0)?;
-                    Ok(UtxoId(id))
-                },
-            )
-            .optional()
-            .map_err(SqliteClientError::from)
-    }
-
-    /// Adds the given received UTXO to the datastore.
-    ///
-    /// Returns the database identifier for the updated UTXO if the address to which the UTXO was
-    /// sent corresponds to a cached transparent receiver in the addresses table, or Ok(None) if
-    /// the address is unknown.
-    #[cfg(feature = "transparent-inputs")]
-    pub(crate) fn stmt_update_received_transparent_utxo(
-        &mut self,
-        output: &WalletTransparentOutput,
-    ) -> Result<Option<UtxoId>, SqliteClientError> {
-        self.stmt_update_received_transparent_utxo
-            .query_row(
-                named_params![
-                    ":prevout_txid": &output.outpoint().hash().to_vec(),
-                    ":prevout_idx": &output.outpoint().n(),
-                    ":address": &output.recipient_address().encode(&self.wallet_db.params),
-                    ":script": &output.txout().script_pubkey.0,
-                    ":value_zat": &i64::from(output.txout().value),
-                    ":height": &u32::from(output.height()),
-                ],
-                |row| {
-                    let id = row.get(0)?;
-                    Ok(UtxoId(id))
-                },
-            )
-            .optional()
-            .map_err(SqliteClientError::from)
-    }
-
-    /// Adds the given legacy UTXO to the datastore.
-    ///
-    /// Returns the database row for the newly-inserted UTXO, or an error if the UTXO
-    /// exists.
-    #[cfg(feature = "transparent-inputs")]
-    pub(crate) fn stmt_insert_legacy_transparent_utxo(
-        &mut self,
-        output: &WalletTransparentOutput,
-        received_by_account: AccountId,
-    ) -> Result<UtxoId, SqliteClientError> {
-        self.stmt_insert_legacy_transparent_utxo
-            .query_row(
-                named_params![
-                    ":received_by_account": &u32::from(received_by_account),
-                    ":address": &output.recipient_address().encode(&self.wallet_db.params),
-                    ":prevout_txid": &output.outpoint().hash().to_vec(),
-                    ":prevout_idx": &output.outpoint().n(),
-                    ":script": &output.txout().script_pubkey.0,
-                    ":value_zat": &i64::from(output.txout().value),
-                    ":height": &u32::from(output.height()),
-                ],
-                |row| {
-                    let id = row.get(0)?;
-                    Ok(UtxoId(id))
-                },
-            )
-            .map_err(SqliteClientError::from)
-    }
-
-    /// Adds the given legacy UTXO to the datastore.
-    ///
-    /// Returns the database row for the newly-inserted UTXO, or an error if the UTXO
-    /// exists.
-    #[cfg(feature = "transparent-inputs")]
-    pub(crate) fn stmt_update_legacy_transparent_utxo(
-        &mut self,
-        output: &WalletTransparentOutput,
-        received_by_account: AccountId,
-    ) -> Result<Option<UtxoId>, SqliteClientError> {
-        self.stmt_update_legacy_transparent_utxo
-            .query_row(
-                named_params![
-                    ":received_by_account": &u32::from(received_by_account),
-                    ":prevout_txid": &output.outpoint().hash().to_vec(),
-                    ":prevout_idx": &output.outpoint().n(),
-                    ":address": &output.recipient_address().encode(&self.wallet_db.params),
-                    ":script": &output.txout().script_pubkey.0,
-                    ":value_zat": &i64::from(output.txout().value),
-                    ":height": &u32::from(output.height()),
-                ],
-                |row| {
-                    let id = row.get(0)?;
-                    Ok(UtxoId(id))
-                },
-            )
-            .optional()
-            .map_err(SqliteClientError::from)
-    }
-
-    /// Adds the given address and diversifier index to the addresses table.
-    ///
-    /// Returns the database row for the newly-inserted address.
-    pub(crate) fn stmt_insert_address(
-        &mut self,
-        account: AccountId,
-        diversifier_index: DiversifierIndex,
-        address: &UnifiedAddress,
-    ) -> Result<(), SqliteClientError> {
-        self.stmt_insert_address.execute(
-            &self.wallet_db.params,
-            account,
-            diversifier_index,
-            address,
-        )?;
-
-        Ok(())
-    }
-}
-
-impl<'a, P> DataConnStmtCache<'a, P> {
-    /// Inserts the given received note into the wallet.
-    ///
-    /// This implementation relies on the facts that:
-    /// - A transaction will not contain more than 2^63 shielded outputs.
-    /// - A note value will never exceed 2^63 zatoshis.
-    ///
-    /// Returns the database row for the newly-inserted note, or an error if the note
-    /// exists.
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn stmt_insert_received_note(
-        &mut self,
-        tx_ref: i64,
-        output_index: usize,
-        account: AccountId,
-        diversifier: &Diversifier,
-        value: u64,
-        rcm: [u8; 32],
-        nf: Option<&Nullifier>,
-        memo: Option<&MemoBytes>,
-        is_change: bool,
-    ) -> Result<NoteId, SqliteClientError> {
-        let sql_args: &[(&str, &dyn ToSql)] = &[
-            (":tx", &tx_ref),
-            (":output_index", &(output_index as i64)),
-            (":account", &u32::from(account)),
-            (":diversifier", &diversifier.0.as_ref()),
-            (":value", &(value as i64)),
-            (":rcm", &rcm.as_ref()),
-            (":nf", &nf.map(|nf| nf.0.as_ref())),
-            (
-                ":memo",
-                &memo
-                    .filter(|m| *m != &MemoBytes::empty())
-                    .map(|m| m.as_slice()),
-            ),
-            (":is_change", &is_change),
-        ];
-
-        self.stmt_insert_received_note.execute(sql_args)?;
-
-        Ok(NoteId::ReceivedNoteId(
-            self.wallet_db.conn.last_insert_rowid(),
-        ))
-    }
-
-    /// Updates the data for the given transaction.
-    ///
-    /// This implementation relies on the facts that:
-    /// - A transaction will not contain more than 2^63 shielded outputs.
-    /// - A note value will never exceed 2^63 zatoshis.
-    ///
-    /// Returns `false` if the transaction doesn't exist in the wallet.
-    #[allow(clippy::too_many_arguments)]
-    pub(crate) fn stmt_update_received_note(
-        &mut self,
-        account: AccountId,
-        diversifier: &Diversifier,
-        value: u64,
-        rcm: [u8; 32],
-        nf: Option<&Nullifier>,
-        memo: Option<&MemoBytes>,
-        is_change: bool,
-        tx_ref: i64,
-        output_index: usize,
-    ) -> Result<bool, SqliteClientError> {
-        let sql_args: &[(&str, &dyn ToSql)] = &[
-            (":account", &u32::from(account)),
-            (":diversifier", &diversifier.0.as_ref()),
-            (":value", &(value as i64)),
-            (":rcm", &rcm.as_ref()),
-            (":nf", &nf.map(|nf| nf.0.as_ref())),
-            (
-                ":memo",
-                &memo
-                    .filter(|m| *m != &MemoBytes::empty())
-                    .map(|m| m.as_slice()),
-            ),
-            (":is_change", &is_change),
-            (":tx", &tx_ref),
-            (":output_index", &(output_index as i64)),
-        ];
-
-        match self.stmt_update_received_note.execute(sql_args)? {
-            0 => Ok(false),
-            1 => Ok(true),
-            _ => unreachable!("tx_output constraint is marked as UNIQUE"),
-        }
-    }
-
-    /// Finds the database row for the given `txid`, if the transaction is in the wallet.
-    pub(crate) fn stmt_select_received_note(
-        &mut self,
-        tx_ref: i64,
-        output_index: usize,
-    ) -> Result<NoteId, SqliteClientError> {
-        self.stmt_select_received_note
-            .query_row(params![tx_ref, (output_index as i64)], |row| {
-                row.get(0).map(NoteId::ReceivedNoteId)
-            })
-            .map_err(SqliteClientError::from)
-    }
-
-    /// Records the incremental witness for the specified note, as of the given block
-    /// height.
-    ///
-    /// Returns `SqliteClientError::InvalidNoteId` if the note ID is for a sent note.
-    pub(crate) fn stmt_insert_witness(
-        &mut self,
-        note_id: NoteId,
-        height: BlockHeight,
-        witness: &sapling::IncrementalWitness,
-    ) -> Result<(), SqliteClientError> {
-        let note_id = match note_id {
-            NoteId::ReceivedNoteId(note_id) => Ok(note_id),
-            NoteId::SentNoteId(_) => Err(SqliteClientError::InvalidNoteId),
-        }?;
-
-        let mut encoded = Vec::new();
-        write_incremental_witness(witness, &mut encoded).unwrap();
-
-        self.stmt_insert_witness
-            .execute(params![note_id, u32::from(height), encoded])?;
-
-        Ok(())
-    }
-
-    /// Removes old incremental witnesses up to the given block height.
-    pub(crate) fn stmt_prune_witnesses(
-        &mut self,
-        below_height: BlockHeight,
-    ) -> Result<(), SqliteClientError> {
-        self.stmt_prune_witnesses
-            .execute([u32::from(below_height)])?;
-        Ok(())
-    }
-
-    /// Marks notes that have not been mined in transactions as expired, up to the given
-    /// block height.
-    pub fn stmt_update_expired(&mut self, height: BlockHeight) -> Result<(), SqliteClientError> {
-        self.stmt_update_expired.execute([u32::from(height)])?;
-        Ok(())
-    }
-}
diff --git a/zcash_client_sqlite/src/testing.rs b/zcash_client_sqlite/src/testing.rs
new file mode 100644
index 0000000000..ab043e3d43
--- /dev/null
+++ b/zcash_client_sqlite/src/testing.rs
@@ -0,0 +1,133 @@
+use prost::Message;
+use rusqlite::params;
+use tempfile::NamedTempFile;
+
+use zcash_client_backend::{
+    data_api::testing::{NoteCommitments, TestCache},
+    proto::compact_formats::CompactBlock,
+};
+
+use crate::{chain::init::init_cache_database, error::SqliteClientError};
+
+use super::BlockDb;
+
+#[cfg(feature = "unstable")]
+use {
+    crate::{
+        chain::{init::init_blockmeta_db, BlockMeta},
+        FsBlockDb, FsBlockDbError,
+    },
+    std::fs::File,
+    tempfile::TempDir,
+};
+
+pub(crate) mod db;
+pub(crate) mod pool;
+
+pub(crate) struct BlockCache {
+    _cache_file: NamedTempFile,
+    db_cache: BlockDb,
+}
+
+impl BlockCache {
+    pub(crate) fn new() -> Self {
+        let cache_file = NamedTempFile::new().unwrap();
+        let db_cache = BlockDb::for_path(cache_file.path()).unwrap();
+        init_cache_database(&db_cache).unwrap();
+
+        BlockCache {
+            _cache_file: cache_file,
+            db_cache,
+        }
+    }
+}
+
+impl TestCache for BlockCache {
+    type BsError = SqliteClientError;
+    type BlockSource = BlockDb;
+    type InsertResult = NoteCommitments;
+
+    fn block_source(&self) -> &Self::BlockSource {
+        &self.db_cache
+    }
+
+    fn insert(&mut self, cb: &CompactBlock) -> Self::InsertResult {
+        let cb_bytes = cb.encode_to_vec();
+        let res = NoteCommitments::from_compact_block(cb);
+        self.db_cache
+            .0
+            .execute(
+                "INSERT INTO compactblocks (height, data) VALUES (?, ?)",
+                params![u32::from(cb.height()), cb_bytes,],
+            )
+            .unwrap();
+        res
+    }
+
+    fn truncate_to_height(&mut self, height: zcash_protocol::consensus::BlockHeight) {
+        self.db_cache
+            .0
+            .execute(
+                "DELETE FROM compactblocks WHERE height > ?",
+                params![u32::from(height)],
+            )
+            .unwrap();
+    }
+}
+
+#[cfg(feature = "unstable")]
+pub(crate) struct FsBlockCache {
+    fsblockdb_root: TempDir,
+    db_meta: FsBlockDb,
+}
+
+#[cfg(feature = "unstable")]
+impl FsBlockCache {
+    pub(crate) fn new() -> Self {
+        let fsblockdb_root = tempfile::tempdir().unwrap();
+        let mut db_meta = FsBlockDb::for_path(&fsblockdb_root).unwrap();
+        init_blockmeta_db(&mut db_meta).unwrap();
+
+        FsBlockCache {
+            fsblockdb_root,
+            db_meta,
+        }
+    }
+}
+
+#[cfg(feature = "unstable")]
+impl TestCache for FsBlockCache {
+    type BsError = FsBlockDbError;
+    type BlockSource = FsBlockDb;
+    type InsertResult = BlockMeta;
+
+    fn block_source(&self) -> &Self::BlockSource {
+        &self.db_meta
+    }
+
+    fn insert(&mut self, cb: &CompactBlock) -> Self::InsertResult {
+        use std::io::Write;
+
+        let meta = BlockMeta {
+            height: cb.height(),
+            block_hash: cb.hash(),
+            block_time: cb.time,
+            sapling_outputs_count: cb.vtx.iter().map(|tx| tx.outputs.len() as u32).sum(),
+            orchard_actions_count: cb.vtx.iter().map(|tx| tx.actions.len() as u32).sum(),
+        };
+
+        let blocks_dir = self.fsblockdb_root.as_ref().join("blocks");
+        let block_path = meta.block_file_path(&blocks_dir);
+
+        File::create(block_path)
+            .unwrap()
+            .write_all(&cb.encode_to_vec())
+            .unwrap();
+
+        meta
+    }
+
+    fn truncate_to_height(&mut self, height: zcash_protocol::consensus::BlockHeight) {
+        self.db_meta.truncate_to_height(height).unwrap()
+    }
+}
diff --git a/zcash_client_sqlite/src/testing/db.rs b/zcash_client_sqlite/src/testing/db.rs
new file mode 100644
index 0000000000..e11cc9f975
--- /dev/null
+++ b/zcash_client_sqlite/src/testing/db.rs
@@ -0,0 +1,194 @@
+use ambassador::Delegate;
+use rusqlite::Connection;
+use std::collections::HashMap;
+use std::num::NonZeroU32;
+use uuid::Uuid;
+
+use tempfile::NamedTempFile;
+
+use rusqlite::{self};
+use secrecy::SecretVec;
+use shardtree::{error::ShardTreeError, ShardTree};
+use zip32::fingerprint::SeedFingerprint;
+
+use zcash_client_backend::{
+    data_api::{
+        chain::{ChainState, CommitmentTreeRoot},
+        scanning::ScanRange,
+        testing::{DataStoreFactory, Reset, TestState},
+        *,
+    },
+    keys::UnifiedFullViewingKey,
+    wallet::{Note, NoteId, ReceivedNote, WalletTransparentOutput},
+    ShieldedProtocol,
+};
+use zcash_keys::{
+    address::UnifiedAddress,
+    keys::{UnifiedAddressRequest, UnifiedSpendingKey},
+};
+use zcash_primitives::{
+    block::BlockHash,
+    transaction::{components::amount::NonNegativeAmount, Transaction, TxId},
+};
+use zcash_protocol::{consensus::BlockHeight, local_consensus::LocalNetwork, memo::Memo};
+
+use crate::{
+    error::SqliteClientError,
+    wallet::init::{init_wallet_db, init_wallet_db_internal},
+    AccountUuid, WalletDb,
+};
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    crate::TransparentAddressMetadata,
+    core::ops::Range,
+    zcash_primitives::{legacy::TransparentAddress, transaction::components::OutPoint},
+};
+
+#[derive(Delegate)]
+#[delegate(InputSource, target = "wallet_db")]
+#[delegate(WalletRead, target = "wallet_db")]
+#[delegate(WalletTest, target = "wallet_db")]
+#[delegate(WalletWrite, target = "wallet_db")]
+#[delegate(WalletCommitmentTrees, target = "wallet_db")]
+pub(crate) struct TestDb {
+    wallet_db: WalletDb<Connection, LocalNetwork>,
+    data_file: NamedTempFile,
+}
+
+impl TestDb {
+    fn from_parts(wallet_db: WalletDb<Connection, LocalNetwork>, data_file: NamedTempFile) -> Self {
+        Self {
+            wallet_db,
+            data_file,
+        }
+    }
+
+    pub(crate) fn db(&self) -> &WalletDb<Connection, LocalNetwork> {
+        &self.wallet_db
+    }
+
+    pub(crate) fn db_mut(&mut self) -> &mut WalletDb<Connection, LocalNetwork> {
+        &mut self.wallet_db
+    }
+
+    pub(crate) fn conn(&self) -> &Connection {
+        &self.wallet_db.conn
+    }
+
+    pub(crate) fn conn_mut(&mut self) -> &mut Connection {
+        &mut self.wallet_db.conn
+    }
+
+    pub(crate) fn take_data_file(self) -> NamedTempFile {
+        self.data_file
+    }
+
+    /// Dump the schema and contents of the given database table, in
+    /// sqlite3 ".dump" format. The name of the table must be a static
+    /// string. This assumes that `sqlite3` is on your path and that it
+    /// invokes a compatible version of sqlite3.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `name` contains characters outside `[a-zA-Z_]`.
+    #[allow(dead_code)]
+    #[cfg(feature = "unstable")]
+    pub(crate) fn dump_table(&self, name: &'static str) {
+        assert!(name.chars().all(|c| c.is_ascii_alphabetic() || c == '_'));
+        unsafe {
+            run_sqlite3(self.data_file.path(), &format!(r#".dump "{name}""#));
+        }
+    }
+
+    /// Print the results of an arbitrary sqlite3 command (with "-safe"
+    /// and "-readonly" flags) to stderr. This is completely insecure and
+    /// should not be exposed in production. Use of the "-safe" and
+    /// "-readonly" flags is intended only to limit *accidental* misuse.
+    /// The output is unfiltered, and control codes could mess up your
+    /// terminal. This assumes that `sqlite3` is on your path and that it
+    /// invokes a compatible version of sqlite3.
+    #[allow(dead_code)]
+    #[cfg(feature = "unstable")]
+    pub(crate) unsafe fn run_sqlite3(&self, command: &str) {
+        run_sqlite3(self.data_file.path(), command)
+    }
+}
+
+#[cfg(feature = "unstable")]
+use std::{ffi::OsStr, process::Command};
+
+// See the doc comment for `TestState::run_sqlite3` above.
+//
+// - `db_path` is the path to the database file.
+// - `command` may contain newlines.
+#[allow(dead_code)]
+#[cfg(feature = "unstable")]
+unsafe fn run_sqlite3<S: AsRef<OsStr>>(db_path: S, command: &str) {
+    let output = Command::new("sqlite3")
+        .arg(db_path)
+        .arg("-safe")
+        .arg("-readonly")
+        .arg(command)
+        .output()
+        .expect("failed to execute sqlite3 process");
+
+    eprintln!(
+        "{}\n------\n{}",
+        command,
+        String::from_utf8_lossy(&output.stdout)
+    );
+    if !output.stderr.is_empty() {
+        eprintln!(
+            "------ stderr:\n{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+    eprintln!("------");
+}
+
+#[derive(Default)]
+pub(crate) struct TestDbFactory {
+    target_migrations: Option<Vec<Uuid>>,
+}
+
+impl TestDbFactory {
+    #[allow(dead_code)]
+    pub(crate) fn new(target_migrations: Vec<Uuid>) -> Self {
+        Self {
+            target_migrations: Some(target_migrations),
+        }
+    }
+}
+
+impl DataStoreFactory for TestDbFactory {
+    type Error = ();
+    type AccountId = AccountUuid;
+    type Account = crate::wallet::Account;
+    type DsError = SqliteClientError;
+    type DataStore = TestDb;
+
+    fn new_data_store(&self, network: LocalNetwork) -> Result<Self::DataStore, Self::Error> {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
+        if let Some(migrations) = &self.target_migrations {
+            init_wallet_db_internal(&mut db_data, None, migrations, true).unwrap();
+        } else {
+            init_wallet_db(&mut db_data, None).unwrap();
+        }
+        Ok(TestDb::from_parts(db_data, data_file))
+    }
+}
+
+impl Reset for TestDb {
+    type Handle = NamedTempFile;
+
+    fn reset<C>(st: &mut TestState<C, Self, LocalNetwork>) -> NamedTempFile {
+        let network = *st.network();
+        let old_db = std::mem::replace(
+            st.wallet_mut(),
+            TestDbFactory::default().new_data_store(network).unwrap(),
+        );
+        old_db.take_data_file()
+    }
+}
diff --git a/zcash_client_sqlite/src/testing/pool.rs b/zcash_client_sqlite/src/testing/pool.rs
new file mode 100644
index 0000000000..726a377034
--- /dev/null
+++ b/zcash_client_sqlite/src/testing/pool.rs
@@ -0,0 +1,263 @@
+//! Test logic involving a single shielded pool.
+//!
+//! Generalised for sharing across the Sapling and Orchard implementations.
+
+use crate::{
+    testing::{db::TestDbFactory, BlockCache},
+    SAPLING_TABLES_PREFIX,
+};
+use zcash_client_backend::data_api::testing::{
+    pool::ShieldedPoolTester, sapling::SaplingPoolTester,
+};
+
+#[cfg(feature = "orchard")]
+use {
+    crate::ORCHARD_TABLES_PREFIX,
+    zcash_client_backend::data_api::testing::orchard::OrchardPoolTester,
+};
+
+pub(crate) trait ShieldedPoolPersistence {
+    const TABLES_PREFIX: &'static str;
+}
+
+impl ShieldedPoolPersistence for SaplingPoolTester {
+    const TABLES_PREFIX: &'static str = SAPLING_TABLES_PREFIX;
+}
+
+#[cfg(feature = "orchard")]
+impl ShieldedPoolPersistence for OrchardPoolTester {
+    const TABLES_PREFIX: &'static str = ORCHARD_TABLES_PREFIX;
+}
+
+pub(crate) fn send_single_step_proposed_transfer<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::send_single_step_proposed_transfer::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn send_with_multiple_change_outputs<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::send_with_multiple_change_outputs::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub(crate) fn send_multi_step_proposed_transfer<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::send_multi_step_proposed_transfer::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+        |e, account_id, expected_bad_index| {
+            matches!(
+                e,
+                crate::error::SqliteClientError::ReachedGapLimit(acct, bad_index)
+                if acct == &account_id && bad_index == &expected_bad_index)
+        },
+    )
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub(crate) fn proposal_fails_if_not_all_ephemeral_outputs_consumed<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::proposal_fails_if_not_all_ephemeral_outputs_consumed::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn create_to_address_fails_on_incorrect_usk<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::create_to_address_fails_on_incorrect_usk::<T, _>(
+        TestDbFactory::default(),
+    )
+}
+
+pub(crate) fn proposal_fails_with_no_blocks<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::proposal_fails_with_no_blocks::<T, _>(
+        TestDbFactory::default(),
+    )
+}
+
+pub(crate) fn spend_fails_on_unverified_notes<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::spend_fails_on_unverified_notes::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn spend_fails_on_locked_notes<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::spend_fails_on_locked_notes::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn ovk_policy_prevents_recovery_from_chain<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::ovk_policy_prevents_recovery_from_chain::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn spend_succeeds_to_t_addr_zero_change<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::spend_succeeds_to_t_addr_zero_change::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn change_note_spends_succeed<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::change_note_spends_succeed::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn external_address_change_spends_detected_in_restore_from_seed<
+    T: ShieldedPoolTester,
+>() {
+    zcash_client_backend::data_api::testing::pool::external_address_change_spends_detected_in_restore_from_seed::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[allow(dead_code)]
+pub(crate) fn zip317_spend<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::zip317_spend::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub(crate) fn shield_transparent<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::shield_transparent::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+// FIXME: This requires fixes to the test framework.
+#[allow(dead_code)]
+pub(crate) fn birthday_in_anchor_shard<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::birthday_in_anchor_shard::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn checkpoint_gaps<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::checkpoint_gaps::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(feature = "orchard")]
+pub(crate) fn pool_crossing_required<P0: ShieldedPoolTester, P1: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::pool_crossing_required::<P0, P1>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(feature = "orchard")]
+pub(crate) fn fully_funded_fully_private<P0: ShieldedPoolTester, P1: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::fully_funded_fully_private::<P0, P1>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(all(feature = "orchard", feature = "transparent-inputs"))]
+pub(crate) fn fully_funded_send_to_t<P0: ShieldedPoolTester, P1: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::fully_funded_send_to_t::<P0, P1>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(feature = "orchard")]
+pub(crate) fn multi_pool_checkpoint<P0: ShieldedPoolTester, P1: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::multi_pool_checkpoint::<P0, P1>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+#[cfg(feature = "orchard")]
+pub(crate) fn multi_pool_checkpoints_with_pruning<
+    P0: ShieldedPoolTester,
+    P1: ShieldedPoolTester,
+>() {
+    zcash_client_backend::data_api::testing::pool::multi_pool_checkpoints_with_pruning::<P0, P1>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn valid_chain_states<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::valid_chain_states::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+// FIXME: This requires fixes to the test framework.
+#[allow(dead_code)]
+pub(crate) fn invalid_chain_cache_disconnected<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::invalid_chain_cache_disconnected::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn data_db_truncation<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::data_db_truncation::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn reorg_to_checkpoint<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::reorg_to_checkpoint::<T, _, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn scan_cached_blocks_allows_blocks_out_of_order<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::scan_cached_blocks_allows_blocks_out_of_order::<T>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn scan_cached_blocks_finds_received_notes<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::scan_cached_blocks_finds_received_notes::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+// TODO: This test can probably be entirely removed, as the following test duplicates it entirely.
+pub(crate) fn scan_cached_blocks_finds_change_notes<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::scan_cached_blocks_finds_change_notes::<T, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
+
+pub(crate) fn scan_cached_blocks_detects_spends_out_of_order<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::scan_cached_blocks_detects_spends_out_of_order::<
+        T,
+        _,
+    >(TestDbFactory::default(), BlockCache::new())
+}
+
+pub(crate) fn metadata_queries_exclude_unwanted_notes<T: ShieldedPoolTester>() {
+    zcash_client_backend::data_api::testing::pool::metadata_queries_exclude_unwanted_notes::<T, _, _>(
+        TestDbFactory::default(),
+        BlockCache::new(),
+    )
+}
diff --git a/zcash_client_sqlite/src/wallet.rs b/zcash_client_sqlite/src/wallet.rs
index dbffcaadd2..b4864382ec 100644
--- a/zcash_client_sqlite/src/wallet.rs
+++ b/zcash_client_sqlite/src/wallet.rs
@@ -1,4 +1,4 @@
-//! Functions for querying information in the wdb database.
+//! Functions for querying information in the wallet database.
 //!
 //! These functions should generally not be used directly; instead,
 //! their functionality is available via the [`WalletRead`] and
@@ -53,8 +53,8 @@
 //! This view exposes the history of transaction outputs received by and sent from the wallet,
 //! keyed by transaction ID, pool type, and output index. The contents of this view are useful for
 //! producing a detailed report of the effects of a transaction. Each row of this view contains:
-//! - `from_account` for sent outputs, the account from which the value was sent.
-//! - `to_account` in the case that the output was received by an account in the wallet, the
+//! - `from_account_id` for sent outputs, the account from which the value was sent.
+//! - `to_account_id` in the case that the output was received by an account in the wallet, the
 //!   identifier for the account receiving the funds.
 //! - `to_address` the address to which an output was sent, or the address at which value was
 //!   received in the case of received transparent funds.
@@ -64,49 +64,257 @@
 //!   wallet.
 //! - `memo` the shielded memo associated with the output, if any.
 
-use rusqlite::{named_params, OptionalExtension, ToSql};
-use std::collections::HashMap;
+use incrementalmerkletree::{Marking, Retention};
+
+use rusqlite::{self, named_params, params, Connection, OptionalExtension};
+use secrecy::{ExposeSecret, SecretVec};
+use shardtree::{error::ShardTreeError, store::ShardStore, ShardTree};
+use uuid::Uuid;
+use zcash_client_backend::data_api::{
+    AccountPurpose, DecryptedTransaction, Progress, TransactionDataRequest, TransactionStatus,
+    Zip32Derivation,
+};
+
+use zip32::fingerprint::SeedFingerprint;
+
+use std::collections::{HashMap, HashSet};
 use std::convert::TryFrom;
+use std::io::{self, Cursor};
+use std::num::NonZeroU32;
+use std::ops::RangeInclusive;
 
+use tracing::{debug, warn};
+
+use zcash_address::ZcashAddress;
+use zcash_client_backend::{
+    data_api::{
+        scanning::{ScanPriority, ScanRange},
+        Account as _, AccountBalance, AccountBirthday, AccountSource, BlockMetadata, Ratio,
+        SentTransaction, SentTransactionOutput, WalletSummary, SAPLING_SHARD_HEIGHT,
+    },
+    encoding::AddressCodec,
+    keys::UnifiedFullViewingKey,
+    wallet::{Note, NoteId, Recipient, WalletTx},
+    DecryptedOutput, PoolType, ShieldedProtocol,
+};
+use zcash_keys::{
+    address::{Address, Receiver, UnifiedAddress},
+    keys::{
+        AddressGenerationError, UnifiedAddressRequest, UnifiedIncomingViewingKey,
+        UnifiedSpendingKey,
+    },
+};
 use zcash_primitives::{
     block::BlockHash,
     consensus::{self, BlockHeight, BranchId, NetworkUpgrade, Parameters},
     memo::{Memo, MemoBytes},
-    sapling::CommitmentTree,
-    transaction::{components::Amount, Transaction, TxId},
-    zip32::{
-        sapling::{DiversifiableFullViewingKey, ExtendedFullViewingKey},
-        AccountId, DiversifierIndex,
+    merkle_tree::read_commitment_tree,
+    transaction::{
+        components::{amount::NonNegativeAmount, Amount, OutPoint},
+        Transaction, TransactionData, TxId,
     },
 };
-
-use zcash_client_backend::{
-    address::{RecipientAddress, UnifiedAddress},
-    data_api::{PoolType, Recipient, SentTransactionOutput},
-    keys::UnifiedFullViewingKey,
-    wallet::WalletTx,
-};
+use zip32::{self, DiversifierIndex, Scope};
 
 use crate::{
-    error::SqliteClientError, prepared::InsertAddress, DataConnStmtCache, WalletDb, PRUNING_HEIGHT,
+    error::SqliteClientError,
+    wallet::commitment_tree::{get_max_checkpointed_height, SqliteShardStore},
+    AccountRef, SqlTransaction, TransferType, WalletCommitmentTrees, WalletDb, DEFAULT_UA_REQUEST,
+    PRUNING_DEPTH, SAPLING_TABLES_PREFIX,
 };
+use crate::{AccountUuid, TxRef, VERIFY_LOOKAHEAD};
 
 #[cfg(feature = "transparent-inputs")]
-use {
-    crate::UtxoId,
-    rusqlite::{params, Connection},
-    std::collections::BTreeSet,
-    zcash_client_backend::{
-        address::AddressMetadata, encoding::AddressCodec, wallet::WalletTransparentOutput,
-    },
-    zcash_primitives::{
-        legacy::{keys::IncomingViewingKey, Script, TransparentAddress},
-        transaction::components::{OutPoint, TxOut},
-    },
-};
+use zcash_primitives::transaction::components::TxOut;
+
+use self::scanning::{parse_priority_code, priority_code, replace_queue_entries};
+
+#[cfg(feature = "orchard")]
+use {crate::ORCHARD_TABLES_PREFIX, zcash_client_backend::data_api::ORCHARD_SHARD_HEIGHT};
 
+pub mod commitment_tree;
+pub(crate) mod common;
+mod db;
 pub mod init;
+#[cfg(feature = "orchard")]
+pub(crate) mod orchard;
 pub(crate) mod sapling;
+pub(crate) mod scanning;
+#[cfg(feature = "transparent-inputs")]
+pub(crate) mod transparent;
+
+pub(crate) const BLOCK_SAPLING_FRONTIER_ABSENT: &[u8] = &[0x0];
+
+fn parse_account_source(
+    account_kind: u32,
+    hd_seed_fingerprint: Option<[u8; 32]>,
+    hd_account_index: Option<u32>,
+    spending_key_available: bool,
+    key_source: Option<String>,
+) -> Result<AccountSource, SqliteClientError> {
+    let derivation = hd_seed_fingerprint
+        .zip(hd_account_index)
+        .map(|(seed_fp, idx)| {
+            zip32::AccountId::try_from(idx)
+                .map_err(|_| {
+                    SqliteClientError::CorruptedData(
+                        "ZIP-32 account ID from wallet DB is out of range.".to_string(),
+                    )
+                })
+                .map(|idx| Zip32Derivation::new(SeedFingerprint::from_bytes(seed_fp), idx))
+        })
+        .transpose()?;
+
+    match (account_kind, derivation) {
+        (0, Some(derivation)) => Ok(AccountSource::Derived {
+            derivation,
+            key_source,
+        }),
+        (1, derivation) => Ok(AccountSource::Imported {
+            purpose: if spending_key_available {
+                AccountPurpose::Spending { derivation }
+            } else {
+                AccountPurpose::ViewOnly
+            },
+            key_source,
+        }),
+        (0, None) => Err(SqliteClientError::CorruptedData(
+            "Wallet DB account_kind constraint violated".to_string(),
+        )),
+        (_, _) => Err(SqliteClientError::CorruptedData(
+            "Unrecognized account_kind".to_string(),
+        )),
+    }
+}
+
+fn account_kind_code(value: &AccountSource) -> u32 {
+    match value {
+        AccountSource::Derived { .. } => 0,
+        AccountSource::Imported { .. } => 1,
+    }
+}
+
+/// The viewing key that an [`Account`] has available to it.
+#[derive(Debug, Clone)]
+pub(crate) enum ViewingKey {
+    /// A full viewing key.
+    ///
+    /// This is available to derived accounts, as well as accounts directly imported as
+    /// full viewing keys.
+    Full(Box<UnifiedFullViewingKey>),
+
+    /// An incoming viewing key.
+    ///
+    /// Accounts that have this kind of viewing key cannot be used in wallet contexts,
+    /// because they are unable to maintain an accurate balance.
+    Incoming(Box<UnifiedIncomingViewingKey>),
+}
+
+/// An account stored in a `zcash_client_sqlite` database.
+#[derive(Debug, Clone)]
+pub struct Account {
+    uuid: AccountUuid,
+    name: Option<String>,
+    kind: AccountSource,
+    viewing_key: ViewingKey,
+}
+
+impl Account {
+    /// Returns the default Unified Address for the account,
+    /// along with the diversifier index that generated it.
+    ///
+    /// The diversifier index may be non-zero if the Unified Address includes a Sapling
+    /// receiver, and there was no valid Sapling receiver at diversifier index zero.
+    pub(crate) fn default_address(
+        &self,
+        request: UnifiedAddressRequest,
+    ) -> Result<(UnifiedAddress, DiversifierIndex), AddressGenerationError> {
+        self.uivk().default_address(request)
+    }
+}
+
+impl zcash_client_backend::data_api::Account for Account {
+    type AccountId = AccountUuid;
+
+    fn id(&self) -> AccountUuid {
+        self.uuid
+    }
+
+    fn name(&self) -> Option<&str> {
+        self.name.as_deref()
+    }
+
+    fn source(&self) -> &AccountSource {
+        &self.kind
+    }
+
+    fn ufvk(&self) -> Option<&UnifiedFullViewingKey> {
+        self.viewing_key.ufvk()
+    }
+
+    fn uivk(&self) -> UnifiedIncomingViewingKey {
+        self.viewing_key.uivk()
+    }
+}
+
+impl ViewingKey {
+    fn ufvk(&self) -> Option<&UnifiedFullViewingKey> {
+        match self {
+            ViewingKey::Full(ufvk) => Some(ufvk),
+            ViewingKey::Incoming(_) => None,
+        }
+    }
+
+    fn uivk(&self) -> UnifiedIncomingViewingKey {
+        match self {
+            ViewingKey::Full(ufvk) => ufvk.as_ref().to_unified_incoming_viewing_key(),
+            ViewingKey::Incoming(uivk) => uivk.as_ref().clone(),
+        }
+    }
+}
+
+pub(crate) fn seed_matches_derived_account<P: consensus::Parameters>(
+    params: &P,
+    seed: &SecretVec<u8>,
+    seed_fingerprint: &SeedFingerprint,
+    account_index: zip32::AccountId,
+    uivk: &UnifiedIncomingViewingKey,
+) -> Result<bool, SqliteClientError> {
+    let seed_fingerprint_match =
+        &SeedFingerprint::from_seed(seed.expose_secret()).ok_or_else(|| {
+            SqliteClientError::BadAccountData(
+                "Seed must be between 32 and 252 bytes in length.".to_owned(),
+            )
+        })? == seed_fingerprint;
+
+    // Keys are not comparable with `Eq`, but addresses are, so we derive what should
+    // be equivalent addresses for each key and use those to check for key equality.
+    let uivk_match =
+        match UnifiedSpendingKey::from_seed(params, &seed.expose_secret()[..], account_index) {
+            // If we can't derive a USK from the given seed with the account's ZIP 32
+            // account index, then we immediately know the UIVK won't match because wallet
+            // accounts are required to have a known UIVK.
+            Err(_) => false,
+            Ok(usk) => UnifiedAddressRequest::all().map_or(
+                Ok::<_, SqliteClientError>(false),
+                |ua_request| {
+                    Ok(usk
+                        .to_unified_full_viewing_key()
+                        .default_address(ua_request)?
+                        == uivk.default_address(ua_request)?)
+                },
+            )?,
+        };
+
+    if seed_fingerprint_match != uivk_match {
+        // If these mismatch, it suggests database corruption.
+        Err(SqliteClientError::CorruptedData(format!(
+            "Seed fingerprint match: {seed_fingerprint_match}, uivk match: {uivk_match}"
+        )))
+    } else {
+        Ok(seed_fingerprint_match && uivk_match)
+    }
+}
 
 pub(crate) fn pool_code(pool_type: PoolType) -> i64 {
     // These constants are *incidentally* shared with the typecodes
@@ -114,66 +322,313 @@ pub(crate) fn pool_code(pool_type: PoolType) -> i64 {
     // implementation detail.
     match pool_type {
         PoolType::Transparent => 0i64,
-        PoolType::Sapling => 2i64,
+        PoolType::Shielded(ShieldedProtocol::Sapling) => 2i64,
+        PoolType::Shielded(ShieldedProtocol::Orchard) => 3i64,
     }
 }
 
-pub(crate) fn get_max_account_id<P>(
-    wdb: &WalletDb<P>,
-) -> Result<Option<AccountId>, SqliteClientError> {
-    // This returns the most recently generated address.
-    wdb.conn
-        .query_row("SELECT MAX(account) FROM accounts", [], |row| {
-            let account_id: Option<u32> = row.get(0)?;
-            Ok(account_id.map(AccountId::from))
-        })
-        .map_err(SqliteClientError::from)
+pub(crate) fn scope_code(scope: Scope) -> i64 {
+    match scope {
+        Scope::External => 0i64,
+        Scope::Internal => 1i64,
+    }
 }
 
-pub(crate) fn add_account<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-    key: &UnifiedFullViewingKey,
-) -> Result<(), SqliteClientError> {
-    add_account_internal(&wdb.conn, &wdb.params, "accounts", account, key)
+pub(crate) fn parse_scope(code: i64) -> Option<Scope> {
+    match code {
+        0i64 => Some(Scope::External),
+        1i64 => Some(Scope::Internal),
+        _ => None,
+    }
 }
 
-pub(crate) fn add_account_internal<P: consensus::Parameters, E: From<rusqlite::Error>>(
+pub(crate) fn memo_repr(memo: Option<&MemoBytes>) -> Option<&[u8]> {
+    memo.map(|m| {
+        if m == &MemoBytes::empty() {
+            // we store the empty memo as a single 0xf6 byte
+            &[0xf6]
+        } else {
+            m.as_slice()
+        }
+    })
+}
+
+// Returns the highest used account index for a given seed.
+pub(crate) fn max_zip32_account_index(
     conn: &rusqlite::Connection,
-    network: &P,
-    accounts_table: &'static str,
-    account: AccountId,
-    key: &UnifiedFullViewingKey,
-) -> Result<(), E> {
-    let ufvk_str: String = key.encode(network);
-    conn.execute(
-        &format!(
-            "INSERT INTO {} (account, ufvk) VALUES (:account, :ufvk)",
-            accounts_table
-        ),
-        named_params![":account": &<u32>::from(account), ":ufvk": &ufvk_str],
-    )?;
+    seed_id: &SeedFingerprint,
+) -> Result<Option<zip32::AccountId>, SqliteClientError> {
+    conn.query_row_and_then(
+        "SELECT MAX(hd_account_index) FROM accounts WHERE hd_seed_fingerprint = :hd_seed",
+        [seed_id.to_bytes()],
+        |row| {
+            row.get::<_, Option<u32>>(0)?
+                .map(zip32::AccountId::try_from)
+                .transpose()
+                .map_err(|_| SqliteClientError::Zip32AccountIndexOutOfRange)
+        },
+    )
+}
+
+pub(crate) fn add_account<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    account_name: &str,
+    kind: &AccountSource,
+    viewing_key: ViewingKey,
+    birthday: &AccountBirthday,
+) -> Result<Account, SqliteClientError> {
+    if let Some(ufvk) = viewing_key.ufvk() {
+        // Check whether any component of this UFVK collides with an existing imported or derived FVK.
+        if let Some(existing_account) = get_account_for_ufvk(conn, params, ufvk)? {
+            return Err(SqliteClientError::AccountCollision(existing_account.id()));
+        }
+    }
+    // TODO(#1490): check for IVK collisions.
+
+    let account_uuid = AccountUuid(Uuid::new_v4());
+
+    let (derivation, spending_key_available, key_source) = match kind {
+        AccountSource::Derived {
+            derivation,
+            key_source,
+        } => (Some(derivation), true, key_source),
+        AccountSource::Imported {
+            purpose: AccountPurpose::Spending { derivation },
+            key_source,
+        } => (derivation.as_ref(), true, key_source),
+        AccountSource::Imported {
+            purpose: AccountPurpose::ViewOnly,
+            key_source,
+        } => (None, false, key_source),
+    };
 
-    // Always derive the default Unified Address for the account.
-    let (address, d_idx) = key.default_address();
-    InsertAddress::new(conn)?.execute(network, account, d_idx, &address)?;
+    #[cfg(feature = "orchard")]
+    let orchard_item = viewing_key
+        .ufvk()
+        .and_then(|ufvk| ufvk.orchard().map(|k| k.to_bytes()));
+    #[cfg(not(feature = "orchard"))]
+    let orchard_item: Option<Vec<u8>> = None;
 
-    Ok(())
+    let sapling_item = viewing_key
+        .ufvk()
+        .and_then(|ufvk| ufvk.sapling().map(|k| k.to_bytes()));
+
+    #[cfg(feature = "transparent-inputs")]
+    let transparent_item = viewing_key
+        .ufvk()
+        .and_then(|ufvk| ufvk.transparent().map(|k| k.serialize()));
+    #[cfg(not(feature = "transparent-inputs"))]
+    let transparent_item: Option<Vec<u8>> = None;
+
+    let birthday_sapling_tree_size = Some(birthday.sapling_frontier().tree_size());
+    #[cfg(feature = "orchard")]
+    let birthday_orchard_tree_size = Some(birthday.orchard_frontier().tree_size());
+    #[cfg(not(feature = "orchard"))]
+    let birthday_orchard_tree_size: Option<u64> = None;
+
+    let ufvk_encoded = viewing_key.ufvk().map(|ufvk| ufvk.encode(params));
+    let account_id = conn
+        .query_row(
+            r#"
+            INSERT INTO accounts (
+                name,
+                uuid,
+                account_kind, hd_seed_fingerprint, hd_account_index, key_source,
+                ufvk, uivk,
+                orchard_fvk_item_cache, sapling_fvk_item_cache, p2pkh_fvk_item_cache,
+                birthday_height, birthday_sapling_tree_size, birthday_orchard_tree_size,
+                recover_until_height,
+                has_spend_key
+            )
+            VALUES (
+                :account_name,
+                :uuid,
+                :account_kind, :hd_seed_fingerprint, :hd_account_index, :key_source,
+                :ufvk, :uivk,
+                :orchard_fvk_item_cache, :sapling_fvk_item_cache, :p2pkh_fvk_item_cache,
+                :birthday_height, :birthday_sapling_tree_size, :birthday_orchard_tree_size,
+                :recover_until_height,
+                :has_spend_key
+            )
+            RETURNING id
+            "#,
+            named_params![
+                ":account_name": account_name,
+                ":uuid": account_uuid.0,
+                ":account_kind": account_kind_code(kind),
+                ":hd_seed_fingerprint": derivation.map(|d| d.seed_fingerprint().to_bytes()),
+                ":hd_account_index": derivation.map(|d| u32::from(d.account_index())),
+                ":key_source": key_source,
+                ":ufvk": ufvk_encoded,
+                ":uivk": viewing_key.uivk().encode(params),
+                ":orchard_fvk_item_cache": orchard_item,
+                ":sapling_fvk_item_cache": sapling_item,
+                ":p2pkh_fvk_item_cache": transparent_item,
+                ":birthday_height": u32::from(birthday.height()),
+                ":birthday_sapling_tree_size": birthday_sapling_tree_size,
+                ":birthday_orchard_tree_size": birthday_orchard_tree_size,
+                ":recover_until_height": birthday.recover_until().map(u32::from),
+                ":has_spend_key": spending_key_available as i64,
+            ],
+            |row| row.get(0).map(AccountRef),
+        )
+        .map_err(|e| match e {
+            rusqlite::Error::SqliteFailure(f, s)
+                if f.code == rusqlite::ErrorCode::ConstraintViolation =>
+            {
+                // An account conflict occurred. This should already have been caught by
+                // the check using `get_account_for_ufvk` above, but in case it wasn't,
+                // make a best effort to determine the AccountRef of the pre-existing row
+                // and provide that to our caller.
+                if let Ok(colliding_uuid) = conn.query_row(
+                    "SELECT uuid FROM accounts WHERE ufvk = ?",
+                    params![ufvk_encoded],
+                    |row| Ok(AccountUuid(row.get(0)?)),
+                ) {
+                    return SqliteClientError::AccountCollision(colliding_uuid);
+                }
+
+                SqliteClientError::from(rusqlite::Error::SqliteFailure(f, s))
+            }
+            _ => SqliteClientError::from(e),
+        })?;
+
+    let account = Account {
+        name: Some(account_name.to_owned()),
+        uuid: account_uuid,
+        kind: kind.clone(),
+        viewing_key,
+    };
+
+    // If a birthday frontier is available, insert it into the note commitment tree. If the
+    // birthday frontier is the empty frontier, we don't need to do anything.
+    if let Some(frontier) = birthday.sapling_frontier().value() {
+        debug!("Inserting Sapling frontier into ShardTree: {:?}", frontier);
+        let shard_store =
+            SqliteShardStore::<_, ::sapling::Node, SAPLING_SHARD_HEIGHT>::from_connection(
+                conn,
+                SAPLING_TABLES_PREFIX,
+            )?;
+        let mut shard_tree: ShardTree<
+            _,
+            { ::sapling::NOTE_COMMITMENT_TREE_DEPTH },
+            SAPLING_SHARD_HEIGHT,
+        > = ShardTree::new(shard_store, PRUNING_DEPTH.try_into().unwrap());
+        shard_tree.insert_frontier_nodes(
+            frontier.clone(),
+            Retention::Checkpoint {
+                // This subtraction is safe, because all leaves in the tree appear in blocks, and
+                // the invariant that birthday.height() always corresponds to the block for which
+                // `frontier` is the tree state at the start of the block. Together, this means
+                // there exists a prior block for which frontier is the tree state at the end of
+                // the block.
+                id: birthday.height() - 1,
+                marking: Marking::Reference,
+            },
+        )?;
+    }
+
+    #[cfg(feature = "orchard")]
+    if let Some(frontier) = birthday.orchard_frontier().value() {
+        debug!("Inserting Orchard frontier into ShardTree: {:?}", frontier);
+        let shard_store = SqliteShardStore::<
+            _,
+            ::orchard::tree::MerkleHashOrchard,
+            ORCHARD_SHARD_HEIGHT,
+        >::from_connection(conn, ORCHARD_TABLES_PREFIX)?;
+        let mut shard_tree: ShardTree<
+            _,
+            { ::orchard::NOTE_COMMITMENT_TREE_DEPTH as u8 },
+            ORCHARD_SHARD_HEIGHT,
+        > = ShardTree::new(shard_store, PRUNING_DEPTH.try_into().unwrap());
+        shard_tree.insert_frontier_nodes(
+            frontier.clone(),
+            Retention::Checkpoint {
+                // This subtraction is safe, because all leaves in the tree appear in blocks, and
+                // the invariant that birthday.height() always corresponds to the block for which
+                // `frontier` is the tree state at the start of the block. Together, this means
+                // there exists a prior block for which frontier is the tree state at the end of
+                // the block.
+                id: birthday.height() - 1,
+                marking: Marking::Reference,
+            },
+        )?;
+    }
+
+    // The ignored range always starts at Sapling activation
+    let sapling_activation_height = params
+        .activation_height(NetworkUpgrade::Sapling)
+        .expect("Sapling activation height must be available.");
+
+    // Add the ignored range up to the birthday height.
+    if sapling_activation_height < birthday.height() {
+        let ignored_range = sapling_activation_height..birthday.height();
+
+        replace_queue_entries::<SqliteClientError>(
+            conn,
+            &ignored_range,
+            Some(ScanRange::from_parts(
+                ignored_range.clone(),
+                ScanPriority::Ignored,
+            ))
+            .into_iter(),
+            false,
+        )?;
+    };
+
+    // Rewrite the scan ranges from the birthday height up to the chain tip so that we'll ensure we
+    // re-scan to find any notes that might belong to the newly added account.
+    if let Some(t) = chain_tip_height(conn)? {
+        let rescan_range = birthday.height()..(t + 1);
+
+        replace_queue_entries::<SqliteClientError>(
+            conn,
+            &rescan_range,
+            Some(ScanRange::from_parts(
+                rescan_range.clone(),
+                ScanPriority::Historic,
+            ))
+            .into_iter(),
+            true, // force rescan
+        )?;
+    }
+
+    // Always derive the default Unified Address for the account. If the account's viewing
+    // key has fewer components than the wallet supports (most likely due to this being an
+    // imported viewing key), derive an address containing the common subset of receivers.
+    let ua_request = account
+        .uivk()
+        .to_address_request()
+        .and_then(|ua_request| ua_request.intersect(&DEFAULT_UA_REQUEST))
+        .ok_or_else(|| {
+            SqliteClientError::AddressGeneration(AddressGenerationError::ShieldedReceiverRequired)
+        })?;
+    let (address, d_idx) = account.default_address(ua_request)?;
+    insert_address(conn, params, account_id, d_idx, &address)?;
+
+    // Initialize the `ephemeral_addresses` table.
+    #[cfg(feature = "transparent-inputs")]
+    transparent::ephemeral::init_account(conn, params, account_id)?;
+
+    Ok(account)
 }
 
 pub(crate) fn get_current_address<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_uuid: AccountUuid,
 ) -> Result<Option<(UnifiedAddress, DiversifierIndex)>, SqliteClientError> {
     // This returns the most recently generated address.
-    let addr: Option<(String, Vec<u8>)> = wdb
-        .conn
+    let addr: Option<(String, Vec<u8>)> = conn
         .query_row(
             "SELECT address, diversifier_index_be
-            FROM addresses WHERE account = :account
-            ORDER BY diversifier_index_be DESC
-            LIMIT 1",
-            named_params![":account": &u32::from(account)],
+             FROM addresses
+             JOIN accounts ON addresses.account_id = accounts.id
+             WHERE accounts.uuid = :account_uuid
+             ORDER BY diversifier_index_be DESC
+             LIMIT 1",
+            named_params![":account_uuid": account_uuid.0],
             |row| Ok((row.get(0)?, row.get(1)?)),
         )
         .optional()?;
@@ -184,131 +639,84 @@ pub(crate) fn get_current_address<P: consensus::Parameters>(
         })?;
         di_be.reverse();
 
-        RecipientAddress::decode(&wdb.params, &addr_str)
+        Address::decode(params, &addr_str)
             .ok_or_else(|| {
                 SqliteClientError::CorruptedData("Not a valid Zcash recipient address".to_owned())
             })
             .and_then(|addr| match addr {
-                RecipientAddress::Unified(ua) => Ok(ua),
+                Address::Unified(ua) => Ok(ua),
                 _ => Err(SqliteClientError::CorruptedData(format!(
                     "Addresses table contains {} which is not a unified address",
                     addr_str,
                 ))),
             })
-            .map(|addr| (addr, DiversifierIndex(di_be)))
+            .map(|addr| (addr, DiversifierIndex::from(di_be)))
     })
     .transpose()
 }
 
-#[cfg(feature = "transparent-inputs")]
-pub(crate) fn get_transparent_receivers<P: consensus::Parameters>(
-    params: &P,
-    conn: &Connection,
-    account: AccountId,
-) -> Result<HashMap<TransparentAddress, AddressMetadata>, SqliteClientError> {
-    let mut ret = HashMap::new();
-
-    // Get all UAs derived
-    let mut ua_query = conn
-        .prepare("SELECT address, diversifier_index_be FROM addresses WHERE account = :account")?;
-    let mut rows = ua_query.query(named_params![":account": &u32::from(account)])?;
-
-    while let Some(row) = rows.next()? {
-        let ua_str: String = row.get(0)?;
-        let di_vec: Vec<u8> = row.get(1)?;
-        let mut di_be: [u8; 11] = di_vec.try_into().map_err(|_| {
-            SqliteClientError::CorruptedData(
-                "Diverisifier index is not an 11-byte value".to_owned(),
-            )
-        })?;
-        di_be.reverse();
-
-        let ua = RecipientAddress::decode(params, &ua_str)
-            .ok_or_else(|| {
-                SqliteClientError::CorruptedData("Not a valid Zcash recipient address".to_owned())
-            })
-            .and_then(|addr| match addr {
-                RecipientAddress::Unified(ua) => Ok(ua),
-                _ => Err(SqliteClientError::CorruptedData(format!(
-                    "Addresses table contains {} which is not a unified address",
-                    ua_str,
-                ))),
-            })?;
-
-        if let Some(taddr) = ua.transparent() {
-            ret.insert(
-                *taddr,
-                AddressMetadata::new(account, DiversifierIndex(di_be)),
-            );
-        }
-    }
-
-    if let Some((taddr, diversifier_index)) = get_legacy_transparent_address(params, conn, account)?
-    {
-        ret.insert(taddr, AddressMetadata::new(account, diversifier_index));
-    }
-
-    Ok(ret)
-}
-
-#[cfg(feature = "transparent-inputs")]
-pub(crate) fn get_legacy_transparent_address<P: consensus::Parameters>(
+/// Adds the given address and diversifier index to the addresses table.
+///
+/// Returns the database row for the newly-inserted address.
+pub(crate) fn insert_address<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
     params: &P,
-    conn: &Connection,
-    account: AccountId,
-) -> Result<Option<(TransparentAddress, DiversifierIndex)>, SqliteClientError> {
-    // Get the UFVK for the account.
-    let ufvk_str: Option<String> = conn
-        .query_row(
-            "SELECT ufvk FROM accounts WHERE account = :account",
-            [u32::from(account)],
-            |row| row.get(0),
+    account_id: AccountRef,
+    diversifier_index: DiversifierIndex,
+    address: &UnifiedAddress,
+) -> Result<(), SqliteClientError> {
+    let mut stmt = conn.prepare_cached(
+        "INSERT INTO addresses (
+            account_id,
+            diversifier_index_be,
+            address,
+            cached_transparent_receiver_address
         )
-        .optional()?;
+        VALUES (
+            :account_id,
+            :diversifier_index_be,
+            :address,
+            :cached_transparent_receiver_address
+        )",
+    )?;
 
-    if let Some(ufvk_str) = ufvk_str {
-        let ufvk = UnifiedFullViewingKey::decode(params, &ufvk_str)
-            .map_err(SqliteClientError::CorruptedData)?;
-
-        // Derive the default transparent address (if it wasn't already part of a derived UA).
-        ufvk.transparent()
-            .map(|tfvk| {
-                tfvk.derive_external_ivk()
-                    .map(|tivk| {
-                        let (taddr, child_index) = tivk.default_address();
-                        (taddr, DiversifierIndex::from(child_index))
-                    })
-                    .map_err(SqliteClientError::HdwalletError)
-            })
-            .transpose()
-    } else {
-        Ok(None)
-    }
+    // the diversifier index is stored in big-endian order to allow sorting
+    let mut di_be = *diversifier_index.as_bytes();
+    di_be.reverse();
+    stmt.execute(named_params![
+        ":account_id": account_id.0,
+        ":diversifier_index_be": &di_be[..],
+        ":address": &address.encode(params),
+        ":cached_transparent_receiver_address": &address.transparent().map(|r| r.encode(params)),
+    ])?;
+
+    Ok(())
 }
 
 /// Returns the [`UnifiedFullViewingKey`]s for the wallet.
 pub(crate) fn get_unified_full_viewing_keys<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-) -> Result<HashMap<AccountId, UnifiedFullViewingKey>, SqliteClientError> {
+    conn: &rusqlite::Connection,
+    params: &P,
+) -> Result<HashMap<AccountUuid, UnifiedFullViewingKey>, SqliteClientError> {
     // Fetch the UnifiedFullViewingKeys we are tracking
-    let mut stmt_fetch_accounts = wdb
-        .conn
-        .prepare("SELECT account, ufvk FROM accounts ORDER BY account ASC")?;
+    let mut stmt_fetch_accounts = conn.prepare("SELECT uuid, ufvk FROM accounts")?;
 
     let rows = stmt_fetch_accounts.query_map([], |row| {
-        let acct: u32 = row.get(0)?;
-        let account = AccountId::from(acct);
-        let ufvk_str: String = row.get(1)?;
-        let ufvk = UnifiedFullViewingKey::decode(&wdb.params, &ufvk_str)
-            .map_err(SqliteClientError::CorruptedData);
-
-        Ok((account, ufvk))
+        let ufvk_str: Option<String> = row.get(1)?;
+        if let Some(ufvk_str) = ufvk_str {
+            let ufvk = UnifiedFullViewingKey::decode(params, &ufvk_str)
+                .map_err(SqliteClientError::CorruptedData);
+            Ok(Some((AccountUuid(row.get(0)?), ufvk)))
+        } else {
+            Ok(None)
+        }
     })?;
 
-    let mut res: HashMap<AccountId, UnifiedFullViewingKey> = HashMap::new();
+    let mut res: HashMap<AccountUuid, UnifiedFullViewingKey> = HashMap::new();
     for row in rows {
-        let (account_id, ufvkr) = row?;
-        res.insert(account_id, ufvkr?);
+        if let Some((account_id, ufvkr)) = row? {
+            res.insert(account_id, ufvkr?);
+        }
     }
 
     Ok(res)
@@ -317,724 +725,3151 @@ pub(crate) fn get_unified_full_viewing_keys<P: consensus::Parameters>(
 /// Returns the account id corresponding to a given [`UnifiedFullViewingKey`],
 /// if any.
 pub(crate) fn get_account_for_ufvk<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
+    conn: &rusqlite::Connection,
+    params: &P,
     ufvk: &UnifiedFullViewingKey,
-) -> Result<Option<AccountId>, SqliteClientError> {
-    wdb.conn
-        .query_row(
-            "SELECT account FROM accounts WHERE ufvk = ?",
-            [&ufvk.encode(&wdb.params)],
-            |row| {
-                let acct: u32 = row.get(0)?;
-                Ok(AccountId::from(acct))
-            },
-        )
-        .optional()
-        .map_err(SqliteClientError::from)
-}
+) -> Result<Option<Account>, SqliteClientError> {
+    #[cfg(feature = "orchard")]
+    let orchard_item = ufvk.orchard().map(|k| k.to_bytes());
+    #[cfg(not(feature = "orchard"))]
+    let orchard_item: Option<Vec<u8>> = None;
 
-/// Checks whether the specified [`ExtendedFullViewingKey`] is valid and corresponds to the
-/// specified account.
-///
-/// [`ExtendedFullViewingKey`]: zcash_primitives::zip32::ExtendedFullViewingKey
-pub(crate) fn is_valid_account_extfvk<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-    extfvk: &ExtendedFullViewingKey,
-) -> Result<bool, SqliteClientError> {
-    wdb.conn
-        .prepare("SELECT ufvk FROM accounts WHERE account = ?")?
-        .query_row([u32::from(account).to_sql()?], |row| {
-            row.get(0).map(|ufvk_str: String| {
-                UnifiedFullViewingKey::decode(&wdb.params, &ufvk_str)
-                    .map_err(SqliteClientError::CorruptedData)
-            })
-        })
-        .optional()
-        .map_err(SqliteClientError::from)
-        .and_then(|row| {
-            if let Some(ufvk) = row {
-                ufvk.map(|ufvk| {
-                    ufvk.sapling().map(|dfvk| dfvk.to_bytes())
-                        == Some(DiversifiableFullViewingKey::from(extfvk.clone()).to_bytes())
-                })
-            } else {
-                Ok(false)
-            }
-        })
-}
+    let sapling_item = ufvk.sapling().map(|k| k.to_bytes());
 
-/// Returns the balance for the account, including all mined unspent notes that we know
-/// about.
-///
-/// WARNING: This balance is potentially unreliable, as mined notes may become unmined due
-/// to chain reorgs. You should generally not show this balance to users without some
-/// caveat. Use [`get_balance_at`] where you need a more reliable indication of the
-/// wallet balance.
-#[cfg(test)]
-pub(crate) fn get_balance<P>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-) -> Result<Amount, SqliteClientError> {
-    let balance = wdb.conn.query_row(
-        "SELECT SUM(value) FROM sapling_received_notes
-        INNER JOIN transactions ON transactions.id_tx = sapling_received_notes.tx
-        WHERE account = ? AND spent IS NULL AND transactions.block IS NOT NULL",
-        [u32::from(account)],
-        |row| row.get(0).or(Ok(0)),
+    #[cfg(feature = "transparent-inputs")]
+    let transparent_item = ufvk.transparent().map(|k| k.serialize());
+    #[cfg(not(feature = "transparent-inputs"))]
+    let transparent_item: Option<Vec<u8>> = None;
+
+    let mut stmt = conn.prepare(
+        "SELECT name, uuid, account_kind, 
+                hd_seed_fingerprint, hd_account_index, key_source, 
+                ufvk, has_spend_key
+         FROM accounts
+         WHERE orchard_fvk_item_cache = :orchard_fvk_item_cache
+            OR sapling_fvk_item_cache = :sapling_fvk_item_cache
+            OR p2pkh_fvk_item_cache = :p2pkh_fvk_item_cache",
     )?;
 
-    match Amount::from_i64(balance) {
-        Ok(amount) if !amount.is_negative() => Ok(amount),
-        _ => Err(SqliteClientError::CorruptedData(
-            "Sum of values in sapling_received_notes is out of range".to_string(),
-        )),
-    }
-}
-
-/// Returns the verified balance for the account at the specified height,
-/// This may be used to obtain a balance that ignores notes that have been
-/// received so recently that they are not yet deemed spendable.
-pub(crate) fn get_balance_at<P>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-    anchor_height: BlockHeight,
-) -> Result<Amount, SqliteClientError> {
-    let balance = wdb.conn.query_row(
-        "SELECT SUM(value) FROM sapling_received_notes
-        INNER JOIN transactions ON transactions.id_tx = sapling_received_notes.tx
-        WHERE account = ? AND spent IS NULL AND transactions.block <= ?",
-        [u32::from(account), u32::from(anchor_height)],
-        |row| row.get(0).or(Ok(0)),
-    )?;
+    let accounts = stmt
+        .query_and_then::<_, SqliteClientError, _, _>(
+            named_params![
+                ":orchard_fvk_item_cache": orchard_item,
+                ":sapling_fvk_item_cache": sapling_item,
+                ":p2pkh_fvk_item_cache": transparent_item,
+            ],
+            |row| {
+                let account_name = row.get("name")?;
+                let account_uuid = AccountUuid(row.get("uuid")?);
+                let kind = parse_account_source(
+                    row.get("account_kind")?,
+                    row.get("hd_seed_fingerprint")?,
+                    row.get("hd_account_index")?,
+                    row.get("has_spend_key")?,
+                    row.get("key_source")?,
+                )?;
+
+                // We looked up the account by FVK components, so the UFVK column must be
+                // non-null.
+                let ufvk_str: String = row.get("ufvk")?;
+                let viewing_key = ViewingKey::Full(Box::new(
+                    UnifiedFullViewingKey::decode(params, &ufvk_str).map_err(|e| {
+                        SqliteClientError::CorruptedData(format!(
+                            "Could not decode unified full viewing key for account {}: {}",
+                            account_uuid.0, e
+                        ))
+                    })?,
+                ));
+
+                Ok(Account {
+                    name: account_name,
+                    uuid: account_uuid,
+                    kind,
+                    viewing_key,
+                })
+            },
+        )?
+        .collect::<Result<Vec<_>, _>>()?;
 
-    match Amount::from_i64(balance) {
-        Ok(amount) if !amount.is_negative() => Ok(amount),
-        _ => Err(SqliteClientError::CorruptedData(
-            "Sum of values in sapling_received_notes is out of range".to_string(),
-        )),
+    if accounts.len() > 1 {
+        Err(SqliteClientError::CorruptedData(
+            "Mutiple account records matched the provided UFVK".to_owned(),
+        ))
+    } else {
+        Ok(accounts.into_iter().next())
     }
 }
 
-/// Returns the memo for a received note.
-///
-/// The note is identified by its row index in the `sapling_received_notes` table within the wdb
-/// database.
-pub(crate) fn get_received_memo<P>(
-    wdb: &WalletDb<P>,
-    id_note: i64,
-) -> Result<Option<Memo>, SqliteClientError> {
-    let memo_bytes: Option<Vec<_>> = wdb.conn.query_row(
-        "SELECT memo FROM sapling_received_notes
-        WHERE id_note = ?",
-        [id_note],
-        |row| row.get(0),
+/// Returns the account id corresponding to a given [`SeedFingerprint`]
+/// and [`zip32::AccountId`], if any.
+pub(crate) fn get_derived_account<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    seed_fp: &SeedFingerprint,
+    account_index: zip32::AccountId,
+) -> Result<Option<Account>, SqliteClientError> {
+    let mut stmt = conn.prepare(
+        "SELECT name, key_source, uuid, ufvk
+         FROM accounts
+         WHERE hd_seed_fingerprint = :hd_seed_fingerprint
+         AND hd_account_index = :hd_account_index",
     )?;
 
-    memo_bytes
-        .map(|b| {
-            MemoBytes::from_bytes(&b)
-                .and_then(Memo::try_from)
-                .map_err(SqliteClientError::from)
-        })
-        .transpose()
-}
-
-/// Looks up a transaction by its internal database identifier.
-pub(crate) fn get_transaction<P: Parameters>(
-    wdb: &WalletDb<P>,
-    id_tx: i64,
-) -> Result<Transaction, SqliteClientError> {
-    let (tx_bytes, block_height): (Vec<_>, BlockHeight) = wdb.conn.query_row(
-        "SELECT raw, block FROM transactions
-        WHERE id_tx = ?",
-        [id_tx],
+    let mut accounts = stmt.query_and_then::<_, SqliteClientError, _, _>(
+        named_params![
+            ":hd_seed_fingerprint": seed_fp.to_bytes(),
+            ":hd_account_index": u32::from(account_index),
+        ],
         |row| {
-            let h: u32 = row.get(1)?;
-            Ok((row.get(0)?, BlockHeight::from(h)))
+            let account_name = row.get("name")?;
+            let key_source = row.get("key_source")?;
+            let account_uuid = AccountUuid(row.get("uuid")?);
+            let ufvk = match row.get::<_, Option<String>>("ufvk")? {
+                None => Err(SqliteClientError::CorruptedData(format!(
+                    "Missing unified full viewing key for derived account {}",
+                    account_uuid.0,
+                ))),
+                Some(ufvk_str) => UnifiedFullViewingKey::decode(params, &ufvk_str).map_err(|e| {
+                    SqliteClientError::CorruptedData(format!(
+                        "Could not decode unified full viewing key for account {}: {}",
+                        account_uuid.0, e
+                    ))
+                }),
+            }?;
+            Ok(Account {
+                name: account_name,
+                uuid: account_uuid,
+                kind: AccountSource::Derived {
+                    derivation: Zip32Derivation::new(*seed_fp, account_index),
+                    key_source,
+                },
+                viewing_key: ViewingKey::Full(Box::new(ufvk)),
+            })
         },
     )?;
 
-    Transaction::read(
-        &tx_bytes[..],
-        BranchId::for_height(&wdb.params, block_height),
-    )
-    .map_err(SqliteClientError::from)
+    accounts.next().transpose()
 }
 
-/// Returns the memo for a sent note.
-///
-/// The note is identified by its row index in the `sent_notes` table within the wdb
-/// database.
-pub(crate) fn get_sent_memo<P>(
-    wdb: &WalletDb<P>,
-    id_note: i64,
-) -> Result<Option<Memo>, SqliteClientError> {
-    let memo_bytes: Option<Vec<_>> = wdb.conn.query_row(
-        "SELECT memo FROM sent_notes
-        WHERE id_note = ?",
-        [id_note],
-        |row| row.get(0),
-    )?;
-
-    memo_bytes
-        .map(|b| {
-            MemoBytes::from_bytes(&b)
-                .and_then(Memo::try_from)
-                .map_err(SqliteClientError::from)
-        })
-        .transpose()
+pub(crate) trait ProgressEstimator {
+    fn sapling_scan_progress<P: consensus::Parameters>(
+        &self,
+        conn: &rusqlite::Connection,
+        params: &P,
+        birthday_height: BlockHeight,
+        recover_until_height: Option<BlockHeight>,
+        fully_scanned_height: Option<BlockHeight>,
+        chain_tip_height: BlockHeight,
+    ) -> Result<Option<Progress>, SqliteClientError>;
+
+    #[cfg(feature = "orchard")]
+    fn orchard_scan_progress<P: consensus::Parameters>(
+        &self,
+        conn: &rusqlite::Connection,
+        params: &P,
+        birthday_height: BlockHeight,
+        recover_until_height: Option<BlockHeight>,
+        fully_scanned_height: Option<BlockHeight>,
+        chain_tip_height: BlockHeight,
+    ) -> Result<Option<Progress>, SqliteClientError>;
 }
 
-/// Returns the minimum and maximum heights for blocks stored in the wallet database.
-pub(crate) fn block_height_extrema<P>(
-    wdb: &WalletDb<P>,
-) -> Result<Option<(BlockHeight, BlockHeight)>, rusqlite::Error> {
-    wdb.conn
-        .query_row("SELECT MIN(height), MAX(height) FROM blocks", [], |row| {
-            let min_height: u32 = row.get(0)?;
-            let max_height: u32 = row.get(1)?;
-            Ok(Some((
-                BlockHeight::from(min_height),
-                BlockHeight::from(max_height),
-            )))
-        })
-        //.optional() doesn't work here because a failed aggregate function
-        //produces a runtime error, not an empty set of rows.
-        .or(Ok(None))
+#[derive(Debug)]
+pub(crate) struct SubtreeProgressEstimator;
+
+fn table_constants(
+    shielded_protocol: ShieldedProtocol,
+) -> Result<(&'static str, &'static str, u8), SqliteClientError> {
+    match shielded_protocol {
+        ShieldedProtocol::Sapling => Ok((
+            SAPLING_TABLES_PREFIX,
+            "sapling_output_count",
+            SAPLING_SHARD_HEIGHT,
+        )),
+        #[cfg(feature = "orchard")]
+        ShieldedProtocol::Orchard => Ok((
+            ORCHARD_TABLES_PREFIX,
+            "orchard_action_count",
+            ORCHARD_SHARD_HEIGHT,
+        )),
+        #[cfg(not(feature = "orchard"))]
+        ShieldedProtocol::Orchard => Err(SqliteClientError::UnsupportedPoolType(PoolType::ORCHARD)),
+    }
 }
 
-/// Returns the block height at which the specified transaction was mined,
-/// if any.
-pub(crate) fn get_tx_height<P>(
-    wdb: &WalletDb<P>,
-    txid: TxId,
-) -> Result<Option<BlockHeight>, rusqlite::Error> {
-    wdb.conn
+fn estimate_tree_size<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    shielded_protocol: ShieldedProtocol,
+    pool_activation_height: BlockHeight,
+    chain_tip_height: BlockHeight,
+) -> Result<Option<u64>, SqliteClientError> {
+    let (table_prefix, _, shard_height) = table_constants(shielded_protocol)?;
+
+    // Estimate the size of the tree by linear extrapolation from available
+    // data closest to the chain tip.
+    //
+    // - If we have scanned blocks within the incomplete subtree, and we know
+    //   the tree size for the end of the most recent scanned range, then we
+    //   extrapolate from the start of the incomplete subtree:
+    //
+    //         subtree
+    //         /     \
+    //       /         \
+    //     /             \
+    //   /                 \
+    //   |<--------->|  |
+    //     | scanned |  tip
+    //           last_scanned
+    //
+    //
+    //             subtree
+    //             /     \
+    //           /         \
+    //         /             \
+    //       /                 \
+    //       |<------->|    |
+    //   |   scanned   |    tip
+    //             last_scanned
+    //
+    // - If we don't have scanned blocks within the incomplete subtree, or we
+    //   don't know the tree size, then we extrapolate from the block-width of
+    //   the last complete subtree.
+    //
+    // This avoids having a sharp discontinuity in the progress percentages
+    // shown to users, and gets more accurate the closer to the chain tip we
+    // have scanned.
+    //
+    // TODO: it would be nice to be able to reliably have the size of the
+    // commitment tree at the chain tip without having to have scanned that
+    // block.
+
+    // Get the tree size at the last scanned height, if known.
+    let last_scanned = block_max_scanned(conn, params)?.and_then(|last_scanned| {
+        match shielded_protocol {
+            ShieldedProtocol::Sapling => last_scanned.sapling_tree_size(),
+            #[cfg(feature = "orchard")]
+            ShieldedProtocol::Orchard => last_scanned.orchard_tree_size(),
+            #[cfg(not(feature = "orchard"))]
+            ShieldedProtocol::Orchard => None,
+        }
+        .map(|tree_size| (last_scanned.block_height(), u64::from(tree_size)))
+    });
+
+    // Get the last completed subtree.
+    let last_completed_subtree = conn
         .query_row(
-            "SELECT block FROM transactions WHERE txid = ?",
-            [txid.as_ref().to_vec()],
-            |row| row.get(0).map(u32::into),
+            &format!(
+                "SELECT shard_index, subtree_end_height
+                 FROM {table_prefix}_tree_shards
+                 WHERE subtree_end_height IS NOT NULL
+                 ORDER BY shard_index DESC
+                 LIMIT 1"
+            ),
+            [],
+            |row| {
+                Ok((
+                    incrementalmerkletree::Address::from_parts(
+                        incrementalmerkletree::Level::new(shard_height),
+                        row.get(0)?,
+                    ),
+                    BlockHeight::from_u32(row.get(1)?),
+                ))
+            },
         )
-        .optional()
+        // `None` if we have no subtree roots yet.
+        .optional()?;
+
+    let result = if let Some((last_completed_subtree, last_completed_subtree_end)) =
+        last_completed_subtree
+    {
+        // If we know the tree size at the last scanned height, and that
+        // height is within the incomplete subtree, extrapolate.
+        let tip_tree_size = last_scanned.and_then(|(last_scanned, last_scanned_tree_size)| {
+            (last_scanned > last_completed_subtree_end)
+                .then(|| {
+                    let scanned_notes = last_scanned_tree_size
+                        - u64::from(last_completed_subtree.position_range_end());
+                    let scanned_range = u64::from(last_scanned - last_completed_subtree_end);
+                    let unscanned_range = u64::from(chain_tip_height - last_scanned);
+
+                    (scanned_notes * unscanned_range)
+                        .checked_div(scanned_range)
+                        .map(|extrapolated_unscanned_notes| {
+                            last_scanned_tree_size + extrapolated_unscanned_notes
+                        })
+                })
+                .flatten()
+        });
+
+        if let Some(tree_size) = tip_tree_size {
+            Some(tree_size)
+        } else if let Some(second_to_last_completed_subtree_end) = last_completed_subtree
+            .index()
+            .checked_sub(1)
+            .and_then(|subtree_index| {
+                conn.query_row(
+                    &format!(
+                        "SELECT subtree_end_height
+                         FROM {table_prefix}_tree_shards
+                         WHERE shard_index = :shard_index"
+                    ),
+                    named_params! {":shard_index": subtree_index},
+                    |row| Ok(row.get::<_, Option<_>>(0)?.map(BlockHeight::from_u32)),
+                )
+                .transpose()
+            })
+            .transpose()?
+        {
+            let notes_in_complete_subtrees = u64::from(last_completed_subtree.position_range_end());
+
+            let subtree_notes = 1 << shard_height;
+            let subtree_range =
+                u64::from(last_completed_subtree_end - second_to_last_completed_subtree_end);
+            let unscanned_range = u64::from(chain_tip_height - last_completed_subtree_end);
+
+            (subtree_notes * unscanned_range)
+                .checked_div(subtree_range)
+                .map(|extrapolated_incomplete_subtree_notes| {
+                    notes_in_complete_subtrees + extrapolated_incomplete_subtree_notes
+                })
+        } else {
+            // There's only one completed subtree; its start height must
+            // be the activation height for this shielded protocol.
+            let subtree_notes = 1 << shard_height;
+
+            let subtree_range = u64::from(last_completed_subtree_end - pool_activation_height);
+            let unscanned_range = u64::from(chain_tip_height - last_completed_subtree_end);
+
+            (subtree_notes * unscanned_range)
+                .checked_div(subtree_range)
+                .map(|extrapolated_incomplete_subtree_notes| {
+                    subtree_notes + extrapolated_incomplete_subtree_notes
+                })
+        }
+    } else {
+        // If there are no completed subtrees, but we have scanned some blocks, we can still
+        // interpolate based upon the tree size as of the last scanned block. Here, since we
+        // don't have any subtree data to draw on, we will interpolate based on the number of
+        // blocks since the pool activation height
+        last_scanned.and_then(|(last_scanned_height, last_scanned_tree_size)| {
+            let subtree_range = u64::from(last_scanned_height - pool_activation_height);
+            let unscanned_range = u64::from(chain_tip_height - last_scanned_height);
+
+            (last_scanned_tree_size * unscanned_range)
+                .checked_div(subtree_range)
+                .map(|extrapolated_incomplete_subtree_notes| {
+                    last_scanned_tree_size + extrapolated_incomplete_subtree_notes
+                })
+        })
+    };
+
+    Ok(result)
 }
 
-/// Returns the block hash for the block at the specified height,
-/// if any.
-pub(crate) fn get_block_hash<P>(
-    wdb: &WalletDb<P>,
-    block_height: BlockHeight,
-) -> Result<Option<BlockHash>, rusqlite::Error> {
-    wdb.conn
-        .query_row(
-            "SELECT hash FROM blocks WHERE height = ?",
-            [u32::from(block_height)],
+#[allow(clippy::too_many_arguments)]
+fn subtree_scan_progress<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    shielded_protocol: ShieldedProtocol,
+    pool_activation_height: BlockHeight,
+    birthday_height: BlockHeight,
+    recover_until_height: Option<BlockHeight>,
+    fully_scanned_height: Option<BlockHeight>,
+    chain_tip_height: BlockHeight,
+) -> Result<Option<Progress>, SqliteClientError> {
+    let (table_prefix, output_count_col, shard_height) = table_constants(shielded_protocol)?;
+
+    let mut stmt_scanned_count_until = conn.prepare_cached(&format!(
+        "SELECT SUM({output_count_col})
+        FROM blocks
+        WHERE :start_height <= height AND height < :end_height",
+    ))?;
+    let mut stmt_scanned_count_from = conn.prepare_cached(&format!(
+        "SELECT SUM({output_count_col})
+        FROM blocks
+        WHERE :start_height <= height",
+    ))?;
+    let mut stmt_start_tree_size = conn.prepare_cached(&format!(
+        "SELECT MAX({table_prefix}_commitment_tree_size - {output_count_col})
+        FROM blocks
+        WHERE height <= :start_height",
+    ))?;
+    let mut stmt_end_tree_size_at = conn.prepare_cached(&format!(
+        "SELECT {table_prefix}_commitment_tree_size
+        FROM blocks
+        WHERE height = :height",
+    ))?;
+
+    if fully_scanned_height == Some(chain_tip_height) {
+        // Compute the total blocks scanned since the wallet birthday on either side of
+        // the recover-until height.
+        let recover = match recover_until_height {
+            Some(end_height) => stmt_scanned_count_until.query_row(
+                named_params! {
+                    ":start_height": u32::from(birthday_height),
+                    ":end_height": u32::from(end_height),
+                },
+                |row| {
+                    let recovered = row.get::<_, Option<u64>>(0)?;
+                    Ok(recovered.map(|n| Ratio::new(n, n)))
+                },
+            )?,
+            None => {
+                // If none of the wallet's accounts have a recover-until height, then there
+                // is no recovery phase for the wallet, and therefore the denominator in the
+                // resulting ratio (the number of notes in the recovery range) is zero.
+                Some(Ratio::new(0, 0))
+            }
+        };
+
+        let scan = stmt_scanned_count_from.query_row(
+            named_params! {
+                ":start_height": u32::from(
+                    recover_until_height.unwrap_or(birthday_height)
+                ),
+            },
             |row| {
-                let row_data = row.get::<_, Vec<_>>(0)?;
-                Ok(BlockHash::from_slice(&row_data))
+                let scanned = row.get::<_, Option<u64>>(0)?;
+                Ok(scanned.map(|n| Ratio::new(n, n)))
             },
+        )?;
+
+        Ok(scan.map(|scan| Progress::new(scan, recover)))
+    } else {
+        // In case we didn't have information about the tree size at the recover-until
+        // height, get the tree size from a nearby subtree. It's fine for this to be
+        // approximate; it just shifts the boundary between scan and recover progress.
+        let mut get_tree_size_near = |as_of: BlockHeight| {
+            let size_from_blocks = stmt_start_tree_size
+                .query_row(named_params![":start_height": u32::from(as_of)], |row| {
+                    row.get::<_, Option<u64>>(0)
+                })
+                .optional()?
+                .flatten();
+
+            let size_from_subtree_roots = || {
+                conn.query_row(
+                    &format!(
+                        "SELECT MIN(shard_index)
+                             FROM {table_prefix}_tree_shards
+                             WHERE subtree_end_height >= :start_height
+                             OR subtree_end_height IS NULL",
+                    ),
+                    named_params! {
+                        ":start_height": u32::from(as_of),
+                    },
+                    |row| {
+                        let min_tree_size = row
+                            .get::<_, Option<u64>>(0)?
+                            .map(|min_idx| min_idx << shard_height);
+                        Ok(min_tree_size)
+                    },
+                )
+                .optional()
+                .map(|opt| opt.flatten())
+            };
+
+            match size_from_blocks {
+                Some(size) => Ok(Some(size)),
+                None => size_from_subtree_roots(),
+            }
+        };
+
+        // Get the starting note commitment tree size from the wallet birthday, or failing that
+        // from the blocks table.
+        let birthday_size = match conn
+            .query_row(
+                &format!(
+                    "SELECT birthday_{table_prefix}_tree_size
+                     FROM accounts
+                     WHERE birthday_height = :birthday_height",
+                ),
+                named_params![":birthday_height": u32::from(birthday_height)],
+                |row| row.get::<_, Option<u64>>(0),
+            )
+            .optional()?
+            .flatten()
+        {
+            Some(tree_size) => Some(tree_size),
+            // If we don't have an explicit birthday tree size, find something nearby.
+            None => get_tree_size_near(birthday_height)?,
+        };
+
+        // Get the note commitment tree size as of the start of the recover-until height.
+        // The outer option indicates whether or not we have recover-until height information;
+        // the inner option indicates whether or not we were able to obtain a tree size given
+        // the recover-until height.
+        let recover_until_size: Option<Option<u64>> = recover_until_height
+            // Find a tree size near to the recover-until height
+            .map(get_tree_size_near)
+            .transpose()?;
+
+        // Count the total outputs scanned so far on the birthday side of the recover-until height.
+        let recovered_count = recover_until_height
+            .map(|end_height| {
+                stmt_scanned_count_until.query_row(
+                    named_params! {
+                        ":start_height": u32::from(birthday_height),
+                        ":end_height": u32::from(end_height),
+                    },
+                    |row| row.get::<_, Option<u64>>(0),
+                )
+            })
+            .transpose()?;
+
+        // If we've scanned the block at the chain tip, we know how many notes are currently in the
+        // tree.
+        let tip_tree_size = match stmt_end_tree_size_at
+            .query_row(
+                named_params! {":height": u32::from(chain_tip_height)},
+                |row| row.get::<_, Option<u64>>(0),
+            )
+            .optional()?
+            .flatten()
+        {
+            Some(tree_size) => Some(tree_size),
+            None => estimate_tree_size(
+                conn,
+                params,
+                shielded_protocol,
+                pool_activation_height,
+                chain_tip_height,
+            )?,
+        };
+
+        let recover = recovered_count
+            .zip(recover_until_size)
+            .map(|(recovered, end_size)| {
+                birthday_size.zip(end_size).map(|(start_size, end_size)| {
+                    Ratio::new(recovered.unwrap_or(0), end_size - start_size)
+                })
+            })
+            // If none of the wallet's accounts have a recover-until height, then there
+            // is no recovery phase for the wallet, and therefore the denominator in the
+            // resulting ratio (the number of notes in the recovery range) is zero.
+            .unwrap_or_else(|| Some(Ratio::new(0, 0)));
+
+        let scan = {
+            // Count the total outputs scanned so far on the chain tip side of the
+            // recover-until height.
+            let scanned_count = stmt_scanned_count_from.query_row(
+                named_params![":start_height": u32::from(recover_until_height.unwrap_or(birthday_height))],
+                |row| row.get::<_, Option<u64>>(0),
+            )?;
+
+            recover_until_size
+                .unwrap_or(birthday_size)
+                .zip(tip_tree_size)
+                .map(|(start_size, tip_tree_size)| {
+                    Ratio::new(scanned_count.unwrap_or(0), tip_tree_size - start_size)
+                })
+        };
+
+        Ok(scan.map(|scan| Progress::new(scan, recover)))
+    }
+}
+
+impl ProgressEstimator for SubtreeProgressEstimator {
+    #[tracing::instrument(skip(conn, params))]
+    fn sapling_scan_progress<P: consensus::Parameters>(
+        &self,
+        conn: &rusqlite::Connection,
+        params: &P,
+        birthday_height: BlockHeight,
+        recover_until_height: Option<BlockHeight>,
+        fully_scanned_height: Option<BlockHeight>,
+        chain_tip_height: BlockHeight,
+    ) -> Result<Option<Progress>, SqliteClientError> {
+        subtree_scan_progress(
+            conn,
+            params,
+            ShieldedProtocol::Sapling,
+            params
+                .activation_height(NetworkUpgrade::Sapling)
+                .expect("Sapling activation height must be available."),
+            birthday_height,
+            recover_until_height,
+            fully_scanned_height,
+            chain_tip_height,
+        )
+    }
+
+    #[cfg(feature = "orchard")]
+    #[tracing::instrument(skip(conn, params))]
+    fn orchard_scan_progress<P: consensus::Parameters>(
+        &self,
+        conn: &rusqlite::Connection,
+        params: &P,
+        birthday_height: BlockHeight,
+        recover_until_height: Option<BlockHeight>,
+        fully_scanned_height: Option<BlockHeight>,
+        chain_tip_height: BlockHeight,
+    ) -> Result<Option<Progress>, SqliteClientError> {
+        subtree_scan_progress(
+            conn,
+            params,
+            ShieldedProtocol::Orchard,
+            params
+                .activation_height(NetworkUpgrade::Nu5)
+                .expect("NU5 activation height must be available."),
+            birthday_height,
+            recover_until_height,
+            fully_scanned_height,
+            chain_tip_height,
+        )
+    }
+}
+
+/// Returns the spendable balance for the account at the specified height.
+///
+/// This may be used to obtain a balance that ignores notes that have been detected so recently
+/// that they are not yet spendable, or for which it is not yet possible to construct witnesses.
+///
+/// `min_confirmations` can be 0, but that case is currently treated identically to
+/// `min_confirmations == 1` for shielded notes. This behaviour may change in the future.
+#[tracing::instrument(skip(tx, params, progress))]
+pub(crate) fn get_wallet_summary<P: consensus::Parameters>(
+    tx: &rusqlite::Transaction,
+    params: &P,
+    min_confirmations: u32,
+    progress: &impl ProgressEstimator,
+) -> Result<Option<WalletSummary<AccountUuid>>, SqliteClientError> {
+    let chain_tip_height = match chain_tip_height(tx)? {
+        Some(h) => h,
+        None => {
+            return Ok(None);
+        }
+    };
+
+    let birthday_height = match wallet_birthday(tx)? {
+        Some(h) => h,
+        None => {
+            return Ok(None);
+        }
+    };
+
+    let recover_until_height = recover_until_height(tx)?;
+
+    let fully_scanned_height = block_fully_scanned(tx, params)?.map(|m| m.block_height());
+    let summary_height = (chain_tip_height + 1).saturating_sub(std::cmp::max(min_confirmations, 1));
+
+    let sapling_progress = progress.sapling_scan_progress(
+        tx,
+        params,
+        birthday_height,
+        recover_until_height,
+        fully_scanned_height,
+        chain_tip_height,
+    )?;
+
+    #[cfg(feature = "orchard")]
+    let orchard_progress = progress.orchard_scan_progress(
+        tx,
+        params,
+        birthday_height,
+        recover_until_height,
+        fully_scanned_height,
+        chain_tip_height,
+    )?;
+    #[cfg(not(feature = "orchard"))]
+    let orchard_progress: Option<Progress> = None;
+
+    // Treat Sapling and Orchard outputs as having the same cost to scan.
+    let progress = sapling_progress
+        .as_ref()
+        .zip(orchard_progress.as_ref())
+        .map(|(s, o)| {
+            Progress::new(
+                Ratio::new(
+                    s.scan().numerator() + o.scan().numerator(),
+                    s.scan().denominator() + o.scan().denominator(),
+                ),
+                s.recovery()
+                    .zip(o.recovery())
+                    .map(|(s, o)| {
+                        Ratio::new(
+                            s.numerator() + o.numerator(),
+                            s.denominator() + o.denominator(),
+                        )
+                    })
+                    .or_else(|| s.recovery())
+                    .or_else(|| o.recovery()),
+            )
+        })
+        .or(sapling_progress)
+        .or(orchard_progress);
+
+    let progress = match progress {
+        Some(p) => p,
+        None => return Ok(None),
+    };
+
+    let mut stmt_accounts = tx.prepare_cached("SELECT uuid FROM accounts")?;
+    let mut account_balances = stmt_accounts
+        .query([])?
+        .and_then(|row| {
+            Ok::<_, SqliteClientError>((AccountUuid(row.get::<_, Uuid>(0)?), AccountBalance::ZERO))
+        })
+        .collect::<Result<HashMap<AccountUuid, AccountBalance>, _>>()?;
+
+    fn count_notes<F>(
+        tx: &rusqlite::Transaction,
+        summary_height: BlockHeight,
+        account_balances: &mut HashMap<AccountUuid, AccountBalance>,
+        table_prefix: &'static str,
+        with_pool_balance: F,
+    ) -> Result<(), SqliteClientError>
+    where
+        F: Fn(
+            &mut AccountBalance,
+            NonNegativeAmount,
+            NonNegativeAmount,
+            NonNegativeAmount,
+        ) -> Result<(), SqliteClientError>,
+    {
+        // If the shard containing the summary height contains any unscanned ranges that start below or
+        // including that height, none of our shielded balance is currently spendable.
+        #[tracing::instrument(skip_all)]
+        fn is_any_spendable(
+            conn: &rusqlite::Connection,
+            summary_height: BlockHeight,
+            table_prefix: &'static str,
+        ) -> Result<bool, SqliteClientError> {
+            conn.query_row(
+                &format!(
+                    "SELECT NOT EXISTS(
+                         SELECT 1 FROM v_{table_prefix}_shard_unscanned_ranges
+                         WHERE :summary_height
+                            BETWEEN subtree_start_height
+                            AND IFNULL(subtree_end_height, :summary_height)
+                         AND block_range_start <= :summary_height
+                     )"
+                ),
+                named_params![":summary_height": u32::from(summary_height)],
+                |row| row.get::<_, bool>(0),
+            )
+            .map_err(|e| e.into())
+        }
+
+        let any_spendable = is_any_spendable(tx, summary_height, table_prefix)?;
+        let mut stmt_select_notes = tx.prepare_cached(&format!(
+            "SELECT a.uuid, n.value, n.is_change, scan_state.max_priority, t.block
+             FROM {table_prefix}_received_notes n
+             JOIN accounts a ON a.id = n.account_id
+             JOIN transactions t ON t.id_tx = n.tx
+             LEFT OUTER JOIN v_{table_prefix}_shards_scan_state scan_state
+                ON n.commitment_tree_position >= scan_state.start_position
+                AND n.commitment_tree_position < scan_state.end_position_exclusive
+             WHERE (
+                t.block IS NOT NULL -- the receiving tx is mined
+                OR t.expiry_height IS NULL -- the receiving tx will not expire
+                OR t.expiry_height >= :summary_height -- the receiving tx is unexpired
+             )
+             -- and the received note is unspent
+             AND n.id NOT IN (
+               SELECT {table_prefix}_received_note_id
+               FROM {table_prefix}_received_note_spends
+               JOIN transactions t ON t.id_tx = transaction_id
+               WHERE t.block IS NOT NULL -- the spending transaction is mined
+               OR t.expiry_height IS NULL -- the spending tx will not expire
+               OR t.expiry_height > :summary_height -- the spending tx is unexpired
+             )"
+        ))?;
+
+        let mut rows =
+            stmt_select_notes.query(named_params![":summary_height": u32::from(summary_height)])?;
+        while let Some(row) = rows.next()? {
+            let account = AccountUuid(row.get::<_, Uuid>(0)?);
+
+            let value_raw = row.get::<_, i64>(1)?;
+            let value = NonNegativeAmount::from_nonnegative_i64(value_raw).map_err(|_| {
+                SqliteClientError::CorruptedData(format!(
+                    "Negative received note value: {}",
+                    value_raw
+                ))
+            })?;
+
+            let is_change = row.get::<_, bool>(2)?;
+
+            // If `max_priority` is null, this means that the note is not positioned; the note
+            // will not be spendable, so we assign the scan priority to `ChainTip` as a priority
+            // that is greater than `Scanned`
+            let max_priority_raw = row.get::<_, Option<i64>>(3)?;
+            let max_priority = max_priority_raw.map_or_else(
+                || Ok(ScanPriority::ChainTip),
+                |raw| {
+                    parse_priority_code(raw).ok_or_else(|| {
+                        SqliteClientError::CorruptedData(format!(
+                            "Priority code {} not recognized.",
+                            raw
+                        ))
+                    })
+                },
+            )?;
+
+            let received_height = row.get::<_, Option<u32>>(4)?.map(BlockHeight::from);
+
+            let is_spendable = any_spendable
+                && received_height.iter().any(|h| h <= &summary_height)
+                && max_priority <= ScanPriority::Scanned;
+
+            let is_pending_change =
+                is_change && received_height.iter().all(|h| h > &summary_height);
+
+            let (spendable_value, change_pending_confirmation, value_pending_spendability) = {
+                let zero = NonNegativeAmount::ZERO;
+                if is_spendable {
+                    (value, zero, zero)
+                } else if is_pending_change {
+                    (zero, value, zero)
+                } else {
+                    (zero, zero, value)
+                }
+            };
+
+            if let Some(balances) = account_balances.get_mut(&account) {
+                with_pool_balance(
+                    balances,
+                    spendable_value,
+                    change_pending_confirmation,
+                    value_pending_spendability,
+                )?;
+            }
+        }
+        Ok(())
+    }
+
+    #[cfg(feature = "orchard")]
+    {
+        let orchard_trace = tracing::info_span!("orchard_balances").entered();
+        count_notes(
+            tx,
+            summary_height,
+            &mut account_balances,
+            ORCHARD_TABLES_PREFIX,
+            |balances, spendable_value, change_pending_confirmation, value_pending_spendability| {
+                balances.with_orchard_balance_mut::<_, SqliteClientError>(|bal| {
+                    bal.add_spendable_value(spendable_value)?;
+                    bal.add_pending_change_value(change_pending_confirmation)?;
+                    bal.add_pending_spendable_value(value_pending_spendability)?;
+                    Ok(())
+                })
+            },
+        )?;
+        drop(orchard_trace);
+    }
+
+    let sapling_trace = tracing::info_span!("sapling_balances").entered();
+    count_notes(
+        tx,
+        summary_height,
+        &mut account_balances,
+        SAPLING_TABLES_PREFIX,
+        |balances, spendable_value, change_pending_confirmation, value_pending_spendability| {
+            balances.with_sapling_balance_mut::<_, SqliteClientError>(|bal| {
+                bal.add_spendable_value(spendable_value)?;
+                bal.add_pending_change_value(change_pending_confirmation)?;
+                bal.add_pending_spendable_value(value_pending_spendability)?;
+                Ok(())
+            })
+        },
+    )?;
+    drop(sapling_trace);
+
+    #[cfg(feature = "transparent-inputs")]
+    transparent::add_transparent_account_balances(tx, chain_tip_height + 1, &mut account_balances)?;
+
+    // The approach used here for Sapling and Orchard subtree indexing was a quick hack
+    // that has not yet been replaced. TODO: Make less hacky.
+    // https://github.com/zcash/librustzcash/issues/1249
+    let next_sapling_subtree_index = {
+        let shard_store =
+            SqliteShardStore::<_, ::sapling::Node, SAPLING_SHARD_HEIGHT>::from_connection(
+                tx,
+                SAPLING_TABLES_PREFIX,
+            )?;
+
+        // The last shard will be incomplete, and we want the next range to overlap with
+        // the last complete shard, so return the index of the second-to-last shard root.
+        shard_store
+            .get_shard_roots()
+            .map_err(ShardTreeError::Storage)?
+            .iter()
+            .rev()
+            .nth(1)
+            .map(|addr| addr.index())
+            .unwrap_or(0)
+    };
+
+    #[cfg(feature = "orchard")]
+    let next_orchard_subtree_index = {
+        let shard_store = SqliteShardStore::<
+            _,
+            ::orchard::tree::MerkleHashOrchard,
+            ORCHARD_SHARD_HEIGHT,
+        >::from_connection(tx, ORCHARD_TABLES_PREFIX)?;
+
+        // The last shard will be incomplete, and we want the next range to overlap with
+        // the last complete shard, so return the index of the second-to-last shard root.
+        shard_store
+            .get_shard_roots()
+            .map_err(ShardTreeError::Storage)?
+            .iter()
+            .rev()
+            .nth(1)
+            .map(|addr| addr.index())
+            .unwrap_or(0)
+    };
+
+    let summary = WalletSummary::new(
+        account_balances,
+        chain_tip_height,
+        fully_scanned_height.unwrap_or(birthday_height - 1),
+        progress,
+        next_sapling_subtree_index,
+        #[cfg(feature = "orchard")]
+        next_orchard_subtree_index,
+    );
+
+    Ok(Some(summary))
+}
+
+/// Returns the memo for a received note, if the note is known to the wallet.
+pub(crate) fn get_received_memo(
+    conn: &rusqlite::Connection,
+    note_id: NoteId,
+) -> Result<Option<Memo>, SqliteClientError> {
+    let fetch_memo = |table_prefix: &'static str, output_col: &'static str| {
+        conn.query_row(
+            &format!(
+                "SELECT memo FROM {table_prefix}_received_notes
+                JOIN transactions ON {table_prefix}_received_notes.tx = transactions.id_tx
+                WHERE transactions.txid = :txid
+                AND {table_prefix}_received_notes.{output_col} = :output_index"
+            ),
+            named_params![
+                ":txid": note_id.txid().as_ref(),
+                ":output_index": note_id.output_index()
+            ],
+            |row| row.get(0),
         )
         .optional()
+    };
+
+    let memo_bytes: Option<Vec<_>> = match note_id.protocol() {
+        ShieldedProtocol::Sapling => fetch_memo(SAPLING_TABLES_PREFIX, "output_index")?.flatten(),
+        #[cfg(feature = "orchard")]
+        ShieldedProtocol::Orchard => fetch_memo(ORCHARD_TABLES_PREFIX, "action_index")?.flatten(),
+        #[cfg(not(feature = "orchard"))]
+        ShieldedProtocol::Orchard => {
+            return Err(SqliteClientError::UnsupportedPoolType(PoolType::ORCHARD))
+        }
+    };
+
+    memo_bytes
+        .map(|b| {
+            MemoBytes::from_bytes(&b)
+                .and_then(Memo::try_from)
+                .map_err(SqliteClientError::from)
+        })
+        .transpose()
+}
+
+/// Looks up a transaction by its [`TxId`].
+///
+/// Returns the decoded transaction, along with the block height that was used in its decoding.
+/// This is either the block height at which the transaction was mined, or the expiry height if the
+/// wallet created the transaction but the transaction has not yet been mined from the perspective
+/// of the wallet.
+pub(crate) fn get_transaction<P: Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    txid: TxId,
+) -> Result<Option<(BlockHeight, Transaction)>, SqliteClientError> {
+    conn.query_row(
+        "SELECT raw, block, expiry_height FROM transactions
+        WHERE txid = ?",
+        [txid.as_ref()],
+        |row| {
+            let h: Option<u32> = row.get(1)?;
+            let expiry: Option<u32> = row.get(2)?;
+            Ok((
+                row.get::<_, Vec<u8>>(0)?,
+                h.map(BlockHeight::from),
+                expiry.map(BlockHeight::from),
+            ))
+        },
+    )
+    .optional()?
+    .map(|(tx_bytes, block_height, expiry_height)| {
+        // We need to provide a consensus branch ID so that pre-v5 `Transaction` structs
+        // (which don't commit directly to one) can store it internally.
+        // - If the transaction is mined, we use the block height to get the correct one.
+        // - If the transaction is unmined and has a cached non-zero expiry height, we use
+        //   that (relying on the invariant that a transaction can't be mined across a network
+        //   upgrade boundary, so the expiry height must be in the same epoch).
+        // - Otherwise, we use a placeholder for the initial transaction parse (as the
+        //   consensus branch ID is not used there), and then either use its non-zero expiry
+        //   height or return an error.
+        if let Some(height) =
+            block_height.or_else(|| expiry_height.filter(|h| h > &BlockHeight::from(0)))
+        {
+            Transaction::read(&tx_bytes[..], BranchId::for_height(params, height))
+                .map(|t| (height, t))
+                .map_err(SqliteClientError::from)
+        } else {
+            let tx_data = Transaction::read(&tx_bytes[..], BranchId::Sprout)
+                .map_err(SqliteClientError::from)?
+                .into_data();
+
+            let expiry_height = tx_data.expiry_height();
+            if expiry_height > BlockHeight::from(0) {
+                TransactionData::from_parts(
+                    tx_data.version(),
+                    BranchId::for_height(params, expiry_height),
+                    tx_data.lock_time(),
+                    expiry_height,
+                    tx_data.transparent_bundle().cloned(),
+                    tx_data.sprout_bundle().cloned(),
+                    tx_data.sapling_bundle().cloned(),
+                    tx_data.orchard_bundle().cloned(),
+                    tx_data.zip233_amount(),
+                    #[cfg(zcash_unstable = "tze")]
+                    tx_data.tze_bundle().cloned(),
+                )
+                .freeze()
+                .map(|t| (expiry_height, t))
+                .map_err(SqliteClientError::from)
+            } else {
+                Err(SqliteClientError::CorruptedData(
+                    "Consensus branch ID not known, cannot parse this transaction until it is mined"
+                        .to_string(),
+                ))
+            }
+        }
+    })
+    .transpose()
+}
+
+pub(crate) fn get_funding_accounts(
+    conn: &rusqlite::Connection,
+    tx: &Transaction,
+) -> Result<HashSet<AccountUuid>, rusqlite::Error> {
+    let mut funding_accounts = HashSet::new();
+    #[cfg(feature = "transparent-inputs")]
+    funding_accounts.extend(transparent::detect_spending_accounts(
+        conn,
+        tx.transparent_bundle()
+            .iter()
+            .flat_map(|bundle| bundle.vin.iter().map(|txin| &txin.prevout)),
+    )?);
+
+    funding_accounts.extend(sapling::detect_spending_accounts(
+        conn,
+        tx.sapling_bundle().iter().flat_map(|bundle| {
+            bundle
+                .shielded_spends()
+                .iter()
+                .map(|spend| spend.nullifier())
+        }),
+    )?);
+
+    #[cfg(feature = "orchard")]
+    funding_accounts.extend(orchard::detect_spending_accounts(
+        conn,
+        tx.orchard_bundle()
+            .iter()
+            .flat_map(|bundle| bundle.actions().iter().map(|action| action.nullifier())),
+    )?);
+
+    Ok(funding_accounts)
 }
 
-/// Gets the height to which the database must be truncated if any truncation that would remove a
-/// number of blocks greater than the pruning height is attempted.
-pub(crate) fn get_min_unspent_height<P>(
-    wdb: &WalletDb<P>,
-) -> Result<Option<BlockHeight>, SqliteClientError> {
-    wdb.conn
+/// Returns the memo for a sent note, if the sent note is known to the wallet.
+pub(crate) fn get_sent_memo(
+    conn: &rusqlite::Connection,
+    note_id: NoteId,
+) -> Result<Option<Memo>, SqliteClientError> {
+    let memo_bytes: Option<Vec<_>> = conn
         .query_row(
-            "SELECT MIN(tx.block)
-             FROM sapling_received_notes n
-             JOIN transactions tx ON tx.id_tx = n.tx
-             WHERE n.spent IS NULL",
-            [],
-            |row| {
-                row.get(0)
-                    .map(|maybe_height: Option<u32>| maybe_height.map(|height| height.into()))
-            },
+            "SELECT memo FROM sent_notes
+            JOIN transactions ON sent_notes.tx = transactions.id_tx
+            WHERE transactions.txid = :txid
+            AND sent_notes.output_pool = :pool_code
+            AND sent_notes.output_index = :output_index",
+            named_params![
+                ":txid": note_id.txid().as_ref(),
+                ":pool_code": pool_code(PoolType::Shielded(note_id.protocol())),
+                ":output_index": note_id.output_index()
+            ],
+            |row| row.get(0),
         )
-        .map_err(SqliteClientError::from)
+        .optional()?
+        .flatten();
+
+    memo_bytes
+        .map(|b| {
+            MemoBytes::from_bytes(&b)
+                .and_then(Memo::try_from)
+                .map_err(SqliteClientError::from)
+        })
+        .transpose()
+}
+
+/// Returns the minimum birthday height for accounts in the wallet.
+//
+// TODO ORCHARD: we should consider whether we want to permit protocol-restricted accounts; if so,
+// we would then want this method to take a protocol identifier to be able to learn the wallet's
+// "Orchard birthday" which might be different from the overall wallet birthday.
+pub(crate) fn wallet_birthday(
+    conn: &rusqlite::Connection,
+) -> Result<Option<BlockHeight>, rusqlite::Error> {
+    conn.query_row(
+        "SELECT MIN(birthday_height) AS wallet_birthday FROM accounts",
+        [],
+        |row| {
+            row.get::<_, Option<u32>>(0)
+                .map(|opt| opt.map(BlockHeight::from))
+        },
+    )
+}
+
+pub(crate) fn account_birthday(
+    conn: &rusqlite::Connection,
+    account_uuid: AccountUuid,
+) -> Result<BlockHeight, SqliteClientError> {
+    conn.query_row(
+        "SELECT birthday_height
+         FROM accounts
+         WHERE uuid = :account_uuid",
+        named_params![":account_uuid": account_uuid.0],
+        |row| row.get::<_, u32>(0).map(BlockHeight::from),
+    )
+    .optional()
+    .map_err(SqliteClientError::from)
+    .and_then(|opt| opt.ok_or(SqliteClientError::AccountUnknown))
+}
+
+/// Returns the maximum recover-until height for accounts in the wallet.
+pub(crate) fn recover_until_height(
+    conn: &rusqlite::Connection,
+) -> Result<Option<BlockHeight>, rusqlite::Error> {
+    conn.query_row(
+        "SELECT MAX(recover_until_height) FROM accounts",
+        [],
+        |row| {
+            row.get::<_, Option<u32>>(0)
+                .map(|opt| opt.map(BlockHeight::from))
+        },
+    )
+}
+
+/// Returns the minimum and maximum heights for blocks stored in the wallet database.
+pub(crate) fn block_height_extrema(
+    conn: &rusqlite::Connection,
+) -> Result<Option<RangeInclusive<BlockHeight>>, rusqlite::Error> {
+    conn.query_row("SELECT MIN(height), MAX(height) FROM blocks", [], |row| {
+        let min_height: Option<u32> = row.get(0)?;
+        let max_height: Option<u32> = row.get(1)?;
+        Ok(min_height
+            .zip(max_height)
+            .map(|(min, max)| RangeInclusive::new(min.into(), max.into())))
+    })
+}
+
+pub(crate) fn get_account_ref(
+    conn: &rusqlite::Connection,
+    account_uuid: AccountUuid,
+) -> Result<AccountRef, SqliteClientError> {
+    conn.query_row(
+        "SELECT id FROM accounts WHERE uuid = :account_uuid",
+        named_params! {":account_uuid": account_uuid.0},
+        |row| row.get("id").map(AccountRef),
+    )
+    .optional()?
+    .ok_or(SqliteClientError::AccountUnknown)
+}
+
+#[cfg(feature = "transparent-inputs")]
+pub(crate) fn get_account_uuid(
+    conn: &rusqlite::Connection,
+    account_id: AccountRef,
+) -> Result<AccountUuid, SqliteClientError> {
+    conn.query_row(
+        "SELECT uuid FROM accounts WHERE id = :account_id",
+        named_params! {":account_id": account_id.0},
+        |row| row.get("uuid").map(AccountUuid),
+    )
+    .optional()?
+    .ok_or(SqliteClientError::AccountUnknown)
+}
+
+pub(crate) fn get_account<P: Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_uuid: AccountUuid,
+) -> Result<Option<Account>, SqliteClientError> {
+    let mut sql = conn.prepare_cached(
+        r#"
+        SELECT name, account_kind, hd_seed_fingerprint, hd_account_index, key_source, ufvk, uivk, has_spend_key
+        FROM accounts
+        WHERE uuid = :account_uuid
+        "#,
+    )?;
+
+    let mut result = sql.query(named_params![":account_uuid": account_uuid.0])?;
+    let row = result.next()?;
+    match row {
+        Some(row) => {
+            let account_name = row.get("name")?;
+            let kind = parse_account_source(
+                row.get("account_kind")?,
+                row.get("hd_seed_fingerprint")?,
+                row.get("hd_account_index")?,
+                row.get("has_spend_key")?,
+                row.get("key_source")?,
+            )?;
+
+            let ufvk_str: Option<String> = row.get("ufvk")?;
+            let viewing_key = if let Some(ufvk_str) = ufvk_str {
+                ViewingKey::Full(Box::new(
+                    UnifiedFullViewingKey::decode(params, &ufvk_str[..])
+                        .map_err(SqliteClientError::BadAccountData)?,
+                ))
+            } else {
+                let uivk_str: String = row.get("uivk")?;
+                ViewingKey::Incoming(Box::new(
+                    UnifiedIncomingViewingKey::decode(params, &uivk_str[..])
+                        .map_err(SqliteClientError::BadAccountData)?,
+                ))
+            };
+
+            Ok(Some(Account {
+                name: account_name,
+                uuid: account_uuid,
+                kind,
+                viewing_key,
+            }))
+        }
+        None => Ok(None),
+    }
+}
+
+/// Returns the minimum and maximum heights of blocks in the chain which may be scanned.
+pub(crate) fn chain_tip_height(
+    conn: &rusqlite::Connection,
+) -> Result<Option<BlockHeight>, rusqlite::Error> {
+    conn.query_row("SELECT MAX(block_range_end) FROM scan_queue", [], |row| {
+        let max_height: Option<u32> = row.get(0)?;
+
+        // Scan ranges are end-exclusive, so we subtract 1 from `max_height` to obtain the
+        // height of the last known chain tip;
+        Ok(max_height.map(|h| BlockHeight::from(h.saturating_sub(1))))
+    })
+}
+
+pub(crate) fn get_target_and_anchor_heights(
+    conn: &rusqlite::Connection,
+    min_confirmations: NonZeroU32,
+) -> Result<Option<(BlockHeight, BlockHeight)>, rusqlite::Error> {
+    match chain_tip_height(conn)? {
+        Some(chain_tip_height) => {
+            let sapling_anchor_height = get_max_checkpointed_height(
+                conn,
+                SAPLING_TABLES_PREFIX,
+                chain_tip_height,
+                min_confirmations,
+            )?;
+
+            #[cfg(feature = "orchard")]
+            let orchard_anchor_height = get_max_checkpointed_height(
+                conn,
+                ORCHARD_TABLES_PREFIX,
+                chain_tip_height,
+                min_confirmations,
+            )?;
+
+            #[cfg(not(feature = "orchard"))]
+            let orchard_anchor_height: Option<BlockHeight> = None;
+
+            let anchor_height = sapling_anchor_height
+                .zip(orchard_anchor_height)
+                .map(|(s, o)| std::cmp::min(s, o))
+                .or(sapling_anchor_height)
+                .or(orchard_anchor_height);
+
+            Ok(anchor_height.map(|h| (chain_tip_height + 1, h)))
+        }
+        None => Ok(None),
+    }
+}
+
+fn parse_block_metadata<P: consensus::Parameters>(
+    _params: &P,
+    row: (BlockHeight, Vec<u8>, Option<u32>, Vec<u8>, Option<u32>),
+) -> Result<BlockMetadata, SqliteClientError> {
+    let (block_height, hash_data, sapling_tree_size_opt, sapling_tree, _orchard_tree_size_opt) =
+        row;
+    let sapling_tree_size = sapling_tree_size_opt.map_or_else(|| {
+        if sapling_tree == BLOCK_SAPLING_FRONTIER_ABSENT {
+            Err(SqliteClientError::CorruptedData("One of either the Sapling tree size or the legacy Sapling commitment tree must be present.".to_owned()))
+        } else {
+            // parse the legacy commitment tree data
+            read_commitment_tree::<
+                ::sapling::Node,
+                _,
+                { ::sapling::NOTE_COMMITMENT_TREE_DEPTH },
+            >(Cursor::new(sapling_tree))
+            .map(|tree| tree.size().try_into().unwrap())
+            .map_err(SqliteClientError::from)
+        }
+    }, Ok)?;
+
+    let block_hash = BlockHash::try_from_slice(&hash_data).ok_or_else(|| {
+        SqliteClientError::from(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("Invalid block hash length: {}", hash_data.len()),
+        ))
+    })?;
+
+    Ok(BlockMetadata::from_parts(
+        block_height,
+        block_hash,
+        Some(sapling_tree_size),
+        #[cfg(feature = "orchard")]
+        if _params
+            .activation_height(NetworkUpgrade::Nu5)
+            .iter()
+            .any(|nu5_activation| &block_height >= nu5_activation)
+        {
+            _orchard_tree_size_opt
+        } else {
+            Some(0)
+        },
+    ))
 }
 
-/// Truncates the database to the given height.
+#[tracing::instrument(skip(conn, params))]
+pub(crate) fn block_metadata<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    block_height: BlockHeight,
+) -> Result<Option<BlockMetadata>, SqliteClientError> {
+    conn.query_row(
+        "SELECT height, hash, sapling_commitment_tree_size, sapling_tree, orchard_commitment_tree_size
+        FROM blocks
+        WHERE height = :block_height",
+        named_params![":block_height": u32::from(block_height)],
+        |row| {
+            let height: u32 = row.get(0)?;
+            let block_hash: Vec<u8> = row.get(1)?;
+            let sapling_tree_size: Option<u32> = row.get(2)?;
+            let sapling_tree: Vec<u8> = row.get(3)?;
+            let orchard_tree_size: Option<u32> = row.get(4)?;
+            Ok((
+                BlockHeight::from(height),
+                block_hash,
+                sapling_tree_size,
+                sapling_tree,
+                orchard_tree_size,
+            ))
+        },
+    )
+    .optional()
+    .map_err(SqliteClientError::from)
+    .and_then(|meta_row| meta_row.map(|r| parse_block_metadata(params, r)).transpose())
+}
+
+#[tracing::instrument(skip_all)]
+pub(crate) fn block_fully_scanned<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+) -> Result<Option<BlockMetadata>, SqliteClientError> {
+    if let Some(birthday_height) = wallet_birthday(conn)? {
+        // We assume that the only way we get a contiguous range of block heights in the `blocks` table
+        // starting with the birthday block, is if all scanning operations have been performed on those
+        // blocks. This holds because the `blocks` table is only altered by `WalletDb::put_blocks` via
+        // `put_block`, and the effective combination of intra-range linear scanning and the nullifier
+        // map ensures that we discover all wallet-related information within the contiguous range.
+        //
+        // We also assume that every contiguous range of block heights in the `blocks` table has a
+        // single matching entry in the `scan_queue` table with priority "Scanned". This requires no
+        // bugs in the scan queue update logic, which we have had before. However, a bug here would
+        // mean that we return a more conservative fully-scanned height, which likely just causes a
+        // performance regression.
+        //
+        // The fully-scanned height is therefore the last height that falls within the first range in
+        // the scan queue with priority "Scanned".
+        let calc_fully_scanned_height = |row: &rusqlite::Row| {
+            let block_range_start = BlockHeight::from_u32(row.get(0)?);
+            let block_range_end = BlockHeight::from_u32(row.get(1)?);
+
+            // If the start of the earliest scanned range is greater than
+            // the birthday height, then there is an unscanned range between
+            // the wallet birthday and that range, so there is no fully
+            // scanned height.
+            Ok(if block_range_start <= birthday_height {
+                // Scan ranges are end-exclusive.
+                Some(block_range_end - 1)
+            } else {
+                None
+            })
+        };
+        let fully_scanned_height = match conn
+            .query_row(
+                "SELECT block_range_start, block_range_end
+                FROM scan_queue
+                WHERE priority = :priority
+                ORDER BY block_range_start ASC
+                LIMIT 1",
+                named_params![":priority": priority_code(&ScanPriority::Scanned)],
+                calc_fully_scanned_height,
+            )
+            .optional()?
+        {
+            Some(Some(h)) => h,
+            _ => return Ok(None),
+        };
+
+        block_metadata(conn, params, fully_scanned_height)
+    } else {
+        Ok(None)
+    }
+}
+
+pub(crate) fn block_max_scanned<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+) -> Result<Option<BlockMetadata>, SqliteClientError> {
+    conn.query_row(
+        "SELECT blocks.height, hash, sapling_commitment_tree_size, sapling_tree, orchard_commitment_tree_size
+         FROM blocks
+         JOIN (SELECT MAX(height) AS height FROM blocks) blocks_max
+         ON blocks.height = blocks_max.height",
+        [],
+        |row| {
+            let height: u32 = row.get(0)?;
+            let block_hash: Vec<u8> = row.get(1)?;
+            let sapling_tree_size: Option<u32> = row.get(2)?;
+            let sapling_tree: Vec<u8> = row.get(3)?;
+            let orchard_tree_size: Option<u32> = row.get(4)?;
+            Ok((
+                BlockHeight::from(height),
+                block_hash,
+                sapling_tree_size,
+                sapling_tree,
+                orchard_tree_size
+            ))
+        },
+    )
+    .optional()
+    .map_err(SqliteClientError::from)
+    .and_then(|meta_row| meta_row.map(|r| parse_block_metadata(params, r)).transpose())
+}
+
+/// Returns the block height at which the specified transaction was mined,
+/// if any.
+pub(crate) fn get_tx_height(
+    conn: &rusqlite::Connection,
+    txid: TxId,
+) -> Result<Option<BlockHeight>, rusqlite::Error> {
+    conn.query_row(
+        "SELECT block FROM transactions WHERE txid = ?",
+        [txid.as_ref()],
+        |row| Ok(row.get::<_, Option<u32>>(0)?.map(BlockHeight::from)),
+    )
+    .optional()
+    .map(|opt| opt.flatten())
+}
+
+/// Returns the block hash for the block at the specified height,
+/// if any.
+pub(crate) fn get_block_hash(
+    conn: &rusqlite::Connection,
+    block_height: BlockHeight,
+) -> Result<Option<BlockHash>, rusqlite::Error> {
+    conn.query_row(
+        "SELECT hash FROM blocks WHERE height = ?",
+        [u32::from(block_height)],
+        |row| {
+            let row_data = row.get::<_, Vec<_>>(0)?;
+            Ok(BlockHash::from_slice(&row_data))
+        },
+    )
+    .optional()
+}
+
+pub(crate) fn get_max_height_hash(
+    conn: &rusqlite::Connection,
+) -> Result<Option<(BlockHeight, BlockHash)>, rusqlite::Error> {
+    conn.query_row(
+        "SELECT height, hash FROM blocks ORDER BY height DESC LIMIT 1",
+        [],
+        |row| {
+            let height = row.get::<_, u32>(0).map(BlockHeight::from)?;
+            let row_data = row.get::<_, Vec<_>>(1)?;
+            Ok((height, BlockHash::from_slice(&row_data)))
+        },
+    )
+    .optional()
+}
+
+pub(crate) fn store_transaction_to_be_sent<P: consensus::Parameters>(
+    wdb: &mut WalletDb<SqlTransaction<'_>, P>,
+    sent_tx: &SentTransaction<AccountUuid>,
+) -> Result<(), SqliteClientError> {
+    let tx_ref = put_tx_data(
+        wdb.conn.0,
+        sent_tx.tx(),
+        Some(sent_tx.fee_amount()),
+        Some(sent_tx.created()),
+        Some(sent_tx.target_height()),
+    )?;
+
+    let mut detectable_via_scanning = false;
+
+    // Mark notes as spent.
+    //
+    // This locks the notes so they aren't selected again by a subsequent call to
+    // create_spend_to_address() before this transaction has been mined (at which point the notes
+    // get re-marked as spent).
+    //
+    // Assumes that create_spend_to_address() will never be called in parallel, which is a
+    // reasonable assumption for a light client such as a mobile phone.
+    if let Some(bundle) = sent_tx.tx().sapling_bundle() {
+        detectable_via_scanning = true;
+        for spend in bundle.shielded_spends() {
+            sapling::mark_sapling_note_spent(wdb.conn.0, tx_ref, spend.nullifier())?;
+        }
+    }
+    if let Some(_bundle) = sent_tx.tx().orchard_bundle() {
+        #[cfg(feature = "orchard")]
+        {
+            detectable_via_scanning = true;
+            for action in _bundle.actions() {
+                orchard::mark_orchard_note_spent(wdb.conn.0, tx_ref, action.nullifier())?;
+            }
+        }
+
+        #[cfg(not(feature = "orchard"))]
+        panic!("Sent a transaction with Orchard Actions without `orchard` enabled?");
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    for utxo_outpoint in sent_tx.utxos_spent() {
+        transparent::mark_transparent_utxo_spent(wdb.conn.0, tx_ref, utxo_outpoint)?;
+    }
+
+    for output in sent_tx.outputs() {
+        insert_sent_output(
+            wdb.conn.0,
+            &wdb.params,
+            tx_ref,
+            *sent_tx.account_id(),
+            output,
+        )?;
+
+        match output.recipient() {
+            Recipient::InternalAccount {
+                receiving_account,
+                note: Note::Sapling(note),
+                ..
+            } => {
+                sapling::put_received_note(
+                    wdb.conn.0,
+                    &DecryptedOutput::new(
+                        output.output_index(),
+                        note.clone(),
+                        *receiving_account,
+                        output
+                            .memo()
+                            .map_or_else(MemoBytes::empty, |memo| memo.clone()),
+                        TransferType::WalletInternal,
+                    ),
+                    tx_ref,
+                    None,
+                )?;
+            }
+            #[cfg(feature = "orchard")]
+            Recipient::InternalAccount {
+                receiving_account,
+                note: Note::Orchard(note),
+                ..
+            } => {
+                orchard::put_received_note(
+                    wdb.conn.0,
+                    &DecryptedOutput::new(
+                        output.output_index(),
+                        *note,
+                        *receiving_account,
+                        output
+                            .memo()
+                            .map_or_else(MemoBytes::empty, |memo| memo.clone()),
+                        TransferType::WalletInternal,
+                    ),
+                    tx_ref,
+                    None,
+                )?;
+            }
+            #[cfg(feature = "transparent-inputs")]
+            Recipient::EphemeralTransparent {
+                receiving_account,
+                ephemeral_address,
+                outpoint_metadata,
+            } => {
+                transparent::put_transparent_output(
+                    wdb.conn.0,
+                    &wdb.params,
+                    outpoint_metadata,
+                    &TxOut {
+                        value: output.value(),
+                        script_pubkey: ephemeral_address.script(),
+                    },
+                    None,
+                    ephemeral_address,
+                    *receiving_account,
+                    true,
+                )?;
+                transparent::ephemeral::mark_ephemeral_address_as_used(
+                    wdb.conn.0,
+                    &wdb.params,
+                    ephemeral_address,
+                    tx_ref,
+                )?;
+            }
+            _ => {}
+        }
+    }
+
+    // Add the transaction to the set to be queried for transaction status. This is only necessary
+    // at present for fully transparent transactions, because any transaction with a shielded
+    // component will be detected via ordinary chain scanning and/or nullifier checking.
+    if !detectable_via_scanning {
+        queue_tx_retrieval(wdb.conn.0, std::iter::once(sent_tx.tx().txid()), None)?;
+    }
+
+    Ok(())
+}
+
+pub(crate) fn set_transaction_status(
+    conn: &rusqlite::Transaction,
+    txid: TxId,
+    status: TransactionStatus,
+) -> Result<(), SqliteClientError> {
+    // It is safe to unconditionally delete the request from `tx_retrieval_queue` below (both in
+    // the expired case and the case where it has been mined), because we already have all the data
+    // we need about this transaction:
+    // * if the status is being set in response to a `GetStatus` request, we know that we already
+    //   have the transaction data (`GetStatus` requests are only generated if we already have that
+    //   data)
+    // * if it is being set in response to an `Enhancement` request, we know that the status must
+    //   be `TxidNotRecognized` because otherwise the transaction data should have been provided to
+    //   the backend directly instead of calling `set_transaction_status`
+    //
+    // In general `Enhancement` requests are only generated in response to situations where a
+    // transaction has already been mined - either the transaction was detected by scanning the
+    // chain of `CompactBlock` values, or was discovered by walking backward from the inputs of a
+    // transparent transaction; in the case that a transaction was read from the mempool, complete
+    // transaction data will have been available and the only question that we are concerned with
+    // is whether that transaction ends up being mined or expires.
+    match status {
+        TransactionStatus::TxidNotRecognized | TransactionStatus::NotInMainChain => {
+            // If the transaction is now expired, remove it from the retrieval queue.
+            if let Some(chain_tip) = chain_tip_height(conn)? {
+                conn.execute(
+                    "DELETE FROM tx_retrieval_queue WHERE txid IN (
+                        SELECT txid FROM transactions
+                        WHERE txid = :txid AND expiry_height < :chain_tip_minus_lookahead
+                    )",
+                    named_params![
+                        ":txid": txid.as_ref(),
+                        ":chain_tip_minus_lookahead": u32::from(chain_tip).saturating_sub(VERIFY_LOOKAHEAD)
+                    ],
+                )?;
+            }
+        }
+        TransactionStatus::Mined(height) => {
+            // The transaction has been mined, so we can set its mined height, associate it with
+            // the appropriate block, and remove it from the retrieval queue.
+            let sql_args = named_params![
+                ":txid": txid.as_ref(),
+                ":height": u32::from(height)
+            ];
+
+            conn.execute(
+                "UPDATE transactions
+                 SET mined_height = :height
+                 WHERE txid = :txid",
+                sql_args,
+            )?;
+
+            conn.execute(
+                "UPDATE transactions
+                 SET block = blocks.height
+                 FROM blocks
+                 WHERE txid = :txid
+                 AND blocks.height = :height",
+                sql_args,
+            )?;
+
+            notify_tx_retrieved(conn, txid)?;
+        }
+    }
+
+    Ok(())
+}
+
+/// Truncates the database to at most the given height.
 ///
 /// If the requested height is greater than or equal to the height of the last scanned
 /// block, this function does nothing.
 ///
 /// This should only be executed inside a transactional context.
+///
+/// Returns the block height to which the database was truncated.
 pub(crate) fn truncate_to_height<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    block_height: BlockHeight,
-) -> Result<(), SqliteClientError> {
-    let sapling_activation_height = wdb
-        .params
-        .activation_height(NetworkUpgrade::Sapling)
-        .expect("Sapling activation height mutst be available.");
-
-    // Recall where we synced up to previously.
-    let last_scanned_height = wdb
-        .conn
-        .query_row("SELECT MAX(height) FROM blocks", [], |row| {
-            row.get(0)
-                .map(|h: u32| h.into())
-                .or_else(|_| Ok(sapling_activation_height - 1))
+    conn: &rusqlite::Transaction,
+    params: &P,
+    max_height: BlockHeight,
+) -> Result<BlockHeight, SqliteClientError> {
+    // Determine a checkpoint to which we can rewind, if any.
+    #[cfg(not(feature = "orchard"))]
+    let truncation_height_query = r#"
+        SELECT MAX(height) FROM blocks
+        JOIN sapling_tree_checkpoints ON checkpoint_id = blocks.height
+        WHERE blocks.height <= :block_height
+    "#;
+
+    #[cfg(feature = "orchard")]
+    let truncation_height_query = r#"
+        SELECT MAX(height) FROM blocks
+        JOIN sapling_tree_checkpoints sc ON sc.checkpoint_id = blocks.height
+        JOIN orchard_tree_checkpoints oc ON oc.checkpoint_id = blocks.height
+        WHERE blocks.height <= :block_height
+    "#;
+
+    let truncation_height = conn
+        .query_row(
+            truncation_height_query,
+            named_params! {":block_height": u32::from(max_height)},
+            |row| row.get::<_, Option<u32>>(0),
+        )
+        .optional()?
+        .flatten()
+        .map_or_else(
+            || {
+                // If we don't have a checkpoint at a height less than or equal to the requested
+                // truncation height, query for the minimum height to which it's possible for us to
+                // truncate so that we can report it to the caller.
+                #[cfg(not(feature = "orchard"))]
+                let min_checkpoint_height_query =
+                    "SELECT MIN(checkpoint_id) FROM sapling_tree_checkpoints";
+                #[cfg(feature = "orchard")]
+                let min_checkpoint_height_query = "SELECT MIN(sc.checkpoint_id)
+                     FROM sapling_tree_checkpoints sc
+                     JOIN orchard_tree_checkpoints oc
+                     ON oc.checkpoint_id = sc.checkpoint_id";
+
+                let min_truncation_height = conn
+                    .query_row(min_checkpoint_height_query, [], |row| {
+                        row.get::<_, Option<u32>>(0)
+                    })
+                    .optional()?
+                    .flatten()
+                    .map(BlockHeight::from);
+
+                Err(SqliteClientError::RequestedRewindInvalid {
+                    safe_rewind_height: min_truncation_height,
+                    requested_height: max_height,
+                })
+            },
+            |h| Ok(BlockHeight::from(h)),
+        )?;
+
+    let last_scanned_height = conn.query_row("SELECT MAX(height) FROM blocks", [], |row| {
+        let h = row.get::<_, Option<u32>>(0)?;
+
+        Ok(h.map_or_else(
+            || {
+                params
+                    .activation_height(NetworkUpgrade::Sapling)
+                    .expect("Sapling activation height must be available.")
+                    - 1
+            },
+            BlockHeight::from,
+        ))
+    })?;
+
+    // Delete from the scanning queue any range with a start height greater than the
+    // truncation height, and then truncate any remaining range by setting the end
+    // equal to the truncation height + 1. This sets our view of the chain tip back
+    // to the retained height.
+    conn.execute(
+        "DELETE FROM scan_queue
+        WHERE block_range_start >= :new_end_height",
+        named_params![":new_end_height": u32::from(truncation_height + 1)],
+    )?;
+    conn.execute(
+        "UPDATE scan_queue
+        SET block_range_end = :new_end_height
+        WHERE block_range_end > :new_end_height",
+        named_params![":new_end_height": u32::from(truncation_height + 1)],
+    )?;
+
+    // Mark transparent utxos as un-mined. Since the TXO is now not mined, it would ideally be
+    // considered to have been returned to the mempool; it _might_ be spendable in this state, but
+    // we must also set its max_observed_unspent_height field to NULL because the transaction may
+    // be rendered entirely invalid by a reorg that alters anchor(s) used in constructing shielded
+    // spends in the transaction.
+    conn.execute(
+        "UPDATE transparent_received_outputs
+         SET max_observed_unspent_height = CASE WHEN tx.mined_height <= :height THEN :height ELSE NULL END
+         FROM transactions tx
+         WHERE tx.id_tx = transaction_id
+         AND max_observed_unspent_height > :height",
+        named_params![":height": u32::from(truncation_height)],
+    )?;
+
+    // Un-mine transactions. This must be done outside of the last_scanned_height check because
+    // transaction entries may be created as a consequence of receiving transparent TXOs.
+    conn.execute(
+        "UPDATE transactions
+         SET block = NULL, mined_height = NULL, tx_index = NULL
+         WHERE mined_height > :height",
+        named_params![":height": u32::from(truncation_height)],
+    )?;
+
+    // If we're removing scanned blocks, we need to truncate the note commitment tree and remove
+    // affected block records from the database.
+    if truncation_height < last_scanned_height {
+        // Truncate the note commitment trees
+        let mut wdb = WalletDb {
+            conn: SqlTransaction(conn),
+            params: params.clone(),
+        };
+        wdb.with_sapling_tree_mut(|tree| {
+            tree.truncate_to_checkpoint(&truncation_height)?;
+            Ok::<_, SqliteClientError>(())
+        })?;
+        #[cfg(feature = "orchard")]
+        wdb.with_orchard_tree_mut(|tree| {
+            tree.truncate_to_checkpoint(&truncation_height)?;
+            Ok::<_, SqliteClientError>(())
         })?;
 
-    if block_height < last_scanned_height - PRUNING_HEIGHT {
-        if let Some(h) = get_min_unspent_height(wdb)? {
-            if block_height > h {
-                return Err(SqliteClientError::RequestedRewindInvalid(h, block_height));
-            }
-        }
-    }
+        // Do not delete sent notes; this can contain data that is not recoverable
+        // from the chain. Wallets must continue to operate correctly in the
+        // presence of stale sent notes that link to unmined transactions.
+        // Also, do not delete received notes; they may contain memo data that is
+        // not recoverable; balance APIs must ensure that un-mined received notes
+        // do not count towards spendability or transaction balalnce.
 
-    // nothing to do if we're deleting back down to the max height
-    if block_height < last_scanned_height {
-        // Decrement witnesses.
-        wdb.conn.execute(
-            "DELETE FROM sapling_witnesses WHERE block > ?",
-            [u32::from(block_height)],
+        // Now that they aren't depended on, delete un-mined blocks.
+        conn.execute(
+            "DELETE FROM blocks WHERE height > ?",
+            [u32::from(truncation_height)],
         )?;
 
-        // Rewind received notes
-        wdb.conn.execute(
-            "DELETE FROM sapling_received_notes
-                WHERE id_note IN (
-                    SELECT rn.id_note
-                    FROM sapling_received_notes rn
-                    LEFT OUTER JOIN transactions tx
-                    ON tx.id_tx = rn.tx
-                    WHERE tx.block IS NOT NULL AND tx.block > ?
-                );",
-            [u32::from(block_height)],
+        // Delete from the nullifier map any entries with a locator referencing a block
+        // height greater than the truncation height.
+        conn.execute(
+            "DELETE FROM tx_locator_map
+            WHERE block_height > :block_height",
+            named_params![":block_height": u32::from(truncation_height)],
         )?;
+    }
+
+    Ok(truncation_height)
+}
+
+/// Returns a vector with the IDs of all accounts known to this wallet.
+///
+/// Note that this is called from db migration code.
+pub(crate) fn get_account_ids(
+    conn: &rusqlite::Connection,
+) -> Result<Vec<AccountUuid>, rusqlite::Error> {
+    let mut stmt = conn.prepare("SELECT uuid FROM accounts")?;
+    let mut rows = stmt.query([])?;
+    let mut result = Vec::new();
+    while let Some(row) = rows.next()? {
+        let id = AccountUuid(row.get(0)?);
+        result.push(id);
+    }
+    Ok(result)
+}
+
+/// Inserts information about a scanned block into the database.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn put_block(
+    conn: &rusqlite::Transaction<'_>,
+    block_height: BlockHeight,
+    block_hash: BlockHash,
+    block_time: u32,
+    sapling_commitment_tree_size: u32,
+    sapling_output_count: u32,
+    #[cfg(feature = "orchard")] orchard_commitment_tree_size: u32,
+    #[cfg(feature = "orchard")] orchard_action_count: u32,
+) -> Result<(), SqliteClientError> {
+    let block_hash_data = conn
+        .query_row(
+            "SELECT hash FROM blocks WHERE height = ?",
+            [u32::from(block_height)],
+            |row| row.get::<_, Vec<u8>>(0),
+        )
+        .optional()?;
 
-        // Do not delete sent notes; this can contain data that is not recoverable
-        // from the chain. Wallets must continue to operate correctly in the
-        // presence of stale sent notes that link to unmined transactions.
+    // Ensure that in the case of an upsert, we don't overwrite block data
+    // with information for a block with a different hash.
+    if let Some(bytes) = block_hash_data {
+        let expected_hash = BlockHash::try_from_slice(&bytes).ok_or_else(|| {
+            SqliteClientError::CorruptedData(format!(
+                "Invalid block hash at height {}",
+                u32::from(block_height)
+            ))
+        })?;
+        if expected_hash != block_hash {
+            return Err(SqliteClientError::BlockConflict(block_height));
+        }
+    }
 
-        // Rewind utxos
-        wdb.conn.execute(
-            "DELETE FROM utxos WHERE height > ?",
-            [u32::from(block_height)],
-        )?;
+    let mut stmt_upsert_block = conn.prepare_cached(
+        "INSERT INTO blocks (
+            height,
+            hash,
+            time,
+            sapling_commitment_tree_size,
+            sapling_output_count,
+            sapling_tree,
+            orchard_commitment_tree_size,
+            orchard_action_count
+        )
+        VALUES (
+            :height,
+            :hash,
+            :block_time,
+            :sapling_commitment_tree_size,
+            :sapling_output_count,
+            x'00',
+            :orchard_commitment_tree_size,
+            :orchard_action_count
+        )
+        ON CONFLICT (height) DO UPDATE
+        SET hash = :hash,
+            time = :block_time,
+            sapling_commitment_tree_size = :sapling_commitment_tree_size,
+            sapling_output_count = :sapling_output_count,
+            orchard_commitment_tree_size = :orchard_commitment_tree_size,
+            orchard_action_count = :orchard_action_count",
+    )?;
 
-        // Un-mine transactions.
-        wdb.conn.execute(
-            "UPDATE transactions SET block = NULL, tx_index = NULL WHERE block IS NOT NULL AND block > ?",
-            [u32::from(block_height)],
-        )?;
+    #[cfg(not(feature = "orchard"))]
+    let orchard_commitment_tree_size: Option<u32> = None;
+    #[cfg(not(feature = "orchard"))]
+    let orchard_action_count: Option<u32> = None;
+
+    stmt_upsert_block.execute(named_params![
+        ":height": u32::from(block_height),
+        ":hash": &block_hash.0[..],
+        ":block_time": block_time,
+        ":sapling_commitment_tree_size": sapling_commitment_tree_size,
+        ":sapling_output_count": sapling_output_count,
+        ":orchard_commitment_tree_size": orchard_commitment_tree_size,
+        ":orchard_action_count": orchard_action_count,
+    ])?;
+
+    // If we now have a block corresponding to a received transparent output that had not been
+    // scanned at the time the UTXO was discovered, update the associated transaction record to
+    // refer to that block.
+    //
+    // NOTE: There's a small data corruption hazard here, in that we're relying exclusively upon
+    // the block height to associate the transaction to the block. This is because CompactBlock
+    // values only contain CompactTx entries for transactions that contain shielded inputs or
+    // outputs, and the GetAddressUtxosReply data does not contain the block hash. As such, it's
+    // necessary to ensure that any chain rollback to below the received height causes that height
+    // to be set to NULL.
+    let mut stmt_update_transaction_block_reference = conn.prepare_cached(
+        "UPDATE transactions
+         SET block = :height
+         WHERE mined_height = :height",
+    )?;
 
-        // Now that they aren't depended on, delete scanned blocks.
-        wdb.conn.execute(
-            "DELETE FROM blocks WHERE height > ?",
-            [u32::from(block_height)],
-        )?;
-    }
+    stmt_update_transaction_block_reference
+        .execute(named_params![":height": u32::from(block_height),])?;
 
     Ok(())
 }
 
-/// Returns unspent transparent outputs that have been received by this wallet at the given
-/// transparent address, such that the block that included the transaction was mined at a
-/// height less than or equal to the provided `max_height`.
-#[cfg(feature = "transparent-inputs")]
-pub(crate) fn get_unspent_transparent_outputs<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    address: &TransparentAddress,
-    max_height: BlockHeight,
-    exclude: &[OutPoint],
-) -> Result<Vec<WalletTransparentOutput>, SqliteClientError> {
-    let mut stmt_blocks = wdb.conn.prepare(
-        "SELECT u.prevout_txid, u.prevout_idx, u.script,
-                u.value_zat, u.height, tx.block as block
-         FROM utxos u
-         LEFT OUTER JOIN transactions tx
-         ON tx.id_tx = u.spent_in_tx
-         WHERE u.address = ?
-         AND u.height <= ?
-         AND tx.block IS NULL",
-    )?;
-
-    let addr_str = address.encode(&wdb.params);
+pub(crate) fn store_decrypted_tx<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    d_tx: DecryptedTransaction<AccountUuid>,
+) -> Result<(), SqliteClientError> {
+    let tx_ref = put_tx_data(conn, d_tx.tx(), None, None, None)?;
+    if let Some(height) = d_tx.mined_height() {
+        set_transaction_status(conn, d_tx.tx().txid(), TransactionStatus::Mined(height))?;
+    }
 
-    let mut utxos = Vec::<WalletTransparentOutput>::new();
-    let mut rows = stmt_blocks.query(params![addr_str, u32::from(max_height)])?;
-    let excluded: BTreeSet<OutPoint> = exclude.iter().cloned().collect();
-    while let Some(row) = rows.next()? {
-        let txid: Vec<u8> = row.get(0)?;
-        let mut txid_bytes = [0u8; 32];
-        txid_bytes.copy_from_slice(&txid);
-
-        let index: u32 = row.get(1)?;
-        let script_pubkey = Script(row.get(2)?);
-        let value = Amount::from_i64(row.get(3)?).unwrap();
-        let height: u32 = row.get(4)?;
-
-        let outpoint = OutPoint::new(txid_bytes, index);
-        if excluded.contains(&outpoint) {
-            continue;
-        }
+    let funding_accounts = get_funding_accounts(conn, d_tx.tx())?;
 
-        let output = WalletTransparentOutput::from_parts(
-            outpoint,
-            TxOut {
-                value,
-                script_pubkey,
-            },
-            BlockHeight::from(height),
+    // TODO(#1305): Correctly track accounts that fund each transaction output.
+    let funding_account = funding_accounts.iter().next().copied();
+    if funding_accounts.len() > 1 {
+        warn!(
+            "More than one wallet account detected as funding transaction {:?}, selecting {:?}",
+            d_tx.tx().txid(),
+            funding_account.unwrap()
         )
-        .ok_or_else(|| {
-            SqliteClientError::CorruptedData(
-                "Txout script_pubkey value did not correspond to a P2PKH or P2SH address"
-                    .to_string(),
-            )
-        })?;
+    }
+
+    // A flag used to determine whether it is necessary to query for transactions that
+    // provided transparent inputs to this transaction, in order to be able to correctly
+    // recover transparent transaction history.
+    #[cfg(feature = "transparent-inputs")]
+    let mut tx_has_wallet_outputs = false;
 
-        utxos.push(output);
+    for output in d_tx.sapling_outputs() {
+        #[cfg(feature = "transparent-inputs")]
+        {
+            tx_has_wallet_outputs = true;
+        }
+        match output.transfer_type() {
+            TransferType::Outgoing => {
+                let recipient = {
+                    let receiver = Receiver::Sapling(output.note().recipient());
+                    let wallet_address =
+                        select_receiving_address(params, conn, *output.account(), &receiver)?
+                            .unwrap_or_else(|| receiver.to_zcash_address(params.network_type()));
+
+                    Recipient::External(wallet_address, PoolType::SAPLING)
+                };
+
+                put_sent_output(
+                    conn,
+                    params,
+                    *output.account(),
+                    tx_ref,
+                    output.index(),
+                    &recipient,
+                    output.note_value(),
+                    Some(output.memo()),
+                )?;
+            }
+            TransferType::WalletInternal => {
+                sapling::put_received_note(conn, output, tx_ref, None)?;
+
+                let recipient = Recipient::InternalAccount {
+                    receiving_account: *output.account(),
+                    external_address: None,
+                    note: Note::Sapling(output.note().clone()),
+                };
+
+                put_sent_output(
+                    conn,
+                    params,
+                    *output.account(),
+                    tx_ref,
+                    output.index(),
+                    &recipient,
+                    output.note_value(),
+                    Some(output.memo()),
+                )?;
+            }
+            TransferType::Incoming => {
+                sapling::put_received_note(conn, output, tx_ref, None)?;
+
+                if let Some(account_id) = funding_account {
+                    let recipient = Recipient::InternalAccount {
+                        receiving_account: *output.account(),
+                        external_address: {
+                            let receiver = Receiver::Sapling(output.note().recipient());
+                            Some(
+                                select_receiving_address(
+                                    params,
+                                    conn,
+                                    *output.account(),
+                                    &receiver,
+                                )?
+                                .unwrap_or_else(|| {
+                                    receiver.to_zcash_address(params.network_type())
+                                }),
+                            )
+                        },
+                        note: Note::Sapling(output.note().clone()),
+                    };
+
+                    put_sent_output(
+                        conn,
+                        params,
+                        account_id,
+                        tx_ref,
+                        output.index(),
+                        &recipient,
+                        output.note_value(),
+                        Some(output.memo()),
+                    )?;
+                }
+            }
+        }
     }
 
-    Ok(utxos)
-}
+    #[cfg(feature = "orchard")]
+    for output in d_tx.orchard_outputs() {
+        #[cfg(feature = "transparent-inputs")]
+        {
+            tx_has_wallet_outputs = true;
+        }
+        match output.transfer_type() {
+            TransferType::Outgoing => {
+                let recipient = {
+                    let receiver = Receiver::Orchard(output.note().recipient());
+                    let wallet_address =
+                        select_receiving_address(params, conn, *output.account(), &receiver)?
+                            .unwrap_or_else(|| receiver.to_zcash_address(params.network_type()));
+
+                    Recipient::External(wallet_address, PoolType::ORCHARD)
+                };
+
+                put_sent_output(
+                    conn,
+                    params,
+                    *output.account(),
+                    tx_ref,
+                    output.index(),
+                    &recipient,
+                    output.note_value(),
+                    Some(output.memo()),
+                )?;
+            }
+            TransferType::WalletInternal => {
+                orchard::put_received_note(conn, output, tx_ref, None)?;
+
+                let recipient = Recipient::InternalAccount {
+                    receiving_account: *output.account(),
+                    external_address: None,
+                    note: Note::Orchard(*output.note()),
+                };
+
+                put_sent_output(
+                    conn,
+                    params,
+                    *output.account(),
+                    tx_ref,
+                    output.index(),
+                    &recipient,
+                    output.note_value(),
+                    Some(output.memo()),
+                )?;
+            }
+            TransferType::Incoming => {
+                orchard::put_received_note(conn, output, tx_ref, None)?;
+
+                if let Some(account_id) = funding_account {
+                    // Even if the recipient address is external, record the send as internal.
+                    let recipient = Recipient::InternalAccount {
+                        receiving_account: *output.account(),
+                        external_address: {
+                            let receiver = Receiver::Orchard(output.note().recipient());
+                            Some(
+                                select_receiving_address(
+                                    params,
+                                    conn,
+                                    *output.account(),
+                                    &receiver,
+                                )?
+                                .unwrap_or_else(|| {
+                                    receiver.to_zcash_address(params.network_type())
+                                }),
+                            )
+                        },
+                        note: Note::Orchard(*output.note()),
+                    };
+
+                    put_sent_output(
+                        conn,
+                        params,
+                        account_id,
+                        tx_ref,
+                        output.index(),
+                        &recipient,
+                        output.note_value(),
+                        Some(output.memo()),
+                    )?;
+                }
+            }
+        }
+    }
 
-/// Returns the unspent balance for each transparent address associated with the specified account,
-/// such that the block that included the transaction was mined at a height less than or equal to
-/// the provided `max_height`.
-#[cfg(feature = "transparent-inputs")]
-pub(crate) fn get_transparent_balances<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-    max_height: BlockHeight,
-) -> Result<HashMap<TransparentAddress, Amount>, SqliteClientError> {
-    let mut stmt_blocks = wdb.conn.prepare(
-        "SELECT u.address, SUM(u.value_zat)
-         FROM utxos u
-         LEFT OUTER JOIN transactions tx
-         ON tx.id_tx = u.spent_in_tx
-         WHERE u.received_by_account = ?
-         AND u.height <= ?
-         AND tx.block IS NULL
-         GROUP BY u.address",
-    )?;
+    // If any of the utxos spent in the transaction are ours, mark them as spent.
+    #[cfg(feature = "transparent-inputs")]
+    for txin in d_tx
+        .tx()
+        .transparent_bundle()
+        .iter()
+        .flat_map(|b| b.vin.iter())
+    {
+        transparent::mark_transparent_utxo_spent(conn, tx_ref, &txin.prevout)?;
+    }
 
-    let mut res = HashMap::new();
-    let mut rows = stmt_blocks.query(params![u32::from(account), u32::from(max_height)])?;
-    while let Some(row) = rows.next()? {
-        let taddr_str: String = row.get(0)?;
-        let taddr = TransparentAddress::decode(&wdb.params, &taddr_str)?;
-        let value = Amount::from_i64(row.get(1)?).unwrap();
+    // This `if` is just an optimization for cases where we would do nothing in the loop.
+    if funding_account.is_some() || cfg!(feature = "transparent-inputs") {
+        for (output_index, txout) in d_tx
+            .tx()
+            .transparent_bundle()
+            .iter()
+            .flat_map(|b| b.vout.iter())
+            .enumerate()
+        {
+            if let Some(address) = txout.recipient_address() {
+                debug!(
+                    "{:?} output {} has recipient {}",
+                    d_tx.tx().txid(),
+                    output_index,
+                    address.encode(params)
+                );
+
+                // The transaction is not necessarily mined yet, but we want to record
+                // that an output to the address was seen in this tx anyway. This will
+                // advance the gap regardless of whether it is mined, but an output in
+                // an unmined transaction won't advance the range of safe indices.
+                #[cfg(feature = "transparent-inputs")]
+                transparent::ephemeral::mark_ephemeral_address_as_seen(
+                    conn, params, &address, tx_ref,
+                )?;
+
+                // If the output belongs to the wallet, add it to `transparent_received_outputs`.
+                #[cfg(feature = "transparent-inputs")]
+                if let Some(account_uuid) =
+                    transparent::find_account_uuid_for_transparent_address(conn, params, &address)?
+                {
+                    debug!(
+                        "{:?} output {} belongs to account {:?}",
+                        d_tx.tx().txid(),
+                        output_index,
+                        account_uuid
+                    );
+                    transparent::put_transparent_output(
+                        conn,
+                        params,
+                        &OutPoint::new(
+                            d_tx.tx().txid().into(),
+                            u32::try_from(output_index).unwrap(),
+                        ),
+                        txout,
+                        d_tx.mined_height(),
+                        &address,
+                        account_uuid,
+                        false,
+                    )?;
+
+                    // Since the wallet created the transparent output, we need to ensure
+                    // that any transparent inputs belonging to the wallet will be
+                    // discovered.
+                    tx_has_wallet_outputs = true;
+
+                    // When we receive transparent funds (particularly as ephemeral outputs
+                    // in transaction pairs sending to a ZIP 320 address) it becomes
+                    // possible that the spend of these outputs is not then later detected
+                    // if the transaction that spends them is purely transparent. This is
+                    // especially a problem in wallet recovery.
+                    transparent::queue_transparent_spend_detection(
+                        conn,
+                        params,
+                        address,
+                        tx_ref,
+                        output_index.try_into().unwrap(),
+                    )?;
+                } else {
+                    debug!(
+                        "Address {} is not recognized as belonging to any of our accounts.",
+                        address.encode(params)
+                    );
+                }
+
+                // If a transaction we observe contains spends from our wallet, we will
+                // store its transparent outputs in the same way they would be stored by
+                // create_spend_to_address.
+                if let Some(account_uuid) = funding_account {
+                    let receiver = Receiver::Transparent(address);
+
+                    #[cfg(feature = "transparent-inputs")]
+                    let recipient_addr =
+                        select_receiving_address(params, conn, account_uuid, &receiver)?
+                            .unwrap_or_else(|| receiver.to_zcash_address(params.network_type()));
+
+                    #[cfg(not(feature = "transparent-inputs"))]
+                    let recipient_addr = receiver.to_zcash_address(params.network_type());
+
+                    let recipient = Recipient::External(recipient_addr, PoolType::TRANSPARENT);
+
+                    put_sent_output(
+                        conn,
+                        params,
+                        account_uuid,
+                        tx_ref,
+                        output_index,
+                        &recipient,
+                        txout.value,
+                        None,
+                    )?;
+
+                    // Even though we know the funding account, we don't know that we have
+                    // information for all of the transparent inputs to the transaction.
+                    #[cfg(feature = "transparent-inputs")]
+                    {
+                        tx_has_wallet_outputs = true;
+                    }
+                }
+            } else {
+                warn!(
+                    "Unable to determine recipient address for tx {:?} output {}",
+                    d_tx.tx().txid(),
+                    output_index
+                );
+            }
+        }
+    }
 
-        res.insert(taddr, value);
+    // If the transaction has outputs that belong to the wallet as well as transparent
+    // inputs, we may need to download the transactions corresponding to the transparent
+    // prevout references to determine whether the transaction was created (at least in
+    // part) by this wallet.
+    #[cfg(feature = "transparent-inputs")]
+    if tx_has_wallet_outputs {
+        queue_transparent_input_retrieval(conn, tx_ref, &d_tx)?
     }
 
-    Ok(res)
-}
+    notify_tx_retrieved(conn, d_tx.tx().txid())?;
 
-/// Inserts information about a scanned block into the database.
-pub(crate) fn insert_block<'a, P>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    block_height: BlockHeight,
-    block_hash: BlockHash,
-    block_time: u32,
-    commitment_tree: &CommitmentTree,
-) -> Result<(), SqliteClientError> {
-    stmts.stmt_insert_block(block_height, block_hash, block_time, commitment_tree)
+    // If the decrypted transaction is unmined and has no shielded components, add it to
+    // the queue for status retrieval.
+    #[cfg(feature = "transparent-inputs")]
+    queue_unmined_tx_retrieval(conn, &d_tx)?;
+
+    Ok(())
 }
 
 /// Inserts information about a mined transaction that was observed to
 /// contain a note related to this wallet into the database.
-pub(crate) fn put_tx_meta<'a, P, N>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    tx: &WalletTx<N>,
+pub(crate) fn put_tx_meta(
+    conn: &rusqlite::Connection,
+    tx: &WalletTx<AccountUuid>,
     height: BlockHeight,
-) -> Result<i64, SqliteClientError> {
-    if !stmts.stmt_update_tx_meta(height, tx.index, &tx.txid)? {
-        // It isn't there, so insert our transaction into the database.
-        stmts.stmt_insert_tx_meta(&tx.txid, height, tx.index)
-    } else {
-        // It was there, so grab its row number.
-        stmts.stmt_select_tx_ref(&tx.txid)
+) -> Result<TxRef, SqliteClientError> {
+    // It isn't there, so insert our transaction into the database.
+    let mut stmt_upsert_tx_meta = conn.prepare_cached(
+        "INSERT INTO transactions (txid, block, mined_height, tx_index)
+        VALUES (:txid, :block, :block, :tx_index)
+        ON CONFLICT (txid) DO UPDATE
+        SET block = :block,
+            mined_height = :block,
+            tx_index = :tx_index
+        RETURNING id_tx",
+    )?;
+
+    let txid_bytes = tx.txid();
+    let tx_params = named_params![
+        ":txid": &txid_bytes.as_ref()[..],
+        ":block": u32::from(height),
+        ":tx_index": i64::try_from(tx.block_index()).expect("transaction indices are representable as i64"),
+    ];
+
+    stmt_upsert_tx_meta
+        .query_row(tx_params, |row| row.get::<_, i64>(0).map(TxRef))
+        .map_err(SqliteClientError::from)
+}
+
+/// Returns the most likely wallet address that corresponds to the protocol-level receiver of a
+/// note or UTXO.
+pub(crate) fn select_receiving_address<P: consensus::Parameters>(
+    _params: &P,
+    conn: &rusqlite::Connection,
+    account: AccountUuid,
+    receiver: &Receiver,
+) -> Result<Option<ZcashAddress>, SqliteClientError> {
+    match receiver {
+        #[cfg(feature = "transparent-inputs")]
+        Receiver::Transparent(taddr) => conn
+            .query_row(
+                "SELECT address
+                 FROM addresses
+                 WHERE cached_transparent_receiver_address = :taddr",
+                named_params! {
+                    ":taddr": Address::Transparent(*taddr).encode(_params)
+                },
+                |row| row.get::<_, String>(0),
+            )
+            .optional()?
+            .map(|addr_str| addr_str.parse::<ZcashAddress>())
+            .transpose()
+            .map_err(SqliteClientError::from),
+        receiver => {
+            let mut stmt = conn.prepare_cached(
+                "SELECT address
+                 FROM addresses
+                 JOIN accounts ON accounts.id = addresses.account_id
+                 WHERE accounts.uuid = :account_uuid",
+            )?;
+
+            let mut result = stmt.query(named_params! { ":account_uuid": account.0 })?;
+            while let Some(row) = result.next()? {
+                let addr_str = row.get::<_, String>(0)?;
+                let decoded = addr_str.parse::<ZcashAddress>()?;
+                if receiver.corresponds(&decoded) {
+                    return Ok(Some(decoded));
+                }
+            }
+
+            Ok(None)
+        }
     }
 }
 
 /// Inserts full transaction data into the database.
-pub(crate) fn put_tx_data<'a, P>(
-    stmts: &mut DataConnStmtCache<'a, P>,
+pub(crate) fn put_tx_data(
+    conn: &rusqlite::Connection,
     tx: &Transaction,
-    fee: Option<Amount>,
+    fee: Option<NonNegativeAmount>,
     created_at: Option<time::OffsetDateTime>,
-) -> Result<i64, SqliteClientError> {
-    let txid = tx.txid();
+    target_height: Option<BlockHeight>,
+) -> Result<TxRef, SqliteClientError> {
+    let mut stmt_upsert_tx_data = conn.prepare_cached(
+        "INSERT INTO transactions (txid, created, expiry_height, raw, fee, target_height)
+        VALUES (:txid, :created_at, :expiry_height, :raw, :fee, :target_height)
+        ON CONFLICT (txid) DO UPDATE
+        SET expiry_height = :expiry_height,
+            raw = :raw,
+            fee = IFNULL(:fee, fee)
+        RETURNING id_tx",
+    )?;
 
+    let txid = tx.txid();
     let mut raw_tx = vec![];
     tx.write(&mut raw_tx)?;
 
-    if !stmts.stmt_update_tx_data(tx.expiry_height(), &raw_tx, fee, &txid)? {
-        // It isn't there, so insert our transaction into the database.
-        stmts.stmt_insert_tx_data(&txid, created_at, tx.expiry_height(), &raw_tx, fee)
-    } else {
-        // It was there, so grab its row number.
-        stmts.stmt_select_tx_ref(&txid)
+    let tx_params = named_params![
+        ":txid": &txid.as_ref()[..],
+        ":created_at": created_at,
+        ":expiry_height": u32::from(tx.expiry_height()),
+        ":raw": raw_tx,
+        ":fee": fee.map(u64::from),
+        ":target_height": target_height.map(u32::from),
+    ];
+
+    stmt_upsert_tx_data
+        .query_row(tx_params, |row| row.get::<_, i64>(0).map(TxRef))
+        .map_err(SqliteClientError::from)
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum TxQueryType {
+    Status,
+    Enhancement,
+}
+
+impl TxQueryType {
+    pub(crate) fn code(&self) -> i64 {
+        match self {
+            TxQueryType::Status => 0,
+            TxQueryType::Enhancement => 1,
+        }
+    }
+
+    pub(crate) fn from_code(code: i64) -> Option<Self> {
+        match code {
+            0 => Some(TxQueryType::Status),
+            1 => Some(TxQueryType::Enhancement),
+            _ => None,
+        }
     }
 }
 
-/// Marks the given UTXO as having been spent.
 #[cfg(feature = "transparent-inputs")]
-pub(crate) fn mark_transparent_utxo_spent<'a, P>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    tx_ref: i64,
-    outpoint: &OutPoint,
+pub(crate) fn queue_transparent_input_retrieval<AccountId>(
+    conn: &rusqlite::Transaction<'_>,
+    tx_ref: TxRef,
+    d_tx: &DecryptedTransaction<'_, AccountId>,
 ) -> Result<(), SqliteClientError> {
-    stmts.stmt_mark_transparent_utxo_spent(tx_ref, outpoint)?;
+    if let Some(b) = d_tx.tx().transparent_bundle() {
+        // queue the transparent inputs for enhancement
+        queue_tx_retrieval(
+            conn,
+            b.vin.iter().map(|txin| *txin.prevout.txid()),
+            Some(tx_ref),
+        )?;
+    }
 
     Ok(())
 }
 
-/// Adds the given received UTXO to the datastore.
 #[cfg(feature = "transparent-inputs")]
-pub(crate) fn put_received_transparent_utxo<'a, P: consensus::Parameters>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    output: &WalletTransparentOutput,
-) -> Result<UtxoId, SqliteClientError> {
-    stmts
-        .stmt_update_received_transparent_utxo(output)
-        .transpose()
-        .or_else(|| {
-            stmts
-                .stmt_insert_received_transparent_utxo(output)
-                .transpose()
-        })
-        .unwrap_or_else(|| {
-            // This could occur if the UTXO is received at the legacy transparent
-            // address, in which case the join to the `addresses` table will fail.
-            // In this case, we should look up the legacy address for account 0 and
-            // check whether it matches the address for the received UTXO, and if
-            // so then insert/update it directly.
-            let account = AccountId::from(0u32);
-            get_legacy_transparent_address(&stmts.wallet_db.params, &stmts.wallet_db.conn, account)
-                .and_then(|legacy_taddr| {
-                    if legacy_taddr
-                        .iter()
-                        .any(|(taddr, _)| taddr == output.recipient_address())
-                    {
-                        stmts
-                            .stmt_update_legacy_transparent_utxo(output, account)
-                            .transpose()
-                            .unwrap_or_else(|| {
-                                stmts.stmt_insert_legacy_transparent_utxo(output, account)
-                            })
-                    } else {
-                        Err(SqliteClientError::AddressNotRecognized(
-                            *output.recipient_address(),
-                        ))
-                    }
-                })
-        })
+pub(crate) fn queue_unmined_tx_retrieval<AccountId>(
+    conn: &rusqlite::Transaction<'_>,
+    d_tx: &DecryptedTransaction<'_, AccountId>,
+) -> Result<(), SqliteClientError> {
+    let detectable_via_scanning = d_tx.tx().sapling_bundle().is_some();
+    #[cfg(feature = "orchard")]
+    let detectable_via_scanning = detectable_via_scanning | d_tx.tx().orchard_bundle().is_some();
+
+    if d_tx.mined_height().is_none() && !detectable_via_scanning {
+        queue_tx_retrieval(conn, std::iter::once(d_tx.tx().txid()), None)?
+    }
+
+    Ok(())
 }
 
-/// Removes old incremental witnesses up to the given block height.
-pub(crate) fn prune_witnesses<P>(
-    stmts: &mut DataConnStmtCache<'_, P>,
-    below_height: BlockHeight,
+pub(crate) fn queue_tx_retrieval(
+    conn: &rusqlite::Transaction<'_>,
+    txids: impl Iterator<Item = TxId>,
+    dependent_tx_ref: Option<TxRef>,
 ) -> Result<(), SqliteClientError> {
-    stmts.stmt_prune_witnesses(below_height)
+    // Add an entry to the transaction retrieval queue if it would not be redundant.
+    let mut stmt_insert_tx = conn.prepare_cached(
+        "INSERT INTO tx_retrieval_queue (txid, query_type, dependent_transaction_id)
+            SELECT
+            :txid,
+            IIF(
+                EXISTS (SELECT 1 FROM transactions WHERE txid = :txid AND raw IS NOT NULL),
+                :status_type,
+                :enhancement_type
+            ),
+            :dependent_transaction_id
+        ON CONFLICT (txid) DO UPDATE
+        SET query_type =
+            IIF(
+                EXISTS (SELECT 1 FROM transactions WHERE txid = :txid AND raw IS NOT NULL),
+                :status_type,
+                :enhancement_type
+            ),
+            dependent_transaction_id = IFNULL(:dependent_transaction_id, dependent_transaction_id)",
+    )?;
+
+    for txid in txids {
+        stmt_insert_tx.execute(named_params! {
+            ":txid": txid.as_ref(),
+            ":status_type": TxQueryType::Status.code(),
+            ":enhancement_type": TxQueryType::Enhancement.code(),
+            ":dependent_transaction_id": dependent_tx_ref.map(|r| r.0),
+        })?;
+    }
+
+    Ok(())
 }
 
-/// Marks notes that have not been mined in transactions
-/// as expired, up to the given block height.
-pub(crate) fn update_expired_notes<P>(
-    stmts: &mut DataConnStmtCache<'_, P>,
-    height: BlockHeight,
+/// Returns the vector of [`TransactionDataRequest`]s that represents the information needed by the
+/// wallet backend in order to be able to present a complete view of wallet history and memo data.
+pub(crate) fn transaction_data_requests(
+    conn: &rusqlite::Connection,
+) -> Result<Vec<TransactionDataRequest>, SqliteClientError> {
+    let mut tx_retrieval_stmt =
+        conn.prepare_cached("SELECT txid, query_type FROM tx_retrieval_queue")?;
+
+    let result = tx_retrieval_stmt
+        .query_and_then([], |row| {
+            let txid = row.get(0).map(TxId::from_bytes)?;
+            let query_type = row.get(1).map(TxQueryType::from_code)?.ok_or_else(|| {
+                SqliteClientError::CorruptedData(
+                    "Unrecognized transaction data request type.".to_owned(),
+                )
+            })?;
+
+            Ok::<TransactionDataRequest, SqliteClientError>(match query_type {
+                TxQueryType::Status => TransactionDataRequest::GetStatus(txid),
+                TxQueryType::Enhancement => TransactionDataRequest::Enhancement(txid),
+            })
+        })?
+        .collect::<Result<Vec<_>, _>>()?;
+
+    Ok(result)
+}
+
+pub(crate) fn notify_tx_retrieved(
+    conn: &rusqlite::Transaction<'_>,
+    txid: TxId,
 ) -> Result<(), SqliteClientError> {
-    stmts.stmt_update_expired(height)
+    conn.execute(
+        "DELETE FROM tx_retrieval_queue WHERE txid = :txid",
+        named_params![":txid": &txid.as_ref()[..]],
+    )?;
+
+    Ok(())
 }
 
-/// Records information about a transaction output that your wallet created.
-///
-/// This is a crate-internal convenience method.
-pub(crate) fn insert_sent_output<'a, P: consensus::Parameters>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    tx_ref: i64,
-    from_account: AccountId,
-    output: &SentTransactionOutput,
+// A utility function for creation of parameters for use in `insert_sent_output`
+// and `put_sent_output`
+fn recipient_params<P: consensus::Parameters>(
+    conn: &Connection,
+    params: &P,
+    from: AccountUuid,
+    to: &Recipient<AccountUuid, Note, OutPoint>,
+) -> Result<(AccountRef, Option<String>, Option<AccountRef>, PoolType), SqliteClientError> {
+    let from_account_id = get_account_ref(conn, from)?;
+    match to {
+        Recipient::External(addr, pool) => Ok((from_account_id, Some(addr.encode()), None, *pool)),
+        Recipient::EphemeralTransparent {
+            receiving_account,
+            ephemeral_address,
+            ..
+        } => {
+            let to_account = get_account_ref(conn, *receiving_account)?;
+            Ok((
+                from_account_id,
+                Some(ephemeral_address.encode(params)),
+                Some(to_account),
+                PoolType::TRANSPARENT,
+            ))
+        }
+        Recipient::InternalAccount {
+            receiving_account,
+            external_address,
+            note,
+        } => {
+            let to_account = get_account_ref(conn, *receiving_account)?;
+            Ok((
+                from_account_id,
+                external_address.as_ref().map(|a| a.encode()),
+                Some(to_account),
+                PoolType::Shielded(note.protocol()),
+            ))
+        }
+    }
+}
+
+fn flag_previously_received_change(
+    conn: &rusqlite::Transaction,
+    tx_ref: TxRef,
 ) -> Result<(), SqliteClientError> {
-    stmts.stmt_insert_sent_output(
-        tx_ref,
-        output.output_index(),
-        from_account,
-        output.recipient(),
-        output.value(),
-        output.memo(),
-    )
+    let flag_received_change = |table_prefix| {
+        conn.execute(
+            &format!(
+                "UPDATE {table_prefix}_received_notes
+                 SET is_change = 1
+                 FROM sent_notes sn
+                 WHERE sn.tx = {table_prefix}_received_notes.tx
+                 AND sn.tx = :tx
+                 AND sn.from_account_id = {table_prefix}_received_notes.account_id
+                 AND {table_prefix}_received_notes.recipient_key_scope = :internal_scope"
+            ),
+            named_params! {
+                ":tx": tx_ref.0,
+                ":internal_scope": scope_code(Scope::Internal)
+            },
+        )
+    };
+
+    flag_received_change(SAPLING_TABLES_PREFIX)?;
+    #[cfg(feature = "orchard")]
+    flag_received_change(ORCHARD_TABLES_PREFIX)?;
+
+    Ok(())
 }
 
 /// Records information about a transaction output that your wallet created.
+pub(crate) fn insert_sent_output<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    tx_ref: TxRef,
+    from_account_uuid: AccountUuid,
+    output: &SentTransactionOutput<AccountUuid>,
+) -> Result<(), SqliteClientError> {
+    let mut stmt_insert_sent_output = conn.prepare_cached(
+        "INSERT INTO sent_notes (
+            tx, output_pool, output_index, from_account_id,
+            to_address, to_account_id, value, memo)
+         VALUES (
+            :tx, :output_pool, :output_index, :from_account_id,
+            :to_address, :to_account_id, :value, :memo)",
+    )?;
+
+    let (from_account_id, to_address, to_account_id, pool_type) =
+        recipient_params(conn, params, from_account_uuid, output.recipient())?;
+    let sql_args = named_params![
+        ":tx": tx_ref.0,
+        ":output_pool": &pool_code(pool_type),
+        ":output_index": &i64::try_from(output.output_index()).unwrap(),
+        ":from_account_id": from_account_id.0,
+        ":to_address": &to_address,
+        ":to_account_id": to_account_id.map(|a| a.0),
+        ":value": &i64::from(Amount::from(output.value())),
+        ":memo": memo_repr(output.memo())
+    ];
+
+    stmt_insert_sent_output.execute(sql_args)?;
+    flag_previously_received_change(conn, tx_ref)?;
+
+    Ok(())
+}
+
+/// Records information about a transaction output that your wallet created, from the constituent
+/// properties of that output.
 ///
-/// This is a crate-internal convenience method.
+/// - If `recipient` is a Unified address, `output_index` is an index into the outputs of the
+///   transaction within the bundle associated with the recipient's output pool.
+/// - If `recipient` is a Sapling address, `output_index` is an index into the Sapling outputs of
+///   the transaction.
+/// - If `recipient` is a transparent address, `output_index` is an index into the transparent
+///   outputs of the transaction.
+/// - If `recipient` is an internal account, `output_index` is an index into the Sapling outputs of
+///   the transaction.
 #[allow(clippy::too_many_arguments)]
-pub(crate) fn put_sent_output<'a, P: consensus::Parameters>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    from_account: AccountId,
-    tx_ref: i64,
+pub(crate) fn put_sent_output<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    from_account_uuid: AccountUuid,
+    tx_ref: TxRef,
     output_index: usize,
-    recipient: &Recipient,
-    value: Amount,
+    recipient: &Recipient<AccountUuid, Note, OutPoint>,
+    value: NonNegativeAmount,
     memo: Option<&MemoBytes>,
 ) -> Result<(), SqliteClientError> {
-    if !stmts.stmt_update_sent_output(from_account, recipient, value, memo, tx_ref, output_index)? {
-        stmts.stmt_insert_sent_output(
-            tx_ref,
-            output_index,
-            from_account,
-            recipient,
-            value,
-            memo,
-        )?;
+    let mut stmt_upsert_sent_output = conn.prepare_cached(
+        "INSERT INTO sent_notes (
+            tx, output_pool, output_index, from_account_id,
+            to_address, to_account_id, value, memo)
+        VALUES (
+            :tx, :output_pool, :output_index, :from_account_id,
+            :to_address, :to_account_id, :value, :memo)
+        ON CONFLICT (tx, output_pool, output_index) DO UPDATE
+        SET from_account_id = :from_account_id,
+            to_address = IFNULL(to_address, :to_address),
+            to_account_id = IFNULL(to_account_id, :to_account_id),
+            value = :value,
+            memo = IFNULL(:memo, memo)",
+    )?;
+
+    let (from_account_id, to_address, to_account_id, pool_type) =
+        recipient_params(conn, params, from_account_uuid, recipient)?;
+    let sql_args = named_params![
+        ":tx": tx_ref.0,
+        ":output_pool": &pool_code(pool_type),
+        ":output_index": &i64::try_from(output_index).unwrap(),
+        ":from_account_id": from_account_id.0,
+        ":to_address": &to_address,
+        ":to_account_id": &to_account_id.map(|a| a.0),
+        ":value": &i64::from(Amount::from(value)),
+        ":memo": memo_repr(memo)
+    ];
+
+    stmt_upsert_sent_output.execute(sql_args)?;
+    flag_previously_received_change(conn, tx_ref)?;
+
+    Ok(())
+}
+
+/// Inserts the given entries into the nullifier map.
+///
+/// Returns an error if the new entries conflict with existing ones. This indicates either
+/// corrupted data, or that a reorg has occurred and the caller needs to repair the wallet
+/// state with [`truncate_to_height`].
+pub(crate) fn insert_nullifier_map<N: AsRef<[u8]>>(
+    conn: &rusqlite::Transaction<'_>,
+    block_height: BlockHeight,
+    spend_pool: ShieldedProtocol,
+    new_entries: &[(TxId, u16, Vec<N>)],
+) -> Result<(), SqliteClientError> {
+    let mut stmt_select_tx_locators = conn.prepare_cached(
+        "SELECT block_height, tx_index, txid
+        FROM tx_locator_map
+        WHERE (block_height = :block_height AND tx_index = :tx_index) OR txid = :txid",
+    )?;
+    let mut stmt_insert_tx_locator = conn.prepare_cached(
+        "INSERT INTO tx_locator_map
+        (block_height, tx_index, txid)
+        VALUES (:block_height, :tx_index, :txid)",
+    )?;
+    let mut stmt_insert_nullifier_mapping = conn.prepare_cached(
+        "INSERT INTO nullifier_map
+        (spend_pool, nf, block_height, tx_index)
+        VALUES (:spend_pool, :nf, :block_height, :tx_index)
+        ON CONFLICT (spend_pool, nf) DO UPDATE
+        SET block_height = :block_height,
+            tx_index = :tx_index",
+    )?;
+
+    for (txid, tx_index, nullifiers) in new_entries {
+        let tx_args = named_params![
+            ":block_height": u32::from(block_height),
+            ":tx_index": tx_index,
+            ":txid": txid.as_ref(),
+        ];
+
+        // We cannot use an upsert here, because we use the tx locator as the foreign key
+        // in `nullifier_map` instead of `txid` for database size efficiency. If an insert
+        // into `tx_locator_map` were to conflict, we would need the resulting update to
+        // cascade into `nullifier_map` as either:
+        // - an update (if a transaction moved within a block), or
+        // - a deletion (if the locator now points to a different transaction).
+        //
+        // `ON UPDATE` has `CASCADE` to always update, but has no deletion option. So we
+        // instead set `ON UPDATE RESTRICT` on the foreign key relation, and require the
+        // caller to manually rewind the database in this situation.
+        let locator = stmt_select_tx_locators
+            .query_map(tx_args, |row| {
+                Ok((
+                    BlockHeight::from_u32(row.get(0)?),
+                    row.get::<_, u16>(1)?,
+                    TxId::from_bytes(row.get(2)?),
+                ))
+            })?
+            .try_fold(None, |acc, row| -> Result<_, SqliteClientError> {
+                match (acc, row?) {
+                    (None, rhs) => Ok(Some(Some(rhs))),
+                    // If there was more than one row, then due to the uniqueness
+                    // constraints on the `tx_locator_map` table, all of the rows conflict
+                    // with the locator being inserted.
+                    (Some(_), _) => Ok(Some(None)),
+                }
+            })?;
+
+        match locator {
+            // If the locator in the table matches the one being inserted, do nothing.
+            Some(Some(loc)) if loc == (block_height, *tx_index, *txid) => (),
+            // If the locator being inserted would conflict, report it.
+            Some(_) => Err(SqliteClientError::DbError(rusqlite::Error::SqliteFailure(
+                rusqlite::ffi::Error::new(rusqlite::ffi::SQLITE_CONSTRAINT),
+                Some("UNIQUE constraint failed: tx_locator_map.block_height, tx_locator_map.tx_index".into()),
+            )))?,
+            // If the locator doesn't exist, insert it.
+            None => stmt_insert_tx_locator.execute(tx_args).map(|_| ())?,
+        }
+
+        for nf in nullifiers {
+            // Here it is okay to use an upsert, because per above we've confirmed that
+            // the locator points to the same transaction.
+            let nf_args = named_params![
+                ":spend_pool": pool_code(PoolType::Shielded(spend_pool)),
+                ":nf": nf.as_ref(),
+                ":block_height": u32::from(block_height),
+                ":tx_index": tx_index,
+            ];
+            stmt_insert_nullifier_mapping.execute(nf_args)?;
+        }
     }
 
     Ok(())
 }
 
-#[cfg(test)]
-mod tests {
-    use secrecy::Secret;
-    use tempfile::NamedTempFile;
+/// Returns the row of the `transactions` table corresponding to the transaction in which
+/// this nullifier is revealed, if any.
+pub(crate) fn query_nullifier_map<N: AsRef<[u8]>>(
+    conn: &rusqlite::Transaction<'_>,
+    spend_pool: ShieldedProtocol,
+    nf: &N,
+) -> Result<Option<TxRef>, SqliteClientError> {
+    let mut stmt_select_locator = conn.prepare_cached(
+        "SELECT block_height, tx_index, txid
+        FROM nullifier_map
+        LEFT JOIN tx_locator_map USING (block_height, tx_index)
+        WHERE spend_pool = :spend_pool AND nf = :nf",
+    )?;
 
-    use zcash_primitives::transaction::components::Amount;
+    let sql_args = named_params![
+        ":spend_pool": pool_code(PoolType::Shielded(spend_pool)),
+        ":nf": nf.as_ref(),
+    ];
+
+    // Find the locator corresponding to this nullifier, if any.
+    let locator = stmt_select_locator
+        .query_row(sql_args, |row| {
+            Ok((
+                BlockHeight::from_u32(row.get(0)?),
+                row.get(1)?,
+                TxId::from_bytes(row.get(2)?),
+            ))
+        })
+        .optional()?;
+    let (height, index, txid) = match locator {
+        Some(res) => res,
+        None => return Ok(None),
+    };
 
-    use zcash_client_backend::data_api::WalletRead;
+    // Find or create a corresponding row in the `transactions` table. Usually a row will
+    // have been created during the same scan that the locator was added to the nullifier
+    // map, but it would not happen if the transaction in question spent the note with no
+    // change or explicit in-wallet recipient.
+    put_tx_meta(
+        conn,
+        &WalletTx::new(
+            txid,
+            index,
+            vec![],
+            vec![],
+            #[cfg(feature = "orchard")]
+            vec![],
+            #[cfg(feature = "orchard")]
+            vec![],
+        ),
+        height,
+    )
+    .map(Some)
+}
 
-    use crate::{
-        tests,
-        wallet::{get_current_address, init::init_wallet_db},
-        AccountId, WalletDb,
+/// Deletes from the nullifier map any entries with a locator referencing a block height
+/// lower than the pruning height.
+pub(crate) fn prune_nullifier_map(
+    conn: &rusqlite::Transaction<'_>,
+    block_height: BlockHeight,
+) -> Result<(), SqliteClientError> {
+    let mut stmt_delete_locators = conn.prepare_cached(
+        "DELETE FROM tx_locator_map
+        WHERE block_height < :block_height",
+    )?;
+
+    stmt_delete_locators.execute(named_params![":block_height": u32::from(block_height)])?;
+
+    Ok(())
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod testing {
+    use incrementalmerkletree::Position;
+    use zcash_client_backend::data_api::testing::TransactionSummary;
+    use zcash_primitives::transaction::TxId;
+    use zcash_protocol::{
+        consensus::BlockHeight,
+        value::{ZatBalance, Zatoshis},
+        ShieldedProtocol,
     };
 
-    use super::get_balance;
+    use crate::{error::SqliteClientError, AccountUuid, SAPLING_TABLES_PREFIX};
 
-    #[cfg(feature = "transparent-inputs")]
-    use {
-        zcash_client_backend::{
-            data_api::WalletWrite, encoding::AddressCodec, wallet::WalletTransparentOutput,
-        },
-        zcash_primitives::{
-            consensus::BlockHeight,
-            transaction::components::{OutPoint, TxOut},
-        },
+    #[cfg(feature = "orchard")]
+    use crate::ORCHARD_TABLES_PREFIX;
+
+    pub(crate) fn get_tx_history(
+        conn: &rusqlite::Connection,
+    ) -> Result<Vec<TransactionSummary<AccountUuid>>, SqliteClientError> {
+        let mut stmt = conn.prepare_cached(
+            "SELECT accounts.uuid as account_uuid, v_transactions.*
+             FROM v_transactions
+             JOIN accounts ON accounts.uuid = v_transactions.account_uuid
+             ORDER BY mined_height DESC, tx_index DESC",
+        )?;
+
+        let results = stmt
+            .query_and_then::<_, SqliteClientError, _, _>([], |row| {
+                Ok(TransactionSummary::from_parts(
+                    AccountUuid(row.get("account_uuid")?),
+                    TxId::from_bytes(row.get("txid")?),
+                    row.get::<_, Option<u32>>("expiry_height")?
+                        .map(BlockHeight::from),
+                    row.get::<_, Option<u32>>("mined_height")?
+                        .map(BlockHeight::from),
+                    ZatBalance::from_i64(row.get("account_balance_delta")?)?,
+                    row.get::<_, Option<i64>>("fee_paid")?
+                        .map(Zatoshis::from_nonnegative_i64)
+                        .transpose()?,
+                    row.get("spent_note_count")?,
+                    row.get("has_change")?,
+                    row.get("sent_note_count")?,
+                    row.get("received_note_count")?,
+                    row.get("memo_count")?,
+                    row.get("expired_unmined")?,
+                    row.get("is_shielding")?,
+                ))
+            })?
+            .collect::<Result<Vec<_>, _>>()?;
+
+        Ok(results)
+    }
+
+    /// Returns a vector of transaction summaries
+    #[allow(dead_code)] // used only for tests that are flagged off by default
+    pub(crate) fn get_checkpoint_history(
+        conn: &rusqlite::Connection,
+        protocol: &ShieldedProtocol,
+    ) -> Result<Vec<(BlockHeight, Option<Position>)>, SqliteClientError> {
+        let table_prefix = match protocol {
+            ShieldedProtocol::Sapling => SAPLING_TABLES_PREFIX,
+            #[cfg(feature = "orchard")]
+            ShieldedProtocol::Orchard => ORCHARD_TABLES_PREFIX,
+            #[cfg(not(feature = "orchard"))]
+            ShieldedProtocol::Orchard => {
+                return Err(SqliteClientError::UnsupportedPoolType(
+                    zcash_protocol::PoolType::ORCHARD,
+                ));
+            }
+        };
+
+        let mut stmt = conn.prepare_cached(&format!(
+            "SELECT checkpoint_id, position FROM {}_tree_checkpoints
+             ORDER BY checkpoint_id",
+            table_prefix
+        ))?;
+
+        let results = stmt
+            .query_and_then::<_, SqliteClientError, _, _>([], |row| {
+                Ok((
+                    BlockHeight::from(row.get::<_, u32>(0)?),
+                    row.get::<_, Option<u64>>(1)?.map(Position::from),
+                ))
+            })?
+            .collect::<Result<Vec<_>, _>>()?;
+
+        Ok(results)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::num::NonZeroU32;
+
+    use sapling::zip32::ExtendedSpendingKey;
+    use secrecy::{ExposeSecret, SecretVec};
+    use uuid::Uuid;
+    use zcash_client_backend::data_api::{
+        testing::{AddressType, DataStoreFactory, FakeCompactOutput, TestBuilder, TestState},
+        Account as _, AccountSource, WalletRead, WalletWrite,
+    };
+    use zcash_primitives::{block::BlockHash, transaction::components::amount::NonNegativeAmount};
+
+    use crate::{
+        testing::{db::TestDbFactory, BlockCache},
+        AccountUuid,
     };
 
+    use super::account_birthday;
+
     #[test]
     fn empty_database_has_no_balance() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+        let account = st.test_account().unwrap();
 
-        // Add an account to the wallet
-        tests::init_test_accounts_table(&db_data);
+        // The account should have no summary information
+        assert_eq!(st.get_wallet_summary(0), None);
 
-        // The account should be empty
+        // We can't get an anchor height, as we have not scanned any blocks.
         assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::zero()
+            st.wallet()
+                .get_target_and_anchor_heights(NonZeroU32::new(10).unwrap())
+                .unwrap(),
+            None
         );
 
-        // We can't get an anchor height, as we have not scanned any blocks.
-        assert_eq!(db_data.get_target_and_anchor_heights(10).unwrap(), None);
+        // The default address is set for the test account
+        assert_matches!(st.wallet().get_current_address(account.id()), Ok(Some(_)));
 
-        // An invalid account has zero balance
-        assert_matches!(get_current_address(&db_data, AccountId::from(1)), Ok(None));
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::zero()
+        // No default address is set for an un-initialized account
+        assert_matches!(
+            st.wallet().get_current_address(AccountUuid(Uuid::nil())),
+            Ok(None)
         );
     }
 
     #[test]
-    #[cfg(feature = "transparent-inputs")]
-    fn put_received_transparent_utxo() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (account_id, _usk) = ops.create_account(&seed).unwrap();
-        let uaddr = db_data.get_current_address(account_id).unwrap().unwrap();
-        let taddr = uaddr.transparent().unwrap();
-
-        let bal_absent = db_data
-            .get_transparent_balances(account_id, BlockHeight::from_u32(12345))
+    fn get_default_account_index() {
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+        let account_id = st.test_account().unwrap().id();
+        let account_parameters = st.wallet().get_account(account_id).unwrap().unwrap();
+
+        let expected_account_index = zip32::AccountId::try_from(0).unwrap();
+        assert_matches!(
+            account_parameters.kind,
+            AccountSource::Derived{derivation, ..} if derivation.account_index() == expected_account_index
+        );
+    }
+
+    #[test]
+    fn get_account_ids() {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+
+        let seed = SecretVec::new(st.test_seed().unwrap().expose_secret().clone());
+        let birthday = st.test_account().unwrap().birthday().clone();
+
+        st.wallet_mut()
+            .create_account("", &seed, &birthday, None)
             .unwrap();
-        assert!(bal_absent.is_empty());
 
-        let utxo = WalletTransparentOutput::from_parts(
-            OutPoint::new([1u8; 32], 1),
-            TxOut {
-                value: Amount::from_u64(100000).unwrap(),
-                script_pubkey: taddr.script(),
-            },
-            BlockHeight::from_u32(12345),
-        )
-        .unwrap();
-
-        let res0 = super::put_received_transparent_utxo(&mut ops, &utxo);
-        assert_matches!(res0, Ok(_));
-
-        // Change the mined height of the UTXO and upsert; we should get back
-        // the same utxoid
-        let utxo2 = WalletTransparentOutput::from_parts(
-            OutPoint::new([1u8; 32], 1),
-            TxOut {
-                value: Amount::from_u64(100000).unwrap(),
-                script_pubkey: taddr.script(),
-            },
-            BlockHeight::from_u32(34567),
-        )
-        .unwrap();
-        let res1 = super::put_received_transparent_utxo(&mut ops, &utxo2);
-        assert_matches!(res1, Ok(id) if id == res0.unwrap());
+        for acct_id in st.wallet().get_account_ids().unwrap() {
+            assert_matches!(st.wallet().get_account(acct_id), Ok(Some(_)))
+        }
+    }
 
-        assert_matches!(
-            super::get_unspent_transparent_outputs(
-                &db_data,
-                taddr,
-                BlockHeight::from_u32(12345),
-                &[]
-            ),
-            Ok(utxos) if utxos.is_empty()
-        );
+    #[test]
+    fn block_fully_scanned() {
+        check_block_fully_scanned(TestDbFactory::default())
+    }
 
-        assert_matches!(
-            super::get_unspent_transparent_outputs(
-                &db_data,
-                taddr,
-                BlockHeight::from_u32(34567),
-                &[]
-            ),
-            Ok(utxos) if {
-                utxos.len() == 1 &&
-                utxos.iter().any(|rutxo| rutxo.height() == utxo2.height())
-            }
+    fn check_block_fully_scanned<DsF: DataStoreFactory>(dsf: DsF) {
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(dsf)
+            .with_block_cache(BlockCache::new())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+
+        let block_fully_scanned = |st: &TestState<_, DsF::DataStore, _>| {
+            st.wallet()
+                .block_fully_scanned()
+                .unwrap()
+                .map(|meta| meta.block_height())
+        };
+
+        // A fresh wallet should have no fully-scanned block.
+        assert_eq!(block_fully_scanned(&st), None);
+
+        // Scan a block above the wallet's birthday height.
+        let not_our_key = ExtendedSpendingKey::master(&[]).to_diversifiable_full_viewing_key();
+        let not_our_value = NonNegativeAmount::const_from_u64(10000);
+        let start_height = st.sapling_activation_height();
+        let _ = st.generate_block_at(
+            start_height,
+            BlockHash([0; 32]),
+            &[FakeCompactOutput::new(
+                &not_our_key,
+                AddressType::DefaultExternal,
+                not_our_value,
+            )],
+            0,
+            0,
+            false,
         );
+        let (mid_height, _, _) =
+            st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
+        let (end_height, _, _) =
+            st.generate_next_block(&not_our_key, AddressType::DefaultExternal, not_our_value);
 
-        assert_matches!(
-            db_data.get_transparent_balances(account_id, BlockHeight::from_u32(34567)),
-            Ok(h) if h.get(taddr) == Amount::from_u64(100000).ok().as_ref()
-        );
+        // Scan the last block first
+        st.scan_cached_blocks(end_height, 1);
 
-        // Artificially delete the address from the addresses table so that
-        // we can ensure the update fails if the join doesn't work.
-        db_data
-            .conn
-            .execute(
-                "DELETE FROM addresses WHERE cached_transparent_receiver_address = ?",
-                [Some(taddr.encode(&db_data.params))],
-            )
-            .unwrap();
+        // The wallet should still have no fully-scanned block, as no scanned block range
+        // overlaps the wallet's birthday.
+        assert_eq!(block_fully_scanned(&st), None);
 
-        let res2 = super::put_received_transparent_utxo(&mut ops, &utxo2);
-        assert_matches!(res2, Err(_));
+        // Scan the block at the wallet's birthday height.
+        st.scan_cached_blocks(start_height, 1);
+
+        // The fully-scanned height should now be that of the scanned block.
+        assert_eq!(block_fully_scanned(&st), Some(start_height));
+
+        // Scan the block in between the two previous blocks.
+        st.scan_cached_blocks(mid_height, 1);
+
+        // The fully-scanned height should now be the latest block, as the two disjoint
+        // ranges have been connected.
+        assert_eq!(block_fully_scanned(&st), Some(end_height));
+    }
+
+    #[test]
+    fn test_account_birthday() {
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+
+        let account_id = st.test_account().unwrap().id();
+        assert_matches!(
+            account_birthday(st.wallet().conn(), account_id),
+            Ok(birthday) if birthday == st.sapling_activation_height()
+        )
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/commitment_tree.rs b/zcash_client_sqlite/src/wallet/commitment_tree.rs
new file mode 100644
index 0000000000..71b34f83c9
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/commitment_tree.rs
@@ -0,0 +1,1279 @@
+use rusqlite::{self, named_params, OptionalExtension};
+use std::{
+    collections::BTreeSet,
+    error, fmt,
+    io::{self, Cursor},
+    marker::PhantomData,
+    num::NonZeroU32,
+    ops::Range,
+    sync::Arc,
+};
+use zcash_client_backend::data_api::chain::CommitmentTreeRoot;
+
+use incrementalmerkletree::{Address, Hashable, Level, Position, Retention};
+use shardtree::{
+    error::ShardTreeError,
+    store::{Checkpoint, ShardStore, TreeState},
+    LocatedPrunableTree, LocatedTree, PrunableTree, RetentionFlags,
+};
+
+use zcash_primitives::{consensus::BlockHeight, merkle_tree::HashSer};
+
+use zcash_client_backend::serialization::shardtree::{read_shard, write_shard};
+
+/// Errors that can appear in SQLite-back [`ShardStore`] implementation operations.
+#[derive(Debug)]
+pub enum Error {
+    /// Errors in deserializing stored shard data
+    Serialization(io::Error),
+    /// Errors encountered querying stored shard data
+    Query(rusqlite::Error),
+    /// Raised when the caller attempts to add a checkpoint at a block height where a checkpoint
+    /// already exists, but the tree state being checkpointed or the marks removed at that
+    /// checkpoint conflict with the existing tree state.
+    CheckpointConflict {
+        checkpoint_id: BlockHeight,
+        checkpoint: Checkpoint,
+        extant_tree_state: TreeState,
+        extant_marks_removed: Option<BTreeSet<Position>>,
+    },
+    /// Raised when attempting to add shard roots to the database that
+    /// are discontinuous with the existing roots in the database.
+    SubtreeDiscontinuity {
+        attempted_insertion_range: Range<u64>,
+        existing_range: Range<u64>,
+    },
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match &self {
+            Error::Serialization(err) => write!(f, "Commitment tree serialization error: {}", err),
+            Error::Query(err) => write!(f, "Commitment tree query or update error: {}", err),
+            Error::CheckpointConflict {
+                checkpoint_id,
+                checkpoint,
+                extant_tree_state,
+                extant_marks_removed,
+            } => {
+                write!(
+                    f,
+                    "Conflict at checkpoint id {}, tried to insert {:?}, which is incompatible with existing state ({:?}, {:?})",
+                    checkpoint_id, checkpoint, extant_tree_state, extant_marks_removed
+                )
+            }
+            Error::SubtreeDiscontinuity {
+                attempted_insertion_range,
+                existing_range,
+            } => {
+                write!(
+                    f,
+                    "Attempted to write subtree roots with indices {:?} which is discontinuous with existing subtree range {:?}",
+                    attempted_insertion_range, existing_range,
+                )
+            }
+        }
+    }
+}
+
+impl error::Error for Error {
+    fn source(&self) -> Option<&(dyn error::Error + 'static)> {
+        match &self {
+            Error::Serialization(e) => Some(e),
+            Error::Query(e) => Some(e),
+            Error::CheckpointConflict { .. } => None,
+            Error::SubtreeDiscontinuity { .. } => None,
+        }
+    }
+}
+
+pub struct SqliteShardStore<C, H, const SHARD_HEIGHT: u8> {
+    pub(crate) conn: C,
+    table_prefix: &'static str,
+    _hash_type: PhantomData<H>,
+}
+
+impl<C, H, const SHARD_HEIGHT: u8> SqliteShardStore<C, H, SHARD_HEIGHT> {
+    const SHARD_ROOT_LEVEL: Level = Level::new(SHARD_HEIGHT);
+
+    pub(crate) fn from_connection(
+        conn: C,
+        table_prefix: &'static str,
+    ) -> Result<Self, rusqlite::Error> {
+        Ok(SqliteShardStore {
+            conn,
+            table_prefix,
+            _hash_type: PhantomData,
+        })
+    }
+}
+
+impl<'conn, 'a: 'conn, H: HashSer, const SHARD_HEIGHT: u8> ShardStore
+    for SqliteShardStore<&'a rusqlite::Transaction<'conn>, H, SHARD_HEIGHT>
+{
+    type H = H;
+    type CheckpointId = BlockHeight;
+    type Error = Error;
+
+    fn get_shard(
+        &self,
+        shard_root: Address,
+    ) -> Result<Option<LocatedPrunableTree<Self::H>>, Self::Error> {
+        get_shard(self.conn, self.table_prefix, shard_root)
+    }
+
+    fn last_shard(&self) -> Result<Option<LocatedPrunableTree<Self::H>>, Self::Error> {
+        last_shard(self.conn, self.table_prefix, Self::SHARD_ROOT_LEVEL)
+    }
+
+    fn put_shard(&mut self, subtree: LocatedPrunableTree<Self::H>) -> Result<(), Self::Error> {
+        put_shard(self.conn, self.table_prefix, subtree)
+    }
+
+    fn get_shard_roots(&self) -> Result<Vec<Address>, Self::Error> {
+        get_shard_roots(self.conn, self.table_prefix, Self::SHARD_ROOT_LEVEL)
+    }
+
+    fn truncate_shards(&mut self, shard_index: u64) -> Result<(), Self::Error> {
+        truncate_shards(self.conn, self.table_prefix, shard_index)
+    }
+
+    fn get_cap(&self) -> Result<PrunableTree<Self::H>, Self::Error> {
+        get_cap(self.conn, self.table_prefix)
+    }
+
+    fn put_cap(&mut self, cap: PrunableTree<Self::H>) -> Result<(), Self::Error> {
+        put_cap(self.conn, self.table_prefix, cap)
+    }
+
+    fn min_checkpoint_id(&self) -> Result<Option<Self::CheckpointId>, Self::Error> {
+        min_checkpoint_id(self.conn, self.table_prefix)
+    }
+
+    fn max_checkpoint_id(&self) -> Result<Option<Self::CheckpointId>, Self::Error> {
+        max_checkpoint_id(self.conn, self.table_prefix)
+    }
+
+    fn add_checkpoint(
+        &mut self,
+        checkpoint_id: Self::CheckpointId,
+        checkpoint: Checkpoint,
+    ) -> Result<(), Self::Error> {
+        add_checkpoint(self.conn, self.table_prefix, checkpoint_id, checkpoint)
+    }
+
+    fn checkpoint_count(&self) -> Result<usize, Self::Error> {
+        checkpoint_count(self.conn, self.table_prefix)
+    }
+
+    fn get_checkpoint_at_depth(
+        &self,
+        checkpoint_depth: usize,
+    ) -> Result<Option<(Self::CheckpointId, Checkpoint)>, Self::Error> {
+        get_checkpoint_at_depth(self.conn, self.table_prefix, checkpoint_depth)
+            .map_err(Error::Query)
+    }
+
+    fn get_checkpoint(
+        &self,
+        checkpoint_id: &Self::CheckpointId,
+    ) -> Result<Option<Checkpoint>, Self::Error> {
+        get_checkpoint(self.conn, self.table_prefix, *checkpoint_id)
+    }
+
+    fn with_checkpoints<F>(&mut self, limit: usize, callback: F) -> Result<(), Self::Error>
+    where
+        F: FnMut(&Self::CheckpointId, &Checkpoint) -> Result<(), Self::Error>,
+    {
+        with_checkpoints(self.conn, self.table_prefix, limit, callback)
+    }
+
+    fn for_each_checkpoint<F>(&self, limit: usize, callback: F) -> Result<(), Self::Error>
+    where
+        F: FnMut(&Self::CheckpointId, &Checkpoint) -> Result<(), Self::Error>,
+    {
+        with_checkpoints(self.conn, self.table_prefix, limit, callback)
+    }
+
+    fn update_checkpoint_with<F>(
+        &mut self,
+        checkpoint_id: &Self::CheckpointId,
+        update: F,
+    ) -> Result<bool, Self::Error>
+    where
+        F: Fn(&mut Checkpoint) -> Result<(), Self::Error>,
+    {
+        update_checkpoint_with(self.conn, self.table_prefix, *checkpoint_id, update)
+    }
+
+    fn remove_checkpoint(&mut self, checkpoint_id: &Self::CheckpointId) -> Result<(), Self::Error> {
+        remove_checkpoint(self.conn, self.table_prefix, *checkpoint_id)
+    }
+
+    fn truncate_checkpoints_retaining(
+        &mut self,
+        checkpoint_id: &Self::CheckpointId,
+    ) -> Result<(), Self::Error> {
+        truncate_checkpoints_retaining(self.conn, self.table_prefix, *checkpoint_id)
+    }
+}
+
+impl<H: HashSer, const SHARD_HEIGHT: u8> ShardStore
+    for SqliteShardStore<rusqlite::Connection, H, SHARD_HEIGHT>
+{
+    type H = H;
+    type CheckpointId = BlockHeight;
+    type Error = Error;
+
+    fn get_shard(
+        &self,
+        shard_root: Address,
+    ) -> Result<Option<LocatedPrunableTree<Self::H>>, Self::Error> {
+        get_shard(&self.conn, self.table_prefix, shard_root)
+    }
+
+    fn last_shard(&self) -> Result<Option<LocatedPrunableTree<Self::H>>, Self::Error> {
+        last_shard(&self.conn, self.table_prefix, Self::SHARD_ROOT_LEVEL)
+    }
+
+    fn put_shard(&mut self, subtree: LocatedPrunableTree<Self::H>) -> Result<(), Self::Error> {
+        let tx = self.conn.transaction().map_err(Error::Query)?;
+        put_shard(&tx, self.table_prefix, subtree)?;
+        tx.commit().map_err(Error::Query)?;
+        Ok(())
+    }
+
+    fn get_shard_roots(&self) -> Result<Vec<Address>, Self::Error> {
+        get_shard_roots(&self.conn, self.table_prefix, Self::SHARD_ROOT_LEVEL)
+    }
+
+    fn truncate_shards(&mut self, shard_index: u64) -> Result<(), Self::Error> {
+        truncate_shards(&self.conn, self.table_prefix, shard_index)
+    }
+
+    fn get_cap(&self) -> Result<PrunableTree<Self::H>, Self::Error> {
+        get_cap(&self.conn, self.table_prefix)
+    }
+
+    fn put_cap(&mut self, cap: PrunableTree<Self::H>) -> Result<(), Self::Error> {
+        put_cap(&self.conn, self.table_prefix, cap)
+    }
+
+    fn min_checkpoint_id(&self) -> Result<Option<Self::CheckpointId>, Self::Error> {
+        min_checkpoint_id(&self.conn, self.table_prefix)
+    }
+
+    fn max_checkpoint_id(&self) -> Result<Option<Self::CheckpointId>, Self::Error> {
+        max_checkpoint_id(&self.conn, self.table_prefix)
+    }
+
+    fn add_checkpoint(
+        &mut self,
+        checkpoint_id: Self::CheckpointId,
+        checkpoint: Checkpoint,
+    ) -> Result<(), Self::Error> {
+        let tx = self.conn.transaction().map_err(Error::Query)?;
+        add_checkpoint(&tx, self.table_prefix, checkpoint_id, checkpoint)?;
+        tx.commit().map_err(Error::Query)
+    }
+
+    fn checkpoint_count(&self) -> Result<usize, Self::Error> {
+        checkpoint_count(&self.conn, self.table_prefix)
+    }
+
+    fn get_checkpoint_at_depth(
+        &self,
+        checkpoint_depth: usize,
+    ) -> Result<Option<(Self::CheckpointId, Checkpoint)>, Self::Error> {
+        get_checkpoint_at_depth(&self.conn, self.table_prefix, checkpoint_depth)
+            .map_err(Error::Query)
+    }
+
+    fn get_checkpoint(
+        &self,
+        checkpoint_id: &Self::CheckpointId,
+    ) -> Result<Option<Checkpoint>, Self::Error> {
+        get_checkpoint(&self.conn, self.table_prefix, *checkpoint_id)
+    }
+
+    fn with_checkpoints<F>(&mut self, limit: usize, callback: F) -> Result<(), Self::Error>
+    where
+        F: FnMut(&Self::CheckpointId, &Checkpoint) -> Result<(), Self::Error>,
+    {
+        let tx = self.conn.transaction().map_err(Error::Query)?;
+        with_checkpoints(&tx, self.table_prefix, limit, callback)?;
+        tx.commit().map_err(Error::Query)
+    }
+
+    fn for_each_checkpoint<F>(&self, limit: usize, callback: F) -> Result<(), Self::Error>
+    where
+        F: FnMut(&Self::CheckpointId, &Checkpoint) -> Result<(), Self::Error>,
+    {
+        let tx = self.conn.unchecked_transaction().map_err(Error::Query)?;
+        with_checkpoints(&tx, self.table_prefix, limit, callback)?;
+        // Here, we use `tx.rollback` as the semantics of this method is that the callback must
+        // not mutate the data store.
+        tx.rollback().map_err(Error::Query)
+    }
+
+    fn update_checkpoint_with<F>(
+        &mut self,
+        checkpoint_id: &Self::CheckpointId,
+        update: F,
+    ) -> Result<bool, Self::Error>
+    where
+        F: Fn(&mut Checkpoint) -> Result<(), Self::Error>,
+    {
+        let tx = self.conn.transaction().map_err(Error::Query)?;
+        let result = update_checkpoint_with(&tx, self.table_prefix, *checkpoint_id, update)?;
+        tx.commit().map_err(Error::Query)?;
+        Ok(result)
+    }
+
+    fn remove_checkpoint(&mut self, checkpoint_id: &Self::CheckpointId) -> Result<(), Self::Error> {
+        let tx = self.conn.transaction().map_err(Error::Query)?;
+        remove_checkpoint(&tx, self.table_prefix, *checkpoint_id)?;
+        tx.commit().map_err(Error::Query)
+    }
+
+    fn truncate_checkpoints_retaining(
+        &mut self,
+        checkpoint_id: &Self::CheckpointId,
+    ) -> Result<(), Self::Error> {
+        let tx = self.conn.transaction().map_err(Error::Query)?;
+        truncate_checkpoints_retaining(&tx, self.table_prefix, *checkpoint_id)?;
+        tx.commit().map_err(Error::Query)
+    }
+}
+
+pub(crate) fn get_shard<H: HashSer>(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    shard_root_addr: Address,
+) -> Result<Option<LocatedPrunableTree<H>>, Error> {
+    conn.query_row(
+        &format!(
+            "SELECT shard_data, root_hash
+             FROM {}_tree_shards
+             WHERE shard_index = :shard_index",
+            table_prefix
+        ),
+        named_params![":shard_index": shard_root_addr.index()],
+        |row| Ok((row.get::<_, Vec<u8>>(0)?, row.get::<_, Option<Vec<u8>>>(1)?)),
+    )
+    .optional()
+    .map_err(Error::Query)?
+    .map(|(shard_data, root_hash)| {
+        let shard_tree = read_shard(&mut Cursor::new(shard_data)).map_err(Error::Serialization)?;
+        let located_tree = LocatedPrunableTree::from_parts(shard_root_addr, shard_tree);
+        if let Some(root_hash_data) = root_hash {
+            let root_hash = H::read(Cursor::new(root_hash_data)).map_err(Error::Serialization)?;
+            Ok(located_tree.reannotate_root(Some(Arc::new(root_hash))))
+        } else {
+            Ok(located_tree)
+        }
+    })
+    .transpose()
+}
+
+pub(crate) fn last_shard<H: HashSer>(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    shard_root_level: Level,
+) -> Result<Option<LocatedPrunableTree<H>>, Error> {
+    conn.query_row(
+        &format!(
+            "SELECT shard_index, shard_data
+             FROM {}_tree_shards
+             ORDER BY shard_index DESC
+             LIMIT 1",
+            table_prefix
+        ),
+        [],
+        |row| {
+            let shard_index: u64 = row.get(0)?;
+            let shard_data: Vec<u8> = row.get(1)?;
+            Ok((shard_index, shard_data))
+        },
+    )
+    .optional()
+    .map_err(Error::Query)?
+    .map(|(shard_index, shard_data)| {
+        let shard_root = Address::from_parts(shard_root_level, shard_index);
+        let shard_tree = read_shard(&mut Cursor::new(shard_data)).map_err(Error::Serialization)?;
+        Ok(LocatedPrunableTree::from_parts(shard_root, shard_tree))
+    })
+    .transpose()
+}
+
+/// Returns an error iff the proposed insertion range
+/// for the tree shards would create a discontinuity
+/// in the database.
+#[tracing::instrument(skip(conn))]
+fn check_shard_discontinuity(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    proposed_insertion_range: Range<u64>,
+) -> Result<(), Error> {
+    if let Ok((Some(stored_min), Some(stored_max))) = conn
+        .query_row(
+            &format!(
+                "SELECT MIN(shard_index), MAX(shard_index) FROM {}_tree_shards",
+                table_prefix
+            ),
+            [],
+            |row| {
+                let min = row.get::<_, Option<u64>>(0)?;
+                let max = row.get::<_, Option<u64>>(1)?;
+                Ok((min, max))
+            },
+        )
+        .map_err(Error::Query)
+    {
+        // If the ranges overlap, or are directly adjacent, then we aren't creating a
+        // discontinuity. We can check this by comparing their start-inclusive,
+        // end-exclusive bounds:
+        // - If `cur_start == ins_end` then the proposed insertion range is immediately
+        //   before the current shards. If `cur_start > ins_end` then there is a gap.
+        // - If `ins_start == cur_end` then the proposed insertion range is immediately
+        //   after the current shards. If `ins_start > cur_end` then there is a gap.
+        let (cur_start, cur_end) = (stored_min, stored_max + 1);
+        let (ins_start, ins_end) = (proposed_insertion_range.start, proposed_insertion_range.end);
+        if cur_start > ins_end || ins_start > cur_end {
+            return Err(Error::SubtreeDiscontinuity {
+                attempted_insertion_range: proposed_insertion_range,
+                existing_range: cur_start..cur_end,
+            });
+        }
+    }
+
+    Ok(())
+}
+
+pub(crate) fn put_shard<H: HashSer>(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    subtree: LocatedPrunableTree<H>,
+) -> Result<(), Error> {
+    let subtree_root_hash = subtree
+        .root()
+        .annotation()
+        .and_then(|ann| {
+            ann.as_ref().map(|rc| {
+                let mut root_hash = vec![];
+                rc.write(&mut root_hash)?;
+                Ok(root_hash)
+            })
+        })
+        .transpose()
+        .map_err(Error::Serialization)?;
+
+    let mut subtree_data = vec![];
+    write_shard(&mut subtree_data, subtree.root()).map_err(Error::Serialization)?;
+
+    let shard_index = subtree.root_addr().index();
+
+    check_shard_discontinuity(conn, table_prefix, shard_index..shard_index + 1)?;
+
+    let mut stmt_put_shard = conn
+        .prepare_cached(&format!(
+            "INSERT INTO {}_tree_shards (shard_index, root_hash, shard_data)
+             VALUES (:shard_index, :root_hash, :shard_data)
+             ON CONFLICT (shard_index) DO UPDATE
+             SET root_hash = :root_hash,
+             shard_data = :shard_data",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+
+    stmt_put_shard
+        .execute(named_params![
+            ":shard_index": shard_index,
+            ":root_hash": subtree_root_hash,
+            ":shard_data": subtree_data
+        ])
+        .map_err(Error::Query)?;
+
+    Ok(())
+}
+
+pub(crate) fn get_shard_roots(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    shard_root_level: Level,
+) -> Result<Vec<Address>, Error> {
+    let mut stmt = conn
+        .prepare(&format!(
+            "SELECT shard_index FROM {}_tree_shards ORDER BY shard_index",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+    let mut rows = stmt.query([]).map_err(Error::Query)?;
+
+    let mut res = vec![];
+    while let Some(row) = rows.next().map_err(Error::Query)? {
+        res.push(Address::from_parts(
+            shard_root_level,
+            row.get(0).map_err(Error::Query)?,
+        ));
+    }
+    Ok(res)
+}
+
+pub(crate) fn truncate_shards(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    shard_index: u64,
+) -> Result<(), Error> {
+    conn.execute(
+        &format!(
+            "DELETE FROM {}_tree_shards WHERE shard_index >= ?",
+            table_prefix
+        ),
+        [shard_index],
+    )
+    .map_err(Error::Query)
+    .map(|_| ())
+}
+
+#[tracing::instrument(skip(conn))]
+pub(crate) fn get_cap<H: HashSer>(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+) -> Result<PrunableTree<H>, Error> {
+    conn.query_row(
+        &format!("SELECT cap_data FROM {}_tree_cap", table_prefix),
+        [],
+        |row| row.get::<_, Vec<u8>>(0),
+    )
+    .optional()
+    .map_err(Error::Query)?
+    .map_or_else(
+        || Ok(PrunableTree::empty()),
+        |cap_data| read_shard(&mut Cursor::new(cap_data)).map_err(Error::Serialization),
+    )
+}
+
+#[tracing::instrument(skip(conn, cap))]
+pub(crate) fn put_cap<H: HashSer>(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    cap: PrunableTree<H>,
+) -> Result<(), Error> {
+    let mut stmt = conn
+        .prepare_cached(&format!(
+            "INSERT INTO {}_tree_cap (cap_id, cap_data)
+             VALUES (0, :cap_data)
+             ON CONFLICT (cap_id) DO UPDATE
+             SET cap_data = :cap_data",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+
+    let mut cap_data = vec![];
+    write_shard(&mut cap_data, &cap).map_err(Error::Serialization)?;
+    stmt.execute([cap_data]).map_err(Error::Query)?;
+
+    Ok(())
+}
+
+pub(crate) fn min_checkpoint_id(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+) -> Result<Option<BlockHeight>, Error> {
+    conn.query_row(
+        &format!(
+            "SELECT MIN(checkpoint_id) FROM {}_tree_checkpoints",
+            table_prefix
+        ),
+        [],
+        |row| {
+            row.get::<_, Option<u32>>(0)
+                .map(|opt| opt.map(BlockHeight::from))
+        },
+    )
+    .map_err(Error::Query)
+}
+
+pub(crate) fn max_checkpoint_id(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+) -> Result<Option<BlockHeight>, Error> {
+    conn.query_row(
+        &format!(
+            "SELECT MAX(checkpoint_id) FROM {}_tree_checkpoints",
+            table_prefix
+        ),
+        [],
+        |row| {
+            row.get::<_, Option<u32>>(0)
+                .map(|opt| opt.map(BlockHeight::from))
+        },
+    )
+    .map_err(Error::Query)
+}
+
+pub(crate) fn add_checkpoint(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    checkpoint_id: BlockHeight,
+    checkpoint: Checkpoint,
+) -> Result<(), Error> {
+    let extant_tree_state = conn
+        .query_row(
+            &format!(
+                "SELECT position FROM {}_tree_checkpoints WHERE checkpoint_id = :checkpoint_id",
+                table_prefix
+            ),
+            named_params![":checkpoint_id": u32::from(checkpoint_id),],
+            |row| {
+                row.get::<_, Option<u64>>(0).map(|opt| {
+                    opt.map_or_else(
+                        || TreeState::Empty,
+                        |pos| TreeState::AtPosition(Position::from(pos)),
+                    )
+                })
+            },
+        )
+        .optional()
+        .map_err(Error::Query)?;
+
+    match extant_tree_state {
+        Some(current) => {
+            if current != checkpoint.tree_state() {
+                // If the checkpoint position for a given checkpoint identifier has changed, we treat
+                // this as an error because the wallet should have detected a chain reorg and truncated
+                // the tree.
+                Err(Error::CheckpointConflict {
+                    checkpoint_id,
+                    checkpoint,
+                    extant_tree_state: current,
+                    extant_marks_removed: None,
+                })
+            } else {
+                // if the existing spends are the same, we can skip the insert; if the
+                // existing spends have changed, this is also a conflict.
+                let marks_removed = get_marks_removed(conn, table_prefix, checkpoint_id)?;
+                if &marks_removed == checkpoint.marks_removed() {
+                    Ok(())
+                } else {
+                    Err(Error::CheckpointConflict {
+                        checkpoint_id,
+                        checkpoint,
+                        extant_tree_state: current,
+                        extant_marks_removed: Some(marks_removed),
+                    })
+                }
+            }
+        }
+        None => {
+            let mut stmt_insert_checkpoint = conn
+                .prepare_cached(&format!(
+                    "INSERT INTO {}_tree_checkpoints (checkpoint_id, position)
+                     VALUES (:checkpoint_id, :position)",
+                    table_prefix
+                ))
+                .map_err(Error::Query)?;
+
+            stmt_insert_checkpoint
+                .execute(named_params![
+                    ":checkpoint_id": u32::from(checkpoint_id),
+                    ":position": checkpoint.position().map(u64::from)
+                ])
+                .map_err(Error::Query)?;
+
+            let mut stmt_insert_mark_removed = conn
+                .prepare_cached(&format!(
+                    "INSERT INTO {}_tree_checkpoint_marks_removed (checkpoint_id, mark_removed_position)
+                     VALUES (:checkpoint_id, :position)",
+                    table_prefix
+                ))
+                .map_err(Error::Query)?;
+
+            for pos in checkpoint.marks_removed() {
+                stmt_insert_mark_removed
+                    .execute(named_params![
+                        ":checkpoint_id": u32::from(checkpoint_id),
+                        ":position": u64::from(*pos)
+                    ])
+                    .map_err(Error::Query)?;
+            }
+
+            Ok(())
+        }
+    }
+}
+
+pub(crate) fn checkpoint_count(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+) -> Result<usize, Error> {
+    conn.query_row(
+        &format!("SELECT COUNT(*) FROM {}_tree_checkpoints", table_prefix),
+        [],
+        |row| row.get::<_, usize>(0),
+    )
+    .map_err(Error::Query)
+}
+
+fn get_marks_removed(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    checkpoint_id: BlockHeight,
+) -> Result<BTreeSet<Position>, Error> {
+    let mut stmt = conn
+        .prepare_cached(&format!(
+            "SELECT mark_removed_position
+            FROM {}_tree_checkpoint_marks_removed
+            WHERE checkpoint_id = ?",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+    let mark_removed_rows = stmt
+        .query([u32::from(checkpoint_id)])
+        .map_err(Error::Query)?;
+
+    mark_removed_rows
+        .mapped(|row| row.get::<_, u64>(0).map(Position::from))
+        .collect::<Result<BTreeSet<_>, _>>()
+        .map_err(Error::Query)
+}
+
+pub(crate) fn get_checkpoint(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    checkpoint_id: BlockHeight,
+) -> Result<Option<Checkpoint>, Error> {
+    let checkpoint_position = conn
+        .query_row(
+            &format!(
+                "SELECT position
+                 FROM {}_tree_checkpoints
+                 WHERE checkpoint_id = ?",
+                table_prefix
+            ),
+            [u32::from(checkpoint_id)],
+            |row| {
+                row.get::<_, Option<u64>>(0)
+                    .map(|opt| opt.map(Position::from))
+            },
+        )
+        .optional()
+        .map_err(Error::Query)?;
+
+    checkpoint_position
+        .map(|pos_opt| {
+            Ok(Checkpoint::from_parts(
+                pos_opt.map_or(TreeState::Empty, TreeState::AtPosition),
+                get_marks_removed(conn, table_prefix, checkpoint_id)?,
+            ))
+        })
+        .transpose()
+}
+
+pub(crate) fn get_max_checkpointed_height(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    chain_tip_height: BlockHeight,
+    min_confirmations: NonZeroU32,
+) -> Result<Option<BlockHeight>, rusqlite::Error> {
+    let max_checkpoint_height =
+        u32::from(chain_tip_height).saturating_sub(u32::from(min_confirmations) - 1);
+
+    // We exclude from consideration all checkpoints having heights greater than the maximum
+    // checkpoint height. The checkpoint depth is the number of excluded checkpoints + 1.
+    conn.query_row(
+        &format!(
+            "SELECT checkpoint_id
+             FROM {}_tree_checkpoints
+             WHERE checkpoint_id <= :max_checkpoint_height
+             ORDER BY checkpoint_id DESC
+             LIMIT 1",
+            table_prefix
+        ),
+        named_params![":max_checkpoint_height": max_checkpoint_height],
+        |row| row.get::<_, u32>(0).map(BlockHeight::from),
+    )
+    .optional()
+}
+
+pub(crate) fn get_checkpoint_at_depth(
+    conn: &rusqlite::Connection,
+    table_prefix: &'static str,
+    checkpoint_depth: usize,
+) -> Result<Option<(BlockHeight, Checkpoint)>, rusqlite::Error> {
+    let checkpoint_parts = conn
+        .query_row(
+            &format!(
+                "SELECT checkpoint_id, position
+                FROM {}_tree_checkpoints
+                ORDER BY checkpoint_id DESC
+                LIMIT 1
+                OFFSET :offset",
+                table_prefix
+            ),
+            named_params![":offset": checkpoint_depth],
+            |row| {
+                let checkpoint_id: u32 = row.get(0)?;
+                let position: Option<u64> = row.get(1)?;
+                Ok((
+                    BlockHeight::from(checkpoint_id),
+                    position.map(Position::from),
+                ))
+            },
+        )
+        .optional()?;
+
+    checkpoint_parts
+        .map(|(checkpoint_id, pos_opt)| {
+            let mut stmt = conn.prepare_cached(&format!(
+                "SELECT mark_removed_position
+                    FROM {}_tree_checkpoint_marks_removed
+                    WHERE checkpoint_id = ?",
+                table_prefix
+            ))?;
+            let mark_removed_rows = stmt.query([u32::from(checkpoint_id)])?;
+
+            let marks_removed = mark_removed_rows
+                .mapped(|row| row.get::<_, u64>(0).map(Position::from))
+                .collect::<Result<BTreeSet<_>, _>>()?;
+
+            Ok((
+                checkpoint_id,
+                Checkpoint::from_parts(
+                    pos_opt.map_or(TreeState::Empty, TreeState::AtPosition),
+                    marks_removed,
+                ),
+            ))
+        })
+        .transpose()
+}
+
+pub(crate) fn with_checkpoints<F>(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    limit: usize,
+    mut callback: F,
+) -> Result<(), Error>
+where
+    F: FnMut(&BlockHeight, &Checkpoint) -> Result<(), Error>,
+{
+    let mut stmt_get_checkpoints = conn
+        .prepare_cached(&format!(
+            "SELECT checkpoint_id, position
+            FROM {}_tree_checkpoints
+            ORDER BY position
+            LIMIT :limit",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+
+    let mut stmt_get_checkpoint_marks_removed = conn
+        .prepare_cached(&format!(
+            "SELECT mark_removed_position
+            FROM {}_tree_checkpoint_marks_removed
+            WHERE checkpoint_id = :checkpoint_id",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+
+    let mut rows = stmt_get_checkpoints
+        .query(named_params![":limit": limit])
+        .map_err(Error::Query)?;
+
+    while let Some(row) = rows.next().map_err(Error::Query)? {
+        let checkpoint_id = row.get::<_, u32>(0).map_err(Error::Query)?;
+        let tree_state = row
+            .get::<_, Option<u64>>(1)
+            .map(|opt| opt.map_or_else(|| TreeState::Empty, |p| TreeState::AtPosition(p.into())))
+            .map_err(Error::Query)?;
+
+        let mark_removed_rows = stmt_get_checkpoint_marks_removed
+            .query(named_params![":checkpoint_id": checkpoint_id])
+            .map_err(Error::Query)?;
+
+        let marks_removed = mark_removed_rows
+            .mapped(|row| row.get::<_, u64>(0).map(Position::from))
+            .collect::<Result<BTreeSet<_>, _>>()
+            .map_err(Error::Query)?;
+
+        callback(
+            &BlockHeight::from(checkpoint_id),
+            &Checkpoint::from_parts(tree_state, marks_removed),
+        )?
+    }
+
+    Ok(())
+}
+
+pub(crate) fn update_checkpoint_with<F>(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    checkpoint_id: BlockHeight,
+    update: F,
+) -> Result<bool, Error>
+where
+    F: Fn(&mut Checkpoint) -> Result<(), Error>,
+{
+    if let Some(mut c) = get_checkpoint(conn, table_prefix, checkpoint_id)? {
+        update(&mut c)?;
+        remove_checkpoint(conn, table_prefix, checkpoint_id)?;
+        add_checkpoint(conn, table_prefix, checkpoint_id, c)?;
+        Ok(true)
+    } else {
+        Ok(false)
+    }
+}
+
+pub(crate) fn remove_checkpoint(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    checkpoint_id: BlockHeight,
+) -> Result<(), Error> {
+    // cascading delete here obviates the need to manually delete from
+    // `tree_checkpoint_marks_removed`
+    let mut stmt_delete_checkpoint = conn
+        .prepare_cached(&format!(
+            "DELETE FROM {}_tree_checkpoints
+             WHERE checkpoint_id = :checkpoint_id",
+            table_prefix
+        ))
+        .map_err(Error::Query)?;
+
+    stmt_delete_checkpoint
+        .execute(named_params![":checkpoint_id": u32::from(checkpoint_id),])
+        .map_err(Error::Query)?;
+
+    Ok(())
+}
+
+pub(crate) fn truncate_checkpoints_retaining(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    checkpoint_id: BlockHeight,
+) -> Result<(), Error> {
+    // cascading delete here obviates the need to manually delete from
+    // `<protocol>_tree_checkpoint_marks_removed`
+    conn.execute(
+        &format!(
+            "DELETE FROM {}_tree_checkpoints WHERE checkpoint_id > ?",
+            table_prefix
+        ),
+        [u32::from(checkpoint_id)],
+    )
+    .map_err(Error::Query)?;
+
+    // we do however need to manually delete any marks associated with the retained checkpoint
+    conn.execute(
+        &format!(
+            "DELETE FROM {}_tree_checkpoint_marks_removed WHERE checkpoint_id = ?",
+            table_prefix
+        ),
+        [u32::from(checkpoint_id)],
+    )
+    .map_err(Error::Query)?;
+
+    Ok(())
+}
+
+#[tracing::instrument(skip(conn, roots))]
+pub(crate) fn put_shard_roots<
+    H: Hashable + HashSer + Clone + Eq,
+    const DEPTH: u8,
+    const SHARD_HEIGHT: u8,
+>(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+    start_index: u64,
+    roots: &[CommitmentTreeRoot<H>],
+) -> Result<(), ShardTreeError<Error>> {
+    if roots.is_empty() {
+        // nothing to do
+        return Ok(());
+    }
+
+    // We treat the cap as a tree with `DEPTH - SHARD_HEIGHT` levels, so that we can make a
+    // batch insertion of root data using `Position::from(start_index)` as the starting position
+    // and treating the roots as level-0 leaves.
+    #[derive(Clone, Debug, PartialEq, Eq)]
+    struct LevelShifter<H, const SHARD_HEIGHT: u8>(H);
+    impl<H: Hashable, const SHARD_HEIGHT: u8> Hashable for LevelShifter<H, SHARD_HEIGHT> {
+        fn empty_leaf() -> Self {
+            Self(H::empty_root(SHARD_HEIGHT.into()))
+        }
+
+        fn combine(level: Level, a: &Self, b: &Self) -> Self {
+            Self(H::combine(level + SHARD_HEIGHT, &a.0, &b.0))
+        }
+
+        fn empty_root(level: Level) -> Self
+        where
+            Self: Sized,
+        {
+            Self(H::empty_root(level + SHARD_HEIGHT))
+        }
+    }
+    impl<H: HashSer, const SHARD_HEIGHT: u8> HashSer for LevelShifter<H, SHARD_HEIGHT> {
+        fn read<R: io::Read>(reader: R) -> io::Result<Self>
+        where
+            Self: Sized,
+        {
+            H::read(reader).map(Self)
+        }
+
+        fn write<W: io::Write>(&self, writer: W) -> io::Result<()> {
+            self.0.write(writer)
+        }
+    }
+
+    let cap = LocatedTree::from_parts(
+        Address::from_parts((DEPTH - SHARD_HEIGHT).into(), 0),
+        get_cap::<LevelShifter<H, SHARD_HEIGHT>>(conn, table_prefix)
+            .map_err(ShardTreeError::Storage)?,
+    );
+
+    let insert_into_cap = tracing::info_span!("insert_into_cap").entered();
+    let cap_result = cap
+        .batch_insert::<(), _>(
+            Position::from(start_index),
+            roots
+                .iter()
+                .map(|r| (LevelShifter(r.root_hash().clone()), Retention::Reference)),
+        )
+        .map_err(ShardTreeError::Insert)?
+        .expect("slice of inserted roots was verified to be nonempty");
+    drop(insert_into_cap);
+
+    put_cap(conn, table_prefix, cap_result.subtree.take_root()).map_err(ShardTreeError::Storage)?;
+
+    check_shard_discontinuity(
+        conn,
+        table_prefix,
+        start_index..start_index + (roots.len() as u64),
+    )
+    .map_err(ShardTreeError::Storage)?;
+
+    // We want to avoid deserializing the subtree just to annotate its root node, so we simply
+    // cache the downloaded root alongside of any already-persisted subtree. We will update the
+    // subtree data itself by reannotating the root node of the tree, handling conflicts, at
+    // the time that we deserialize the tree.
+    let mut stmt = conn
+        .prepare_cached(&format!(
+            "INSERT INTO {}_tree_shards (shard_index, subtree_end_height, root_hash, shard_data)
+            VALUES (:shard_index, :subtree_end_height, :root_hash, :shard_data)
+            ON CONFLICT (shard_index) DO UPDATE
+            SET subtree_end_height = :subtree_end_height, root_hash = :root_hash",
+            table_prefix
+        ))
+        .map_err(|e| ShardTreeError::Storage(Error::Query(e)))?;
+
+    let put_roots = tracing::info_span!("write_shards").entered();
+    for (root, i) in roots.iter().zip(0u64..) {
+        // The `shard_data` value will only be used in the case that no tree already exists.
+        let mut shard_data: Vec<u8> = vec![];
+        let tree = PrunableTree::leaf((root.root_hash().clone(), RetentionFlags::EPHEMERAL));
+        write_shard(&mut shard_data, &tree)
+            .map_err(|e| ShardTreeError::Storage(Error::Serialization(e)))?;
+
+        let mut root_hash_data: Vec<u8> = vec![];
+        root.root_hash()
+            .write(&mut root_hash_data)
+            .map_err(|e| ShardTreeError::Storage(Error::Serialization(e)))?;
+
+        stmt.execute(named_params![
+            ":shard_index": start_index + i,
+            ":subtree_end_height": u32::from(root.subtree_end_height()),
+            ":root_hash": root_hash_data,
+            ":shard_data": shard_data,
+        ])
+        .map_err(|e| ShardTreeError::Storage(Error::Query(e)))?;
+    }
+    drop(put_roots);
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use tempfile::NamedTempFile;
+
+    use incrementalmerkletree::{Marking, Position, Retention};
+    use incrementalmerkletree_testing::{
+        check_append, check_checkpoint_rewind, check_remove_mark, check_rewind_remove_mark,
+        check_root_hashes, check_witness_consistency, check_witnesses,
+    };
+    use shardtree::ShardTree;
+    use zcash_client_backend::data_api::{
+        chain::CommitmentTreeRoot,
+        testing::{pool::ShieldedPoolTester, sapling::SaplingPoolTester},
+    };
+    use zcash_primitives::consensus::{BlockHeight, Network};
+
+    use super::SqliteShardStore;
+    use crate::{testing::pool::ShieldedPoolPersistence, wallet::init::init_wallet_db, WalletDb};
+
+    fn new_tree<T: ShieldedPoolTester + ShieldedPoolPersistence>(
+        m: usize,
+    ) -> ShardTree<SqliteShardStore<rusqlite::Connection, String, 3>, 4, 3> {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+        data_file.keep().unwrap();
+
+        init_wallet_db(&mut db_data, None).unwrap();
+        let store =
+            SqliteShardStore::<_, String, 3>::from_connection(db_data.conn, T::TABLES_PREFIX)
+                .unwrap();
+        ShardTree::new(store, m)
+    }
+
+    #[cfg(feature = "orchard")]
+    mod orchard {
+        use super::new_tree;
+        use zcash_client_backend::data_api::testing::orchard::OrchardPoolTester;
+
+        #[test]
+        fn append() {
+            super::check_append(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn root_hashes() {
+            super::check_root_hashes(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn witnesses() {
+            super::check_witnesses(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn witness_consistency() {
+            super::check_witness_consistency(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn checkpoint_rewind() {
+            super::check_checkpoint_rewind(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn remove_mark() {
+            super::check_remove_mark(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn rewind_remove_mark() {
+            super::check_rewind_remove_mark(new_tree::<OrchardPoolTester>);
+        }
+
+        #[test]
+        fn put_shard_roots() {
+            super::put_shard_roots::<OrchardPoolTester>()
+        }
+    }
+
+    #[test]
+    fn sapling_append() {
+        check_append(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_root_hashes() {
+        check_root_hashes(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_witnesses() {
+        check_witnesses(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_witness_consistency() {
+        check_witness_consistency(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_checkpoint_rewind() {
+        check_checkpoint_rewind(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_remove_mark() {
+        check_remove_mark(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_rewind_remove_mark() {
+        check_rewind_remove_mark(new_tree::<SaplingPoolTester>);
+    }
+
+    #[test]
+    fn sapling_put_shard_roots() {
+        put_shard_roots::<SaplingPoolTester>()
+    }
+
+    fn put_shard_roots<T: ShieldedPoolTester + ShieldedPoolPersistence>() {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+        data_file.keep().unwrap();
+
+        init_wallet_db(&mut db_data, None).unwrap();
+        let tx = db_data.conn.transaction().unwrap();
+        let store =
+            SqliteShardStore::<_, String, 3>::from_connection(&tx, T::TABLES_PREFIX).unwrap();
+
+        // introduce some roots
+        let roots = (0u32..4)
+            .map(|idx| {
+                CommitmentTreeRoot::from_parts(
+                    BlockHeight::from((idx + 1) * 3),
+                    if idx == 3 {
+                        "abcdefgh".to_string()
+                    } else {
+                        idx.to_string()
+                    },
+                )
+            })
+            .collect::<Vec<_>>();
+        super::put_shard_roots::<_, 6, 3>(store.conn, T::TABLES_PREFIX, 0, &roots).unwrap();
+
+        // simulate discovery of a note
+        let mut tree = ShardTree::<_, 6, 3>::new(store, 10);
+        let checkpoint_height = BlockHeight::from(3);
+        tree.batch_insert(
+            Position::from(24),
+            ('a'..='h').map(|c| {
+                (
+                    c.to_string(),
+                    match c {
+                        'c' => Retention::Marked,
+                        'h' => Retention::Checkpoint {
+                            id: checkpoint_height,
+                            marking: Marking::None,
+                        },
+                        _ => Retention::Ephemeral,
+                    },
+                )
+            }),
+        )
+        .unwrap();
+
+        // construct a witness for the note
+        let witness = tree
+            .witness_at_checkpoint_id(Position::from(26), &checkpoint_height)
+            .unwrap();
+        assert_eq!(
+            witness
+                .expect("an anchor exists at the expected checkpoint height")
+                .path_elems(),
+            &[
+                "d",
+                "ab",
+                "efgh",
+                "2",
+                "01",
+                "________________________________"
+            ]
+        );
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/common.rs b/zcash_client_sqlite/src/wallet/common.rs
new file mode 100644
index 0000000000..ac9e3834ee
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/common.rs
@@ -0,0 +1,426 @@
+//! Functions common to Sapling and Orchard support in the wallet.
+
+use rusqlite::{named_params, types::Value, Connection, Row};
+use std::{num::NonZeroU64, rc::Rc};
+
+use zcash_client_backend::{
+    data_api::{NoteFilter, PoolMeta},
+    wallet::ReceivedNote,
+    ShieldedProtocol,
+};
+use zcash_primitives::transaction::{components::amount::NonNegativeAmount, TxId};
+use zcash_protocol::{
+    consensus::{self, BlockHeight},
+    value::BalanceError,
+    PoolType,
+};
+
+use super::wallet_birthday;
+use crate::{
+    error::SqliteClientError, wallet::pool_code, AccountUuid, ReceivedNoteId, SAPLING_TABLES_PREFIX,
+};
+
+#[cfg(feature = "orchard")]
+use crate::ORCHARD_TABLES_PREFIX;
+
+pub(crate) fn per_protocol_names(
+    protocol: ShieldedProtocol,
+) -> (&'static str, &'static str, &'static str) {
+    match protocol {
+        ShieldedProtocol::Sapling => (SAPLING_TABLES_PREFIX, "output_index", "rcm"),
+        #[cfg(feature = "orchard")]
+        ShieldedProtocol::Orchard => (ORCHARD_TABLES_PREFIX, "action_index", "rho, rseed"),
+        #[cfg(not(feature = "orchard"))]
+        ShieldedProtocol::Orchard => {
+            unreachable!("Should never be called unless the `orchard` feature is enabled")
+        }
+    }
+}
+
+fn unscanned_tip_exists(
+    conn: &Connection,
+    anchor_height: BlockHeight,
+    table_prefix: &'static str,
+) -> Result<bool, rusqlite::Error> {
+    // v_sapling_shard_unscanned_ranges only returns ranges ending on or after wallet birthday, so
+    // we don't need to refer to the birthday in this query.
+    conn.query_row(
+        &format!(
+            "SELECT EXISTS (
+                 SELECT 1 FROM v_{table_prefix}_shard_unscanned_ranges range
+                 WHERE range.block_range_start <= :anchor_height
+                 AND :anchor_height BETWEEN
+                    range.subtree_start_height
+                    AND IFNULL(range.subtree_end_height, :anchor_height)
+             )"
+        ),
+        named_params![":anchor_height": u32::from(anchor_height),],
+        |row| row.get::<_, bool>(0),
+    )
+}
+
+// The `clippy::let_and_return` lint is explicitly allowed here because a bug in Clippy
+// (https://github.com/rust-lang/rust-clippy/issues/11308) means it fails to identify that the `result` temporary
+// is required in order to resolve the borrows involved in the `query_and_then` call.
+#[allow(clippy::let_and_return)]
+pub(crate) fn get_spendable_note<P: consensus::Parameters, F, Note>(
+    conn: &Connection,
+    params: &P,
+    txid: &TxId,
+    index: u32,
+    protocol: ShieldedProtocol,
+    to_spendable_note: F,
+) -> Result<Option<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError>
+where
+    F: Fn(&P, &Row) -> Result<Option<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError>,
+{
+    let (table_prefix, index_col, note_reconstruction_cols) = per_protocol_names(protocol);
+    let result = conn.query_row_and_then(
+        &format!(
+            "SELECT rn.id, txid, {index_col},
+                diversifier, value, {note_reconstruction_cols}, commitment_tree_position,
+                accounts.ufvk, recipient_key_scope
+             FROM {table_prefix}_received_notes rn
+             INNER JOIN accounts ON accounts.id = rn.account_id
+             INNER JOIN transactions ON transactions.id_tx = rn.tx
+             WHERE txid = :txid
+             AND transactions.block IS NOT NULL
+             AND {index_col} = :output_index
+             AND accounts.ufvk IS NOT NULL
+             AND recipient_key_scope IS NOT NULL
+             AND nf IS NOT NULL
+             AND commitment_tree_position IS NOT NULL
+             AND rn.id NOT IN (
+               SELECT {table_prefix}_received_note_id
+               FROM {table_prefix}_received_note_spends
+               JOIN transactions stx ON stx.id_tx = transaction_id
+               WHERE stx.block IS NOT NULL -- the spending tx is mined
+               OR stx.expiry_height IS NULL -- the spending tx will not expire
+             )"
+        ),
+        named_params![
+           ":txid": txid.as_ref(),
+           ":output_index": index,
+        ],
+        |row| to_spendable_note(params, row),
+    );
+
+    // `OptionalExtension` doesn't work here because the error type of `Result` is already
+    // `SqliteClientError`
+    match result {
+        Ok(r) => Ok(r),
+        Err(SqliteClientError::DbError(rusqlite::Error::QueryReturnedNoRows)) => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn select_spendable_notes<P: consensus::Parameters, F, Note>(
+    conn: &Connection,
+    params: &P,
+    account: AccountUuid,
+    target_value: NonNegativeAmount,
+    anchor_height: BlockHeight,
+    exclude: &[ReceivedNoteId],
+    protocol: ShieldedProtocol,
+    to_spendable_note: F,
+) -> Result<Vec<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError>
+where
+    F: Fn(&P, &Row) -> Result<Option<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError>,
+{
+    let birthday_height = match wallet_birthday(conn)? {
+        Some(birthday) => birthday,
+        None => {
+            // the wallet birthday can only be unknown if there are no accounts in the wallet; in
+            // such a case, the wallet has no notes to spend.
+            return Ok(vec![]);
+        }
+    };
+
+    let (table_prefix, index_col, note_reconstruction_cols) = per_protocol_names(protocol);
+    if unscanned_tip_exists(conn, anchor_height, table_prefix)? {
+        return Ok(vec![]);
+    }
+
+    // The goal of this SQL statement is to select the oldest notes until the required
+    // value has been reached.
+    // 1) Use a window function to create a view of all notes, ordered from oldest to
+    //    newest, with an additional column containing a running sum:
+    //    - Unspent notes accumulate the values of all unspent notes in that note's
+    //      account, up to itself.
+    //    - Spent notes accumulate the values of all notes in the transaction they were
+    //      spent in, up to itself.
+    //
+    // 2) Select all unspent notes in the desired account, along with their running sum.
+    //
+    // 3) Select all notes for which the running sum was less than the required value, as
+    //    well as a single note for which the sum was greater than or equal to the
+    //    required value, bringing the sum of all selected notes across the threshold.
+    let mut stmt_select_notes = conn.prepare_cached(
+        &format!(
+            "WITH eligible AS (
+                 SELECT
+                     {table_prefix}_received_notes.id AS id, txid, {index_col},
+                     diversifier, value, {note_reconstruction_cols}, commitment_tree_position,
+                     SUM(value) OVER (ROWS UNBOUNDED PRECEDING) AS so_far,
+                     accounts.ufvk as ufvk, recipient_key_scope
+                 FROM {table_prefix}_received_notes
+                 INNER JOIN accounts
+                    ON accounts.id = {table_prefix}_received_notes.account_id
+                 INNER JOIN transactions
+                    ON transactions.id_tx = {table_prefix}_received_notes.tx
+                 WHERE accounts.uuid = :account_uuid
+                 AND {table_prefix}_received_notes.account_id = accounts.id
+                 AND value > 5000 -- FIXME #1316, allow selection of dust inputs
+                 AND accounts.ufvk IS NOT NULL
+                 AND recipient_key_scope IS NOT NULL
+                 AND nf IS NOT NULL
+                 AND commitment_tree_position IS NOT NULL
+                 AND transactions.block <= :anchor_height
+                 AND {table_prefix}_received_notes.id NOT IN rarray(:exclude)
+                 AND {table_prefix}_received_notes.id NOT IN (
+                   SELECT {table_prefix}_received_note_id
+                   FROM {table_prefix}_received_note_spends
+                   JOIN transactions stx ON stx.id_tx = transaction_id
+                   WHERE stx.block IS NOT NULL -- the spending tx is mined
+                   OR stx.expiry_height IS NULL -- the spending tx will not expire
+                   OR stx.expiry_height > :anchor_height -- the spending tx is unexpired
+                 )
+                 AND NOT EXISTS (
+                    SELECT 1 FROM v_{table_prefix}_shard_unscanned_ranges unscanned
+                    -- select all the unscanned ranges involving the shard containing this note
+                    WHERE {table_prefix}_received_notes.commitment_tree_position >= unscanned.start_position
+                    AND {table_prefix}_received_notes.commitment_tree_position < unscanned.end_position_exclusive
+                    -- exclude unscanned ranges that start above the anchor height (they don't affect spendability)
+                    AND unscanned.block_range_start <= :anchor_height
+                    -- exclude unscanned ranges that end below the wallet birthday
+                    AND unscanned.block_range_end > :wallet_birthday
+                 )
+             )
+             SELECT id, txid, {index_col},
+                    diversifier, value, {note_reconstruction_cols}, commitment_tree_position,
+                    ufvk, recipient_key_scope
+             FROM eligible WHERE so_far < :target_value
+             UNION
+             SELECT id, txid, {index_col},
+                    diversifier, value, {note_reconstruction_cols}, commitment_tree_position,
+                    ufvk, recipient_key_scope
+             FROM (SELECT * from eligible WHERE so_far >= :target_value LIMIT 1)",
+        )
+    )?;
+
+    let excluded: Vec<Value> = exclude
+        .iter()
+        .filter_map(|ReceivedNoteId(p, n)| {
+            if *p == protocol {
+                Some(Value::from(*n))
+            } else {
+                None
+            }
+        })
+        .collect();
+    let excluded_ptr = Rc::new(excluded);
+
+    let notes = stmt_select_notes.query_and_then(
+        named_params![
+            ":account_uuid": account.0,
+            ":anchor_height": &u32::from(anchor_height),
+            ":target_value": &u64::from(target_value),
+            ":exclude": &excluded_ptr,
+            ":wallet_birthday": u32::from(birthday_height)
+        ],
+        |r| to_spendable_note(params, r),
+    )?;
+
+    notes
+        .filter_map(|r| r.transpose())
+        .collect::<Result<_, _>>()
+}
+
+pub(crate) fn spendable_notes_meta(
+    conn: &rusqlite::Connection,
+    protocol: ShieldedProtocol,
+    chain_tip_height: BlockHeight,
+    account: AccountUuid,
+    filter: &NoteFilter,
+    exclude: &[ReceivedNoteId],
+) -> Result<Option<PoolMeta>, SqliteClientError> {
+    let (table_prefix, _, _) = per_protocol_names(protocol);
+
+    let excluded: Vec<Value> = exclude
+        .iter()
+        .filter_map(|ReceivedNoteId(p, n)| {
+            if *p == protocol {
+                Some(Value::from(*n))
+            } else {
+                None
+            }
+        })
+        .collect();
+    let excluded_ptr = Rc::new(excluded);
+
+    fn zatoshis(value: i64) -> Result<NonNegativeAmount, SqliteClientError> {
+        NonNegativeAmount::from_nonnegative_i64(value).map_err(|_| {
+            SqliteClientError::CorruptedData(format!("Negative received note value: {}", value))
+        })
+    }
+
+    let run_selection = |min_value| {
+        conn.query_row_and_then::<_, SqliteClientError, _, _>(
+            &format!(
+                "SELECT COUNT(*), SUM(rn.value)
+                 FROM {table_prefix}_received_notes rn
+                 INNER JOIN accounts a ON a.id = rn.account_id
+                 INNER JOIN transactions ON transactions.id_tx = rn.tx
+                 WHERE a.uuid = :account_uuid
+                 AND a.ufvk IS NOT NULL
+                 AND rn.value >= :min_value
+                 AND transactions.mined_height IS NOT NULL
+                 AND rn.id NOT IN rarray(:exclude)
+                 AND rn.id NOT IN (
+                   SELECT {table_prefix}_received_note_id
+                   FROM {table_prefix}_received_note_spends rns
+                   JOIN transactions stx ON stx.id_tx = rns.transaction_id
+                   WHERE stx.block IS NOT NULL -- the spending tx is mined
+                   OR stx.expiry_height IS NULL -- the spending tx will not expire
+                   OR stx.expiry_height > :chain_tip_height -- the spending tx is unexpired
+                 )"
+            ),
+            named_params![
+                ":account_uuid": account.0,
+                ":min_value": u64::from(min_value),
+                ":exclude": &excluded_ptr,
+                ":chain_tip_height": u32::from(chain_tip_height)
+            ],
+            |row| {
+                Ok((
+                    row.get::<_, usize>(0)?,
+                    row.get::<_, Option<i64>>(1)?.map(zatoshis).transpose()?,
+                ))
+            },
+        )
+    };
+
+    // Evaluates the provided note filter conditions against the wallet database in order to
+    // determine the minimum value of notes to be produced by note splitting.
+    fn min_note_value(
+        conn: &rusqlite::Connection,
+        account: AccountUuid,
+        filter: &NoteFilter,
+        chain_tip_height: BlockHeight,
+    ) -> Result<Option<NonNegativeAmount>, SqliteClientError> {
+        match filter {
+            NoteFilter::ExceedsMinValue(v) => Ok(Some(*v)),
+            NoteFilter::ExceedsPriorSendPercentile(n) => {
+                let mut bucket_query = conn.prepare(
+                    "WITH bucketed AS (
+                        SELECT s.value, NTILE(10) OVER (ORDER BY s.value) AS bucket_index
+                        FROM sent_notes s
+                        JOIN transactions t ON s.tx = t.id_tx
+                        JOIN accounts a on a.id = s.from_account_id
+                        WHERE a.uuid = :account_uuid
+                        -- only count mined transactions
+                        AND t.mined_height IS NOT NULL
+                        -- exclude change and account-internal sends
+                        AND (s.to_account_id IS NULL OR s.from_account_id != s.to_account_id)
+                    )
+                    SELECT MAX(value) as value
+                    FROM bucketed
+                    GROUP BY bucket_index
+                    ORDER BY bucket_index",
+                )?;
+
+                let bucket_maxima = bucket_query
+                    .query_and_then::<_, SqliteClientError, _, _>(
+                        named_params![":account_uuid": account.0],
+                        |row| {
+                            NonNegativeAmount::from_nonnegative_i64(row.get::<_, i64>(0)?).map_err(
+                                |_| {
+                                    SqliteClientError::CorruptedData(format!(
+                                        "Negative received note value: {}",
+                                        n.value()
+                                    ))
+                                },
+                            )
+                        },
+                    )?
+                    .collect::<Result<Vec<_>, _>>()?;
+
+                // Pick a bucket index by scaling the requested percentile to the number of buckets
+                let i = (bucket_maxima.len() * usize::from(*n) / 100).saturating_sub(1);
+                Ok(bucket_maxima.get(i).copied())
+            }
+            NoteFilter::ExceedsBalancePercentage(p) => {
+                let balance = conn.query_row_and_then::<_, SqliteClientError, _, _>(
+                    "SELECT SUM(rn.value)
+                     FROM v_received_outputs rn
+                     INNER JOIN accounts a ON a.id = rn.account_id
+                     INNER JOIN transactions ON transactions.id_tx = rn.transaction_id
+                     WHERE a.uuid = :account_uuid
+                     AND a.ufvk IS NOT NULL
+                     AND transactions.mined_height IS NOT NULL
+                     AND rn.pool != :transparent_pool
+                     AND (rn.pool, rn.id_within_pool_table) NOT IN (
+                       SELECT rns.pool, rns.received_output_id
+                       FROM v_received_output_spends rns
+                       JOIN transactions stx ON stx.id_tx = rns.transaction_id
+                       WHERE (
+                           stx.block IS NOT NULL -- the spending tx is mined
+                           OR stx.expiry_height IS NULL -- the spending tx will not expire
+                           OR stx.expiry_height > :chain_tip_height -- the spending tx is unexpired
+                       )
+                     )",
+                    named_params![
+                        ":account_uuid": account.0,
+                        ":chain_tip_height": u32::from(chain_tip_height),
+                        ":transparent_pool": pool_code(PoolType::Transparent)
+                    ],
+                    |row| row.get::<_, Option<i64>>(0)?.map(zatoshis).transpose(),
+                )?;
+
+                Ok(match balance {
+                    None => None,
+                    Some(b) => {
+                        let numerator = (b * u64::from(p.value())).ok_or(BalanceError::Overflow)?;
+                        Some(numerator / NonZeroU64::new(100).expect("Constant is nonzero."))
+                    }
+                })
+            }
+            NoteFilter::Combine(a, b) => {
+                // All the existing note selectors set lower bounds on note value, so the "and"
+                // operation is just taking the maximum of the two lower bounds.
+                let a_min_value = min_note_value(conn, account, a.as_ref(), chain_tip_height)?;
+                let b_min_value = min_note_value(conn, account, b.as_ref(), chain_tip_height)?;
+                Ok(a_min_value
+                    .zip(b_min_value)
+                    .map(|(av, bv)| std::cmp::max(av, bv))
+                    .or(a_min_value)
+                    .or(b_min_value))
+            }
+            NoteFilter::Attempt {
+                condition,
+                fallback,
+            } => {
+                let cond = min_note_value(conn, account, condition.as_ref(), chain_tip_height)?;
+                if cond.is_none() {
+                    min_note_value(conn, account, fallback, chain_tip_height)
+                } else {
+                    Ok(cond)
+                }
+            }
+        }
+    }
+
+    // TODO: Simplify the query before executing it. Not worrying about this now because queries
+    // will be developer-configured, not end-user defined.
+    if let Some(min_value) = min_note_value(conn, account, filter, chain_tip_height)? {
+        let (note_count, total_value) = run_selection(min_value)?;
+
+        Ok(Some(PoolMeta::new(
+            note_count,
+            total_value.unwrap_or(NonNegativeAmount::ZERO),
+        )))
+    } else {
+        Ok(None)
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/db.rs b/zcash_client_sqlite/src/wallet/db.rs
new file mode 100644
index 0000000000..a2f920afb3
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/db.rs
@@ -0,0 +1,1061 @@
+//! Documentation about the wallet database structure.
+//!
+//! The database structure is managed by [`crate::wallet::init::init_wallet_db`], which
+//! applies migrations (defined in `crate::wallet::init::migrations`) that produce the
+//! current structure.
+//!
+//! The SQL code in this module's constants encodes the current database structure, as
+//! represented internally by SQLite. We do not use these constants at runtime; instead we
+//! check the output of the migrations in `crate::wallet::init::tests::verify_schema`, to
+//! pin the expected database structure.
+
+// The constants in this module are only used in tests, but `#[cfg(test)]` prevents them
+// from showing up in `cargo doc --document-private-items`.
+#![allow(dead_code)]
+
+use static_assertions::const_assert_eq;
+
+use zcash_client_backend::data_api::{scanning::ScanPriority, GAP_LIMIT};
+use zcash_protocol::consensus::{NetworkUpgrade, Parameters};
+
+use crate::wallet::scanning::priority_code;
+
+/// Stores information about the accounts that the wallet is tracking.
+pub(super) const TABLE_ACCOUNTS: &str = r#"
+CREATE TABLE "accounts" (
+    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    name TEXT,
+    uuid BLOB NOT NULL,
+    account_kind INTEGER NOT NULL DEFAULT 0,
+    key_source TEXT,
+    hd_seed_fingerprint BLOB,
+    hd_account_index INTEGER,
+    ufvk TEXT,
+    uivk TEXT NOT NULL,
+    orchard_fvk_item_cache BLOB,
+    sapling_fvk_item_cache BLOB,
+    p2pkh_fvk_item_cache BLOB,
+    birthday_height INTEGER NOT NULL,
+    birthday_sapling_tree_size INTEGER,
+    birthday_orchard_tree_size INTEGER,
+    recover_until_height INTEGER,
+    has_spend_key INTEGER NOT NULL DEFAULT 1,
+    CHECK (
+      (
+        account_kind = 0
+        AND hd_seed_fingerprint IS NOT NULL
+        AND hd_account_index IS NOT NULL
+        AND ufvk IS NOT NULL
+      )
+      OR
+      (
+        account_kind = 1
+        AND (hd_seed_fingerprint IS NULL) = (hd_account_index IS NULL)
+      )
+    )
+)"#;
+pub(super) const INDEX_ACCOUNTS_UUID: &str =
+    r#"CREATE UNIQUE INDEX accounts_uuid ON accounts (uuid)"#;
+pub(super) const INDEX_ACCOUNTS_UFVK: &str =
+    r#"CREATE UNIQUE INDEX accounts_ufvk ON accounts (ufvk)"#;
+pub(super) const INDEX_ACCOUNTS_UIVK: &str =
+    r#"CREATE UNIQUE INDEX accounts_uivk ON accounts (uivk)"#;
+pub(super) const INDEX_HD_ACCOUNT: &str =
+    r#"CREATE UNIQUE INDEX hd_account ON accounts (hd_seed_fingerprint, hd_account_index)"#;
+
+/// Stores diversified Unified Addresses that have been generated from accounts in the
+/// wallet.
+///
+/// - The `cached_transparent_receiver_address` column contains the transparent receiver component
+///   of the UA. It is cached directly in the table to make account lookups for transparent outputs
+///   more efficient, enabling joins to [`TABLE_TRANSPARENT_RECEIVED_OUTPUTS`].
+pub(super) const TABLE_ADDRESSES: &str = r#"
+CREATE TABLE "addresses" (
+    account_id INTEGER NOT NULL,
+    diversifier_index_be BLOB NOT NULL,
+    address TEXT NOT NULL,
+    cached_transparent_receiver_address TEXT,
+    FOREIGN KEY (account_id) REFERENCES accounts(id),
+    CONSTRAINT diversification UNIQUE (account_id, diversifier_index_be)
+)"#;
+pub(super) const INDEX_ADDRESSES_ACCOUNTS: &str = r#"
+CREATE INDEX "addresses_accounts" ON "addresses" (
+    "account_id" ASC
+)"#;
+
+/// Stores ephemeral transparent addresses used for ZIP 320.
+///
+/// For each account, these addresses are allocated sequentially by address index under scope 2
+/// (`TransparentKeyScope::EPHEMERAL`) at the "change" level of the BIP 32 address hierarchy.
+/// The ephemeral addresses stored in the table are exactly the "reserved" ephemeral addresses
+/// (that is addresses that have been allocated for use in a ZIP 320 transaction proposal), plus
+/// the addresses at the next [`GAP_LIMIT`] indices.
+///
+/// Addresses are never removed. New ones should only be reserved via the
+/// `WalletWrite::reserve_next_n_ephemeral_addresses` API. All of the addresses in the table
+/// should be scanned for incoming funds.
+///
+/// ### Columns
+/// - `address` contains the string (Base58Check) encoding of a transparent P2PKH address.
+/// - `used_in_tx` indicates that the address has been used by this wallet in a transaction (which
+///   has not necessarily been mined yet). This should only be set once, when the txid is known.
+/// - `seen_in_tx` is non-null iff an output to the address has been seed in a transaction observed
+///   on the network and passed to `store_decrypted_tx`. The transaction may have been sent by this
+//    wallet or another one using the same seed, or by a TEX address recipient sending back the
+///   funds. This is used to advance the "gap", as well as to heuristically reduce the chance of
+///   address reuse collisions with another wallet using the same seed.
+///
+/// It is an external invariant that within each account:
+/// - the address indices are contiguous and start from 0;
+/// - the last [`GAP_LIMIT`] addresses have `used_in_tx` and `seen_in_tx` both NULL.
+///
+/// All but the last [`GAP_LIMIT`] addresses are defined to be "reserved" addresses. Since the next
+/// index to reserve is determined by dead reckoning from the last stored address, we use dummy
+/// entries having `NULL` for the value of the `address` column after the maximum valid index in
+/// order to allow the last [`GAP_LIMIT`] addresses at the end of the index range to be used.
+///
+/// Note that the fact that `used_in_tx` references a specific transaction is just a debugging aid.
+/// The same is mostly true of `seen_in_tx`, but we also take into account whether the referenced
+/// transaction is unmined in order to determine the last index that is safe to reserve.
+pub(super) const TABLE_EPHEMERAL_ADDRESSES: &str = r#"
+CREATE TABLE ephemeral_addresses (
+    account_id INTEGER NOT NULL,
+    address_index INTEGER NOT NULL,
+    -- nullability of this column is controlled by the index_range_and_address_nullity check
+    address TEXT,
+    used_in_tx INTEGER,
+    seen_in_tx INTEGER,
+    FOREIGN KEY (account_id) REFERENCES accounts(id),
+    FOREIGN KEY (used_in_tx) REFERENCES transactions(id_tx),
+    FOREIGN KEY (seen_in_tx) REFERENCES transactions(id_tx),
+    PRIMARY KEY (account_id, address_index),
+    CONSTRAINT ephemeral_addr_uniq UNIQUE (address),
+    CONSTRAINT used_implies_seen CHECK (
+        used_in_tx IS NULL OR seen_in_tx IS NOT NULL
+    ),
+    CONSTRAINT index_range_and_address_nullity CHECK (
+        (address_index BETWEEN 0 AND 0x7FFFFFFF AND address IS NOT NULL) OR
+        (address_index BETWEEN 0x80000000 AND 0x7FFFFFFF + 20 AND address IS NULL AND used_in_tx IS NULL AND seen_in_tx IS NULL)
+    )
+) WITHOUT ROWID"#;
+// Hexadecimal integer literals were added in SQLite version 3.8.6 (2014-08-15).
+// libsqlite3-sys requires at least version 3.14.0.
+// "WITHOUT ROWID" tells SQLite to use a clustered index on the (composite) primary key.
+const_assert_eq!(GAP_LIMIT, 20);
+
+/// Stores information about every block that the wallet has scanned.
+///
+/// Note that this table does not contain any rows for blocks that the wallet might have
+/// observed partial information about (for example, a transparent output fetched and
+/// stored in [`TABLE_TRANSPARENT_RECEIVED_OUTPUTS`]). This may change in future.
+pub(super) const TABLE_BLOCKS: &str = "
+CREATE TABLE blocks (
+    height INTEGER PRIMARY KEY,
+    hash BLOB NOT NULL,
+    time INTEGER NOT NULL,
+    sapling_tree BLOB NOT NULL ,
+    sapling_commitment_tree_size INTEGER,
+    orchard_commitment_tree_size INTEGER,
+    sapling_output_count INTEGER,
+    orchard_action_count INTEGER)";
+
+/// Stores the wallet's transactions.
+///
+/// Any transactions that the wallet observes as "belonging to" one of the accounts in
+/// [`TABLE_ACCOUNTS`] may be tracked in this table. As a result, this table may contain
+/// data that is not recoverable from the chain (for example, transactions created by the
+/// wallet that expired before being mined).
+///
+/// ### Columns
+/// - `created`: The time at which the transaction was created as a string in the format
+///   `yyyy-MM-dd HH:mm:ss.fffffffzzz`.
+/// - `block`: stores the height (in the wallet's chain view) of the mined block containing the
+///   transaction. It is `NULL` for transactions that have not yet been observed in scanned blocks,
+///   including transactions in the mempool or that have expired.
+/// - `mined_height`: stores the height (in the wallet's chain view) of the mined block containing
+///   the transaction. It is present to allow the block height for a retrieved transaction to be
+///   stored without requiring that the entire block containing the transaction be scanned; the
+///   foreign key constraint on `block` prevents that column from being populated prior to complete
+///   scanning of the block. This is constrained to be equal to the `block` column if `block` is
+///   non-null.
+/// - `target_height`: stores the target height for which the transaction was constructed, if
+///   known. This will ordinarily be null for transactions discovered via chain scanning; it
+///   will only be set for transactions created using this wallet specifically, and not any
+///   other wallet that uses the same seed (including previous installations of the same
+///   wallet application.)
+pub(super) const TABLE_TRANSACTIONS: &str = r#"
+CREATE TABLE "transactions" (
+    id_tx INTEGER PRIMARY KEY,
+    txid BLOB NOT NULL UNIQUE,
+    created TEXT,
+    block INTEGER,
+    mined_height INTEGER,
+    tx_index INTEGER,
+    expiry_height INTEGER,
+    raw BLOB,
+    fee INTEGER,
+    target_height INTEGER,
+    FOREIGN KEY (block) REFERENCES blocks(height),
+    CONSTRAINT height_consistency CHECK (block IS NULL OR mined_height = block)
+)"#;
+
+/// Stores the Sapling notes received by the wallet.
+///
+/// Note spentness is tracked in [`TABLE_SAPLING_RECEIVED_NOTE_SPENDS`].
+pub(super) const TABLE_SAPLING_RECEIVED_NOTES: &str = r#"
+CREATE TABLE "sapling_received_notes" (
+    id INTEGER PRIMARY KEY,
+    tx INTEGER NOT NULL,
+    output_index INTEGER NOT NULL,
+    account_id INTEGER NOT NULL,
+    diversifier BLOB NOT NULL,
+    value INTEGER NOT NULL,
+    rcm BLOB NOT NULL,
+    nf BLOB UNIQUE,
+    is_change INTEGER NOT NULL,
+    memo BLOB,
+    commitment_tree_position INTEGER,
+    recipient_key_scope INTEGER,
+    FOREIGN KEY (tx) REFERENCES transactions(id_tx),
+    FOREIGN KEY (account_id) REFERENCES accounts(id),
+    CONSTRAINT tx_output UNIQUE (tx, output_index)
+)"#;
+pub(super) const INDEX_SAPLING_RECEIVED_NOTES_ACCOUNT: &str = r#"
+CREATE INDEX "sapling_received_notes_account" ON "sapling_received_notes" (
+    "account_id" ASC
+)"#;
+pub(super) const INDEX_SAPLING_RECEIVED_NOTES_TX: &str = r#"
+CREATE INDEX "sapling_received_notes_tx" ON "sapling_received_notes" (
+    "tx" ASC
+)"#;
+
+/// A junction table between received Sapling notes and the transactions that spend them.
+///
+/// Only one mined transaction can spend a note. However, transactions created by the
+/// wallet may expire before being mined, and the wallet still tracks the fact that the
+/// user created the transaction. The junction table enables the "spent-in" relationship
+/// between notes and expired transactions to be preserved; note spent-ness is determined
+/// by joining this table with [`TABLE_TRANSACTIONS`] and then filtering out transactions
+/// where either `transactions.block` is non-null, or `transactions.expiry_height` is not
+/// greater than the wallet's view of the chain tip.
+pub(super) const TABLE_SAPLING_RECEIVED_NOTE_SPENDS: &str = "
+CREATE TABLE sapling_received_note_spends (
+    sapling_received_note_id INTEGER NOT NULL,
+    transaction_id INTEGER NOT NULL,
+    FOREIGN KEY (sapling_received_note_id)
+        REFERENCES sapling_received_notes(id)
+        ON DELETE CASCADE,
+    FOREIGN KEY (transaction_id)
+        -- We do not delete transactions, so this does not cascade
+        REFERENCES transactions(id_tx),
+    UNIQUE (sapling_received_note_id, transaction_id)
+)";
+
+/// Stores the Orchard notes received by the wallet.
+///
+/// Note spentness is tracked in [`TABLE_ORCHARD_RECEIVED_NOTE_SPENDS`].
+pub(super) const TABLE_ORCHARD_RECEIVED_NOTES: &str = "
+CREATE TABLE orchard_received_notes (
+    id INTEGER PRIMARY KEY,
+    tx INTEGER NOT NULL,
+    action_index INTEGER NOT NULL,
+    account_id INTEGER NOT NULL,
+    diversifier BLOB NOT NULL,
+    value INTEGER NOT NULL,
+    rho BLOB NOT NULL,
+    rseed BLOB NOT NULL,
+    nf BLOB UNIQUE,
+    is_change INTEGER NOT NULL,
+    memo BLOB,
+    commitment_tree_position INTEGER,
+    recipient_key_scope INTEGER,
+    FOREIGN KEY (tx) REFERENCES transactions(id_tx),
+    FOREIGN KEY (account_id) REFERENCES accounts(id),
+    CONSTRAINT tx_output UNIQUE (tx, action_index)
+)";
+pub(super) const INDEX_ORCHARD_RECEIVED_NOTES_ACCOUNT: &str = r#"
+CREATE INDEX orchard_received_notes_account ON orchard_received_notes (
+    account_id ASC
+)"#;
+pub(super) const INDEX_ORCHARD_RECEIVED_NOTES_TX: &str = r#"
+CREATE INDEX orchard_received_notes_tx ON orchard_received_notes (
+    tx ASC
+)"#;
+
+/// A junction table between received Orchard notes and the transactions that spend them.
+///
+/// Thie plays the same role for Orchard notes as does [`TABLE_SAPLING_RECEIVED_NOTE_SPENDS`] for
+/// Sapling notes; see its documentation for details.
+pub(super) const TABLE_ORCHARD_RECEIVED_NOTE_SPENDS: &str = "
+CREATE TABLE orchard_received_note_spends (
+    orchard_received_note_id INTEGER NOT NULL,
+    transaction_id INTEGER NOT NULL,
+    FOREIGN KEY (orchard_received_note_id)
+        REFERENCES orchard_received_notes(id)
+        ON DELETE CASCADE,
+    FOREIGN KEY (transaction_id)
+        -- We do not delete transactions, so this does not cascade
+        REFERENCES transactions(id_tx),
+    UNIQUE (orchard_received_note_id, transaction_id)
+)";
+
+/// Stores the transparent outputs received by the wallet.
+///
+/// Originally this table only stored the current UTXO set (as of latest refresh), and the
+/// table was cleared prior to loading in the latest UTXO set. We now upsert instead of
+/// insert into the database, meaning that spent outputs are left in the database. This
+/// makes it similar to the `*_received_notes` tables in that it can store history.
+/// Depending upon how transparent TXOs for the wallet are discovered, the following
+/// may be true:
+/// - The table may have incomplete contents for recovered-from-seed wallets.
+/// - The table may have inconsistent contents for seeds loaded into multiple wallets
+///   simultaneously.
+/// - The wallet's transparent balance may be incorrect prior to "transaction enhancement"
+///   (downloading the full transaction containing the transparent output spend).
+///
+/// ### Columns:
+/// - `id`: Primary key
+/// - `transaction_id`: Reference to the transaction in which this TXO was created
+/// - `output_index`: The output index of this TXO in the transaction referred to by `transaction_id`
+/// - `account_id`: The account that controls spend authority for this TXO
+/// - `address`: The address to which this TXO was sent. We store this address to make querying
+///   for UTXOs for a single address easier, because when shielding we always select UTXOs
+///   for only a single address at a time to prevent linking addresses in the shielding
+///   transaction.
+/// - `script`: The full txout script
+/// - `value_zat`: The value of the TXO in zatoshis
+/// - `max_observed_unspent_height`: The maximum block height at which this TXO was either
+///   observed to be a member of the UTXO set at the start of the block, or observed
+///   to be an output of a transaction mined in the block. This is intended to be used to
+///   determine when the TXO is no longer a part of the UTXO set, in the case that the
+///   transaction that spends it is not detected by the wallet.
+pub(super) const TABLE_TRANSPARENT_RECEIVED_OUTPUTS: &str = r#"
+CREATE TABLE transparent_received_outputs (
+    id INTEGER PRIMARY KEY,
+    transaction_id INTEGER NOT NULL,
+    output_index INTEGER NOT NULL,
+    account_id INTEGER NOT NULL,
+    address TEXT NOT NULL,
+    script BLOB NOT NULL,
+    value_zat INTEGER NOT NULL,
+    max_observed_unspent_height INTEGER,
+    FOREIGN KEY (transaction_id) REFERENCES transactions(id_tx),
+    FOREIGN KEY (account_id) REFERENCES accounts(id),
+    CONSTRAINT transparent_output_unique UNIQUE (transaction_id, output_index)
+)"#;
+pub(super) const INDEX_TRANSPARENT_RECEIVED_OUTPUTS_ACCOUNT_ID: &str = r#"
+CREATE INDEX idx_transparent_received_outputs_account_id
+ON "transparent_received_outputs" (account_id)"#;
+
+/// A junction table between received transparent outputs and the transactions that spend them.
+///
+/// This plays the same role for transparent TXOs as does [`TABLE_SAPLING_RECEIVED_NOTE_SPENDS`]
+/// for Sapling notes. However, [`TABLE_TRANSPARENT_RECEIVED_OUTPUTS`] differs from
+/// [`TABLE_SAPLING_RECEIVED_NOTES`] and [`TABLE_ORCHARD_RECEIVED_NOTES`] in that an
+/// associated `transactions` record may have its `mined_height` set without there existing a
+/// corresponding record in the `blocks` table for a block at that height, due to the asymmetries
+/// between scanning for shielded notes and retrieving transparent TXOs currently implemented
+/// in [`zcash_client_backend`].
+pub(super) const TABLE_TRANSPARENT_RECEIVED_OUTPUT_SPENDS: &str = r#"
+CREATE TABLE "transparent_received_output_spends" (
+    transparent_received_output_id INTEGER NOT NULL,
+    transaction_id INTEGER NOT NULL,
+    FOREIGN KEY (transparent_received_output_id)
+        REFERENCES transparent_received_outputs(id)
+        ON DELETE CASCADE,
+    FOREIGN KEY (transaction_id)
+        -- We do not delete transactions, so this does not cascade
+        REFERENCES transactions(id_tx),
+    UNIQUE (transparent_received_output_id, transaction_id)
+)"#;
+
+/// A cache of the relationship between a transaction and the prevout data of its
+/// transparent inputs.
+///
+/// This table is used in out-of-order wallet recovery to cache the information about
+/// what transaction(s) spend each transparent outpoint, so that if an output belonging
+/// to the wallet is detected after the transaction that spends it has been processed,
+/// the spend can also be recorded as part of the process of adding the output to
+/// [`TABLE_TRANSPARENT_RECEIVED_OUTPUTS`].
+pub(super) const TABLE_TRANSPARENT_SPEND_MAP: &str = r#"
+CREATE TABLE transparent_spend_map (
+    spending_transaction_id INTEGER NOT NULL,
+    prevout_txid BLOB NOT NULL,
+    prevout_output_index INTEGER NOT NULL,
+    FOREIGN KEY (spending_transaction_id) REFERENCES transactions(id_tx)
+    -- NOTE: We can't create a unique constraint on just (prevout_txid, prevout_output_index)
+    -- because the same output may be attempted to be spent in multiple transactions, even
+    -- though only one will ever be mined.
+    CONSTRAINT transparent_spend_map_unique UNIQUE (
+        spending_transaction_id, prevout_txid, prevout_output_index
+    )
+)"#;
+
+/// Stores the outputs of transactions created by the wallet.
+///
+/// Unlike with outputs received by the wallet, we store sent outputs for all pools in
+/// this table, distinguished by the `output_pool` column. The information we want to
+/// record for sent outputs is the same across all pools, whereas for received outputs we
+/// want to cache pool-specific data.
+///
+/// ### Columns
+/// - `(tx, output_pool, output_index)` collectively identify a transaction output.
+/// - `from_account_id`: the ID of the account that created the transaction.
+///   - On recover-from-seed or when scanning by UFVK, this will be either the account
+///     that decrypted the output, or one of the accounts that funded the transaction.
+/// - `to_address`: the address of the external recipient of this output, or `NULL` if the
+///   output was received by the wallet.
+/// - `to_account_id`: the ID of the account that received this output, or `NULL` if the
+///   output was for an external recipient.
+/// - `value`: the value of the output in zatoshis.
+/// - `memo`: the memo bytes associated with this output, if known.
+///   - This is always `NULL` for transparent outputs.
+///   - This will be set for all shielded outputs of transactions created by the wallet.
+///   - On recover-from-seed or when scanning by UFVK, this will only be set for shielded
+///     outputs after post-scanning transaction enhancement. For shielded notes sent to
+///     external recipients, the transaction needs to have been created with an
+///     [`OvkPolicy`] using a known OVK.
+///
+/// [`OvkPolicy`]: zcash_client_backend::wallet::OvkPolicy
+pub(super) const TABLE_SENT_NOTES: &str = r#"
+CREATE TABLE "sent_notes" (
+    id INTEGER PRIMARY KEY,
+    tx INTEGER NOT NULL,
+    output_pool INTEGER NOT NULL,
+    output_index INTEGER NOT NULL,
+    from_account_id INTEGER NOT NULL,
+    to_address TEXT,
+    to_account_id INTEGER,
+    value INTEGER NOT NULL,
+    memo BLOB,
+    FOREIGN KEY (tx) REFERENCES transactions(id_tx),
+    FOREIGN KEY (from_account_id) REFERENCES accounts(id),
+    FOREIGN KEY (to_account_id) REFERENCES accounts(id),
+    CONSTRAINT tx_output UNIQUE (tx, output_pool, output_index),
+    CONSTRAINT note_recipient CHECK (
+        (to_address IS NOT NULL) OR (to_account_id IS NOT NULL)
+    )
+)"#;
+pub(super) const INDEX_SENT_NOTES_FROM_ACCOUNT: &str =
+    r#"CREATE INDEX sent_notes_from_account ON "sent_notes" (from_account_id)"#;
+pub(super) const INDEX_SENT_NOTES_TO_ACCOUNT: &str =
+    r#"CREATE INDEX sent_notes_to_account ON "sent_notes" (to_account_id)"#;
+pub(super) const INDEX_SENT_NOTES_TX: &str = r#"CREATE INDEX sent_notes_tx ON "sent_notes" (tx)"#;
+
+/// Stores the set of transaction ids for which the backend required additional data.
+///
+/// ### Columns:
+/// - `txid`: The transaction identifier for the transaction to retrieve state information for.
+/// - `query_type`:
+///     - `0` for raw transaction (enhancement) data,
+///     - `1` for transaction mined-ness information.
+/// - `dependent_transaction_id`: If the transaction data request is searching for information
+///   about transparent inputs to a transaction, this is a reference to that transaction record.
+///   NULL for transactions where the request for enhancement data is based on discovery due
+///   to blockchain scanning.
+pub(super) const TABLE_TX_RETRIEVAL_QUEUE: &str = r#"
+CREATE TABLE tx_retrieval_queue (
+    txid BLOB NOT NULL UNIQUE,
+    query_type INTEGER NOT NULL,
+    dependent_transaction_id INTEGER,
+    FOREIGN KEY (dependent_transaction_id) REFERENCES transactions(id_tx)
+)"#;
+
+/// Stores the set of transaction outputs received by the wallet for which spend information
+/// (if any) should be retrieved.
+///
+/// This table is populated in the process of wallet recovery when a deshielding transaction
+/// with transparent outputs belonging to the wallet (e.g., the deshielding half of a ZIP 320
+/// transaction pair) is discovered. It is expected that such a transparent output will be
+/// spent soon after it is received in a purely transparent transaction, which the wallet
+/// currently has no means of detecting otherwise.
+pub(super) const TABLE_TRANSPARENT_SPEND_SEARCH_QUEUE: &str = r#"
+CREATE TABLE transparent_spend_search_queue (
+    address TEXT NOT NULL,
+    transaction_id INTEGER NOT NULL,
+    output_index INTEGER NOT NULL,
+    FOREIGN KEY (transaction_id) REFERENCES transactions(id_tx),
+    CONSTRAINT value_received_height UNIQUE (transaction_id, output_index)
+)"#;
+
+//
+// State for shard trees
+//
+
+/// Stores the shards of a [`ShardTree`] for the Sapling commitment tree.
+///
+/// This table contains a row for each 2^16 subtree of the Sapling note commitment tree,
+/// keyed by the index of the shard. The `shard_data` column contains the subtree's data
+/// as serialized by [`zcash_client_backend::serialization::shardtree::write_shard`].
+///
+/// [`ShardTree`]: shardtree::ShardTree
+pub(super) const TABLE_SAPLING_TREE_SHARDS: &str = "
+CREATE TABLE sapling_tree_shards (
+    shard_index INTEGER PRIMARY KEY,
+    subtree_end_height INTEGER,
+    root_hash BLOB,
+    shard_data BLOB,
+    contains_marked INTEGER,
+    CONSTRAINT root_unique UNIQUE (root_hash)
+)";
+
+/// Stores the "cap" of the Sapling [`ShardTree`].
+///
+/// This table will only ever have a single row, in which is serialized the 2^16 "cap"
+/// of the Sapling note commitment tree, The `cap_data` column contains the cap data
+/// as serialized by [`zcash_client_backend::serialization::shardtree::write_shard`].
+///
+/// [`ShardTree`]: shardtree::ShardTree
+pub(super) const TABLE_SAPLING_TREE_CAP: &str = "
+CREATE TABLE sapling_tree_cap (
+    -- cap_id exists only to be able to take advantage of `ON CONFLICT`
+    -- upsert functionality; the table will only ever contain one row
+    cap_id INTEGER PRIMARY KEY,
+    cap_data BLOB NOT NULL
+)";
+
+/// Stores the checkpointed positions in the Sapling [`ShardTree`].
+///
+/// Each row in this table stores the note commitment tree position of the last Sapling
+/// output in the block having height `checkpoint_id`.
+///
+/// [`ShardTree`]: shardtree::ShardTree
+pub(super) const TABLE_SAPLING_TREE_CHECKPOINTS: &str = "
+CREATE TABLE sapling_tree_checkpoints (
+    checkpoint_id INTEGER PRIMARY KEY,
+    position INTEGER
+)";
+
+/// Stores metadata about the positions of Sapling notes that have been spent but for
+/// which witness information has not yet been removed from the note commitment tree.
+///
+/// In the process of updating the note commitment tree in response to the addition of
+/// a block, it is necessary to temporarily continue to store witness information for
+/// each note so that a spent note can be made spendable again after a rollback of the
+/// spending block. This table caches the metadata needed for that restoration.
+pub(super) const TABLE_SAPLING_TREE_CHECKPOINT_MARKS_REMOVED: &str = "
+CREATE TABLE sapling_tree_checkpoint_marks_removed (
+    checkpoint_id INTEGER NOT NULL,
+    mark_removed_position INTEGER NOT NULL,
+    FOREIGN KEY (checkpoint_id) REFERENCES sapling_tree_checkpoints(checkpoint_id)
+    ON DELETE CASCADE,
+    CONSTRAINT spend_position_unique UNIQUE (checkpoint_id, mark_removed_position)
+)";
+
+/// Stores the shards of a [`ShardTree`] for the Orchard commitment tree.
+///
+/// This is identical to [`TABLE_SAPLING_TREE_SHARDS`]; see its documentation for details.
+///
+/// [`ShardTree`]: shardtree::ShardTree
+pub(super) const TABLE_ORCHARD_TREE_SHARDS: &str = "
+CREATE TABLE orchard_tree_shards (
+    shard_index INTEGER PRIMARY KEY,
+    subtree_end_height INTEGER,
+    root_hash BLOB,
+    shard_data BLOB,
+    contains_marked INTEGER,
+    CONSTRAINT root_unique UNIQUE (root_hash)
+)";
+
+/// Stores the "cap" of the Orchard [`ShardTree`].
+///
+/// This is identical to [`TABLE_SAPLING_TREE_CAP`]; see its documentation for details.
+///
+/// [`ShardTree`]: shardtree::ShardTree
+pub(super) const TABLE_ORCHARD_TREE_CAP: &str = "
+CREATE TABLE orchard_tree_cap (
+    -- cap_id exists only to be able to take advantage of `ON CONFLICT`
+    -- upsert functionality; the table will only ever contain one row
+    cap_id INTEGER PRIMARY KEY,
+    cap_data BLOB NOT NULL
+)";
+
+/// Stores the checkpointed positions in the Orchard [`ShardTree`].
+///
+/// This is identical to [`TABLE_SAPLING_TREE_CHECKPOINTS`]; see its documentation for
+/// details.
+///
+/// [`ShardTree`]: shardtree::ShardTree
+pub(super) const TABLE_ORCHARD_TREE_CHECKPOINTS: &str = "
+CREATE TABLE orchard_tree_checkpoints (
+    checkpoint_id INTEGER PRIMARY KEY,
+    position INTEGER
+)";
+
+/// Stores metadata about the positions of Orchard notes that have been spent but for
+/// which witness information has not yet been removed from the note commitment tree.
+///
+/// This is identical to [`TABLE_SAPLING_TREE_CHECKPOINT_MARKS_REMOVED`]; see its
+/// documentation for details.
+pub(super) const TABLE_ORCHARD_TREE_CHECKPOINT_MARKS_REMOVED: &str = "
+CREATE TABLE orchard_tree_checkpoint_marks_removed (
+    checkpoint_id INTEGER NOT NULL,
+    mark_removed_position INTEGER NOT NULL,
+    FOREIGN KEY (checkpoint_id) REFERENCES orchard_tree_checkpoints(checkpoint_id)
+    ON DELETE CASCADE,
+    CONSTRAINT spend_position_unique UNIQUE (checkpoint_id, mark_removed_position)
+)";
+
+//
+// Scanning
+//
+
+/// Stores the [`ScanPriority`] for all block ranges in the wallet's view of the chain.
+///
+/// [`ScanPriority`]: zcash_client_backend::data_api::scanning::ScanPriority
+pub(super) const TABLE_SCAN_QUEUE: &str = "
+CREATE TABLE scan_queue (
+    block_range_start INTEGER NOT NULL,
+    block_range_end INTEGER NOT NULL,
+    priority INTEGER NOT NULL,
+    CONSTRAINT range_start_uniq UNIQUE (block_range_start),
+    CONSTRAINT range_end_uniq UNIQUE (block_range_end),
+    CONSTRAINT range_bounds_order CHECK (
+        block_range_start < block_range_end
+    )
+)";
+
+/// A map from "transaction locators" to transaction IDs for the current chain state.
+///
+/// `(block_height, tx_index)` is a "transaction locator"; `tx_index` is an index into the
+/// list of transactions for the block at height `block_height` in the chain as currently
+/// known to the wallet.
+///
+/// No foreign key constraint is enforced for `block_height` to [`TABLE_BLOCKS`], to allow
+/// loading the nullifier map separately from block scanning.
+pub(super) const TABLE_TX_LOCATOR_MAP: &str = "
+CREATE TABLE tx_locator_map (
+    block_height INTEGER NOT NULL,
+    tx_index INTEGER NOT NULL,
+    txid BLOB NOT NULL UNIQUE,
+    PRIMARY KEY (block_height, tx_index)
+)";
+
+/// A map from nullifiers to the transaction they were observed in.
+///
+/// The purpose of this map is to allow non-linear scanning. If the wallet scans a block
+/// range `Y..Z` that leaves a gap between the wallet's birthday height and `Y`, then the
+/// wallet must assume that any nullifier observed in `Y..Z` might be spending one of its
+/// notes (that it has not yet observed), otherwise it will fail to detect those spends
+/// and report a too-large balance. Once the wallet has scanned every block between its
+/// birthday height and `Y`, the nullifier map contents up to `Z` is no longer necessary
+/// and can be dropped.
+///
+/// The map stores transaction locators instead of transaction IDs for efficiency. SQLite
+/// will represent the transaction locator in at most 6 bytes, so a transaction that only
+/// spends one shielded note will incur a 12-byte overhead (across both this table and
+/// [`TABLE_TX_LOCATOR_MAP`]), but each additional spent note in a transaction saves 26
+/// bytes.
+pub(super) const TABLE_NULLIFIER_MAP: &str = "
+CREATE TABLE nullifier_map (
+    spend_pool INTEGER NOT NULL,
+    nf BLOB NOT NULL,
+    block_height INTEGER NOT NULL,
+    tx_index INTEGER NOT NULL,
+    CONSTRAINT tx_locator
+        FOREIGN KEY (block_height, tx_index)
+        REFERENCES tx_locator_map(block_height, tx_index)
+        ON DELETE CASCADE
+        ON UPDATE RESTRICT,
+    CONSTRAINT nf_uniq UNIQUE (spend_pool, nf)
+)";
+pub(super) const INDEX_NF_MAP_LOCATOR_IDX: &str =
+    r#"CREATE INDEX nf_map_locator_idx ON nullifier_map(block_height, tx_index)"#;
+
+//
+// Internal tables
+//
+
+/// Internal table used by [`schemerz`] to manage migrations.
+pub(super) const TABLE_SCHEMERZ_MIGRATIONS: &str = "
+CREATE TABLE schemer_migrations (
+    id blob PRIMARY KEY
+)";
+
+/// Internal table created by SQLite when we started using `AUTOINCREMENT`.
+pub(super) const TABLE_SQLITE_SEQUENCE: &str = "CREATE TABLE sqlite_sequence(name,seq)";
+
+//
+// Views
+//
+
+pub(super) const VIEW_RECEIVED_OUTPUTS: &str = "
+CREATE VIEW v_received_outputs AS
+    SELECT
+        sapling_received_notes.id AS id_within_pool_table,
+        sapling_received_notes.tx AS transaction_id,
+        2 AS pool,
+        sapling_received_notes.output_index,
+        account_id,
+        sapling_received_notes.value,
+        is_change,
+        sapling_received_notes.memo,
+        sent_notes.id AS sent_note_id
+    FROM sapling_received_notes
+    LEFT JOIN sent_notes
+    ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+       (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+UNION
+    SELECT
+        orchard_received_notes.id AS id_within_pool_table,
+        orchard_received_notes.tx AS transaction_id,
+        3 AS pool,
+        orchard_received_notes.action_index AS output_index,
+        account_id,
+        orchard_received_notes.value,
+        is_change,
+        orchard_received_notes.memo,
+        sent_notes.id AS sent_note_id
+    FROM orchard_received_notes
+    LEFT JOIN sent_notes
+    ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+       (orchard_received_notes.tx, 3, orchard_received_notes.action_index)
+UNION
+    SELECT
+        u.id AS id_within_pool_table,
+        u.transaction_id,
+        0 AS pool,
+        u.output_index,
+        u.account_id,
+        u.value_zat AS value,
+        0 AS is_change,
+        NULL AS memo,
+        sent_notes.id AS sent_note_id
+    FROM transparent_received_outputs u
+    LEFT JOIN sent_notes
+    ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+       (u.transaction_id, 0, u.output_index)";
+
+pub(super) const VIEW_RECEIVED_OUTPUT_SPENDS: &str = "
+CREATE VIEW v_received_output_spends AS
+SELECT
+    2 AS pool,
+    sapling_received_note_id AS received_output_id,
+    transaction_id
+FROM sapling_received_note_spends
+UNION
+SELECT
+    3 AS pool,
+    orchard_received_note_id AS received_output_id,
+    transaction_id
+FROM orchard_received_note_spends
+UNION
+SELECT
+    0 AS pool,
+    transparent_received_output_id AS received_output_id,
+    transaction_id
+FROM transparent_received_output_spends";
+
+pub(super) const VIEW_TRANSACTIONS: &str = "
+CREATE VIEW v_transactions AS
+WITH
+notes AS (
+    -- Outputs received in this transaction
+    SELECT ro.account_id              AS account_id,
+           transactions.mined_height  AS mined_height,
+           transactions.txid          AS txid,
+           ro.pool                    AS pool,
+           id_within_pool_table,
+           ro.value                   AS value,
+           0                          AS spent_note_count,
+           CASE
+                WHEN ro.is_change THEN 1
+                ELSE 0
+           END AS change_note_count,
+           CASE
+                WHEN ro.is_change THEN 0
+                ELSE 1
+           END AS received_count,
+           CASE
+             WHEN (ro.memo IS NULL OR ro.memo = X'F6')
+               THEN 0
+             ELSE 1
+           END AS memo_present,
+           -- The wallet cannot receive transparent outputs in shielding transactions.
+           CASE
+             WHEN ro.pool = 0
+               THEN 1
+             ELSE 0
+           END AS does_not_match_shielding
+    FROM v_received_outputs ro
+    JOIN transactions
+         ON transactions.id_tx = ro.transaction_id
+    UNION
+    -- Outputs spent in this transaction
+    SELECT ro.account_id              AS account_id,
+           transactions.mined_height  AS mined_height,
+           transactions.txid          AS txid,
+           ro.pool                    AS pool,
+           id_within_pool_table,
+           -ro.value                  AS value,
+           1                          AS spent_note_count,
+           0                          AS change_note_count,
+           0                          AS received_count,
+           0                          AS memo_present,
+           -- The wallet cannot spend shielded outputs in shielding transactions.
+           CASE
+             WHEN ro.pool != 0
+               THEN 1
+             ELSE 0
+           END AS does_not_match_shielding
+    FROM v_received_outputs ro
+    JOIN v_received_output_spends ros
+         ON ros.pool = ro.pool
+         AND ros.received_output_id = ro.id_within_pool_table
+    JOIN transactions
+         ON transactions.id_tx = ros.transaction_id
+),
+-- Obtain a count of the notes that the wallet created in each transaction,
+-- not counting change notes.
+sent_note_counts AS (
+    SELECT sent_notes.from_account_id     AS account_id,
+           transactions.txid              AS txid,
+           COUNT(DISTINCT sent_notes.id)  AS sent_notes,
+           SUM(
+             CASE
+               WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR ro.transaction_id IS NOT NULL)
+                 THEN 0
+               ELSE 1
+             END
+           ) AS memo_count
+    FROM sent_notes
+    JOIN transactions
+         ON transactions.id_tx = sent_notes.tx
+    LEFT JOIN v_received_outputs ro
+         ON sent_notes.id = ro.sent_note_id
+    WHERE COALESCE(ro.is_change, 0) = 0
+    GROUP BY account_id, txid
+),
+blocks_max_height AS (
+    SELECT MAX(blocks.height) AS max_height FROM blocks
+)
+SELECT accounts.uuid                AS account_uuid,
+       notes.mined_height           AS mined_height,
+       notes.txid                   AS txid,
+       transactions.tx_index        AS tx_index,
+       transactions.expiry_height   AS expiry_height,
+       transactions.raw             AS raw,
+       SUM(notes.value)             AS account_balance_delta,
+       transactions.fee             AS fee_paid,
+       SUM(notes.change_note_count) > 0  AS has_change,
+       MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+       SUM(notes.received_count)         AS received_note_count,
+       SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+       blocks.time                       AS block_time,
+       (
+            blocks.height IS NULL
+            AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+       ) AS expired_unmined,
+       SUM(notes.spent_note_count) AS spent_note_count,
+       (
+            -- All of the wallet-spent and wallet-received notes are consistent with a
+            -- shielding transaction.
+            SUM(notes.does_not_match_shielding) = 0
+            -- The transaction contains at least one wallet-spent output.
+            AND SUM(notes.spent_note_count) > 0
+            -- The transaction contains at least one wallet-received note.
+            AND (SUM(notes.received_count) + SUM(notes.change_note_count)) > 0
+            -- We do not know about any external outputs of the transaction.
+            AND MAX(COALESCE(sent_note_counts.sent_notes, 0)) = 0
+       ) AS is_shielding
+FROM notes
+JOIN accounts ON accounts.id = notes.account_id
+LEFT JOIN transactions
+     ON notes.txid = transactions.txid
+JOIN blocks_max_height
+LEFT JOIN blocks ON blocks.height = notes.mined_height
+LEFT JOIN sent_note_counts
+     ON sent_note_counts.account_id = notes.account_id
+     AND sent_note_counts.txid = notes.txid
+GROUP BY notes.account_id, notes.txid";
+
+/// Selects all outputs received by the wallet, plus any outputs sent from the wallet to
+/// external recipients.
+///
+/// This will contain:
+/// * Outputs received from external recipients
+/// * Outputs sent to external recipients
+/// * Outputs received as part of a wallet-internal operation, including
+///   both outputs received as a consequence of wallet-internal transfers
+///   and as change.
+///
+/// The `to_address` column will only contain an address when the recipient is
+/// external. In all other cases, the recipient account id indicates the account
+/// that controls the output.
+pub(super) const VIEW_TX_OUTPUTS: &str = "
+CREATE VIEW v_tx_outputs AS
+-- select all outputs received by the wallet
+SELECT transactions.txid            AS txid,
+       ro.pool                      AS output_pool,
+       ro.output_index              AS output_index,
+       from_account.uuid            AS from_account_uuid,
+       to_account.uuid              AS to_account_uuid,
+       NULL                         AS to_address,
+       ro.value                     AS value,
+       ro.is_change                 AS is_change,
+       ro.memo                      AS memo
+FROM v_received_outputs ro
+JOIN transactions
+    ON transactions.id_tx = ro.transaction_id
+-- join to the sent_notes table to obtain `from_account_id`
+LEFT JOIN sent_notes ON sent_notes.id = ro.sent_note_id
+-- join on the accounts table to obtain account UUIDs
+JOIN accounts from_account ON accounts.id = sent_notes.from_account_id
+JOIN accounts to_account ON accounts.id = ro.account_id
+UNION
+-- select all outputs sent from the wallet to external recipients
+SELECT transactions.txid            AS txid,
+       sent_notes.output_pool       AS output_pool,
+       sent_notes.output_index      AS output_index,
+       from_account.uuid            AS from_account_uuid,
+       NULL                         AS to_account_uuid,
+       sent_notes.to_address        AS to_address,
+       sent_notes.value             AS value,
+       0                            AS is_change,
+       sent_notes.memo              AS memo
+FROM sent_notes
+JOIN transactions
+    ON transactions.id_tx = sent_notes.tx
+LEFT JOIN v_received_outputs ro ON ro.sent_note_id = sent_notes.id
+-- join on the accounts table to obtain account UUIDs
+JOIN accounts from_account ON accounts.id = sent_notes.from_account_id
+-- exclude any sent notes for which a row exists in the v_received_outputs view
+WHERE ro.account_id IS NULL";
+
+pub(super) fn view_sapling_shard_scan_ranges<P: Parameters>(params: &P) -> String {
+    format!(
+        "CREATE VIEW v_sapling_shard_scan_ranges AS
+        SELECT
+            shard.shard_index,
+            shard.shard_index << 16 AS start_position,
+            (shard.shard_index + 1) << 16 AS end_position_exclusive,
+            IFNULL(prev_shard.subtree_end_height, {}) AS subtree_start_height,
+            shard.subtree_end_height,
+            shard.contains_marked,
+            scan_queue.block_range_start,
+            scan_queue.block_range_end,
+            scan_queue.priority
+        FROM sapling_tree_shards shard
+        LEFT OUTER JOIN sapling_tree_shards prev_shard
+            ON shard.shard_index = prev_shard.shard_index + 1
+        -- Join with scan ranges that overlap with the subtree's involved blocks.
+        INNER JOIN scan_queue ON (
+            subtree_start_height < scan_queue.block_range_end AND
+            (
+                scan_queue.block_range_start <= shard.subtree_end_height OR
+                shard.subtree_end_height IS NULL
+            )
+        )",
+        u32::from(params.activation_height(NetworkUpgrade::Sapling).unwrap()),
+    )
+}
+
+pub(super) fn view_sapling_shard_unscanned_ranges() -> String {
+    format!(
+        "CREATE VIEW v_sapling_shard_unscanned_ranges AS
+        WITH wallet_birthday AS (SELECT MIN(birthday_height) AS height FROM accounts)
+        SELECT
+            shard_index,
+            start_position,
+            end_position_exclusive,
+            subtree_start_height,
+            subtree_end_height,
+            contains_marked,
+            block_range_start,
+            block_range_end,
+            priority
+        FROM v_sapling_shard_scan_ranges
+        INNER JOIN wallet_birthday
+        WHERE priority > {}
+        AND block_range_end > wallet_birthday.height",
+        priority_code(&ScanPriority::Scanned)
+    )
+}
+
+pub(super) const VIEW_SAPLING_SHARDS_SCAN_STATE: &str = "
+CREATE VIEW v_sapling_shards_scan_state AS
+SELECT
+    shard_index,
+    start_position,
+    end_position_exclusive,
+    subtree_start_height,
+    subtree_end_height,
+    contains_marked,
+    MAX(priority) AS max_priority
+FROM v_sapling_shard_scan_ranges
+GROUP BY
+    shard_index,
+    start_position,
+    end_position_exclusive,
+    subtree_start_height,
+    subtree_end_height,
+    contains_marked";
+
+pub(super) fn view_orchard_shard_scan_ranges<P: Parameters>(params: &P) -> String {
+    format!(
+        "CREATE VIEW v_orchard_shard_scan_ranges AS
+        SELECT
+            shard.shard_index,
+            shard.shard_index << 16 AS start_position,
+            (shard.shard_index + 1) << 16 AS end_position_exclusive,
+            IFNULL(prev_shard.subtree_end_height, {}) AS subtree_start_height,
+            shard.subtree_end_height,
+            shard.contains_marked,
+            scan_queue.block_range_start,
+            scan_queue.block_range_end,
+            scan_queue.priority
+        FROM orchard_tree_shards shard
+        LEFT OUTER JOIN orchard_tree_shards prev_shard
+            ON shard.shard_index = prev_shard.shard_index + 1
+        -- Join with scan ranges that overlap with the subtree's involved blocks.
+        INNER JOIN scan_queue ON (
+            subtree_start_height < scan_queue.block_range_end AND
+            (
+                scan_queue.block_range_start <= shard.subtree_end_height OR
+                shard.subtree_end_height IS NULL
+            )
+        )",
+        u32::from(params.activation_height(NetworkUpgrade::Nu5).unwrap()),
+    )
+}
+
+pub(super) fn view_orchard_shard_unscanned_ranges() -> String {
+    format!(
+        "CREATE VIEW v_orchard_shard_unscanned_ranges AS
+        WITH wallet_birthday AS (SELECT MIN(birthday_height) AS height FROM accounts)
+        SELECT
+            shard_index,
+            start_position,
+            end_position_exclusive,
+            subtree_start_height,
+            subtree_end_height,
+            contains_marked,
+            block_range_start,
+            block_range_end,
+            priority
+        FROM v_orchard_shard_scan_ranges
+        INNER JOIN wallet_birthday
+        WHERE priority > {}
+        AND block_range_end > wallet_birthday.height",
+        priority_code(&ScanPriority::Scanned),
+    )
+}
+
+pub(super) const VIEW_ORCHARD_SHARDS_SCAN_STATE: &str = "
+CREATE VIEW v_orchard_shards_scan_state AS
+SELECT
+    shard_index,
+    start_position,
+    end_position_exclusive,
+    subtree_start_height,
+    subtree_end_height,
+    contains_marked,
+    MAX(priority) AS max_priority
+FROM v_orchard_shard_scan_ranges
+GROUP BY
+    shard_index,
+    start_position,
+    end_position_exclusive,
+    subtree_start_height,
+    subtree_end_height,
+    contains_marked";
diff --git a/zcash_client_sqlite/src/wallet/init.rs b/zcash_client_sqlite/src/wallet/init.rs
index 6650322915..c1069761a5 100644
--- a/zcash_client_sqlite/src/wallet/init.rs
+++ b/zcash_client_sqlite/src/wallet/init.rs
@@ -1,39 +1,73 @@
 //! Functions for initializing the various databases.
-use std::collections::HashMap;
+
 use std::fmt;
+use std::rc::Rc;
 
-use rusqlite::{self, types::ToSql};
-use schemer::{Migrator, MigratorError};
-use schemer_rusqlite::RusqliteAdapter;
+use regex::Regex;
+use schemerz::{Migrator, MigratorError};
+use schemerz_rusqlite::RusqliteAdapter;
 use secrecy::SecretVec;
+use shardtree::error::ShardTreeError;
 use uuid::Uuid;
 
-use zcash_primitives::{
-    block::BlockHash,
-    consensus::{self, BlockHeight},
-    transaction::components::amount::BalanceError,
-    zip32::AccountId,
+use zcash_client_backend::{
+    data_api::{SeedRelevance, WalletRead},
+    keys::AddressGenerationError,
 };
+use zcash_primitives::{consensus, transaction::components::amount::BalanceError};
 
-use zcash_client_backend::keys::UnifiedFullViewingKey;
+use self::migrations::verify_network_compatibility;
 
-use crate::{error::SqliteClientError, wallet, WalletDb};
+use super::commitment_tree;
+use crate::{error::SqliteClientError, WalletDb};
 
 mod migrations;
 
+const SQLITE_MAJOR_VERSION: u32 = 3;
+const MIN_SQLITE_MINOR_VERSION: u32 = 35;
+
+const MIGRATIONS_TABLE: &str = "schemer_migrations";
+
 #[derive(Debug)]
 pub enum WalletMigrationError {
+    /// A feature required by the wallet database is not supported by the version of
+    /// SQLite that the migration is running against.
+    DatabaseNotSupported(String),
+
     /// The seed is required for the migration.
     SeedRequired,
 
+    /// A seed was provided that is not relevant to any of the accounts within the wallet.
+    ///
+    /// Specifically, it is not relevant to any account for which [`Account::source`] is
+    /// [`AccountSource::Derived`]. We do not check whether the seed is relevant to any
+    /// imported account, because that would require brute-forcing the ZIP 32 account
+    /// index space.
+    ///
+    /// [`Account::source`]: zcash_client_backend::data_api::Account::source
+    /// [`AccountSource::Derived`]: zcash_client_backend::data_api::AccountSource::Derived
+    SeedNotRelevant,
+
     /// Decoding of an existing value from its serialized form has failed.
     CorruptedData(String),
 
+    /// An error occurred in migrating a Zcash address or key.
+    AddressGeneration(AddressGenerationError),
+
     /// Wrapper for rusqlite errors.
     DbError(rusqlite::Error),
 
     /// Wrapper for amount balance violations
     BalanceError(BalanceError),
+
+    /// Wrapper for commitment tree invariant violations
+    CommitmentTree(ShardTreeError<commitment_tree::Error>),
+
+    /// Reverting the specified migration is not supported.
+    CannotRevert(Uuid),
+
+    /// Some other unexpected violation of database business rules occurred
+    Other(SqliteClientError),
 }
 
 impl From<rusqlite::Error> for WalletMigrationError {
@@ -48,20 +82,74 @@ impl From<BalanceError> for WalletMigrationError {
     }
 }
 
+impl From<ShardTreeError<commitment_tree::Error>> for WalletMigrationError {
+    fn from(e: ShardTreeError<commitment_tree::Error>) -> Self {
+        WalletMigrationError::CommitmentTree(e)
+    }
+}
+
+impl From<AddressGenerationError> for WalletMigrationError {
+    fn from(e: AddressGenerationError) -> Self {
+        WalletMigrationError::AddressGeneration(e)
+    }
+}
+
+impl From<SqliteClientError> for WalletMigrationError {
+    fn from(value: SqliteClientError) -> Self {
+        match value {
+            SqliteClientError::CorruptedData(err) => WalletMigrationError::CorruptedData(err),
+            SqliteClientError::DbError(err) => WalletMigrationError::DbError(err),
+            SqliteClientError::CommitmentTree(err) => WalletMigrationError::CommitmentTree(err),
+            SqliteClientError::BalanceError(err) => WalletMigrationError::BalanceError(err),
+            SqliteClientError::AddressGeneration(err) => {
+                WalletMigrationError::AddressGeneration(err)
+            }
+            other => WalletMigrationError::Other(other),
+        }
+    }
+}
+
 impl fmt::Display for WalletMigrationError {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match &self {
+            WalletMigrationError::DatabaseNotSupported(version) => {
+                write!(
+                    f,
+                    "The installed SQLite version {} does not support operations required by the wallet.",
+                    version
+                )
+            }
             WalletMigrationError::SeedRequired => {
                 write!(
                     f,
                     "The wallet seed is required in order to update the database."
                 )
             }
+            WalletMigrationError::SeedNotRelevant => {
+                write!(
+                    f,
+                    "The provided seed is not relevant to any derived accounts in the database."
+                )
+            }
             WalletMigrationError::CorruptedData(reason) => {
                 write!(f, "Wallet database is corrupted: {}", reason)
             }
             WalletMigrationError::DbError(e) => write!(f, "{}", e),
             WalletMigrationError::BalanceError(e) => write!(f, "Balance error: {:?}", e),
+            WalletMigrationError::CommitmentTree(e) => write!(f, "Commitment tree error: {:?}", e),
+            WalletMigrationError::AddressGeneration(e) => {
+                write!(f, "Address generation error: {:?}", e)
+            }
+            WalletMigrationError::CannotRevert(uuid) => {
+                write!(f, "Reverting migration {} is not supported", uuid)
+            }
+            WalletMigrationError::Other(err) => {
+                write!(
+                    f,
+                    "Unexpected violation of database business rules: {}",
+                    err
+                )
+            }
         }
     }
 }
@@ -70,11 +158,83 @@ impl std::error::Error for WalletMigrationError {
     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
         match &self {
             WalletMigrationError::DbError(e) => Some(e),
+            WalletMigrationError::BalanceError(e) => Some(e),
+            WalletMigrationError::CommitmentTree(e) => Some(e),
+            WalletMigrationError::AddressGeneration(e) => Some(e),
+            WalletMigrationError::Other(e) => Some(e),
             _ => None,
         }
     }
 }
 
+/// Helper to enable calling regular `WalletDb` methods inside the migration code.
+///
+/// In this context we can know the full set of errors that are generated by any call we
+/// make, so we mark errors as unreachable instead of adding new `WalletMigrationError`
+/// variants.
+fn sqlite_client_error_to_wallet_migration_error(e: SqliteClientError) -> WalletMigrationError {
+    match e {
+        SqliteClientError::CorruptedData(e) => WalletMigrationError::CorruptedData(e),
+        SqliteClientError::Protobuf(e) => WalletMigrationError::CorruptedData(e.to_string()),
+        SqliteClientError::InvalidNote => {
+            WalletMigrationError::CorruptedData("invalid note".into())
+        }
+        SqliteClientError::DecodingError(e) => WalletMigrationError::CorruptedData(e.to_string()),
+        #[cfg(feature = "transparent-inputs")]
+        SqliteClientError::TransparentDerivation(e) => {
+            WalletMigrationError::CorruptedData(e.to_string())
+        }
+        #[cfg(feature = "transparent-inputs")]
+        SqliteClientError::TransparentAddress(e) => {
+            WalletMigrationError::CorruptedData(e.to_string())
+        }
+        SqliteClientError::DbError(e) => WalletMigrationError::DbError(e),
+        SqliteClientError::Io(e) => WalletMigrationError::CorruptedData(e.to_string()),
+        SqliteClientError::InvalidMemo(e) => WalletMigrationError::CorruptedData(e.to_string()),
+        SqliteClientError::AddressGeneration(e) => WalletMigrationError::AddressGeneration(e),
+        SqliteClientError::BadAccountData(e) => WalletMigrationError::CorruptedData(e),
+        SqliteClientError::CommitmentTree(e) => WalletMigrationError::CommitmentTree(e),
+        SqliteClientError::UnsupportedPoolType(pool) => WalletMigrationError::CorruptedData(
+            format!("Wallet DB contains unsupported pool type {}", pool),
+        ),
+        SqliteClientError::BalanceError(e) => WalletMigrationError::BalanceError(e),
+        SqliteClientError::TableNotEmpty => unreachable!("wallet already initialized"),
+        SqliteClientError::BlockConflict(_)
+        | SqliteClientError::NonSequentialBlocks
+        | SqliteClientError::RequestedRewindInvalid { .. }
+        | SqliteClientError::KeyDerivationError(_)
+        | SqliteClientError::Zip32AccountIndexOutOfRange
+        | SqliteClientError::AccountCollision(_)
+        | SqliteClientError::CacheMiss(_) => {
+            unreachable!("we only call WalletRead methods; mutations can't occur")
+        }
+        #[cfg(feature = "transparent-inputs")]
+        SqliteClientError::AddressNotRecognized(_) => {
+            unreachable!("we only call WalletRead methods; mutations can't occur")
+        }
+        SqliteClientError::AccountUnknown => {
+            unreachable!("all accounts are known in migration context")
+        }
+        SqliteClientError::UnknownZip32Derivation => {
+            unreachable!("we don't call methods that require operating on imported accounts")
+        }
+        SqliteClientError::ChainHeightUnknown => {
+            unreachable!("we don't call methods that require a known chain height")
+        }
+        #[cfg(feature = "transparent-inputs")]
+        SqliteClientError::ReachedGapLimit(_, _) => {
+            unreachable!("we don't do ephemeral address tracking")
+        }
+        #[cfg(feature = "transparent-inputs")]
+        SqliteClientError::EphemeralAddressReuse(_, _) => {
+            unreachable!("we don't do ephemeral address tracking")
+        }
+        SqliteClientError::NoteFilterInvalid(_) => {
+            unreachable!("we don't do note selection in migrations")
+        }
+    }
+}
+
 /// Sets up the internal structure of the data database.
 ///
 /// This procedure will automatically perform migration operations to update the wallet database to
@@ -83,26 +243,67 @@ impl std::error::Error for WalletMigrationError {
 /// operation of this procedure is idempotent, so it is safe (though not required) to invoke this
 /// operation every time the wallet is opened.
 ///
+/// In order to correctly apply migrations to accounts derived from a seed, sometimes the
+/// optional `seed` argument is required. This function should first be invoked with
+/// `seed` set to `None`; if a pending migration requires the seed, the function returns
+/// `Err(schemerz::MigratorError::Migration { error: WalletMigrationError::SeedRequired, .. })`.
+/// The caller can then re-call this function with the necessary seed.
+///
+/// > Note that currently only one seed can be provided; as such, wallets containing
+/// > accounts derived from several different seeds are unsupported, and will result in an
+/// > error. Support for multi-seed wallets is being tracked in [zcash/librustzcash#1284].
+///
+/// When the `seed` argument is provided, the seed is checked against the database for
+/// _relevance_: if any account in the wallet for which [`Account::source`] is
+/// [`AccountSource::Derived`] can be derived from the given seed, the seed is relevant to
+/// the wallet. If the given seed is not relevant, the function returns
+/// `Err(schemerz::MigratorError::Migration { error: WalletMigrationError::SeedNotRelevant, .. })`
+/// or `Err(schemerz::MigratorError::Adapter(WalletMigrationError::SeedNotRelevant))`.
+///
+/// We do not check whether the seed is relevant to any imported account, because that
+/// would require brute-forcing the ZIP 32 account index space. Consequentially, imported
+/// accounts are not migrated.
+///
 /// It is safe to use a wallet database previously created without the ability to create
 /// transparent spends with a build that enables transparent spends (via use of the
 /// `transparent-inputs` feature flag.) The reverse is unsafe, as wallet balance calculations would
 /// ignore the transparent UTXOs already controlled by the wallet.
 ///
+/// [zcash/librustzcash#1284]: https://github.com/zcash/librustzcash/issues/1284
+/// [`Account::source`]: zcash_client_backend::data_api::Account::source
+/// [`AccountSource::Derived`]: zcash_client_backend::data_api::AccountSource::Derived
 ///
 /// # Examples
 ///
 /// ```
-/// use secrecy::Secret;
-/// use tempfile::NamedTempFile;
+/// # use std::error::Error;
+/// # use secrecy::SecretVec;
+/// # use tempfile::NamedTempFile;
 /// use zcash_primitives::consensus::Network;
 /// use zcash_client_sqlite::{
 ///     WalletDb,
-///     wallet::init::init_wallet_db,
+///     wallet::init::{WalletMigrationError, init_wallet_db},
 /// };
 ///
-/// let data_file = NamedTempFile::new().unwrap();
-/// let mut db = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
-/// init_wallet_db(&mut db, Some(Secret::new(vec![]))).unwrap();
+/// # fn main() -> Result<(), Box<dyn Error>> {
+/// # let data_file = NamedTempFile::new().unwrap();
+/// # let get_data_db_path = || data_file.path();
+/// # let load_seed = || -> Result<_, String> { Ok(SecretVec::new(vec![])) };
+/// let mut db = WalletDb::for_path(get_data_db_path(), Network::TestNetwork)?;
+/// match init_wallet_db(&mut db, None) {
+///     Err(e)
+///         if matches!(
+///             e.source().and_then(|e| e.downcast_ref()),
+///             Some(&WalletMigrationError::SeedRequired)
+///         ) =>
+///     {
+///         let seed = load_seed()?;
+///         init_wallet_db(&mut db, Some(seed))
+///     }
+///     res => res,
+/// }?;
+/// # Ok(())
+/// # }
 /// ```
 // TODO: It would be possible to make the transition from providing transparent support to no
 // longer providing transparent support safe, by including a migration that verifies that no
@@ -111,31 +312,55 @@ impl std::error::Error for WalletMigrationError {
 // check for unspent transparent outputs whenever running initialization with a version of the
 // library *not* compiled with the `transparent-inputs` feature flag, and fail if any are present.
 pub fn init_wallet_db<P: consensus::Parameters + 'static>(
-    wdb: &mut WalletDb<P>,
+    wdb: &mut WalletDb<rusqlite::Connection, P>,
     seed: Option<SecretVec<u8>>,
-) -> Result<(), MigratorError<WalletMigrationError>> {
-    init_wallet_db_internal(wdb, seed, &[])
+) -> Result<(), MigratorError<Uuid, WalletMigrationError>> {
+    init_wallet_db_internal(wdb, seed, &[], true)
 }
 
-fn init_wallet_db_internal<P: consensus::Parameters + 'static>(
-    wdb: &mut WalletDb<P>,
+pub(crate) fn init_wallet_db_internal<P: consensus::Parameters + 'static>(
+    wdb: &mut WalletDb<rusqlite::Connection, P>,
     seed: Option<SecretVec<u8>>,
     target_migrations: &[Uuid],
-) -> Result<(), MigratorError<WalletMigrationError>> {
-    // Turn off foreign keys, and ensure that table replacement/modification
-    // does not break views
+    verify_seed_relevance: bool,
+) -> Result<(), MigratorError<Uuid, WalletMigrationError>> {
+    let seed = seed.map(Rc::new);
+
+    verify_sqlite_version_compatibility(&wdb.conn).map_err(MigratorError::Adapter)?;
+
+    // Turn off foreign key enforcement, to ensure that table replacement does not break foreign
+    // key references in table definitions.
+    //
+    // It is necessary to perform this operation globally using the outer connection because this
+    // pragma has no effect when set or unset within a transaction.
     wdb.conn
-        .execute_batch(
-            "PRAGMA foreign_keys = OFF;
-             PRAGMA legacy_alter_table = TRUE;",
-        )
+        .execute_batch("PRAGMA foreign_keys = OFF;")
         .map_err(|e| MigratorError::Adapter(WalletMigrationError::from(e)))?;
-    let adapter = RusqliteAdapter::new(&mut wdb.conn, Some("schemer_migrations".to_string()));
-    adapter.init().expect("Migrations table setup succeeds.");
 
+    // Temporarily take ownership of the connection in a wrapper to perform the initial migration
+    // table setup. This extra adapter creation could be omitted if `RusqliteAdapter` provided an
+    // accessor for the connection that it wraps, or if it provided a mechanism to query to
+    // determine whether a given migration has been applied. (see
+    // https://github.com/zcash/schemerz/issues/6)
+    {
+        let adapter = RusqliteAdapter::<'_, WalletMigrationError>::new(
+            &mut wdb.conn,
+            Some(MIGRATIONS_TABLE.to_string()),
+        );
+        adapter.init().expect("Migrations table setup succeeds.");
+    }
+
+    // Now that we are certain that the migrations table exists, verify that if the database
+    // already contains account data, any stored UFVKs correspond to the same network that the
+    // migrations are being run for.
+    verify_network_compatibility(&wdb.conn, &wdb.params).map_err(MigratorError::Adapter)?;
+
+    // Now create the adapter that we're actually going to use to perform the migrations, and
+    // proceed.
+    let adapter = RusqliteAdapter::new(&mut wdb.conn, Some(MIGRATIONS_TABLE.to_string()));
     let mut migrator = Migrator::new(adapter);
     migrator
-        .register_multiple(migrations::all_migrations(&wdb.params, seed))
+        .register_multiple(migrations::all_migrations(&wdb.params, seed.clone()).into_iter())
         .expect("Wallet migration registration should have been successful.");
     if target_migrations.is_empty() {
         migrator.up(None)?;
@@ -147,447 +372,208 @@ fn init_wallet_db_internal<P: consensus::Parameters + 'static>(
     wdb.conn
         .execute("PRAGMA foreign_keys = ON", [])
         .map_err(|e| MigratorError::Adapter(WalletMigrationError::from(e)))?;
-    Ok(())
-}
 
-/// Initialises the data database with the given set of account [`UnifiedFullViewingKey`]s.
-///
-/// **WARNING** This method should be used with care, and should ordinarily be unnecessary.
-/// Prefer to use [`WalletWrite::create_account`] instead.
-///
-/// [`WalletWrite::create_account`]: zcash_client_backend::data_api::WalletWrite::create_account
-///
-/// The [`UnifiedFullViewingKey`]s are stored internally and used by other APIs such as
-/// [`scan_cached_blocks`], and [`create_spend_to_address`]. Account identifiers in `keys` **MUST**
-/// form a consecutive sequence beginning at account 0, and the [`UnifiedFullViewingKey`]
-/// corresponding to a given account identifier **MUST** be derived from the wallet's mnemonic seed
-/// at the BIP-44 `account` path level as described by [ZIP
-/// 316](https://zips.z.cash/zip-0316)
-///
-/// # Examples
-///
-/// ```
-/// # #[cfg(feature = "transparent-inputs")]
-/// # {
-/// use tempfile::NamedTempFile;
-/// use secrecy::Secret;
-/// use std::collections::HashMap;
-///
-/// use zcash_primitives::{
-///     consensus::{Network, Parameters},
-///     zip32::{AccountId, ExtendedSpendingKey}
-/// };
-///
-/// use zcash_client_backend::{
-///     keys::{
-///         sapling,
-///         UnifiedFullViewingKey
-///     },
-/// };
-///
-/// use zcash_client_sqlite::{
-///     WalletDb,
-///     wallet::init::{init_accounts_table, init_wallet_db}
-/// };
-///
-/// let data_file = NamedTempFile::new().unwrap();
-/// let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
-/// init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-///
-/// let seed = [0u8; 32]; // insecure; replace with a strong random seed
-/// let account = AccountId::from(0);
-/// let extsk = sapling::spending_key(&seed, Network::TestNetwork.coin_type(), account);
-/// let dfvk = extsk.to_diversifiable_full_viewing_key();
-/// let ufvk = UnifiedFullViewingKey::new(None, Some(dfvk), None).unwrap();
-/// let ufvks = HashMap::from([(account, ufvk)]);
-/// init_accounts_table(&db_data, &ufvks).unwrap();
-/// # }
-/// ```
-///
-/// [`get_address`]: crate::wallet::get_address
-/// [`scan_cached_blocks`]: zcash_client_backend::data_api::chain::scan_cached_blocks
-/// [`create_spend_to_address`]: zcash_client_backend::data_api::wallet::create_spend_to_address
-pub fn init_accounts_table<P: consensus::Parameters>(
-    wdb: &WalletDb<P>,
-    keys: &HashMap<AccountId, UnifiedFullViewingKey>,
-) -> Result<(), SqliteClientError> {
-    let mut empty_check = wdb.conn.prepare("SELECT * FROM accounts LIMIT 1")?;
-    if empty_check.exists([])? {
-        return Err(SqliteClientError::TableNotEmpty);
-    }
-
-    // Ensure that the account identifiers are sequential and begin at zero.
-    if let Some(account_id) = keys.keys().max() {
-        if usize::try_from(u32::from(*account_id)).unwrap() >= keys.len() {
-            return Err(SqliteClientError::AccountIdDiscontinuity);
+    // Now that the migration succeeded, check whether the seed is relevant to the wallet.
+    // We can only check this if we have migrated as far as `full_account_ids::MIGRATION_ID`,
+    // but unfortunately `schemer` does not currently expose its DAG of migrations. As a
+    // consequence, the caller has to choose whether or not this check should be performed
+    // based upon which migrations they're asking to apply.
+    if verify_seed_relevance {
+        if let Some(seed) = seed {
+            match wdb
+                .seed_relevance_to_derived_accounts(&seed)
+                .map_err(sqlite_client_error_to_wallet_migration_error)?
+            {
+                SeedRelevance::Relevant { .. } => (),
+                // Every seed is relevant to a wallet with no accounts; this is most likely a
+                // new wallet database being initialized for the first time.
+                SeedRelevance::NoAccounts => (),
+                // No seed is relevant to a wallet that only has imported accounts.
+                SeedRelevance::NotRelevant | SeedRelevance::NoDerivedAccounts => {
+                    return Err(WalletMigrationError::SeedNotRelevant.into())
+                }
+            }
         }
     }
 
-    // Insert accounts atomically
-    wdb.conn.execute("BEGIN IMMEDIATE", [])?;
-    for (account, key) in keys.iter() {
-        wallet::add_account(wdb, *account, key)?;
-    }
-    wdb.conn.execute("COMMIT", [])?;
-
     Ok(())
 }
 
-/// Initialises the data database with the given block.
-///
-/// This enables a newly-created database to be immediately-usable, without needing to
-/// synchronise historic blocks.
-///
-/// # Examples
-///
-/// ```
-/// use tempfile::NamedTempFile;
-/// use zcash_primitives::{
-///     block::BlockHash,
-///     consensus::{BlockHeight, Network},
-/// };
-/// use zcash_client_sqlite::{
-///     WalletDb,
-///     wallet::init::init_blocks_table,
-/// };
-///
-/// // The block height.
-/// let height = BlockHeight::from_u32(500_000);
-/// // The hash of the block header.
-/// let hash = BlockHash([0; 32]);
-/// // The nTime field from the block header.
-/// let time = 12_3456_7890;
-/// // The serialized Sapling commitment tree as of this block.
-/// // Pre-compute and hard-code, or obtain from a service.
-/// let sapling_tree = &[];
-///
-/// let data_file = NamedTempFile::new().unwrap();
-/// let db = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
-/// init_blocks_table(&db, height, hash, time, sapling_tree);
-/// ```
-pub fn init_blocks_table<P>(
-    wdb: &WalletDb<P>,
-    height: BlockHeight,
-    hash: BlockHash,
-    time: u32,
-    sapling_tree: &[u8],
-) -> Result<(), SqliteClientError> {
-    let mut empty_check = wdb.conn.prepare("SELECT * FROM blocks LIMIT 1")?;
-    if empty_check.exists([])? {
-        return Err(SqliteClientError::TableNotEmpty);
-    }
-
-    wdb.conn.execute(
-        "INSERT INTO blocks (height, hash, time, sapling_tree)
-        VALUES (?, ?, ?, ?)",
-        [
-            u32::from(height).to_sql()?,
-            hash.0.to_sql()?,
-            time.to_sql()?,
-            sapling_tree.to_sql()?,
-        ],
-    )?;
+/// Verify that the sqlite version in use supports the features required by this library.
+/// Note that the version of sqlite available to the database backend may be different
+/// from what is used to query the views that are part of the public API.
+fn verify_sqlite_version_compatibility(
+    conn: &rusqlite::Connection,
+) -> Result<(), WalletMigrationError> {
+    let sqlite_version =
+        conn.query_row("SELECT sqlite_version()", [], |row| row.get::<_, String>(0))?;
+
+    let version_re = Regex::new(r"^(?<major>[0-9]+)\.(?<minor>[0-9]+).*$").unwrap();
+    let captures =
+        version_re
+            .captures(&sqlite_version)
+            .ok_or(WalletMigrationError::DatabaseNotSupported(
+                "Unknown".to_owned(),
+            ))?;
+    let parse_version_part = |part: &str| {
+        captures[part].parse::<u32>().map_err(|_| {
+            WalletMigrationError::CorruptedData(format!(
+                "Cannot decode SQLite {} version component {}",
+                part, &captures[part]
+            ))
+        })
+    };
+    let major = parse_version_part("major")?;
+    let minor = parse_version_part("minor")?;
 
-    Ok(())
+    if major != SQLITE_MAJOR_VERSION || minor < MIN_SQLITE_MINOR_VERSION {
+        Err(WalletMigrationError::DatabaseNotSupported(sqlite_version))
+    } else {
+        Ok(())
+    }
 }
 
 #[cfg(test)]
-#[allow(deprecated)]
 mod tests {
-    use rusqlite::{self, ToSql};
+    use rusqlite::{self, named_params, Connection, ToSql};
     use secrecy::Secret;
-    use std::collections::HashMap;
+
     use tempfile::NamedTempFile;
 
     use zcash_client_backend::{
-        address::RecipientAddress,
-        data_api::WalletRead,
+        address::Address,
+        data_api::testing::TestBuilder,
         encoding::{encode_extended_full_viewing_key, encode_payment_address},
-        keys::{sapling, UnifiedFullViewingKey, UnifiedSpendingKey},
+        keys::{sapling, UnifiedAddressRequest, UnifiedFullViewingKey, UnifiedSpendingKey},
     };
 
+    use ::sapling::zip32::ExtendedFullViewingKey;
     use zcash_primitives::{
-        block::BlockHash,
-        consensus::{BlockHeight, BranchId, Parameters},
+        consensus::{self, BlockHeight, BranchId, Network, NetworkConstants},
         transaction::{TransactionData, TxVersion},
-        zip32::sapling::ExtendedFullViewingKey,
+        zip32::AccountId,
     };
 
-    use crate::{
-        error::SqliteClientError,
-        tests::{self, network},
-        AccountId, WalletDb,
-    };
+    use crate::{testing::db::TestDbFactory, wallet::db, WalletDb, UA_TRANSPARENT};
 
-    use super::{init_accounts_table, init_blocks_table, init_wallet_db};
+    use super::init_wallet_db;
 
     #[cfg(feature = "transparent-inputs")]
     use {
-        crate::{
-            wallet::{self, pool_code, PoolType},
-            WalletWrite,
-        },
+        super::WalletMigrationError,
+        crate::wallet::{self, pool_code, PoolType},
         zcash_address::test_vectors,
-        zcash_primitives::{
-            consensus::Network, legacy::keys as transparent, zip32::DiversifierIndex,
-        },
+        zcash_client_backend::data_api::WalletWrite,
+        zcash_primitives::zip32::DiversifierIndex,
     };
 
+    pub(crate) fn describe_tables(conn: &Connection) -> Result<Vec<String>, rusqlite::Error> {
+        let result = conn
+            .prepare("SELECT sql FROM sqlite_schema WHERE type = 'table' ORDER BY tbl_name")?
+            .query_and_then([], |row| row.get::<_, String>(0))?
+            .collect::<Result<Vec<_>, _>>()?;
+
+        Ok(result)
+    }
+
     #[test]
     fn verify_schema() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
 
         use regex::Regex;
         let re = Regex::new(r"\s+").unwrap();
 
         let expected_tables = vec![
-            "CREATE TABLE \"accounts\" (
-                account INTEGER PRIMARY KEY,
-                ufvk TEXT NOT NULL
-            )",
-            "CREATE TABLE addresses (
-                account INTEGER NOT NULL,
-                diversifier_index_be BLOB NOT NULL,
-                address TEXT NOT NULL,
-                cached_transparent_receiver_address TEXT,
-                FOREIGN KEY (account) REFERENCES accounts(account),
-                CONSTRAINT diversification UNIQUE (account, diversifier_index_be)
-            )",
-            "CREATE TABLE blocks (
-                height INTEGER PRIMARY KEY,
-                hash BLOB NOT NULL,
-                time INTEGER NOT NULL,
-                sapling_tree BLOB NOT NULL
-            )",
-            "CREATE TABLE sapling_received_notes (
-                id_note INTEGER PRIMARY KEY,
-                tx INTEGER NOT NULL,
-                output_index INTEGER NOT NULL,
-                account INTEGER NOT NULL,
-                diversifier BLOB NOT NULL,
-                value INTEGER NOT NULL,
-                rcm BLOB NOT NULL,
-                nf BLOB UNIQUE,
-                is_change INTEGER NOT NULL,
-                memo BLOB,
-                spent INTEGER,
-                FOREIGN KEY (tx) REFERENCES transactions(id_tx),
-                FOREIGN KEY (account) REFERENCES accounts(account),
-                FOREIGN KEY (spent) REFERENCES transactions(id_tx),
-                CONSTRAINT tx_output UNIQUE (tx, output_index)
-            )",
-            "CREATE TABLE sapling_witnesses (
-                id_witness INTEGER PRIMARY KEY,
-                note INTEGER NOT NULL,
-                block INTEGER NOT NULL,
-                witness BLOB NOT NULL,
-                FOREIGN KEY (note) REFERENCES sapling_received_notes(id_note),
-                FOREIGN KEY (block) REFERENCES blocks(height),
-                CONSTRAINT witness_height UNIQUE (note, block)
-            )",
-            "CREATE TABLE schemer_migrations (
-                id blob PRIMARY KEY
-            )",
-            "CREATE TABLE \"sent_notes\" (
-                id_note INTEGER PRIMARY KEY,
-                tx INTEGER NOT NULL,
-                output_pool INTEGER NOT NULL,
-                output_index INTEGER NOT NULL,
-                from_account INTEGER NOT NULL,
-                to_address TEXT,
-                to_account INTEGER,
-                value INTEGER NOT NULL,
-                memo BLOB,
-                FOREIGN KEY (tx) REFERENCES transactions(id_tx),
-                FOREIGN KEY (from_account) REFERENCES accounts(account),
-                FOREIGN KEY (to_account) REFERENCES accounts(account),
-                CONSTRAINT tx_output UNIQUE (tx, output_pool, output_index),
-                CONSTRAINT note_recipient CHECK (
-                    (to_address IS NOT NULL) != (to_account IS NOT NULL)
-                )
-            )",
-            "CREATE TABLE transactions (
-                id_tx INTEGER PRIMARY KEY,
-                txid BLOB NOT NULL UNIQUE,
-                created TEXT,
-                block INTEGER,
-                tx_index INTEGER,
-                expiry_height INTEGER,
-                raw BLOB,
-                fee INTEGER,
-                FOREIGN KEY (block) REFERENCES blocks(height)
-            )",
-            "CREATE TABLE \"utxos\" (
-                id_utxo INTEGER PRIMARY KEY,
-                received_by_account INTEGER NOT NULL,
-                address TEXT NOT NULL,
-                prevout_txid BLOB NOT NULL,
-                prevout_idx INTEGER NOT NULL,
-                script BLOB NOT NULL,
-                value_zat INTEGER NOT NULL,
-                height INTEGER NOT NULL,
-                spent_in_tx INTEGER,
-                FOREIGN KEY (received_by_account) REFERENCES accounts(account),
-                FOREIGN KEY (spent_in_tx) REFERENCES transactions(id_tx),
-                CONSTRAINT tx_outpoint UNIQUE (prevout_txid, prevout_idx)
-            )",
+            db::TABLE_ACCOUNTS,
+            db::TABLE_ADDRESSES,
+            db::TABLE_BLOCKS,
+            db::TABLE_EPHEMERAL_ADDRESSES,
+            db::TABLE_NULLIFIER_MAP,
+            db::TABLE_ORCHARD_RECEIVED_NOTE_SPENDS,
+            db::TABLE_ORCHARD_RECEIVED_NOTES,
+            db::TABLE_ORCHARD_TREE_CAP,
+            db::TABLE_ORCHARD_TREE_CHECKPOINT_MARKS_REMOVED,
+            db::TABLE_ORCHARD_TREE_CHECKPOINTS,
+            db::TABLE_ORCHARD_TREE_SHARDS,
+            db::TABLE_SAPLING_RECEIVED_NOTE_SPENDS,
+            db::TABLE_SAPLING_RECEIVED_NOTES,
+            db::TABLE_SAPLING_TREE_CAP,
+            db::TABLE_SAPLING_TREE_CHECKPOINT_MARKS_REMOVED,
+            db::TABLE_SAPLING_TREE_CHECKPOINTS,
+            db::TABLE_SAPLING_TREE_SHARDS,
+            db::TABLE_SCAN_QUEUE,
+            db::TABLE_SCHEMERZ_MIGRATIONS,
+            db::TABLE_SENT_NOTES,
+            db::TABLE_SQLITE_SEQUENCE,
+            db::TABLE_TRANSACTIONS,
+            db::TABLE_TRANSPARENT_RECEIVED_OUTPUT_SPENDS,
+            db::TABLE_TRANSPARENT_RECEIVED_OUTPUTS,
+            db::TABLE_TRANSPARENT_SPEND_MAP,
+            db::TABLE_TRANSPARENT_SPEND_SEARCH_QUEUE,
+            db::TABLE_TX_LOCATOR_MAP,
+            db::TABLE_TX_RETRIEVAL_QUEUE,
         ];
 
-        let mut tables_query = db_data
+        let rows = describe_tables(&st.wallet().db().conn).unwrap();
+        assert_eq!(rows.len(), expected_tables.len());
+        for (actual, expected) in rows.iter().zip(expected_tables.iter()) {
+            assert_eq!(
+                re.replace_all(actual, " "),
+                re.replace_all(expected, " ").trim(),
+            );
+        }
+
+        let expected_indices = vec![
+            db::INDEX_ACCOUNTS_UFVK,
+            db::INDEX_ACCOUNTS_UIVK,
+            db::INDEX_ACCOUNTS_UUID,
+            db::INDEX_HD_ACCOUNT,
+            db::INDEX_ADDRESSES_ACCOUNTS,
+            db::INDEX_NF_MAP_LOCATOR_IDX,
+            db::INDEX_ORCHARD_RECEIVED_NOTES_ACCOUNT,
+            db::INDEX_ORCHARD_RECEIVED_NOTES_TX,
+            db::INDEX_SAPLING_RECEIVED_NOTES_ACCOUNT,
+            db::INDEX_SAPLING_RECEIVED_NOTES_TX,
+            db::INDEX_SENT_NOTES_FROM_ACCOUNT,
+            db::INDEX_SENT_NOTES_TO_ACCOUNT,
+            db::INDEX_SENT_NOTES_TX,
+            db::INDEX_TRANSPARENT_RECEIVED_OUTPUTS_ACCOUNT_ID,
+        ];
+        let mut indices_query = st
+            .wallet()
+            .db()
             .conn
-            .prepare("SELECT sql FROM sqlite_schema WHERE type = 'table' ORDER BY tbl_name")
+            .prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND sql != '' ORDER BY tbl_name, name")
             .unwrap();
-        let mut rows = tables_query.query([]).unwrap();
+        let mut rows = indices_query.query([]).unwrap();
         let mut expected_idx = 0;
         while let Some(row) = rows.next().unwrap() {
             let sql: String = row.get(0).unwrap();
             assert_eq!(
                 re.replace_all(&sql, " "),
-                re.replace_all(expected_tables[expected_idx], " ")
+                re.replace_all(expected_indices[expected_idx], " ").trim(),
             );
             expected_idx += 1;
         }
 
         let expected_views = vec![
-            // v_transactions
-            "CREATE VIEW v_transactions AS
-            WITH
-            notes AS (
-                SELECT sapling_received_notes.account        AS account_id,
-                       sapling_received_notes.tx             AS id_tx,
-                       2                             AS pool,
-                       sapling_received_notes.value          AS value,
-                       CASE
-                            WHEN sapling_received_notes.is_change THEN 1
-                            ELSE 0
-                       END AS is_change,
-                       CASE
-                            WHEN sapling_received_notes.is_change THEN 0
-                            ELSE 1
-                       END AS received_count,
-                       CASE
-                           WHEN sapling_received_notes.memo IS NULL THEN 0
-                           ELSE 1
-                       END AS memo_present
-                FROM   sapling_received_notes
-                UNION
-                SELECT utxos.received_by_account     AS account_id,
-                       transactions.id_tx            AS id_tx,
-                       0                             AS pool,
-                       utxos.value_zat               AS value,
-                       0                             AS is_change,
-                       1                             AS received_count,
-                       0                             AS memo_present
-                FROM utxos
-                JOIN transactions
-                     ON transactions.txid = utxos.prevout_txid
-                UNION
-                SELECT sapling_received_notes.account        AS account_id,
-                       sapling_received_notes.spent          AS id_tx,
-                       2                             AS pool,
-                       -sapling_received_notes.value         AS value,
-                       0                             AS is_change,
-                       0                             AS received_count,
-                       0                             AS memo_present
-                FROM   sapling_received_notes
-                WHERE  sapling_received_notes.spent IS NOT NULL
-            ),
-            sent_note_counts AS (
-                SELECT sent_notes.from_account AS account_id,
-                       sent_notes.tx AS id_tx,
-                       COUNT(DISTINCT sent_notes.id_note) as sent_notes,
-                       SUM(
-                         CASE
-                             WHEN sent_notes.memo IS NULL THEN 0
-                             ELSE 1
-                         END
-                       ) AS memo_count
-                FROM sent_notes
-                LEFT JOIN sapling_received_notes
-                          ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
-                             (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
-                WHERE  sapling_received_notes.is_change IS NULL
-                   OR  sapling_received_notes.is_change = 0
-                GROUP BY account_id, id_tx
-            ),
-            blocks_max_height AS (
-                SELECT MAX(blocks.height) as max_height FROM blocks
-            )
-            SELECT notes.account_id                  AS account_id,
-                   transactions.id_tx                AS id_tx,
-                   transactions.block                AS mined_height,
-                   transactions.tx_index             AS tx_index,
-                   transactions.txid                 AS txid,
-                   transactions.expiry_height        AS expiry_height,
-                   transactions.raw                  AS raw,
-                   SUM(notes.value)                  AS account_balance_delta,
-                   transactions.fee                  AS fee_paid,
-                   SUM(notes.is_change) > 0          AS has_change,
-                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
-                   SUM(notes.received_count)         AS received_note_count,
-                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
-                   blocks.time                       AS block_time,
-                   (
-                        blocks.height IS NULL
-                        AND transactions.expiry_height <= blocks_max_height.max_height
-                   ) AS expired_unmined
-            FROM transactions
-            JOIN notes ON notes.id_tx = transactions.id_tx
-            JOIN blocks_max_height
-            LEFT JOIN blocks ON blocks.height = transactions.block
-            LEFT JOIN sent_note_counts
-                      ON sent_note_counts.account_id = notes.account_id
-                      AND sent_note_counts.id_tx = notes.id_tx
-            GROUP BY notes.account_id, transactions.id_tx",
-            // v_tx_outputs
-            "CREATE VIEW v_tx_outputs AS
-            SELECT sapling_received_notes.tx           AS id_tx,
-                   2                                   AS output_pool,
-                   sapling_received_notes.output_index AS output_index,
-                   sent_notes.from_account             AS from_account,
-                   sapling_received_notes.account      AS to_account,
-                   NULL                                AS to_address,
-                   sapling_received_notes.value        AS value,
-                   sapling_received_notes.is_change    AS is_change,
-                   sapling_received_notes.memo         AS memo
-            FROM sapling_received_notes
-            LEFT JOIN sent_notes
-                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
-                         (sapling_received_notes.tx, 2, sent_notes.output_index)
-            UNION
-            SELECT transactions.id_tx          AS id_tx,
-                   0                           AS output_pool,
-                   utxos.prevout_idx           AS output_index,
-                   NULL                        AS from_account,
-                   utxos.received_by_account   AS to_account,
-                   utxos.address               AS to_address,
-                   utxos.value_zat             AS value,
-                   false                       AS is_change,
-                   NULL                        AS memo
-            FROM utxos
-            JOIN transactions
-                 ON transactions.txid = utxos.prevout_txid
-            UNION
-            SELECT sent_notes.tx                  AS id_tx,
-                   sent_notes.output_pool         AS output_pool,
-                   sent_notes.output_index        AS output_index,
-                   sent_notes.from_account        AS from_account,
-                   sapling_received_notes.account AS to_account,
-                   sent_notes.to_address          AS to_address,
-                   sent_notes.value               AS value,
-                   false                          AS is_change,
-                   sent_notes.memo                AS memo
-            FROM sent_notes
-            LEFT JOIN sapling_received_notes
-                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
-                         (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
-            WHERE  sapling_received_notes.is_change IS NULL
-               OR  sapling_received_notes.is_change = 0"
+            db::view_orchard_shard_scan_ranges(st.network()),
+            db::view_orchard_shard_unscanned_ranges(),
+            db::VIEW_ORCHARD_SHARDS_SCAN_STATE.to_owned(),
+            db::VIEW_RECEIVED_OUTPUT_SPENDS.to_owned(),
+            db::VIEW_RECEIVED_OUTPUTS.to_owned(),
+            db::view_sapling_shard_scan_ranges(st.network()),
+            db::view_sapling_shard_unscanned_ranges(),
+            db::VIEW_SAPLING_SHARDS_SCAN_STATE.to_owned(),
+            db::VIEW_TRANSACTIONS.to_owned(),
+            db::VIEW_TX_OUTPUTS.to_owned(),
         ];
 
-        let mut views_query = db_data
+        let mut views_query = st
+            .wallet()
+            .db()
             .conn
             .prepare("SELECT sql FROM sqlite_schema WHERE type = 'view' ORDER BY tbl_name")
             .unwrap();
@@ -597,7 +583,7 @@ mod tests {
             let sql: String = row.get(0).unwrap();
             assert_eq!(
                 re.replace_all(&sql, " "),
-                re.replace_all(expected_views[expected_idx], " ")
+                re.replace_all(&expected_views[expected_idx], " ").trim(),
             );
             expected_idx += 1;
         }
@@ -605,8 +591,8 @@ mod tests {
 
     #[test]
     fn init_migrate_from_0_3_0() {
-        fn init_0_3_0<P>(
-            wdb: &mut WalletDb<P>,
+        fn init_0_3_0<P: consensus::Parameters>(
+            wdb: &mut WalletDb<rusqlite::Connection, P>,
             extfvk: &ExtendedFullViewingKey,
             account: AccountId,
         ) -> Result<(), rusqlite::Error> {
@@ -689,11 +675,11 @@ mod tests {
             )?;
 
             let address = encode_payment_address(
-                tests::network().hrp_sapling_payment_address(),
+                wdb.params.hrp_sapling_payment_address(),
                 &extfvk.default_address().1,
             );
             let extfvk = encode_extended_full_viewing_key(
-                tests::network().hrp_sapling_extended_full_viewing_key(),
+                wdb.params.hrp_sapling_extended_full_viewing_key(),
                 extfvk,
             );
             wdb.conn.execute(
@@ -709,20 +695,26 @@ mod tests {
             Ok(())
         }
 
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+
         let seed = [0xab; 32];
-        let account = AccountId::from(0);
-        let secret_key = sapling::spending_key(&seed, tests::network().coin_type(), account);
+        let account = AccountId::ZERO;
+        let secret_key = sapling::spending_key(&seed, db_data.params.coin_type(), account);
+        #[allow(deprecated)]
         let extfvk = secret_key.to_extended_full_viewing_key();
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
+
         init_0_3_0(&mut db_data, &extfvk, account).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))).unwrap();
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))),
+            Ok(_)
+        );
     }
 
     #[test]
     fn init_migrate_from_autoshielding_poc() {
-        fn init_autoshielding<P>(
-            wdb: &WalletDb<P>,
+        fn init_autoshielding<P: consensus::Parameters>(
+            wdb: &mut WalletDb<rusqlite::Connection, P>,
             extfvk: &ExtendedFullViewingKey,
             account: AccountId,
         ) -> Result<(), rusqlite::Error> {
@@ -821,11 +813,11 @@ mod tests {
             )?;
 
             let address = encode_payment_address(
-                tests::network().hrp_sapling_payment_address(),
+                wdb.params.hrp_sapling_payment_address(),
                 &extfvk.default_address().1,
             );
             let extfvk = encode_extended_full_viewing_key(
-                tests::network().hrp_sapling_extended_full_viewing_key(),
+                wdb.params.hrp_sapling_extended_full_viewing_key(),
                 extfvk,
             );
             wdb.conn.execute(
@@ -840,7 +832,7 @@ mod tests {
 
             // add a sapling sent note
             wdb.conn.execute(
-                "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, '')",
+                "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'000000')",
                 [],
             )?;
 
@@ -853,6 +845,9 @@ mod tests {
                 None,
                 None,
                 None,
+                None,
+                #[cfg(zcash_unstable = "tze")]
+                None,
             )
             .freeze()
             .unwrap();
@@ -860,8 +855,11 @@ mod tests {
             let mut tx_bytes = vec![];
             tx.write(&mut tx_bytes).unwrap();
             wdb.conn.execute(
-                "INSERT INTO transactions (block, id_tx, txid, raw) VALUES (0, 0, '', ?)",
-                [&tx_bytes[..]],
+                "INSERT INTO transactions (block, id_tx, txid, raw) VALUES (0, 0, :txid, :tx_bytes)",
+                named_params![
+                    ":txid": tx.txid().as_ref(),
+                    ":tx_bytes": &tx_bytes[..]
+                ],
             )?;
             wdb.conn.execute(
                 "INSERT INTO sent_notes (tx, output_index, from_account, address, value)
@@ -872,20 +870,26 @@ mod tests {
             Ok(())
         }
 
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+
         let seed = [0xab; 32];
-        let account = AccountId::from(0);
-        let secret_key = sapling::spending_key(&seed, tests::network().coin_type(), account);
+        let account = AccountId::ZERO;
+        let secret_key = sapling::spending_key(&seed, db_data.params.coin_type(), account);
+        #[allow(deprecated)]
         let extfvk = secret_key.to_extended_full_viewing_key();
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_autoshielding(&db_data, &extfvk, account).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))).unwrap();
+
+        init_autoshielding(&mut db_data, &extfvk, account).unwrap();
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))),
+            Ok(_)
+        );
     }
 
     #[test]
     fn init_migrate_from_main_pre_migrations() {
-        fn init_main<P>(
-            wdb: &WalletDb<P>,
+        fn init_main<P: consensus::Parameters>(
+            wdb: &mut WalletDb<rusqlite::Connection, P>,
             ufvk: &UnifiedFullViewingKey,
             account: AccountId,
         ) -> Result<(), rusqlite::Error> {
@@ -984,9 +988,17 @@ mod tests {
                 [],
             )?;
 
-            let ufvk_str = ufvk.encode(&tests::network());
-            let address_str =
-                RecipientAddress::Unified(ufvk.default_address().0).encode(&tests::network());
+            let ufvk_str = ufvk.encode(&wdb.params);
+
+            // Unified addresses at the time of the addition of migrations did not contain an
+            // Orchard component.
+            let ua_request = UnifiedAddressRequest::unsafe_new(false, true, UA_TRANSPARENT);
+            let address_str = Address::Unified(
+                ufvk.default_address(ua_request)
+                    .expect("A valid default address exists for the UFVK")
+                    .0,
+            )
+            .encode(&wdb.params);
             wdb.conn.execute(
                 "INSERT INTO accounts (account, ufvk, address, transparent_address)
                 VALUES (?, ?, ?, '')",
@@ -1000,11 +1012,17 @@ mod tests {
             // add a transparent "sent note"
             #[cfg(feature = "transparent-inputs")]
             {
-                let taddr =
-                    RecipientAddress::Transparent(*ufvk.default_address().0.transparent().unwrap())
-                        .encode(&tests::network());
+                let taddr = Address::Transparent(
+                    *ufvk
+                        .default_address(ua_request)
+                        .expect("A valid default address exists for the UFVK")
+                        .0
+                        .transparent()
+                        .unwrap(),
+                )
+                .encode(&wdb.params);
                 wdb.conn.execute(
-                    "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, '')",
+                    "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'000000')",
                     [],
                 )?;
                 wdb.conn.execute(
@@ -1014,163 +1032,96 @@ mod tests {
                 wdb.conn.execute(
                     "INSERT INTO sent_notes (tx, output_pool, output_index, from_account, address, value)
                     VALUES (0, ?, 0, ?, ?, 0)",
-                    [pool_code(PoolType::Transparent).to_sql()?, u32::from(account).to_sql()?, taddr.to_sql()?])?;
+                    [pool_code(PoolType::TRANSPARENT).to_sql()?, u32::from(account).to_sql()?, taddr.to_sql()?])?;
             }
 
             Ok(())
         }
 
-        let seed = [0xab; 32];
-        let account = AccountId::from(0);
-        let secret_key = UnifiedSpendingKey::from_seed(&tests::network(), &seed, account).unwrap();
         let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_main(&db_data, &secret_key.to_unified_full_viewing_key(), account).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))).unwrap();
-    }
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
 
-    #[test]
-    fn init_accounts_table_only_works_once() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // We can call the function as many times as we want with no data
-        init_accounts_table(&db_data, &HashMap::new()).unwrap();
-        init_accounts_table(&db_data, &HashMap::new()).unwrap();
-
-        let seed = [0u8; 32];
-        let account = AccountId::from(0);
-
-        // First call with data should initialise the accounts table
-        let extsk = sapling::spending_key(&seed, network().coin_type(), account);
-        let dfvk = extsk.to_diversifiable_full_viewing_key();
+        let seed = [0xab; 32];
+        let account = AccountId::ZERO;
+        let secret_key = UnifiedSpendingKey::from_seed(&db_data.params, &seed, account).unwrap();
 
-        #[cfg(feature = "transparent-inputs")]
-        let ufvk = UnifiedFullViewingKey::new(
-            Some(
-                transparent::AccountPrivKey::from_seed(&network(), &seed, account)
-                    .unwrap()
-                    .to_account_pubkey(),
-            ),
-            Some(dfvk),
-            None,
+        init_main(
+            &mut db_data,
+            &secret_key.to_unified_full_viewing_key(),
+            account,
         )
         .unwrap();
-
-        #[cfg(not(feature = "transparent-inputs"))]
-        let ufvk = UnifiedFullViewingKey::new(Some(dfvk), None).unwrap();
-        let ufvks = HashMap::from([(account, ufvk)]);
-
-        init_accounts_table(&db_data, &ufvks).unwrap();
-
-        // Subsequent calls should return an error
-        init_accounts_table(&db_data, &HashMap::new()).unwrap_err();
-        init_accounts_table(&db_data, &ufvks).unwrap_err();
-    }
-
-    #[test]
-    fn init_accounts_table_allows_no_gaps() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // allow sequential initialization
-        let seed = [0u8; 32];
-        let ufvks = |ids: &[u32]| {
-            ids.iter()
-                .map(|a| {
-                    let account = AccountId::from(*a);
-                    UnifiedSpendingKey::from_seed(&network(), &seed, account)
-                        .map(|k| (account, k.to_unified_full_viewing_key()))
-                        .unwrap()
-                })
-                .collect::<HashMap<_, _>>()
-        };
-
-        // should fail if we have a gap
         assert_matches!(
-            init_accounts_table(&db_data, &ufvks(&[0, 2])),
-            Err(SqliteClientError::AccountIdDiscontinuity)
+            init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))),
+            Ok(_)
         );
-
-        // should succeed if there are no gaps
-        assert!(init_accounts_table(&db_data, &ufvks(&[0, 1, 2])).is_ok());
-    }
-
-    #[test]
-    fn init_blocks_table_only_works_once() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // First call with data should initialise the blocks table
-        init_blocks_table(
-            &db_data,
-            BlockHeight::from(1u32),
-            BlockHash([1; 32]),
-            1,
-            &[],
-        )
-        .unwrap();
-
-        // Subsequent calls should return an error
-        init_blocks_table(
-            &db_data,
-            BlockHeight::from(2u32),
-            BlockHash([2; 32]),
-            2,
-            &[],
-        )
-        .unwrap_err();
-    }
-
-    #[test]
-    fn init_accounts_table_stores_correct_address() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        let seed = [0u8; 32];
-
-        // Add an account to the wallet
-        let account_id = AccountId::from(0);
-        let usk = UnifiedSpendingKey::from_seed(&tests::network(), &seed, account_id).unwrap();
-        let ufvk = usk.to_unified_full_viewing_key();
-        let expected_address = ufvk.sapling().unwrap().default_address().1;
-        let ufvks = HashMap::from([(account_id, ufvk)]);
-        init_accounts_table(&db_data, &ufvks).unwrap();
-
-        // The account's address should be in the data DB
-        let ua = db_data.get_current_address(AccountId::from(0)).unwrap();
-        assert_eq!(ua.unwrap().sapling().unwrap(), &expected_address);
     }
 
     #[test]
     #[cfg(feature = "transparent-inputs")]
     fn account_produces_expected_ua_sequence() {
+        use zcash_client_backend::data_api::{AccountBirthday, AccountSource, WalletRead};
+        use zcash_primitives::block::BlockHash;
+
+        let network = Network::MainNetwork;
         let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), Network::MainNetwork).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
+        assert_matches!(init_wallet_db(&mut db_data, None), Ok(_));
 
-        let mut ops = db_data.get_update_ops().unwrap();
+        // Prior to adding any accounts, every seed phrase is relevant to the wallet.
         let seed = test_vectors::UNIFIED[0].root_seed;
-        let (account, _usk) = ops.create_account(&Secret::new(seed.to_vec())).unwrap();
-        assert_eq!(account, AccountId::from(0u32));
+        let other_seed = [7; 32];
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))),
+            Ok(())
+        );
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(Secret::new(other_seed.to_vec()))),
+            Ok(())
+        );
+
+        let birthday = AccountBirthday::from_sapling_activation(&network, BlockHash([0; 32]));
+        let (account_id, _usk) = db_data
+            .create_account("", &Secret::new(seed.to_vec()), &birthday, None)
+            .unwrap();
+        assert_matches!(
+            db_data.get_account(account_id),
+            Ok(Some(account)) if matches!(
+                &account.kind,
+                AccountSource::Derived{derivation, ..} if derivation.account_index() == zip32::AccountId::ZERO,
+            )
+        );
+
+        // After adding an account, only the real seed phrase is relevant to the wallet.
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(Secret::new(seed.to_vec()))),
+            Ok(())
+        );
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(Secret::new(other_seed.to_vec()))),
+            Err(schemerz::MigratorError::Adapter(
+                WalletMigrationError::SeedNotRelevant
+            ))
+        );
 
         for tv in &test_vectors::UNIFIED[..3] {
-            if let Some(RecipientAddress::Unified(tvua)) =
-                RecipientAddress::decode(&Network::MainNetwork, tv.unified_addr)
+            if let Some(Address::Unified(tvua)) =
+                Address::decode(&Network::MainNetwork, tv.unified_addr)
             {
-                let (ua, di) = wallet::get_current_address(&db_data, account)
-                    .unwrap()
-                    .expect("create_account generated the first address");
+                let (ua, di) =
+                    wallet::get_current_address(&db_data.conn, &db_data.params, account_id)
+                        .unwrap()
+                        .expect("create_account generated the first address");
                 assert_eq!(DiversifierIndex::from(tv.diversifier_index), di);
                 assert_eq!(tvua.transparent(), ua.transparent());
                 assert_eq!(tvua.sapling(), ua.sapling());
+                #[cfg(not(feature = "orchard"))]
                 assert_eq!(tv.unified_addr, ua.encode(&Network::MainNetwork));
 
-                ops.get_next_available_address(account)
+                // hardcoded with knowledge of what's coming next
+                let ua_request = UnifiedAddressRequest::unsafe_new(false, true, true);
+                db_data
+                    .get_next_available_address(account_id, ua_request)
                     .unwrap()
                     .expect("get_next_available_address generated an address");
             } else {
diff --git a/zcash_client_sqlite/src/wallet/init/migrations.rs b/zcash_client_sqlite/src/wallet/init/migrations.rs
index 1cc9bcfc5f..1e076736ed 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations.rs
@@ -1,40 +1,97 @@
+mod add_account_birthdays;
+mod add_account_uuids;
 mod add_transaction_views;
 mod add_utxo_account;
 mod addresses_table;
+mod ensure_orchard_ua_receiver;
+mod ephemeral_addresses;
+mod fix_bad_change_flagging;
+mod fix_broken_commitment_trees;
+mod full_account_ids;
 mod initial_setup;
+mod nullifier_map;
+mod orchard_received_notes;
+mod orchard_shardtree;
 mod received_notes_nullable_nf;
+mod receiving_key_scopes;
+mod sapling_memo_consistency;
 mod sent_notes_to_internal;
+mod shardtree_support;
+mod spend_key_available;
+mod support_legacy_sqlite;
+mod tx_retrieval_queue;
 mod ufvk_support;
 mod utxos_table;
+mod utxos_to_txos;
+mod v_sapling_shard_unscanned_ranges;
 mod v_transactions_net;
+mod v_transactions_note_uniqueness;
+mod v_transactions_shielding_balance;
+mod v_transactions_transparent_history;
+mod v_tx_outputs_use_legacy_false;
+mod wallet_summaries;
 
-use schemer_rusqlite::RusqliteMigration;
+use std::rc::Rc;
+
+use rusqlite::{named_params, OptionalExtension};
+use schemerz_rusqlite::RusqliteMigration;
 use secrecy::SecretVec;
-use zcash_primitives::consensus;
+use uuid::Uuid;
+use zcash_address::unified::{Encoding as _, Ufvk};
+use zcash_protocol::consensus;
 
 use super::WalletMigrationError;
 
 pub(super) fn all_migrations<P: consensus::Parameters + 'static>(
     params: &P,
-    seed: Option<SecretVec<u8>>,
+    seed: Option<Rc<SecretVec<u8>>>,
 ) -> Vec<Box<dyn RusqliteMigration<Error = WalletMigrationError>>> {
-    //      initial_setup
-    //      /           \
-    // utxos_table     ufvk_support ----------
-    //      \                \                \
-    //       \         addresses_table   sent_notes_to_internal
-    //        \              /                /
-    //        add_utxo_account               /
-    //                       \              /
-    //                    add_transaction_views
-    //                       /
-    //        v_transactions_net
+    //                                   initial_setup
+    //                                   /           \
+    //                          utxos_table         ufvk_support
+    //                             |                 /         \
+    //                             |    addresses_table   sent_notes_to_internal
+    //                             |          /                /
+    //                           add_utxo_account             /
+    //                                        \              /
+    //                                     add_transaction_views
+    //                                               |
+    //                                       v_transactions_net
+    //                                               |
+    //                                            received_notes_nullable_nf----------------------
+    //                                            /           |                                   \
+    //                                           /            |                                    \
+    //           --------------- shardtree_support    sapling_memo_consistency                    nullifier_map
+    //          /                     /           \                       \                                  |
+    // orchard_shardtree   add_account_birthdays   receiving_key_scopes   v_transactions_transparent_history |
+    //   |                    |                 \            |                     |                         |
+    //   |   v_sapling_shard_unscanned_ranges    \           |       v_tx_outputs_use_legacy_false           |
+    //   |                    |                   \          |                     |                         |
+    //   |            wallet_summaries             \         |      v_transactions_shielding_balance         |
+    //   |                    \                     \        |                     |                        /
+    //    \                    \                     \       |      v_transactions_note_uniqueness         /
+    //     \                    \                     \      |        /                                   /
+    //      \                    -------------------- full_account_ids                                   /
+    //       \                                        /               \                                 /
+    //        \                         orchard_received_notes        spend_key_available              /
+    //         \                             /         \                      /                       /
+    //          \     ensure_orchard_ua_receiver     utxos_to_txos           /                       /
+    //           \                          \              |                /                       /
+    //            \                          \     ephemeral_addresses     /                       /
+    //             \                          \            |              /                       /
+    //              ------------------------------ tx_retrieval_queue ----------------------------
+    //                                                     |
+    //                                            support_legacy_sqlite
+    //                                               /           \
+    //                         fix_broken_commitment_trees      add_account_uuids
+    //                                     |
+    //                          fix_bad_change_flagging
     vec![
         Box::new(initial_setup::Migration {}),
         Box::new(utxos_table::Migration {}),
         Box::new(ufvk_support::Migration {
             params: params.clone(),
-            seed,
+            seed: seed.clone(),
         }),
         Box::new(addresses_table::Migration {
             params: params.clone(),
@@ -46,5 +103,247 @@ pub(super) fn all_migrations<P: consensus::Parameters + 'static>(
         Box::new(add_transaction_views::Migration),
         Box::new(v_transactions_net::Migration),
         Box::new(received_notes_nullable_nf::Migration),
+        Box::new(shardtree_support::Migration {
+            params: params.clone(),
+        }),
+        Box::new(nullifier_map::Migration),
+        Box::new(sapling_memo_consistency::Migration {
+            params: params.clone(),
+        }),
+        Box::new(add_account_birthdays::Migration {
+            params: params.clone(),
+        }),
+        Box::new(v_sapling_shard_unscanned_ranges::Migration {
+            params: params.clone(),
+        }),
+        Box::new(wallet_summaries::Migration),
+        Box::new(v_transactions_transparent_history::Migration),
+        Box::new(v_tx_outputs_use_legacy_false::Migration),
+        Box::new(v_transactions_shielding_balance::Migration),
+        Box::new(v_transactions_note_uniqueness::Migration),
+        Box::new(receiving_key_scopes::Migration {
+            params: params.clone(),
+        }),
+        Box::new(full_account_ids::Migration {
+            seed,
+            params: params.clone(),
+        }),
+        Box::new(orchard_shardtree::Migration {
+            params: params.clone(),
+        }),
+        Box::new(orchard_received_notes::Migration),
+        Box::new(ensure_orchard_ua_receiver::Migration {
+            params: params.clone(),
+        }),
+        Box::new(utxos_to_txos::Migration),
+        Box::new(ephemeral_addresses::Migration {
+            params: params.clone(),
+        }),
+        Box::new(spend_key_available::Migration),
+        Box::new(tx_retrieval_queue::Migration {
+            _params: params.clone(),
+        }),
+        Box::new(support_legacy_sqlite::Migration),
+        Box::new(fix_broken_commitment_trees::Migration {
+            params: params.clone(),
+        }),
+        Box::new(fix_bad_change_flagging::Migration),
+        Box::new(add_account_uuids::Migration),
     ]
 }
+
+/// All states of the migration DAG that have been exposed in a public crate release, in
+/// the order that crate users would have encountered them.
+///
+/// Omitted versions had the same migration state as the first prior version that is
+/// included.
+#[allow(dead_code)]
+const PUBLIC_MIGRATION_STATES: &[&[Uuid]] = &[
+    V_0_4_0, V_0_6_0, V_0_8_0, V_0_9_0, V_0_10_0, V_0_10_3, V_0_11_0, V_0_11_1, V_0_11_2, V_0_12_0,
+    V_0_13_0,
+];
+
+/// Leaf migrations in the 0.4.0 release.
+const V_0_4_0: &[Uuid] = &[add_transaction_views::MIGRATION_ID];
+
+/// Leaf migrations in the 0.6.0 release.
+const V_0_6_0: &[Uuid] = &[v_transactions_net::MIGRATION_ID];
+
+/// Leaf migrations in the 0.8.0 release.
+const V_0_8_0: &[Uuid] = &[
+    nullifier_map::MIGRATION_ID,
+    v_transactions_note_uniqueness::MIGRATION_ID,
+    wallet_summaries::MIGRATION_ID,
+];
+
+/// Leaf migrations in the 0.9.0 release.
+const V_0_9_0: &[Uuid] = &[
+    nullifier_map::MIGRATION_ID,
+    receiving_key_scopes::MIGRATION_ID,
+    v_transactions_note_uniqueness::MIGRATION_ID,
+    wallet_summaries::MIGRATION_ID,
+];
+
+/// Leaf migrations in the 0.10.0 release.
+const V_0_10_0: &[Uuid] = &[
+    nullifier_map::MIGRATION_ID,
+    orchard_received_notes::MIGRATION_ID,
+    orchard_shardtree::MIGRATION_ID,
+];
+
+/// Leaf migrations in the 0.10.3 release.
+const V_0_10_3: &[Uuid] = &[
+    ensure_orchard_ua_receiver::MIGRATION_ID,
+    nullifier_map::MIGRATION_ID,
+    orchard_shardtree::MIGRATION_ID,
+];
+
+/// Leaf migrations in the 0.11.0 release.
+const V_0_11_0: &[Uuid] = &[
+    ensure_orchard_ua_receiver::MIGRATION_ID,
+    ephemeral_addresses::MIGRATION_ID,
+    nullifier_map::MIGRATION_ID,
+    orchard_shardtree::MIGRATION_ID,
+    spend_key_available::MIGRATION_ID,
+    tx_retrieval_queue::MIGRATION_ID,
+];
+
+/// Leaf migrations in the 0.11.1 release.
+const V_0_11_1: &[Uuid] = &[tx_retrieval_queue::MIGRATION_ID];
+
+/// Leaf migrations in the 0.11.2 release.
+const V_0_11_2: &[Uuid] = &[support_legacy_sqlite::MIGRATION_ID];
+
+/// Leaf migrations in the 0.12.0 release.
+const V_0_12_0: &[Uuid] = &[fix_broken_commitment_trees::MIGRATION_ID];
+
+/// Leaf migrations in the 0.13.0 release.
+const V_0_13_0: &[Uuid] = &[fix_bad_change_flagging::MIGRATION_ID];
+
+pub(super) fn verify_network_compatibility<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+) -> Result<(), WalletMigrationError> {
+    // Ensure that the `ufvk_support` migration has been applied; if it hasn't, we won't be able to
+    // validate that the UFVKs in the wallet correspond to the network type that the wallet is
+    // being migrated for.
+    let has_ufvk = conn
+        .query_row(
+            &format!(
+                "SELECT 1 FROM {} WHERE id = :migration_id",
+                super::MIGRATIONS_TABLE
+            ),
+            named_params![":migration_id": &ufvk_support::MIGRATION_ID.as_bytes()[..]],
+            |row| row.get::<_, bool>(0),
+        )
+        .optional()?
+        == Some(true);
+
+    if has_ufvk {
+        let mut fvks_stmt = conn.prepare("SELECT ufvk FROM accounts")?;
+        let mut rows = fvks_stmt.query([])?;
+        while let Some(row) = rows.next()? {
+            let ufvk_str = row.get::<_, String>(0)?;
+            let (network, _) = Ufvk::decode(&ufvk_str).map_err(|e| {
+                WalletMigrationError::CorruptedData(format!("Unable to parse UFVK: {e}"))
+            })?;
+
+            if network != params.network_type() {
+                let network_name = |n| match n {
+                    consensus::NetworkType::Main => "mainnet",
+                    consensus::NetworkType::Test => "testnet",
+                    consensus::NetworkType::Regtest => "regtest",
+                };
+                return Err(WalletMigrationError::CorruptedData(format!(
+                    "Network type mismatch: account UFVK is for {} but attempting to initialize for {}.",
+                    network_name(network),
+                    network_name(params.network_type())
+                )));
+            }
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashSet;
+
+    use rusqlite::Connection;
+    use secrecy::Secret;
+    use tempfile::NamedTempFile;
+    use uuid::Uuid;
+    use zcash_protocol::consensus::Network;
+
+    use crate::{wallet::init::init_wallet_db_internal, WalletDb};
+
+    /// Tests that we can migrate from a completely empty wallet database to the target
+    /// migrations.
+    pub(crate) fn test_migrate(migrations: &[Uuid]) {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+
+        let seed = [0xab; 32];
+        assert_matches!(
+            init_wallet_db_internal(
+                &mut db_data,
+                Some(Secret::new(seed.to_vec())),
+                migrations,
+                false
+            ),
+            Ok(_)
+        );
+    }
+
+    #[test]
+    fn migrate_between_releases_without_data() {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+
+        let seed = [0xab; 32].to_vec();
+
+        let mut prev_state = HashSet::new();
+        let mut ensure_migration_state_changed = |conn: &Connection| {
+            let new_state = conn
+                .prepare_cached("SELECT * FROM schemer_migrations")
+                .unwrap()
+                .query_map([], |row| row.get::<_, [u8; 16]>(0).map(Uuid::from_bytes))
+                .unwrap()
+                .collect::<Result<HashSet<Uuid>, _>>()
+                .unwrap();
+            assert!(prev_state != new_state);
+            prev_state = new_state;
+        };
+
+        let mut prev_leaves: &[Uuid] = &[];
+        for migrations in super::PUBLIC_MIGRATION_STATES {
+            assert_matches!(
+                init_wallet_db_internal(
+                    &mut db_data,
+                    Some(Secret::new(seed.clone())),
+                    migrations,
+                    false
+                ),
+                Ok(_)
+            );
+
+            // If we have any new leaves, ensure the migration state changed. This lets us
+            // represent releases that changed the graph edges without introducing any new
+            // migrations.
+            if migrations.iter().any(|m| !prev_leaves.contains(m)) {
+                ensure_migration_state_changed(&db_data.conn);
+            }
+
+            prev_leaves = *migrations;
+        }
+
+        // Now check that we can migrate from the last public release to the current
+        // migration state in this branch.
+        assert_matches!(
+            init_wallet_db_internal(&mut db_data, Some(Secret::new(seed)), &[], false),
+            Ok(_)
+        );
+        // We don't ensure that the migration state changed, because it may not have.
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/add_account_birthdays.rs b/zcash_client_sqlite/src/wallet/init/migrations/add_account_birthdays.rs
new file mode 100644
index 0000000000..89b08448a9
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/add_account_birthdays.rs
@@ -0,0 +1,130 @@
+//! This migration adds a birthday height to each account record.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_primitives::consensus::{self, NetworkUpgrade};
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::shardtree_support;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xeeec0d0d_fee0_4231_8c68_5f3a7c7c2245);
+
+const DEPENDENCIES: &[Uuid] = &[shardtree_support::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Adds a birthday height for each account."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(&format!(
+            "ALTER TABLE accounts ADD COLUMN birthday_height INTEGER;
+
+            -- set the birthday height to the height of the first block in the blocks table
+            UPDATE accounts SET birthday_height = MIN(blocks.height) FROM blocks;
+            -- if the blocks table is empty, set the birthday height to Sapling activation - 1
+            UPDATE accounts SET birthday_height = {} WHERE birthday_height IS NULL;
+
+            CREATE TABLE accounts_new (
+                account INTEGER PRIMARY KEY,
+                ufvk TEXT NOT NULL,
+                birthday_height INTEGER NOT NULL,
+                recover_until_height INTEGER
+            );
+
+            INSERT INTO accounts_new (account, ufvk, birthday_height)
+            SELECT account, ufvk, birthday_height FROM accounts;
+
+            PRAGMA legacy_alter_table = ON;
+            DROP TABLE accounts;
+            ALTER TABLE accounts_new RENAME TO accounts;
+            PRAGMA legacy_alter_table = OFF;",
+            u32::from(
+                self.params
+                    .activation_height(NetworkUpgrade::Sapling)
+                    .unwrap()
+            )
+        ))?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use rusqlite::named_params;
+    use secrecy::Secret;
+    use tempfile::NamedTempFile;
+    use zcash_keys::keys::UnifiedSpendingKey;
+    use zcash_protocol::consensus::Network;
+    use zip32::AccountId;
+
+    use super::{DEPENDENCIES, MIGRATION_ID};
+    use crate::{wallet::init::init_wallet_db_internal, WalletDb};
+
+    #[test]
+    fn migrate() {
+        let data_file = NamedTempFile::new().unwrap();
+        let network = Network::TestNetwork;
+        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
+
+        let seed_bytes = vec![0xab; 32];
+        init_wallet_db_internal(
+            &mut db_data,
+            Some(Secret::new(seed_bytes.clone())),
+            DEPENDENCIES,
+            false,
+        )
+        .unwrap();
+
+        let usk =
+            UnifiedSpendingKey::from_seed(&network, &seed_bytes[..], AccountId::ZERO).unwrap();
+        let ufvk_str = usk.to_unified_full_viewing_key().encode(&network);
+
+        db_data
+            .conn
+            .execute(
+                "INSERT INTO accounts (account, ufvk) VALUES (0, :ufvk_str)",
+                named_params![":ufvk_str": ufvk_str],
+            )
+            .unwrap();
+        db_data
+            .conn
+            .execute_batch(
+                "INSERT INTO addresses (account, diversifier_index_be, address) 
+                VALUES (0, X'', 'not_a_real_address');",
+            )
+            .unwrap();
+
+        init_wallet_db_internal(
+            &mut db_data,
+            Some(Secret::new(seed_bytes)),
+            &[MIGRATION_ID],
+            false,
+        )
+        .unwrap();
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/add_account_uuids.rs b/zcash_client_sqlite/src/wallet/init/migrations/add_account_uuids.rs
new file mode 100644
index 0000000000..aa38cd12cc
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/add_account_uuids.rs
@@ -0,0 +1,331 @@
+//! This migration adds a UUID to each account record, and adds `name` and `key_source` columns. In
+//! addition, imported account records are now permitted to include key derivation metadata.
+
+use std::collections::HashSet;
+
+use rusqlite::named_params;
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_client_backend::data_api::{AccountPurpose, AccountSource, Zip32Derivation};
+use zip32::fingerprint::SeedFingerprint;
+
+use crate::wallet::{account_kind_code, init::WalletMigrationError};
+
+use super::support_legacy_sqlite;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xcccc623f_3243_43c7_b884_ceef25149e04);
+
+const DEPENDENCIES: &[Uuid] = &[support_legacy_sqlite::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Adds a UUID for each account."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        let account_kind_derived = account_kind_code(&AccountSource::Derived {
+            derivation: Zip32Derivation::new(
+                SeedFingerprint::from_bytes([0; 32]),
+                zip32::AccountId::ZERO,
+            ),
+            key_source: None,
+        });
+        let account_kind_imported = account_kind_code(&AccountSource::Imported {
+            // the purpose here is irrelevant; we just use it to get the correct code
+            // for the account kind
+            purpose: AccountPurpose::ViewOnly,
+            key_source: None,
+        });
+        transaction.execute_batch(&format!(
+            r#"
+            CREATE TABLE accounts_new (
+                id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+                name TEXT,
+                uuid BLOB NOT NULL,
+                account_kind INTEGER NOT NULL DEFAULT {account_kind_derived},
+                key_source TEXT,
+                hd_seed_fingerprint BLOB,
+                hd_account_index INTEGER,
+                ufvk TEXT,
+                uivk TEXT NOT NULL,
+                orchard_fvk_item_cache BLOB,
+                sapling_fvk_item_cache BLOB,
+                p2pkh_fvk_item_cache BLOB,
+                birthday_height INTEGER NOT NULL,
+                birthday_sapling_tree_size INTEGER,
+                birthday_orchard_tree_size INTEGER,
+                recover_until_height INTEGER,
+                has_spend_key INTEGER NOT NULL DEFAULT 1,
+                CHECK (
+                  (
+                    account_kind = {account_kind_derived}
+                    AND hd_seed_fingerprint IS NOT NULL
+                    AND hd_account_index IS NOT NULL
+                    AND ufvk IS NOT NULL
+                  )
+                  OR
+                  (
+                    account_kind = {account_kind_imported}
+                    AND (hd_seed_fingerprint IS NULL) = (hd_account_index IS NULL)
+                  )
+                )
+            );
+            "#
+        ))?;
+
+        let mut q = transaction.prepare("SELECT * FROM accounts")?;
+        let mut rows = q.query([])?;
+        while let Some(row) = rows.next()? {
+            let preserve = |idx: &str| row.get::<_, rusqlite::types::Value>(idx);
+            transaction.execute(
+                r#"
+                INSERT INTO accounts_new (
+                    id, uuid,
+                    account_kind, hd_seed_fingerprint, hd_account_index,
+                    ufvk, uivk,
+                    orchard_fvk_item_cache, sapling_fvk_item_cache, p2pkh_fvk_item_cache,
+                    birthday_height, birthday_sapling_tree_size, birthday_orchard_tree_size,
+                    recover_until_height,
+                    has_spend_key
+                )
+                VALUES (
+                    :account_id, :uuid,
+                    :account_kind, :hd_seed_fingerprint, :hd_account_index,
+                    :ufvk, :uivk,
+                    :orchard_fvk_item_cache, :sapling_fvk_item_cache, :p2pkh_fvk_item_cache,
+                    :birthday_height, :birthday_sapling_tree_size, :birthday_orchard_tree_size,
+                    :recover_until_height,
+                    :has_spend_key
+                );
+                "#,
+                named_params! {
+                    ":account_id": preserve("id")?,
+                    ":uuid": Uuid::new_v4(),
+                    ":account_kind": preserve("account_kind")?,
+                    ":hd_seed_fingerprint": preserve("hd_seed_fingerprint")?,
+                    ":hd_account_index": preserve("hd_account_index")?,
+                    ":ufvk": preserve("ufvk")?,
+                    ":uivk": preserve("uivk")?,
+                    ":orchard_fvk_item_cache": preserve("orchard_fvk_item_cache")?,
+                    ":sapling_fvk_item_cache": preserve("sapling_fvk_item_cache")?,
+                    ":p2pkh_fvk_item_cache": preserve("p2pkh_fvk_item_cache")?,
+                    ":birthday_height": preserve("birthday_height")?,
+                    ":birthday_sapling_tree_size": preserve("birthday_sapling_tree_size")?,
+                    ":birthday_orchard_tree_size": preserve("birthday_orchard_tree_size")?,
+                    ":recover_until_height": preserve("recover_until_height")?,
+                    ":has_spend_key": preserve("has_spend_key")?,
+                },
+            )?;
+        }
+
+        transaction.execute_batch(
+            "PRAGMA legacy_alter_table = ON;
+            DROP TABLE accounts;
+            ALTER TABLE accounts_new RENAME TO accounts;
+            PRAGMA legacy_alter_table = OFF;
+
+            -- Add the new index.
+            CREATE UNIQUE INDEX accounts_uuid ON accounts (uuid);
+
+            -- Recreate the existing indices now that the original ones have been deleted.
+            CREATE UNIQUE INDEX hd_account ON accounts (hd_seed_fingerprint, hd_account_index);
+            CREATE UNIQUE INDEX accounts_uivk ON accounts (uivk);
+            CREATE UNIQUE INDEX accounts_ufvk ON accounts (ufvk);
+
+            -- Replace accounts.id with accounts.uuid in v_transactions.
+            DROP VIEW v_transactions;
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                -- Outputs received in this transaction
+                SELECT ro.account_id              AS account_id,
+                       transactions.mined_height  AS mined_height,
+                       transactions.txid          AS txid,
+                       ro.pool                    AS pool,
+                       id_within_pool_table,
+                       ro.value                   AS value,
+                       0                          AS spent_note_count,
+                       CASE
+                            WHEN ro.is_change THEN 1
+                            ELSE 0
+                       END AS change_note_count,
+                       CASE
+                            WHEN ro.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (ro.memo IS NULL OR ro.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present,
+                       -- The wallet cannot receive transparent outputs in shielding transactions.
+                       CASE
+                         WHEN ro.pool = 0
+                           THEN 1
+                         ELSE 0
+                       END AS does_not_match_shielding
+                FROM v_received_outputs ro
+                JOIN transactions
+                     ON transactions.id_tx = ro.transaction_id
+                UNION
+                -- Outputs spent in this transaction
+                SELECT ro.account_id              AS account_id,
+                       transactions.mined_height  AS mined_height,
+                       transactions.txid          AS txid,
+                       ro.pool                    AS pool,
+                       id_within_pool_table,
+                       -ro.value                  AS value,
+                       1                          AS spent_note_count,
+                       0                          AS change_note_count,
+                       0                          AS received_count,
+                       0                          AS memo_present,
+                       -- The wallet cannot spend shielded outputs in shielding transactions.
+                       CASE
+                         WHEN ro.pool != 0
+                           THEN 1
+                         ELSE 0
+                       END AS does_not_match_shielding
+                FROM v_received_outputs ro
+                JOIN v_received_output_spends ros
+                     ON ros.pool = ro.pool
+                     AND ros.received_output_id = ro.id_within_pool_table
+                JOIN transactions
+                     ON transactions.id_tx = ros.transaction_id
+            ),
+            -- Obtain a count of the notes that the wallet created in each transaction,
+            -- not counting change notes.
+            sent_note_counts AS (
+                SELECT sent_notes.from_account_id     AS account_id,
+                       transactions.txid              AS txid,
+                       COUNT(DISTINCT sent_notes.id)  AS sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR ro.transaction_id IS NOT NULL)
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                JOIN transactions
+                     ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN v_received_outputs ro
+                     ON sent_notes.id = ro.sent_note_id
+                WHERE COALESCE(ro.is_change, 0) = 0
+                GROUP BY account_id, txid
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) AS max_height FROM blocks
+            )
+            SELECT accounts.uuid                AS account_uuid,
+                   notes.mined_height           AS mined_height,
+                   notes.txid                   AS txid,
+                   transactions.tx_index        AS tx_index,
+                   transactions.expiry_height   AS expiry_height,
+                   transactions.raw             AS raw,
+                   SUM(notes.value)             AS account_balance_delta,
+                   transactions.fee             AS fee_paid,
+                   SUM(notes.change_note_count) > 0  AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                   ) AS expired_unmined,
+                   SUM(notes.spent_note_count) AS spent_note_count,
+                   (
+                        -- All of the wallet-spent and wallet-received notes are consistent with a
+                        -- shielding transaction.
+                        SUM(notes.does_not_match_shielding) = 0
+                        -- The transaction contains at least one wallet-spent output.
+                        AND SUM(notes.spent_note_count) > 0
+                        -- The transaction contains at least one wallet-received note.
+                        AND (SUM(notes.received_count) + SUM(notes.change_note_count)) > 0
+                        -- We do not know about any external outputs of the transaction.
+                        AND MAX(COALESCE(sent_note_counts.sent_notes, 0)) = 0
+                   ) AS is_shielding
+            FROM notes
+            JOIN accounts ON accounts.id = notes.account_id
+            LEFT JOIN transactions
+                 ON notes.txid = transactions.txid
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = notes.mined_height
+            LEFT JOIN sent_note_counts
+                 ON sent_note_counts.account_id = notes.account_id
+                 AND sent_note_counts.txid = notes.txid
+            GROUP BY notes.account_id, notes.txid;
+
+            -- Replace accounts.id with accounts.uuid in v_tx_outputs.
+            DROP VIEW v_tx_outputs;
+            CREATE VIEW v_tx_outputs AS
+            -- select all outputs received by the wallet
+            SELECT transactions.txid            AS txid,
+                   ro.pool                      AS output_pool,
+                   ro.output_index              AS output_index,
+                   from_account.uuid            AS from_account_uuid,
+                   to_account.uuid              AS to_account_uuid,
+                   NULL                         AS to_address,
+                   ro.value                     AS value,
+                   ro.is_change                 AS is_change,
+                   ro.memo                      AS memo
+            FROM v_received_outputs ro
+            JOIN transactions
+                ON transactions.id_tx = ro.transaction_id
+            -- join to the sent_notes table to obtain `from_account_id`
+            LEFT JOIN sent_notes ON sent_notes.id = ro.sent_note_id
+            -- join on the accounts table to obtain account UUIDs
+            JOIN accounts from_account ON accounts.id = sent_notes.from_account_id
+            JOIN accounts to_account ON accounts.id = ro.account_id
+            UNION
+            -- select all outputs sent from the wallet to external recipients
+            SELECT transactions.txid            AS txid,
+                   sent_notes.output_pool       AS output_pool,
+                   sent_notes.output_index      AS output_index,
+                   from_account.uuid            AS from_account_uuid,
+                   NULL                         AS to_account_uuid,
+                   sent_notes.to_address        AS to_address,
+                   sent_notes.value             AS value,
+                   0                            AS is_change,
+                   sent_notes.memo              AS memo
+            FROM sent_notes
+            JOIN transactions
+                ON transactions.id_tx = sent_notes.tx
+            LEFT JOIN v_received_outputs ro ON ro.sent_note_id = sent_notes.id
+            -- join on the accounts table to obtain account UUIDs
+            JOIN accounts from_account ON accounts.id = sent_notes.from_account_id
+            -- exclude any sent notes for which a row exists in the v_received_outputs view
+            WHERE ro.account_id IS NULL",
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/add_transaction_views.rs b/zcash_client_sqlite/src/wallet/init/migrations/add_transaction_views.rs
index 70694f8425..242a285e32 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/add_transaction_views.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/add_transaction_views.rs
@@ -2,8 +2,7 @@
 use std::collections::HashSet;
 
 use rusqlite::{self, types::ToSql, OptionalExtension};
-use schemer::{self};
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
 
 use zcash_primitives::{
@@ -17,27 +16,22 @@ use zcash_primitives::{
 use super::{add_utxo_account, sent_notes_to_internal};
 use crate::wallet::init::WalletMigrationError;
 
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0x282fad2e,
-    0x8372,
-    0x4ca0,
-    b"\x8b\xed\x71\x82\x13\x20\x90\x9f",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x282fad2e_8372_4ca0_8bed_71821320909f);
+
+const DEPENDENCIES: &[Uuid] = &[
+    add_utxo_account::MIGRATION_ID,
+    sent_notes_to_internal::MIGRATION_ID,
+];
 
 pub(crate) struct Migration;
 
-impl schemer::Migration for Migration {
+impl schemerz::Migration<Uuid> for Migration {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [
-            add_utxo_account::MIGRATION_ID,
-            sent_notes_to_internal::MIGRATION_ID,
-        ]
-        .into_iter()
-        .collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -272,8 +266,7 @@ impl RusqliteMigration for Migration {
     }
 
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
     }
 }
 
@@ -283,10 +276,9 @@ mod tests {
     use tempfile::NamedTempFile;
 
     use zcash_client_backend::keys::UnifiedSpendingKey;
-    use zcash_primitives::zip32::AccountId;
+    use zcash_primitives::{consensus::Network, zip32::AccountId};
 
     use crate::{
-        tests,
         wallet::init::{init_wallet_db_internal, migrations::addresses_table},
         WalletDb,
     };
@@ -310,24 +302,24 @@ mod tests {
 
     #[test]
     fn transaction_views() {
+        let network = Network::TestNetwork;
         let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db_internal(&mut db_data, None, &[addresses_table::MIGRATION_ID]).unwrap();
-        let usk =
-            UnifiedSpendingKey::from_seed(&tests::network(), &[0u8; 32][..], AccountId::from(0))
-                .unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
+        init_wallet_db_internal(&mut db_data, None, &[addresses_table::MIGRATION_ID], false)
+            .unwrap();
+        let usk = UnifiedSpendingKey::from_seed(&network, &[0u8; 32][..], AccountId::ZERO).unwrap();
         let ufvk = usk.to_unified_full_viewing_key();
 
         db_data
             .conn
             .execute(
                 "INSERT INTO accounts (account, ufvk) VALUES (0, ?)",
-                params![ufvk.encode(&tests::network())],
+                params![ufvk.encode(&network)],
             )
             .unwrap();
 
         db_data.conn.execute_batch(
-            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, '');
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'00');
             INSERT INTO transactions (block, id_tx, txid) VALUES (0, 0, '');
 
             INSERT INTO sent_notes (tx, output_pool, output_index, from_account, address, value)
@@ -345,7 +337,7 @@ mod tests {
             VALUES (0, 4, 0, '', 7, '', 'c', true, X'63');",
         ).unwrap();
 
-        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID]).unwrap();
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
 
         let mut q = db_data
             .conn
@@ -402,12 +394,21 @@ mod tests {
     #[test]
     #[cfg(feature = "transparent-inputs")]
     fn migrate_from_wm2() {
+        use zcash_client_backend::keys::UnifiedAddressRequest;
+        use zcash_primitives::{
+            legacy::keys::NonHardenedChildIndex, transaction::components::amount::NonNegativeAmount,
+        };
+
+        use crate::UA_TRANSPARENT;
+
+        let network = Network::TestNetwork;
         let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
         init_wallet_db_internal(
             &mut db_data,
             None,
             &[utxos_table::MIGRATION_ID, ufvk_support::MIGRATION_ID],
+            false,
         )
         .unwrap();
 
@@ -419,12 +420,12 @@ mod tests {
             BlockHeight::from(3),
             Some(transparent::Bundle {
                 vin: vec![TxIn {
-                    prevout: OutPoint::new([1u8; 32], 1),
+                    prevout: OutPoint::fake(),
                     script_sig: Script(vec![]),
                     sequence: 0,
                 }],
                 vout: vec![TxOut {
-                    value: Amount::from_i64(1100000000).unwrap(),
+                    value: NonNegativeAmount::const_from_u64(1100000000),
                     script_pubkey: Script(vec![]),
                 }],
                 authorization: Authorized,
@@ -439,28 +440,32 @@ mod tests {
         let mut tx_bytes = vec![];
         tx.write(&mut tx_bytes).unwrap();
 
-        let usk =
-            UnifiedSpendingKey::from_seed(&tests::network(), &[0u8; 32][..], AccountId::from(0))
-                .unwrap();
+        let usk = UnifiedSpendingKey::from_seed(&network, &[0u8; 32][..], AccountId::ZERO).unwrap();
         let ufvk = usk.to_unified_full_viewing_key();
-        let (ua, _) = ufvk.default_address();
+        let (ua, _) = ufvk
+            .default_address(UnifiedAddressRequest::unsafe_new(
+                false,
+                true,
+                UA_TRANSPARENT,
+            ))
+            .expect("A valid default address exists for the UFVK");
         let taddr = ufvk
             .transparent()
             .and_then(|k| {
                 k.derive_external_ivk()
                     .ok()
-                    .map(|k| k.derive_address(0).unwrap())
+                    .map(|k| k.derive_address(NonHardenedChildIndex::ZERO).unwrap())
             })
-            .map(|a| a.encode(&tests::network()));
+            .map(|a| a.encode(&network));
 
         db_data.conn.execute(
             "INSERT INTO accounts (account, ufvk, address, transparent_address) VALUES (0, ?, ?, ?)",
-            params![ufvk.encode(&tests::network()), ua.encode(&tests::network()), &taddr]
+            params![ufvk.encode(&network), ua.encode(&network), &taddr]
         ).unwrap();
         db_data
             .conn
             .execute_batch(
-                "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, '');",
+                "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'00');",
             )
             .unwrap();
         db_data.conn.execute(
@@ -476,7 +481,7 @@ mod tests {
             )
             .unwrap();
 
-        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID]).unwrap();
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
 
         let fee = db_data
             .conn
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/add_utxo_account.rs b/zcash_client_sqlite/src/wallet/init/migrations/add_utxo_account.rs
index f658ae1030..d3c62b7d3f 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/add_utxo_account.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/add_utxo_account.rs
@@ -1,11 +1,8 @@
 //! A migration that adds an identifier for the account that received a UTXO to the utxos table
-use std::collections::HashSet;
 
-use rusqlite;
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
+use std::collections::HashSet;
 use uuid::Uuid;
-
 use zcash_primitives::consensus;
 
 use super::{addresses_table, utxos_table};
@@ -13,35 +10,36 @@ use crate::wallet::init::WalletMigrationError;
 
 #[cfg(feature = "transparent-inputs")]
 use {
-    crate::{error::SqliteClientError, wallet::get_transparent_receivers},
-    rusqlite::named_params,
-    zcash_client_backend::encoding::AddressCodec,
-    zcash_primitives::zip32::AccountId,
+    crate::error::SqliteClientError,
+    rusqlite::{named_params, OptionalExtension},
+    std::collections::HashMap,
+    zcash_client_backend::{
+        encoding::AddressCodec, keys::UnifiedFullViewingKey, wallet::TransparentAddressMetadata,
+    },
+    zcash_keys::address::Address,
+    zcash_primitives::legacy::{
+        keys::{IncomingViewingKey, NonHardenedChildIndex},
+        TransparentAddress,
+    },
+    zip32::{AccountId, DiversifierIndex, Scope},
 };
 
 /// This migration adds an account identifier column to the UTXOs table.
-///
-/// 761884d6-30d8-44ef-b204-0b82551c4ca1
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0x761884d6,
-    0x30d8,
-    0x44ef,
-    b"\xb2\x04\x0b\x82\x55\x1c\x4c\xa1",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x761884d6_30d8_44ef_b204_0b82551c4ca1);
+
+const DEPENDENCIES: &[Uuid] = &[utxos_table::MIGRATION_ID, addresses_table::MIGRATION_ID];
 
 pub(super) struct Migration<P> {
     pub(super) _params: P,
 }
 
-impl<P> schemer::Migration for Migration<P> {
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [utxos_table::MIGRATION_ID, addresses_table::MIGRATION_ID]
-            .into_iter()
-            .collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -65,23 +63,26 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
 
             let mut rows = stmt_fetch_accounts.query([])?;
             while let Some(row) = rows.next()? {
-                let account: u32 = row.get(0)?;
-                let taddrs =
-                    get_transparent_receivers(&self._params, transaction, AccountId::from(account))
-                        .map_err(|e| match e {
-                            SqliteClientError::DbError(e) => WalletMigrationError::DbError(e),
-                            SqliteClientError::CorruptedData(s) => {
-                                WalletMigrationError::CorruptedData(s)
-                            }
-                            other => WalletMigrationError::CorruptedData(format!(
-                                "Unexpected error in migration: {}",
-                                other
-                            )),
-                        })?;
+                let account = AccountId::try_from(row.get::<_, u32>(0)?).map_err(|_| {
+                    WalletMigrationError::CorruptedData(
+                        "Unexpected ZIP-32 account index.".to_string(),
+                    )
+                })?;
+                let taddrs = get_transparent_receivers(transaction, &self._params, account)
+                    .map_err(|e| match e {
+                        SqliteClientError::DbError(e) => WalletMigrationError::DbError(e),
+                        SqliteClientError::CorruptedData(s) => {
+                            WalletMigrationError::CorruptedData(s)
+                        }
+                        other => WalletMigrationError::CorruptedData(format!(
+                            "Unexpected error in migration: {}",
+                            other
+                        )),
+                    })?;
 
                 for (taddr, _) in taddrs {
                     stmt_update_utxo_account.execute(named_params![
-                        ":account": &account,
+                        ":account": u32::from(account),
                         ":address": &taddr.encode(&self._params),
                     ])?;
                 }
@@ -123,7 +124,118 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
     }
 
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(feature = "transparent-inputs")]
+fn get_transparent_receivers<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account: AccountId,
+) -> Result<HashMap<TransparentAddress, Option<TransparentAddressMetadata>>, SqliteClientError> {
+    let mut ret: HashMap<TransparentAddress, Option<TransparentAddressMetadata>> = HashMap::new();
+
+    // Get all UAs derived
+    let mut ua_query = conn
+        .prepare("SELECT address, diversifier_index_be FROM addresses WHERE account = :account")?;
+    let mut rows = ua_query.query(named_params![":account": u32::from(account)])?;
+
+    while let Some(row) = rows.next()? {
+        let ua_str: String = row.get(0)?;
+        let di_vec: Vec<u8> = row.get(1)?;
+        let mut di: [u8; 11] = di_vec.try_into().map_err(|_| {
+            SqliteClientError::CorruptedData("Diversifier index is not an 11-byte value".to_owned())
+        })?;
+        di.reverse(); // BE -> LE conversion
+
+        let ua = Address::decode(params, &ua_str)
+            .ok_or_else(|| {
+                SqliteClientError::CorruptedData("Not a valid Zcash recipient address".to_owned())
+            })
+            .and_then(|addr| match addr {
+                Address::Unified(ua) => Ok(ua),
+                _ => Err(SqliteClientError::CorruptedData(format!(
+                    "Addresses table contains {} which is not a unified address",
+                    ua_str,
+                ))),
+            })?;
+
+        if let Some(taddr) = ua.transparent() {
+            let index = NonHardenedChildIndex::from_index(
+                DiversifierIndex::from(di).try_into().map_err(|_| {
+                    SqliteClientError::CorruptedData(
+                        "Unable to get diversifier for transparent address.".to_owned(),
+                    )
+                })?,
+            )
+            .ok_or_else(|| {
+                SqliteClientError::CorruptedData(
+                    "Unexpected hardened index for transparent address.".to_owned(),
+                )
+            })?;
+
+            ret.insert(
+                *taddr,
+                Some(TransparentAddressMetadata::new(
+                    Scope::External.into(),
+                    index,
+                )),
+            );
+        }
+    }
+
+    if let Some((taddr, address_index)) = get_legacy_transparent_address(params, conn, account)? {
+        ret.insert(
+            taddr,
+            Some(TransparentAddressMetadata::new(
+                Scope::External.into(),
+                address_index,
+            )),
+        );
+    }
+
+    Ok(ret)
+}
+
+#[cfg(feature = "transparent-inputs")]
+fn get_legacy_transparent_address<P: consensus::Parameters>(
+    params: &P,
+    conn: &rusqlite::Connection,
+    account: AccountId,
+) -> Result<Option<(TransparentAddress, NonHardenedChildIndex)>, SqliteClientError> {
+    // Get the UFVK for the account.
+    let ufvk_str: Option<String> = conn
+        .query_row(
+            "SELECT ufvk FROM accounts WHERE account = :account",
+            [u32::from(account)],
+            |row| row.get(0),
+        )
+        .optional()?;
+
+    if let Some(uvk_str) = ufvk_str {
+        let ufvk = UnifiedFullViewingKey::decode(params, &uvk_str)
+            .map_err(SqliteClientError::CorruptedData)?;
+
+        // Derive the default transparent address (if it wasn't already part of a derived UA).
+        ufvk.transparent()
+            .map(|tfvk| {
+                tfvk.derive_external_ivk()
+                    .map(|tivk| tivk.default_address())
+                    .map_err(SqliteClientError::TransparentDerivation)
+            })
+            .transpose()
+    } else {
+        Ok(None)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/addresses_table.rs b/zcash_client_sqlite/src/wallet/init/migrations/addresses_table.rs
index 3d3a7fa95d..a6fc1483e7 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/addresses_table.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/addresses_table.rs
@@ -1,13 +1,14 @@
 use std::collections::HashSet;
 
-use rusqlite::Transaction;
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use rusqlite::{named_params, Transaction};
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
-use zcash_client_backend::{address::RecipientAddress, keys::UnifiedFullViewingKey};
-use zcash_primitives::{consensus, zip32::AccountId};
+use zcash_client_backend::{address::Address, keys::UnifiedFullViewingKey};
+use zcash_keys::{address::UnifiedAddress, encoding::AddressCodec, keys::UnifiedAddressRequest};
+use zcash_primitives::consensus;
+use zip32::{AccountId, DiversifierIndex};
 
-use crate::wallet::{add_account_internal, init::WalletMigrationError};
+use crate::{wallet::init::WalletMigrationError, UA_TRANSPARENT};
 
 #[cfg(feature = "transparent-inputs")]
 use zcash_primitives::legacy::keys::IncomingViewingKey;
@@ -16,26 +17,21 @@ use super::ufvk_support;
 
 /// The migration that removed the address columns from the `accounts` table, and created
 /// the `accounts` table.
-///
-/// d956978c-9c87-4d6e-815d-fb8f088d094c
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0xd956978c,
-    0x9c87,
-    0x4d6e,
-    b"\x81\x5d\xfb\x8f\x08\x8d\x09\x4c",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xd956978c_9c87_4d6e_815d_fb8f088d094c);
+
+const DEPENDENCIES: &[Uuid] = &[ufvk_support::MIGRATION_ID];
 
 pub(crate) struct Migration<P: consensus::Parameters> {
     pub(crate) params: P,
 }
 
-impl<P: consensus::Parameters> schemer::Migration for Migration<P> {
+impl<P: consensus::Parameters> schemerz::Migration<Uuid> for Migration<P> {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [ufvk_support::MIGRATION_ID].into_iter().collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -67,8 +63,9 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
 
         let mut rows = stmt_fetch_accounts.query([])?;
         while let Some(row) = rows.next()? {
-            let account: u32 = row.get(0)?;
-            let account = AccountId::from(account);
+            let account = AccountId::try_from(row.get::<_, u32>(0)?).map_err(|_| {
+                WalletMigrationError::CorruptedData("Invalid ZIP-32 account index.".to_owned())
+            })?;
 
             let ufvk_str: String = row.get(1)?;
             let ufvk = UnifiedFullViewingKey::decode(&self.params, &ufvk_str)
@@ -76,25 +73,27 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
 
             // Verify that the address column contains the expected value.
             let address: String = row.get(2)?;
-            let decoded = RecipientAddress::decode(&self.params, &address).ok_or_else(|| {
+            let decoded = Address::decode(&self.params, &address).ok_or_else(|| {
                 WalletMigrationError::CorruptedData(format!(
                     "Could not decode {} as a valid Zcash address.",
                     address
                 ))
             })?;
-            let decoded_address = if let RecipientAddress::Unified(ua) = decoded {
+            let decoded_address = if let Address::Unified(ua) = decoded {
                 ua
             } else {
                 return Err(WalletMigrationError::CorruptedData(
                     "Address in accounts table was not a Unified Address.".to_string(),
                 ));
             };
-            let (expected_address, idx) = ufvk.default_address();
+            let (expected_address, idx) = ufvk.default_address(
+                UnifiedAddressRequest::unsafe_new(false, true, UA_TRANSPARENT),
+            )?;
             if decoded_address != expected_address {
                 return Err(WalletMigrationError::CorruptedData(format!(
                     "Decoded UA {} does not match the UFVK's default address {} at {:?}.",
                     address,
-                    RecipientAddress::Unified(expected_address).encode(&self.params),
+                    Address::Unified(expected_address).encode(&self.params),
                     idx,
                 )));
             }
@@ -102,16 +101,14 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
             // The transparent_address column might not be filled, depending on how this
             // crate was compiled.
             if let Some(transparent_address) = row.get::<_, Option<String>>(3)? {
-                let decoded_transparent =
-                    RecipientAddress::decode(&self.params, &transparent_address).ok_or_else(
-                        || {
-                            WalletMigrationError::CorruptedData(format!(
-                                "Could not decode {} as a valid Zcash address.",
-                                address
-                            ))
-                        },
-                    )?;
-                let decoded_transparent_address = if let RecipientAddress::Transparent(addr) =
+                let decoded_transparent = Address::decode(&self.params, &transparent_address)
+                    .ok_or_else(|| {
+                        WalletMigrationError::CorruptedData(format!(
+                            "Could not decode {} as a valid Zcash address.",
+                            address
+                        ))
+                    })?;
+                let decoded_transparent_address = if let Address::Transparent(addr) =
                     decoded_transparent
                 {
                     addr
@@ -152,13 +149,21 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
                 }
             }
 
-            add_account_internal::<P, WalletMigrationError>(
-                transaction,
-                &self.params,
-                "accounts_new",
-                account,
-                &ufvk,
+            transaction.execute(
+                "INSERT INTO accounts_new (account, ufvk)
+                 VALUES (:account, :ufvk)",
+                named_params![
+                    ":account": u32::from(account),
+                    ":ufvk": ufvk.encode(&self.params),
+                ],
             )?;
+
+            let (address, d_idx) = ufvk.default_address(UnifiedAddressRequest::unsafe_new(
+                false,
+                true,
+                UA_TRANSPARENT,
+            ))?;
+            insert_address(transaction, &self.params, account, d_idx, &address)?;
         }
 
         transaction.execute_batch(
@@ -170,7 +175,52 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
     }
 
     fn down(&self, _transaction: &Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+/// Adds the given address and diversifier index to the addresses table.
+fn insert_address<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account: AccountId,
+    diversifier_index: DiversifierIndex,
+    address: &UnifiedAddress,
+) -> Result<(), rusqlite::Error> {
+    let mut stmt = conn.prepare_cached(
+        "INSERT INTO addresses (
+            account,
+            diversifier_index_be,
+            address,
+            cached_transparent_receiver_address
+        )
+        VALUES (
+            :account,
+            :diversifier_index_be,
+            :address,
+            :cached_transparent_receiver_address
+        )",
+    )?;
+
+    // the diversifier index is stored in big-endian order to allow sorting
+    let mut di_be = *diversifier_index.as_bytes();
+    di_be.reverse();
+    stmt.execute(named_params![
+        ":account": u32::from(account),
+        ":diversifier_index_be": &di_be[..],
+        ":address": &address.encode(params),
+        ":cached_transparent_receiver_address": &address.transparent().map(|r| r.encode(params)),
+    ])?;
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/ensure_orchard_ua_receiver.rs b/zcash_client_sqlite/src/wallet/init/migrations/ensure_orchard_ua_receiver.rs
new file mode 100644
index 0000000000..8bca372acd
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/ensure_orchard_ua_receiver.rs
@@ -0,0 +1,196 @@
+//! This migration ensures that an Orchard receiver exists in the wallet's default Unified address.
+use std::collections::HashSet;
+
+use rusqlite::named_params;
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use zcash_client_backend::keys::{
+    UnifiedAddressRequest, UnifiedFullViewingKey, UnifiedIncomingViewingKey,
+};
+use zcash_primitives::consensus;
+
+use super::orchard_received_notes;
+use crate::{wallet::init::WalletMigrationError, UA_ORCHARD, UA_TRANSPARENT};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x604349c7_5ce5_4768_bea6_12d106ccda93);
+
+const DEPENDENCIES: &[Uuid] = &[orchard_received_notes::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Ensures that the wallet's default address contains an Orchard receiver."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction<'_>) -> Result<(), Self::Error> {
+        let mut get_accounts = transaction.prepare("SELECT id, ufvk, uivk FROM accounts")?;
+
+        let mut update_address = transaction.prepare(
+            r#"UPDATE "addresses"
+               SET address = :address
+               WHERE account_id = :account_id
+               AND diversifier_index_be = :j"#,
+        )?;
+
+        let mut accounts = get_accounts.query([])?;
+        while let Some(row) = accounts.next()? {
+            let account_id = row.get::<_, u32>("id")?;
+            let ufvk_str: Option<String> = row.get("ufvk")?;
+            let uivk = if let Some(ufvk_str) = ufvk_str {
+                UnifiedFullViewingKey::decode(&self.params, &ufvk_str[..])
+                    .map_err(|_| {
+                        WalletMigrationError::CorruptedData("Unable to decode UFVK".to_string())
+                    })?
+                    .to_unified_incoming_viewing_key()
+            } else {
+                let uivk_str: String = row.get("uivk")?;
+                UnifiedIncomingViewingKey::decode(&self.params, &uivk_str[..]).map_err(|_| {
+                    WalletMigrationError::CorruptedData("Unable to decode UIVK".to_string())
+                })?
+            };
+
+            let (default_addr, diversifier_index) = uivk.default_address(
+                UnifiedAddressRequest::unsafe_new(UA_ORCHARD, true, UA_TRANSPARENT),
+            )?;
+
+            let mut di_be = *diversifier_index.as_bytes();
+            di_be.reverse();
+            update_address.execute(named_params![
+                ":address": default_addr.encode(&self.params),
+                ":account_id": account_id,
+                ":j": &di_be[..],
+            ])?;
+        }
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction<'_>) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use rusqlite::named_params;
+    use secrecy::SecretVec;
+    use tempfile::NamedTempFile;
+
+    use zcash_client_backend::keys::{UnifiedAddressRequest, UnifiedSpendingKey};
+    use zcash_keys::address::Address;
+    use zcash_primitives::consensus::Network;
+
+    use crate::{
+        wallet::init::{init_wallet_db, init_wallet_db_internal, migrations::addresses_table},
+        WalletDb, UA_ORCHARD, UA_TRANSPARENT,
+    };
+
+    #[test]
+    fn init_migrate_add_orchard_receiver() {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+
+        let seed = vec![0x10; 32];
+        let account_id = 0u32;
+        let ufvk = UnifiedSpendingKey::from_seed(
+            &db_data.params,
+            &seed,
+            zip32::AccountId::try_from(account_id).unwrap(),
+        )
+        .unwrap()
+        .to_unified_full_viewing_key();
+
+        assert_matches!(
+            init_wallet_db_internal(
+                &mut db_data,
+                Some(SecretVec::new(seed.clone())),
+                &[addresses_table::MIGRATION_ID],
+                false
+            ),
+            Ok(_)
+        );
+
+        // Manually create an entry in the addresses table for an address that lacks an Orchard
+        // receiver.
+        db_data
+            .conn
+            .execute(
+                "INSERT INTO accounts (account, ufvk) VALUES (:account_id, :ufvk)",
+                named_params![
+                    ":account_id": account_id,
+                    ":ufvk": ufvk.encode(&db_data.params)
+                ],
+            )
+            .unwrap();
+
+        let (addr, diversifier_index) = ufvk
+            .default_address(UnifiedAddressRequest::unsafe_new(
+                false,
+                true,
+                UA_TRANSPARENT,
+            ))
+            .unwrap();
+        let mut di_be = *diversifier_index.as_bytes();
+        di_be.reverse();
+
+        db_data
+            .conn
+            .execute(
+                "INSERT INTO addresses (account, diversifier_index_be, address) 
+                 VALUES (:account_id, :j, :address) ",
+                named_params![
+                    ":account_id": account_id,
+                    ":j": &di_be[..],
+                    ":address": addr.encode(&db_data.params)
+                ],
+            )
+            .unwrap();
+
+        match db_data
+            .conn
+            .query_row("SELECT address FROM addresses", [], |row| {
+                Ok(Address::decode(&db_data.params, &row.get::<_, String>(0)?).unwrap())
+            }) {
+            Ok(Address::Unified(ua)) => {
+                assert!(!ua.has_orchard());
+                assert!(ua.has_sapling());
+                assert_eq!(ua.has_transparent(), UA_TRANSPARENT);
+            }
+            other => panic!("Unexpected result from address decoding: {:?}", other),
+        }
+
+        assert_matches!(
+            init_wallet_db(&mut db_data, Some(SecretVec::new(seed))),
+            Ok(_)
+        );
+
+        match db_data
+            .conn
+            .query_row("SELECT address FROM addresses", [], |row| {
+                Ok(Address::decode(&db_data.params, &row.get::<_, String>(0)?).unwrap())
+            }) {
+            Ok(Address::Unified(ua)) => {
+                assert_eq!(ua.has_orchard(), UA_ORCHARD);
+                assert!(ua.has_sapling());
+                assert_eq!(ua.has_transparent(), UA_TRANSPARENT);
+            }
+            other => panic!("Unexpected result from address decoding: {:?}", other),
+        }
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/ephemeral_addresses.rs b/zcash_client_sqlite/src/wallet/init/migrations/ephemeral_addresses.rs
new file mode 100644
index 0000000000..196c922ec3
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/ephemeral_addresses.rs
@@ -0,0 +1,303 @@
+//! The migration that records ephemeral addresses for each account.
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_protocol::consensus;
+
+use crate::wallet::init::WalletMigrationError;
+
+#[cfg(feature = "transparent-inputs")]
+use crate::{wallet::transparent::ephemeral, AccountRef};
+
+use super::utxos_to_txos;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x0e1d4274_1f8e_44e2_909d_689a4bc2967b);
+
+const DEPENDENCIES: &[Uuid] = &[utxos_to_txos::MIGRATION_ID];
+
+#[allow(dead_code)]
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Record ephemeral addresses for each account."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        transaction.execute_batch(
+            "CREATE TABLE ephemeral_addresses (
+                account_id INTEGER NOT NULL,
+                address_index INTEGER NOT NULL,
+                -- nullability of this column is controlled by the index_range_and_address_nullity check
+                address TEXT,
+                used_in_tx INTEGER,
+                seen_in_tx INTEGER,
+                FOREIGN KEY (account_id) REFERENCES accounts(id),
+                FOREIGN KEY (used_in_tx) REFERENCES transactions(id_tx),
+                FOREIGN KEY (seen_in_tx) REFERENCES transactions(id_tx),
+                PRIMARY KEY (account_id, address_index),
+                CONSTRAINT ephemeral_addr_uniq UNIQUE (address),
+                CONSTRAINT used_implies_seen CHECK (
+                    used_in_tx IS NULL OR seen_in_tx IS NOT NULL
+                ),
+                CONSTRAINT index_range_and_address_nullity CHECK (
+                    (address_index BETWEEN 0 AND 0x7FFFFFFF AND address IS NOT NULL) OR
+                    (address_index BETWEEN 0x80000000 AND 0x7FFFFFFF + 20 AND address IS NULL AND used_in_tx IS NULL AND seen_in_tx IS NULL)
+                )
+            ) WITHOUT ROWID;"
+        )?;
+
+        // Make sure that at least `GAP_LIMIT` ephemeral transparent addresses are
+        // stored in each account.
+        #[cfg(feature = "transparent-inputs")]
+        {
+            let mut stmt = transaction.prepare("SELECT id FROM accounts")?;
+            let mut rows = stmt.query([])?;
+            while let Some(row) = rows.next()? {
+                let account_id = AccountRef(row.get(0)?);
+                ephemeral::init_account(transaction, &self.params, account_id)?;
+            }
+        }
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[cfg(feature = "transparent-inputs")]
+    use {
+        rusqlite::{named_params, Connection},
+        secrecy::{ExposeSecret, Secret, SecretVec},
+        tempfile::NamedTempFile,
+        zcash_client_backend::{
+            data_api::{AccountBirthday, AccountSource},
+            wallet::TransparentAddressMetadata,
+        },
+        zcash_keys::keys::UnifiedSpendingKey,
+        zcash_primitives::{block::BlockHash, legacy::keys::NonHardenedChildIndex},
+        zcash_protocol::consensus::Network,
+        zip32::{fingerprint::SeedFingerprint, AccountId as Zip32AccountId},
+    };
+
+    #[cfg(feature = "transparent-inputs")]
+    use {
+        crate::{
+            error::SqliteClientError,
+            wallet::{
+                self, account_kind_code, init::init_wallet_db_internal, transparent::ephemeral,
+            },
+            AccountRef, WalletDb,
+        },
+        zcash_client_backend::data_api::GAP_LIMIT,
+    };
+
+    /// This is a minimized copy of [`wallet::create_account`] as of the time of the
+    /// creation of this migration.
+    #[cfg(feature = "transparent-inputs")]
+    fn create_account(
+        wdb: &mut WalletDb<Connection, Network>,
+        seed: &SecretVec<u8>,
+        birthday: &AccountBirthday,
+    ) -> Result<(AccountRef, UnifiedSpendingKey), SqliteClientError> {
+        wdb.transactionally(|wdb| {
+            let seed_fingerprint =
+                SeedFingerprint::from_seed(seed.expose_secret()).ok_or_else(|| {
+                    SqliteClientError::BadAccountData(
+                        "Seed must be between 32 and 252 bytes in length.".to_owned(),
+                    )
+                })?;
+            let account_index = wallet::max_zip32_account_index(wdb.conn.0, &seed_fingerprint)?
+                .map(|a| {
+                    a.next()
+                        .ok_or(SqliteClientError::Zip32AccountIndexOutOfRange)
+                })
+                .transpose()?
+                .unwrap_or(zip32::AccountId::ZERO);
+
+            let usk =
+                UnifiedSpendingKey::from_seed(&wdb.params, seed.expose_secret(), account_index)
+                    .map_err(|_| SqliteClientError::KeyDerivationError(account_index))?;
+            let ufvk = usk.to_unified_full_viewing_key();
+
+            #[cfg(feature = "orchard")]
+            let orchard_item = ufvk.orchard().map(|k| k.to_bytes());
+            #[cfg(not(feature = "orchard"))]
+            let orchard_item: Option<Vec<u8>> = None;
+
+            let sapling_item = ufvk.sapling().map(|k| k.to_bytes());
+
+            #[cfg(feature = "transparent-inputs")]
+            let transparent_item = ufvk.transparent().map(|k| k.serialize());
+            #[cfg(not(feature = "transparent-inputs"))]
+            let transparent_item: Option<Vec<u8>> = None;
+
+            let birthday_sapling_tree_size = Some(birthday.sapling_frontier().tree_size());
+            #[cfg(feature = "orchard")]
+            let birthday_orchard_tree_size = Some(birthday.orchard_frontier().tree_size());
+            #[cfg(not(feature = "orchard"))]
+            let birthday_orchard_tree_size: Option<u64> = None;
+
+            let account_id: AccountRef = wdb.conn.0.query_row(
+                r#"
+                INSERT INTO accounts (
+                    account_kind, hd_seed_fingerprint, hd_account_index,
+                    ufvk, uivk,
+                    orchard_fvk_item_cache, sapling_fvk_item_cache, p2pkh_fvk_item_cache,
+                    birthday_height, birthday_sapling_tree_size, birthday_orchard_tree_size,
+                    recover_until_height
+                )
+                VALUES (
+                    :account_kind, :hd_seed_fingerprint, :hd_account_index,
+                    :ufvk, :uivk,
+                    :orchard_fvk_item_cache, :sapling_fvk_item_cache, :p2pkh_fvk_item_cache,
+                    :birthday_height, :birthday_sapling_tree_size, :birthday_orchard_tree_size,
+                    :recover_until_height
+                )
+                RETURNING id;
+                "#,
+                named_params![
+                    ":account_kind": 0, // 0 == Derived
+                    ":hd_seed_fingerprint": seed_fingerprint.to_bytes(),
+                    ":hd_account_index": u32::from(account_index),
+                    ":ufvk": ufvk.encode(&wdb.params),
+                    ":uivk": ufvk.to_unified_incoming_viewing_key().encode(&wdb.params),
+                    ":orchard_fvk_item_cache": orchard_item,
+                    ":sapling_fvk_item_cache": sapling_item,
+                    ":p2pkh_fvk_item_cache": transparent_item,
+                    ":birthday_height": u32::from(birthday.height()),
+                    ":birthday_sapling_tree_size": birthday_sapling_tree_size,
+                    ":birthday_orchard_tree_size": birthday_orchard_tree_size,
+                    ":recover_until_height": birthday.recover_until().map(u32::from)
+                ],
+                |row| Ok(AccountRef(row.get(0)?)),
+            )?;
+
+            // Initialize the `ephemeral_addresses` table.
+            #[cfg(feature = "transparent-inputs")]
+            wallet::transparent::ephemeral::init_account(wdb.conn.0, &wdb.params, account_id)?;
+
+            Ok((account_id, usk))
+        })
+    }
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn initialize_table() {
+        use zcash_client_backend::data_api::Zip32Derivation;
+
+        let network = Network::TestNetwork;
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
+
+        let seed0 = vec![0x00; 32];
+        init_wallet_db_internal(
+            &mut db_data,
+            Some(Secret::new(seed0.clone())),
+            super::DEPENDENCIES,
+            false,
+        )
+        .unwrap();
+
+        let birthday = AccountBirthday::from_sapling_activation(&network, BlockHash([0; 32]));
+
+        // Simulate creating an account prior to this migration.
+        let account0_index = Zip32AccountId::ZERO;
+        let account0_seed_fp = [0u8; 32];
+        let account0_kind = account_kind_code(&AccountSource::Derived {
+            derivation: Zip32Derivation::new(
+                SeedFingerprint::from_seed(&account0_seed_fp).unwrap(),
+                account0_index,
+            ),
+            key_source: None,
+        });
+        assert_eq!(u32::from(account0_index), 0);
+        let account0_id = AccountRef(0);
+
+        let usk0 = UnifiedSpendingKey::from_seed(&network, &seed0, account0_index).unwrap();
+        let ufvk0 = usk0.to_unified_full_viewing_key();
+        let uivk0 = ufvk0.to_unified_incoming_viewing_key();
+
+        db_data
+            .conn
+            .execute(
+                "INSERT INTO accounts (id, account_kind, hd_seed_fingerprint, hd_account_index, ufvk, uivk, birthday_height)
+                 VALUES (:id, :account_kind, :hd_seed_fingerprint, :hd_account_index, :ufvk, :uivk, :birthday_height)",
+                named_params![
+                    ":id": account0_id.0,
+                    ":account_kind": account0_kind,
+                    ":hd_seed_fingerprint": account0_seed_fp,
+                    ":hd_account_index": u32::from(account0_index),
+                    ":ufvk": ufvk0.encode(&network),
+                    ":uivk": uivk0.encode(&network),
+                    ":birthday_height": u32::from(birthday.height()),
+                ],
+            )
+            .unwrap();
+
+        // The `ephemeral_addresses` table is expected not to exist before migration.
+        assert_matches!(
+            ephemeral::first_unstored_index(&db_data.conn, account0_id),
+            Err(SqliteClientError::DbError(_))
+        );
+
+        let check = |db: &WalletDb<_, _>, account_id| {
+            eprintln!("checking {account_id:?}");
+            assert_matches!(ephemeral::first_unstored_index(&db.conn, account_id), Ok(addr_index) if addr_index == GAP_LIMIT);
+            assert_matches!(ephemeral::first_unreserved_index(&db.conn, account_id), Ok(addr_index) if addr_index == 0);
+
+            let known_addrs =
+                ephemeral::get_known_ephemeral_addresses(&db.conn, &db.params, account_id, None)
+                    .unwrap();
+
+            let expected_metadata: Vec<TransparentAddressMetadata> = (0..GAP_LIMIT)
+                .map(|i| ephemeral::metadata(NonHardenedChildIndex::from_index(i).unwrap()))
+                .collect();
+            let actual_metadata: Vec<TransparentAddressMetadata> =
+                known_addrs.into_iter().map(|(_, meta)| meta).collect();
+            assert_eq!(actual_metadata, expected_metadata);
+        };
+
+        // The migration should initialize `ephemeral_addresses`.
+        init_wallet_db_internal(
+            &mut db_data,
+            Some(Secret::new(seed0)),
+            &[super::MIGRATION_ID],
+            false,
+        )
+        .unwrap();
+        check(&db_data, account0_id);
+
+        // Creating a new account should initialize `ephemeral_addresses` for that account.
+        let seed1 = vec![0x01; 32];
+        let (account1_id, _usk) =
+            create_account(&mut db_data, &Secret::new(seed1), &birthday).unwrap();
+        assert_ne!(account0_id, account1_id);
+        check(&db_data, account1_id);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/fix_bad_change_flagging.rs b/zcash_client_sqlite/src/wallet/init/migrations/fix_bad_change_flagging.rs
new file mode 100644
index 0000000000..0923b16307
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/fix_bad_change_flagging.rs
@@ -0,0 +1,212 @@
+//! Sets the `is_change` flag on output notes received by an internal key when input value was
+//! provided from the account corresponding to that key.
+use std::collections::HashSet;
+
+use rusqlite::named_params;
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zip32::Scope;
+
+use crate::{
+    wallet::{
+        init::{migrations::fix_broken_commitment_trees, WalletMigrationError},
+        scope_code,
+    },
+    SAPLING_TABLES_PREFIX,
+};
+
+#[cfg(feature = "orchard")]
+use crate::ORCHARD_TABLES_PREFIX;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x6d36656d_533b_4b65_ae91_dcb95c4ad289);
+
+const DEPENDENCIES: &[Uuid] = &[fix_broken_commitment_trees::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Sets the `is_change` flag on output notes received by an internal key when input value was provided from the account corresponding to that key."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        let fix_change_flag = |table_prefix| {
+            transaction.execute(
+                &format!(
+                    "UPDATE {table_prefix}_received_notes
+                     SET is_change = 1
+                     FROM sent_notes sn
+                     WHERE sn.tx = {table_prefix}_received_notes.tx
+                     AND sn.from_account_id = {table_prefix}_received_notes.account_id
+                     AND {table_prefix}_received_notes.recipient_key_scope = :internal_scope"
+                ),
+                named_params! {":internal_scope": scope_code(Scope::Internal)},
+            )
+        };
+
+        fix_change_flag(SAPLING_TABLES_PREFIX)?;
+        #[cfg(feature = "orchard")]
+        fix_change_flag(ORCHARD_TABLES_PREFIX)?;
+
+        Ok(())
+    }
+
+    fn down(&self, _: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[cfg(feature = "transparent-inputs")]
+    use {
+        crate::{
+            testing::{db::TestDbFactory, BlockCache},
+            wallet::init::init_wallet_db,
+        },
+        zcash_client_backend::{
+            data_api::{
+                testing::{
+                    pool::ShieldedPoolTester, sapling::SaplingPoolTester, AddressType, TestBuilder,
+                },
+                wallet::input_selection::GreedyInputSelector,
+                Account as _, WalletRead as _, WalletWrite as _,
+            },
+            fees::{standard, DustOutputPolicy, StandardFeeRule},
+            wallet::WalletTransparentOutput,
+        },
+        zcash_primitives::{
+            block::BlockHash,
+            transaction::components::{OutPoint, TxOut},
+        },
+        zcash_protocol::value::Zatoshis,
+    };
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    fn shield_transparent<T: ShieldedPoolTester>() {
+        let ds_factory = TestDbFactory::new(
+            super::DEPENDENCIES
+                .iter()
+                .copied()
+                // Pull in the account UUID migration so `TestBuilder::build` works.
+                .chain(Some(super::super::add_account_uuids::MIGRATION_ID))
+                .collect(),
+        );
+        let cache = BlockCache::new();
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(ds_factory)
+            .with_block_cache(cache)
+            .with_account_from_sapling_activation(BlockHash([0; 32]))
+            .build();
+
+        let account = st.test_account().cloned().unwrap();
+        let dfvk = T::test_account_fvk(&st);
+
+        let uaddr = st
+            .wallet()
+            .get_current_address(account.id())
+            .unwrap()
+            .unwrap();
+        let taddr = uaddr.transparent().unwrap();
+
+        // Ensure that the wallet has at least one block
+        let (h, _, _) = st.generate_next_block(
+            &dfvk,
+            AddressType::Internal,
+            Zatoshis::const_from_u64(50000),
+        );
+        st.scan_cached_blocks(h, 1);
+
+        let utxo = WalletTransparentOutput::from_parts(
+            OutPoint::fake(),
+            TxOut {
+                value: Zatoshis::const_from_u64(100000),
+                script_pubkey: taddr.script(),
+            },
+            Some(h),
+        )
+        .unwrap();
+
+        let res0 = st.wallet_mut().put_received_transparent_utxo(&utxo);
+        assert_matches!(res0, Ok(_));
+
+        let fee_rule = StandardFeeRule::Zip317;
+
+        let input_selector = GreedyInputSelector::new();
+        let change_strategy = standard::SingleOutputChangeStrategy::new(
+            fee_rule,
+            None,
+            T::SHIELDED_PROTOCOL,
+            DustOutputPolicy::default(),
+        );
+
+        let txids = st
+            .shield_transparent_funds(
+                &input_selector,
+                &change_strategy,
+                Zatoshis::from_u64(10000).unwrap(),
+                account.usk(),
+                &[*taddr],
+                account.id(),
+                1,
+            )
+            .unwrap();
+        assert_eq!(txids.len(), 1);
+
+        let tx = st.get_tx_from_history(*txids.first()).unwrap().unwrap();
+        assert_eq!(tx.spent_note_count(), 1);
+        assert!(tx.has_change());
+        assert_eq!(tx.received_note_count(), 0);
+        assert_eq!(tx.sent_note_count(), 0);
+        assert!(tx.is_shielding());
+
+        // Prior to the fix that removes the source of the error this migration is addressing,
+        // this scanning will result in a state where `tx.is_shielding() == false`. However,
+        // we can't validate that here, because after that fix, this test would fail.
+        let (h, _) = st.generate_next_block_including(*txids.first());
+        st.scan_cached_blocks(h, 1);
+
+        // Complete the migration to resolve the incorrect change flag value.
+        init_wallet_db(st.wallet_mut().db_mut(), None).unwrap();
+
+        let tx = st.get_tx_from_history(*txids.first()).unwrap().unwrap();
+        assert_eq!(tx.spent_note_count(), 1);
+        assert!(tx.has_change());
+        assert_eq!(tx.received_note_count(), 0);
+        assert_eq!(tx.sent_note_count(), 0);
+        assert!(tx.is_shielding());
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn sapling_shield_transparent() {
+        shield_transparent::<SaplingPoolTester>();
+    }
+
+    #[test]
+    #[cfg(all(feature = "orchard", feature = "transparent-inputs"))]
+    fn orchard_shield_transparent() {
+        use zcash_client_backend::data_api::testing::orchard::OrchardPoolTester;
+
+        shield_transparent::<OrchardPoolTester>();
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/fix_broken_commitment_trees.rs b/zcash_client_sqlite/src/wallet/init/migrations/fix_broken_commitment_trees.rs
new file mode 100644
index 0000000000..39e1e0285c
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/fix_broken_commitment_trees.rs
@@ -0,0 +1,81 @@
+//! Truncates away bad note commitment tree state for users whose wallets were broken by incorrect
+//! reorg handling.
+use std::collections::HashSet;
+
+use rusqlite::OptionalExtension;
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_protocol::consensus::{self, BlockHeight};
+
+use crate::wallet::{
+    self,
+    init::{migrations::support_legacy_sqlite, WalletMigrationError},
+};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x9fa43ce0_a387_45d1_be03_57a3edc76d01);
+
+const DEPENDENCIES: &[Uuid] = &[support_legacy_sqlite::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Truncates away bad note commitment tree state for users whose wallets were broken by bad reorg handling."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        #[cfg(not(feature = "orchard"))]
+        let max_height_query = r#"
+            SELECT MAX(height) FROM blocks
+            JOIN sapling_tree_checkpoints sc ON sc.checkpoint_id = height
+        "#;
+        #[cfg(feature = "orchard")]
+        let max_height_query = r#"
+            SELECT MAX(height) FROM blocks
+            JOIN sapling_tree_checkpoints sc ON sc.checkpoint_id = height
+            JOIN orchard_tree_checkpoints oc ON oc.checkpoint_id = height
+        "#;
+
+        let max_block_height = transaction
+            .query_row(max_height_query, [], |row| {
+                let cid = row.get::<_, Option<u32>>(0)?;
+                Ok(cid.map(BlockHeight::from))
+            })
+            .optional()?
+            .flatten();
+
+        if let Some(h) = max_block_height {
+            wallet::truncate_to_height(transaction, &self.params, h)?;
+        }
+
+        Ok(())
+    }
+
+    fn down(&self, _: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/full_account_ids.rs b/zcash_client_sqlite/src/wallet/init/migrations/full_account_ids.rs
new file mode 100644
index 0000000000..e8df8b216f
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/full_account_ids.rs
@@ -0,0 +1,593 @@
+use std::{collections::HashSet, rc::Rc};
+
+use crate::wallet::{account_kind_code, init::WalletMigrationError};
+use rusqlite::{named_params, OptionalExtension, Transaction};
+use schemerz_rusqlite::RusqliteMigration;
+use secrecy::{ExposeSecret, SecretVec};
+use uuid::Uuid;
+use zcash_client_backend::{
+    data_api::{AccountPurpose, AccountSource, Zip32Derivation},
+    keys::UnifiedSpendingKey,
+};
+use zcash_keys::keys::UnifiedFullViewingKey;
+use zcash_primitives::consensus;
+use zip32::fingerprint::SeedFingerprint;
+
+use super::{
+    add_account_birthdays, receiving_key_scopes, v_transactions_note_uniqueness, wallet_summaries,
+};
+
+/// The migration that switched from presumed seed-derived account IDs to supporting
+/// HD accounts and all sorts of imported keys.
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x6d02ec76_8720_4cc6_b646_c4e2ce69221c);
+
+pub(crate) struct Migration<P: consensus::Parameters> {
+    pub(super) seed: Option<Rc<SecretVec<u8>>>,
+    pub(super) params: P,
+}
+
+const DEPENDENCIES: &[Uuid] = &[
+    receiving_key_scopes::MIGRATION_ID,
+    add_account_birthdays::MIGRATION_ID,
+    v_transactions_note_uniqueness::MIGRATION_ID,
+    wallet_summaries::MIGRATION_ID,
+];
+
+impl<P: consensus::Parameters> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Replaces the `account` column in the `accounts` table with columns to support all kinds of
+         account and key types."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &Transaction) -> Result<(), WalletMigrationError> {
+        let account_kind_derived = account_kind_code(&AccountSource::Derived {
+            derivation: Zip32Derivation::new(
+                SeedFingerprint::from_bytes([0; 32]),
+                zip32::AccountId::ZERO,
+            ),
+            key_source: None,
+        });
+        let account_kind_imported = account_kind_code(&AccountSource::Imported {
+            // the purpose here is irrelevant; we just use it to get the correct code
+            // for the account kind
+            purpose: AccountPurpose::ViewOnly,
+            key_source: None,
+        });
+        transaction.execute_batch(&format!(
+            r#"
+            CREATE TABLE accounts_new (
+                id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+                account_kind INTEGER NOT NULL DEFAULT {account_kind_derived},
+                hd_seed_fingerprint BLOB,
+                hd_account_index INTEGER,
+                ufvk TEXT,
+                uivk TEXT NOT NULL,
+                orchard_fvk_item_cache BLOB,
+                sapling_fvk_item_cache BLOB,
+                p2pkh_fvk_item_cache BLOB,
+                birthday_height INTEGER NOT NULL,
+                birthday_sapling_tree_size INTEGER,
+                birthday_orchard_tree_size INTEGER,
+                recover_until_height INTEGER,
+                CHECK (
+                  (
+                    account_kind = {account_kind_derived}
+                    AND hd_seed_fingerprint IS NOT NULL
+                    AND hd_account_index IS NOT NULL
+                    AND ufvk IS NOT NULL
+                  )
+                  OR
+                  (
+                    account_kind = {account_kind_imported}
+                    AND hd_seed_fingerprint IS NULL
+                    AND hd_account_index IS NULL
+                  )
+                )
+            );
+            CREATE UNIQUE INDEX hd_account ON accounts_new (hd_seed_fingerprint, hd_account_index);
+            CREATE UNIQUE INDEX accounts_uivk ON accounts_new (uivk);
+            CREATE UNIQUE INDEX accounts_ufvk ON accounts_new (ufvk);
+            "#
+        ))?;
+
+        // We require the seed *if* there are existing accounts in the table.
+        if transaction.query_row("SELECT COUNT(*) FROM accounts", [], |row| {
+            Ok(row.get::<_, u32>(0)? > 0)
+        })? {
+            if let Some(seed) = &self.seed {
+                let seed_id = SeedFingerprint::from_seed(seed.expose_secret())
+                    .expect("Seed is between 32 and 252 bytes in length.");
+
+                // We track whether we have determined seed relevance or not, in order to
+                // correctly report errors when checking the seed against an account:
+                //
+                // - If we encounter an error with the first account, we can assert that
+                //   the seed is not relevant to the wallet by assuming that:
+                //   - All accounts are from the same seed (which is historically the only
+                //     use case that this migration supported), and
+                //   - All accounts in the wallet must have been able to derive their USKs
+                //     (in order to derive UIVKs).
+                //
+                // - Once the seed has been determined to be relevant (because it matched
+                //   the first account), any subsequent account derivation failure is
+                //   proving wrong our second assumption above, and we report this as
+                //   corrupted data.
+                let mut seed_is_relevant = false;
+
+                let mut q = transaction.prepare("SELECT * FROM accounts")?;
+                let mut rows = q.query([])?;
+                while let Some(row) = rows.next()? {
+                    let account_index: u32 = row.get("account")?;
+                    let birthday_height: u32 = row.get("birthday_height")?;
+                    let recover_until_height: Option<u32> = row.get("recover_until_height")?;
+
+                    // Although 'id' is an AUTOINCREMENT column, we'll set it explicitly to match the old account value
+                    // strictly as a matter of convenience to make this migration script easier,
+                    // specifically around updating tables with foreign keys to this one.
+                    let account_id = account_index;
+
+                    // Verify that the UFVK is as expected by re-deriving it.
+                    let ufvk: String = row.get("ufvk")?;
+                    let ufvk_parsed = UnifiedFullViewingKey::decode(&self.params, &ufvk)
+                        .map_err(|_| WalletMigrationError::CorruptedData("Bad UFVK".to_string()))?;
+                    let usk = UnifiedSpendingKey::from_seed(
+                        &self.params,
+                        seed.expose_secret(),
+                        zip32::AccountId::try_from(account_index).map_err(|_| {
+                            WalletMigrationError::CorruptedData("Bad account index".to_string())
+                        })?,
+                    )
+                    .map_err(|_| {
+                        if seed_is_relevant {
+                            WalletMigrationError::CorruptedData(
+                                "Unable to derive spending key from seed.".to_string(),
+                            )
+                        } else {
+                            WalletMigrationError::SeedNotRelevant
+                        }
+                    })?;
+                    let expected_ufvk = usk.to_unified_full_viewing_key();
+                    if ufvk != expected_ufvk.encode(&self.params) {
+                        return Err(if seed_is_relevant {
+                            WalletMigrationError::CorruptedData(
+                                "UFVK does not match expected value.".to_string(),
+                            )
+                        } else {
+                            WalletMigrationError::SeedNotRelevant
+                        });
+                    }
+
+                    // We made it past one derived account, so the seed must be relevant.
+                    seed_is_relevant = true;
+
+                    let uivk = ufvk_parsed
+                        .to_unified_incoming_viewing_key()
+                        .encode(&self.params);
+
+                    #[cfg(feature = "orchard")]
+                    let orchard_item = ufvk_parsed.orchard().map(|k| k.to_bytes());
+                    #[cfg(not(feature = "orchard"))]
+                    let orchard_item: Option<Vec<u8>> = None;
+
+                    let sapling_item = ufvk_parsed.sapling().map(|k| k.to_bytes());
+
+                    #[cfg(feature = "transparent-inputs")]
+                    let transparent_item = ufvk_parsed.transparent().map(|k| k.serialize());
+                    #[cfg(not(feature = "transparent-inputs"))]
+                    let transparent_item: Option<Vec<u8>> = None;
+
+                    // Get the tree sizes for the birthday height from the blocks table, if
+                    // available.
+                    let (birthday_sapling_tree_size, birthday_orchard_tree_size) = transaction
+                        .query_row(
+                            "SELECT sapling_commitment_tree_size - sapling_output_count,
+                                    orchard_commitment_tree_size - orchard_action_count
+                             FROM blocks
+                             WHERE height = :birthday_height",
+                            named_params![":birthday_height": birthday_height],
+                            |row| {
+                                Ok(row
+                                    .get::<_, Option<u32>>(0)?
+                                    .zip(row.get::<_, Option<u32>>(1)?))
+                            },
+                        )
+                        .optional()?
+                        .flatten()
+                        .map_or((None, None), |(s, o)| (Some(s), Some(o)));
+
+                    transaction.execute(
+                        r#"
+                        INSERT INTO accounts_new (
+                            id, account_kind, hd_seed_fingerprint, hd_account_index,
+                            ufvk, uivk,
+                            orchard_fvk_item_cache, sapling_fvk_item_cache, p2pkh_fvk_item_cache,
+                            birthday_height, birthday_sapling_tree_size, birthday_orchard_tree_size,
+                            recover_until_height
+                        )
+                        VALUES (
+                            :account_id, :account_kind, :seed_id, :account_index,
+                            :ufvk, :uivk,
+                            :orchard_fvk_item_cache, :sapling_fvk_item_cache, :p2pkh_fvk_item_cache,
+                            :birthday_height, :birthday_sapling_tree_size, :birthday_orchard_tree_size,
+                            :recover_until_height
+                        );
+                        "#,
+                        named_params![
+                            ":account_id": account_id,
+                            ":account_kind": account_kind_derived,
+                            ":seed_id": seed_id.to_bytes(),
+                            ":account_index": account_index,
+                            ":ufvk": ufvk,
+                            ":uivk": uivk,
+                            ":orchard_fvk_item_cache": orchard_item,
+                            ":sapling_fvk_item_cache": sapling_item,
+                            ":p2pkh_fvk_item_cache": transparent_item,
+                            ":birthday_height": birthday_height,
+                            ":birthday_sapling_tree_size": birthday_sapling_tree_size,
+                            ":birthday_orchard_tree_size": birthday_orchard_tree_size,
+                            ":recover_until_height": recover_until_height,
+                        ],
+                    )?;
+                }
+            } else {
+                return Err(WalletMigrationError::SeedRequired);
+            }
+        }
+
+        transaction.execute_batch(r#"
+            PRAGMA legacy_alter_table = ON;
+
+            DROP TABLE accounts;
+            ALTER TABLE accounts_new RENAME TO accounts;
+
+            -- Migrate addresses table
+            CREATE TABLE addresses_new (
+                account_id INTEGER NOT NULL,
+                diversifier_index_be BLOB NOT NULL,
+                address TEXT NOT NULL,
+                cached_transparent_receiver_address TEXT,
+                FOREIGN KEY (account_id) REFERENCES accounts(id),
+                CONSTRAINT diversification UNIQUE (account_id, diversifier_index_be)
+            );
+            CREATE INDEX "addresses_accounts" ON "addresses_new" (
+                "account_id" ASC
+            );
+            INSERT INTO addresses_new (account_id, diversifier_index_be, address, cached_transparent_receiver_address)
+            SELECT account, diversifier_index_be, address, cached_transparent_receiver_address
+            FROM addresses;
+
+            DROP TABLE addresses;
+            ALTER TABLE addresses_new RENAME TO addresses;
+
+            -- Migrate sapling_received_notes table
+            CREATE TABLE sapling_received_notes_new (
+                id INTEGER PRIMARY KEY,
+                tx INTEGER NOT NULL,
+                output_index INTEGER NOT NULL,
+                account_id INTEGER NOT NULL,
+                diversifier BLOB NOT NULL,
+                value INTEGER NOT NULL,
+                rcm BLOB NOT NULL,
+                nf BLOB UNIQUE,
+                is_change INTEGER NOT NULL,
+                memo BLOB,
+                commitment_tree_position INTEGER,
+                recipient_key_scope INTEGER,
+                FOREIGN KEY (tx) REFERENCES transactions(id_tx),
+                FOREIGN KEY (account_id) REFERENCES accounts(id),
+                CONSTRAINT tx_output UNIQUE (tx, output_index)
+            );
+            CREATE INDEX "sapling_received_notes_account" ON "sapling_received_notes_new" (
+                "account_id" ASC
+            );
+            CREATE INDEX "sapling_received_notes_tx" ON "sapling_received_notes_new" (
+                "tx" ASC
+            );
+
+            -- Replace the `spent` column in `sapling_received_notes` with a junction table between
+            -- received notes and the transactions that spend them. This is necessary as otherwise
+            -- we cannot compute the correct value of transactions that expire unmined.
+            CREATE TABLE sapling_received_note_spends (
+                sapling_received_note_id INTEGER NOT NULL,
+                transaction_id INTEGER NOT NULL,
+                FOREIGN KEY (sapling_received_note_id)
+                    REFERENCES sapling_received_notes(id)
+                    ON DELETE CASCADE,
+                FOREIGN KEY (transaction_id)
+                    -- We do not delete transactions, so this does not cascade
+                    REFERENCES transactions(id_tx),
+                UNIQUE (sapling_received_note_id, transaction_id)
+            );
+
+            INSERT INTO sapling_received_note_spends (sapling_received_note_id, transaction_id)
+            SELECT id_note, spent
+            FROM sapling_received_notes
+            WHERE spent IS NOT NULL;
+
+            INSERT INTO sapling_received_notes_new (
+                id, tx, output_index, account_id,
+                diversifier, value, rcm, nf, is_change, memo, commitment_tree_position,
+                recipient_key_scope
+            )
+            SELECT
+                id_note, tx, output_index, account,
+                diversifier, value, rcm, nf, is_change, memo, commitment_tree_position,
+                recipient_key_scope
+            FROM sapling_received_notes;
+
+            DROP TABLE sapling_received_notes;
+            ALTER TABLE sapling_received_notes_new RENAME TO sapling_received_notes;
+
+            -- Migrate sent_notes table
+            CREATE TABLE sent_notes_new (
+                id INTEGER PRIMARY KEY,
+                tx INTEGER NOT NULL,
+                output_pool INTEGER NOT NULL,
+                output_index INTEGER NOT NULL,
+                from_account_id INTEGER NOT NULL,
+                to_address TEXT,
+                to_account_id INTEGER,
+                value INTEGER NOT NULL,
+                memo BLOB,
+                FOREIGN KEY (tx) REFERENCES transactions(id_tx),
+                FOREIGN KEY (from_account_id) REFERENCES accounts(id),
+                FOREIGN KEY (to_account_id) REFERENCES accounts(id),
+                CONSTRAINT tx_output UNIQUE (tx, output_pool, output_index),
+                CONSTRAINT note_recipient CHECK (
+                    (to_address IS NOT NULL) OR (to_account_id IS NOT NULL)
+                )
+            );
+            CREATE INDEX sent_notes_tx ON sent_notes_new (tx);
+            CREATE INDEX sent_notes_from_account ON sent_notes_new (from_account_id);
+            CREATE INDEX sent_notes_to_account ON sent_notes_new (to_account_id);
+            INSERT INTO sent_notes_new (id, tx, output_pool, output_index, from_account_id, to_address, to_account_id, value, memo)
+            SELECT id_note, tx, output_pool, output_index, from_account, to_address, to_account, value, memo
+            FROM sent_notes;
+
+            DROP TABLE sent_notes;
+            ALTER TABLE sent_notes_new RENAME TO sent_notes;
+
+            -- No one uses this table any more, and it contains a reference to columns we renamed.
+            DROP TABLE sapling_witnesses;
+
+            -- Migrate utxos table
+            CREATE TABLE utxos_new (
+                id INTEGER PRIMARY KEY,
+                received_by_account_id INTEGER NOT NULL,
+                address TEXT NOT NULL,
+                prevout_txid BLOB NOT NULL,
+                prevout_idx INTEGER NOT NULL,
+                script BLOB NOT NULL,
+                value_zat INTEGER NOT NULL,
+                height INTEGER NOT NULL,
+                FOREIGN KEY (received_by_account_id) REFERENCES accounts(id),
+                CONSTRAINT tx_outpoint UNIQUE (prevout_txid, prevout_idx)
+            );
+            CREATE INDEX utxos_received_by_account ON utxos_new (received_by_account_id);
+
+            INSERT INTO utxos_new (id, received_by_account_id, address, prevout_txid, prevout_idx, script, value_zat, height)
+            SELECT id_utxo, received_by_account, address, prevout_txid, prevout_idx, script, value_zat, height
+            FROM utxos;
+
+            -- Replace the `spent_in_tx` column in `utxos` with a junction table between received
+            -- outputs and the transactions that spend them. This is necessary as otherwise we
+            -- cannot compute the correct value of transactions that expire unmined.
+            CREATE TABLE transparent_received_output_spends (
+                transparent_received_output_id INTEGER NOT NULL,
+                transaction_id INTEGER NOT NULL,
+                FOREIGN KEY (transparent_received_output_id)
+                    REFERENCES utxos(id)
+                    ON DELETE CASCADE,
+                FOREIGN KEY (transaction_id)
+                    -- We do not delete transactions, so this does not cascade
+                    REFERENCES transactions(id_tx),
+                UNIQUE (transparent_received_output_id, transaction_id)
+            );
+
+            INSERT INTO transparent_received_output_spends (transparent_received_output_id, transaction_id)
+            SELECT id_utxo, spent_in_tx
+            FROM utxos
+            WHERE spent_in_tx IS NOT NULL;
+
+            DROP TABLE utxos;
+            ALTER TABLE utxos_new RENAME TO utxos;
+
+            PRAGMA legacy_alter_table = OFF;
+        "#)?;
+
+        // Rewrite v_transactions view
+        transaction.execute_batch("
+            DROP VIEW v_transactions;
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                SELECT sapling_received_notes.id             AS id,
+                       sapling_received_notes.account_id     AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       sapling_received_notes.value          AS value,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 1
+                            ELSE 0
+                       END AS is_change,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (sapling_received_notes.memo IS NULL OR sapling_received_notes.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.tx
+                UNION
+                SELECT utxos.id                      AS id,
+                       utxos.received_by_account_id  AS account_id,
+                       utxos.height                  AS block,
+                       utxos.prevout_txid            AS txid,
+                       0                             AS pool,
+                       utxos.value_zat               AS value,
+                       0                             AS is_change,
+                       1                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                UNION
+                SELECT sapling_received_notes.id             AS id,
+                       sapling_received_notes.account_id     AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       -sapling_received_notes.value         AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM sapling_received_notes
+                JOIN sapling_received_note_spends
+                     ON sapling_received_note_id = sapling_received_notes.id
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_note_spends.transaction_id
+                UNION
+                SELECT utxos.id                      AS id,
+                       utxos.received_by_account_id  AS account_id,
+                       transactions.block            AS block,
+                       transactions.txid             AS txid,
+                       0                             AS pool,
+                       -utxos.value_zat              AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+            JOIN transparent_received_output_spends txo_spends
+                 ON txo_spends.transparent_received_output_id = txos.id
+            JOIN transactions
+                 ON transactions.id_tx = txo_spends.transaction_id
+            ),
+            sent_note_counts AS (
+                SELECT sent_notes.from_account_id AS account_id,
+                       transactions.txid       AS txid,
+                       COUNT(DISTINCT sent_notes.id) as sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR sapling_received_notes.tx IS NOT NULL)
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                JOIN transactions
+                     ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN sapling_received_notes
+                          ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                             (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+                WHERE COALESCE(sapling_received_notes.is_change, 0) = 0
+                GROUP BY account_id, txid
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) as max_height FROM blocks
+            )
+            SELECT notes.account_id                  AS account_id,
+                   notes.block                       AS mined_height,
+                   notes.txid                        AS txid,
+                   transactions.tx_index             AS tx_index,
+                   transactions.expiry_height        AS expiry_height,
+                   transactions.raw                  AS raw,
+                   SUM(notes.value)                  AS account_balance_delta,
+                   transactions.fee                  AS fee_paid,
+                   SUM(notes.is_change) > 0          AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                   ) AS expired_unmined
+            FROM notes
+            LEFT JOIN transactions
+                 ON notes.txid = transactions.txid
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = notes.block
+            LEFT JOIN sent_note_counts
+                      ON sent_note_counts.account_id = notes.account_id
+                      AND sent_note_counts.txid = notes.txid
+            GROUP BY notes.account_id, notes.txid;
+
+            DROP VIEW v_tx_outputs;
+            CREATE VIEW v_tx_outputs AS
+            SELECT transactions.txid                   AS txid,
+                   2                                   AS output_pool,
+                   sapling_received_notes.output_index AS output_index,
+                   sent_notes.from_account_id          AS from_account_id,
+                   sapling_received_notes.account_id   AS to_account_id,
+                   NULL                                AS to_address,
+                   sapling_received_notes.value        AS value,
+                   sapling_received_notes.is_change    AS is_change,
+                   sapling_received_notes.memo         AS memo
+            FROM sapling_received_notes
+            JOIN transactions
+                 ON transactions.id_tx = sapling_received_notes.tx
+            LEFT JOIN sent_notes
+                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                         (sapling_received_notes.tx, 2, sent_notes.output_index)
+            UNION
+            SELECT utxos.prevout_txid           AS txid,
+                   0                            AS output_pool,
+                   utxos.prevout_idx            AS output_index,
+                   NULL                         AS from_account_id,
+                   utxos.received_by_account_id AS to_account_id,
+                   utxos.address                AS to_address,
+                   utxos.value_zat              AS value,
+                   0                            AS is_change,
+                   NULL                         AS memo
+            FROM utxos
+            UNION
+            SELECT transactions.txid                 AS txid,
+                   sent_notes.output_pool            AS output_pool,
+                   sent_notes.output_index           AS output_index,
+                   sent_notes.from_account_id        AS from_account_id,
+                   sapling_received_notes.account_id AS to_account_id,
+                   sent_notes.to_address             AS to_address,
+                   sent_notes.value                  AS value,
+                   0                                 AS is_change,
+                   sent_notes.memo                   AS memo
+            FROM sent_notes
+            JOIN transactions
+                 ON transactions.id_tx = sent_notes.tx
+            LEFT JOIN sapling_received_notes
+                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                         (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+            WHERE COALESCE(sapling_received_notes.is_change, 0) = 0;
+        ")?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/initial_setup.rs b/zcash_client_sqlite/src/wallet/init/migrations/initial_setup.rs
index 8501368564..5433fcf676 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/initial_setup.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/initial_setup.rs
@@ -1,26 +1,17 @@
 //! The migration that performs the initial setup of the wallet database.
 use std::collections::HashSet;
 
-use rusqlite;
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
 
 use crate::wallet::init::WalletMigrationError;
 
 /// Identifier for the migration that performs the initial setup of the wallet database.
-///
-/// bc4f5e57-d600-4b6c-990f-b3538f0bfce1,
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0xbc4f5e57,
-    0xd600,
-    0x4b6c,
-    b"\x99\x0f\xb3\x53\x8f\x0b\xfc\xe1",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xbc4f5e57_d600_4b6c_990f_b3538f0bfce1);
 
 pub(super) struct Migration;
 
-impl schemer::Migration for Migration {
+impl schemerz::Migration<Uuid> for Migration {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
@@ -111,6 +102,16 @@ impl RusqliteMigration for Migration {
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
         // We should never down-migrate the first migration, as that can irreversibly
         // destroy data.
-        panic!("Cannot revert the initial migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/nullifier_map.rs b/zcash_client_sqlite/src/wallet/init/migrations/nullifier_map.rs
new file mode 100644
index 0000000000..5891841d45
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/nullifier_map.rs
@@ -0,0 +1,83 @@
+//! This migration adds a table for storing mappings from nullifiers to the transaction
+//! they are revealed in.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use tracing::debug;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::received_notes_nullable_nf;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xe2d71ac5_6a44_4c6b_a9a0_6d0a79d355f1);
+
+const DEPENDENCIES: &[Uuid] = &[received_notes_nullable_nf::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Adds a lookup table for nullifiers we've observed on-chain that we haven't confirmed are not ours."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        // We don't enforce any foreign key constraint to the blocks table, to allow
+        // loading the nullifier map separately from block scanning.
+        debug!("Creating tables for nullifier map");
+        transaction.execute_batch(
+            "CREATE TABLE tx_locator_map (
+                block_height INTEGER NOT NULL,
+                tx_index INTEGER NOT NULL,
+                txid BLOB NOT NULL UNIQUE,
+                PRIMARY KEY (block_height, tx_index)
+            );
+            CREATE TABLE nullifier_map (
+                spend_pool INTEGER NOT NULL,
+                nf BLOB NOT NULL,
+                block_height INTEGER NOT NULL,
+                tx_index INTEGER NOT NULL,
+                CONSTRAINT tx_locator
+                    FOREIGN KEY (block_height, tx_index)
+                    REFERENCES tx_locator_map(block_height, tx_index)
+                    ON DELETE CASCADE
+                    ON UPDATE RESTRICT,
+                CONSTRAINT nf_uniq UNIQUE (spend_pool, nf)
+            );
+            CREATE INDEX nf_map_locator_idx ON nullifier_map(block_height, tx_index);",
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(
+            "DROP TABLE nullifier_map;
+            DROP TABLE tx_locator_map;",
+        )?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/orchard_received_notes.rs b/zcash_client_sqlite/src/wallet/init/migrations/orchard_received_notes.rs
new file mode 100644
index 0000000000..d3be54599d
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/orchard_received_notes.rs
@@ -0,0 +1,326 @@
+//! This migration adds tables to the wallet database that are needed to persist Orchard received
+//! notes.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_client_backend::PoolType;
+
+use super::full_account_ids;
+use crate::wallet::{init::WalletMigrationError, pool_code};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x51d7a273_aa19_4109_9325_80e4a5545048);
+
+const DEPENDENCIES: &[Uuid] = &[full_account_ids::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Add support for storage of Orchard received notes."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction<'_>) -> Result<(), Self::Error> {
+        transaction.execute_batch(
+            "CREATE TABLE orchard_received_notes (
+                id INTEGER PRIMARY KEY,
+                tx INTEGER NOT NULL,
+                action_index INTEGER NOT NULL,
+                account_id INTEGER NOT NULL,
+                diversifier BLOB NOT NULL,
+                value INTEGER NOT NULL,
+                rho BLOB NOT NULL,
+                rseed BLOB NOT NULL,
+                nf BLOB UNIQUE,
+                is_change INTEGER NOT NULL,
+                memo BLOB,
+                commitment_tree_position INTEGER,
+                recipient_key_scope INTEGER,
+                FOREIGN KEY (tx) REFERENCES transactions(id_tx),
+                FOREIGN KEY (account_id) REFERENCES accounts(id),
+                CONSTRAINT tx_output UNIQUE (tx, action_index)
+            );
+            CREATE INDEX orchard_received_notes_account ON orchard_received_notes (
+                account_id ASC
+            );
+            CREATE INDEX orchard_received_notes_tx ON orchard_received_notes (
+                tx ASC
+            );
+
+            CREATE TABLE orchard_received_note_spends (
+                orchard_received_note_id INTEGER NOT NULL,
+                transaction_id INTEGER NOT NULL,
+                FOREIGN KEY (orchard_received_note_id)
+                    REFERENCES orchard_received_notes(id)
+                    ON DELETE CASCADE,
+                FOREIGN KEY (transaction_id)
+                    -- We do not delete transactions, so this does not cascade
+                    REFERENCES transactions(id_tx),
+                UNIQUE (orchard_received_note_id, transaction_id)
+            );",
+        )?;
+
+        transaction.execute_batch({
+            let sapling_pool_code = pool_code(PoolType::SAPLING);
+            let orchard_pool_code = pool_code(PoolType::ORCHARD);
+            &format!(
+                "CREATE VIEW v_received_notes AS
+                    SELECT
+                        sapling_received_notes.id AS id_within_pool_table,
+                        sapling_received_notes.tx,
+                        {sapling_pool_code} AS pool,
+                        sapling_received_notes.output_index AS output_index,
+                        account_id,
+                        sapling_received_notes.value,
+                        is_change,
+                        sapling_received_notes.memo,
+                        sent_notes.id AS sent_note_id
+                    FROM sapling_received_notes
+                    LEFT JOIN sent_notes
+                    ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                       (sapling_received_notes.tx, {sapling_pool_code}, sapling_received_notes.output_index)
+                UNION
+                    SELECT
+                        orchard_received_notes.id AS id_within_pool_table,
+                        orchard_received_notes.tx,
+                        {orchard_pool_code} AS pool,
+                        orchard_received_notes.action_index AS output_index,
+                        account_id,
+                        orchard_received_notes.value,
+                        is_change,
+                        orchard_received_notes.memo,
+                        sent_notes.id AS sent_note_id
+                    FROM orchard_received_notes
+                    LEFT JOIN sent_notes
+                    ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                       (orchard_received_notes.tx, {orchard_pool_code}, orchard_received_notes.action_index);"
+            )
+        })?;
+
+        transaction.execute_batch({
+            let sapling_pool_code = pool_code(PoolType::SAPLING);
+            let orchard_pool_code = pool_code(PoolType::ORCHARD);
+            &format!(
+                "CREATE VIEW v_received_note_spends AS
+                SELECT
+                    {sapling_pool_code} AS pool,
+                    sapling_received_note_id AS received_note_id,
+                    transaction_id
+                FROM sapling_received_note_spends
+                UNION
+                SELECT
+                    {orchard_pool_code} AS pool,
+                    orchard_received_note_id AS received_note_id,
+                    transaction_id
+                FROM orchard_received_note_spends;"
+            )
+        })?;
+
+        transaction.execute_batch({
+            let transparent_pool_code = pool_code(PoolType::TRANSPARENT);
+            &format!(
+                "DROP VIEW v_transactions;
+                CREATE VIEW v_transactions AS
+                WITH
+                notes AS (
+                    -- Shielded notes received in this transaction
+                    SELECT v_received_notes.account_id     AS account_id,
+                           transactions.block              AS block,
+                           transactions.txid               AS txid,
+                           v_received_notes.pool           AS pool,
+                           id_within_pool_table,
+                           v_received_notes.value          AS value,
+                           CASE
+                                WHEN v_received_notes.is_change THEN 1
+                                ELSE 0
+                           END AS is_change,
+                           CASE
+                                WHEN v_received_notes.is_change THEN 0
+                                ELSE 1
+                           END AS received_count,
+                           CASE
+                             WHEN (v_received_notes.memo IS NULL OR v_received_notes.memo = X'F6')
+                               THEN 0
+                             ELSE 1
+                           END AS memo_present
+                    FROM v_received_notes
+                    JOIN transactions
+                         ON transactions.id_tx = v_received_notes.tx
+                    UNION
+                    -- Transparent TXOs received in this transaction
+                    SELECT utxos.received_by_account_id AS account_id,
+                           utxos.height                 AS block,
+                           utxos.prevout_txid           AS txid,
+                           {transparent_pool_code}      AS pool,
+                           utxos.id                     AS id_within_pool_table,
+                           utxos.value_zat              AS value,
+                           0                            AS is_change,
+                           1                            AS received_count,
+                           0                            AS memo_present
+                    FROM utxos
+                    UNION
+                    -- Shielded notes spent in this transaction
+                    SELECT v_received_notes.account_id  AS account_id,
+                           transactions.block           AS block,
+                           transactions.txid            AS txid,
+                           v_received_notes.pool        AS pool,
+                           id_within_pool_table,
+                           -v_received_notes.value      AS value,
+                           0                            AS is_change,
+                           0                            AS received_count,
+                           0                            AS memo_present
+                    FROM v_received_notes
+                    JOIN v_received_note_spends rns
+                         ON rns.pool = v_received_notes.pool
+                         AND rns.received_note_id = v_received_notes.id_within_pool_table
+                    JOIN transactions
+                         ON transactions.id_tx = rns.transaction_id
+                    UNION
+                    -- Transparent TXOs spent in this transaction
+                    SELECT utxos.received_by_account_id AS account_id,
+                           transactions.block           AS block,
+                           transactions.txid            AS txid,
+                           {transparent_pool_code}      AS pool,
+                           utxos.id                     AS id_within_pool_table,
+                           -utxos.value_zat             AS value,
+                           0                            AS is_change,
+                           0                            AS received_count,
+                           0                            AS memo_present
+                    FROM utxos
+                    JOIN transparent_received_output_spends tros
+                         ON tros.transparent_received_output_id = utxos.id
+                    JOIN transactions
+                         ON transactions.id_tx = tros.transaction_id
+                ),
+                -- Obtain a count of the notes that the wallet created in each transaction,
+                -- not counting change notes.
+                sent_note_counts AS (
+                    SELECT sent_notes.from_account_id AS account_id,
+                           transactions.txid       AS txid,
+                           COUNT(DISTINCT sent_notes.id) as sent_notes,
+                           SUM(
+                             CASE
+                               WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR v_received_notes.tx IS NOT NULL)
+                                 THEN 0
+                               ELSE 1
+                             END
+                           ) AS memo_count
+                    FROM sent_notes
+                    JOIN transactions
+                         ON transactions.id_tx = sent_notes.tx
+                    LEFT JOIN v_received_notes
+                         ON sent_notes.id = v_received_notes.sent_note_id
+                    WHERE COALESCE(v_received_notes.is_change, 0) = 0
+                    GROUP BY account_id, txid
+                ),
+                blocks_max_height AS (
+                    SELECT MAX(blocks.height) as max_height FROM blocks
+                )
+                SELECT notes.account_id                  AS account_id,
+                       notes.block                       AS mined_height,
+                       notes.txid                        AS txid,
+                       transactions.tx_index             AS tx_index,
+                       transactions.expiry_height        AS expiry_height,
+                       transactions.raw                  AS raw,
+                       SUM(notes.value)                  AS account_balance_delta,
+                       transactions.fee                  AS fee_paid,
+                       SUM(notes.is_change) > 0          AS has_change,
+                       MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                       SUM(notes.received_count)         AS received_note_count,
+                       SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                       blocks.time                       AS block_time,
+                       (
+                            blocks.height IS NULL
+                            AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                       ) AS expired_unmined
+                FROM notes
+                LEFT JOIN transactions
+                     ON notes.txid = transactions.txid
+                JOIN blocks_max_height
+                LEFT JOIN blocks ON blocks.height = notes.block
+                LEFT JOIN sent_note_counts
+                     ON sent_note_counts.account_id = notes.account_id
+                     AND sent_note_counts.txid = notes.txid
+                GROUP BY notes.account_id, notes.txid;"
+            )
+        })?;
+
+        transaction.execute_batch({
+            let transparent_pool_code = pool_code(PoolType::TRANSPARENT);
+            &format!(
+                "DROP VIEW v_tx_outputs;
+                CREATE VIEW v_tx_outputs AS
+                SELECT transactions.txid              AS txid,
+                       v_received_notes.pool          AS output_pool,
+                       v_received_notes.output_index  AS output_index,
+                       sent_notes.from_account_id     AS from_account_id,
+                       v_received_notes.account_id    AS to_account_id,
+                       NULL                           AS to_address,
+                       v_received_notes.value         AS value,
+                       v_received_notes.is_change     AS is_change,
+                       v_received_notes.memo          AS memo
+                FROM v_received_notes
+                JOIN transactions
+                    ON transactions.id_tx = v_received_notes.tx
+                LEFT JOIN sent_notes
+                    ON sent_notes.id = v_received_notes.sent_note_id
+                UNION
+                SELECT utxos.prevout_txid           AS txid,
+                       {transparent_pool_code}      AS output_pool,
+                       utxos.prevout_idx            AS output_index,
+                       NULL                         AS from_account_id,
+                       utxos.received_by_account_id AS to_account_id,
+                       utxos.address                AS to_address,
+                       utxos.value_zat              AS value,
+                       0                            AS is_change,
+                       NULL                         AS memo
+                FROM utxos
+                UNION
+                SELECT transactions.txid            AS txid,
+                       sent_notes.output_pool       AS output_pool,
+                       sent_notes.output_index      AS output_index,
+                       sent_notes.from_account_id   AS from_account_id,
+                       v_received_notes.account_id  AS to_account_id,
+                       sent_notes.to_address        AS to_address,
+                       sent_notes.value             AS value,
+                       0                            AS is_change,
+                       sent_notes.memo              AS memo
+                FROM sent_notes
+                JOIN transactions
+                    ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN v_received_notes
+                    ON sent_notes.id = v_received_notes.sent_note_id
+                WHERE COALESCE(v_received_notes.is_change, 0) = 0;"
+            )
+        })?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction<'_>) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/orchard_shardtree.rs b/zcash_client_sqlite/src/wallet/init/migrations/orchard_shardtree.rs
new file mode 100644
index 0000000000..a655ffb12d
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/orchard_shardtree.rs
@@ -0,0 +1,228 @@
+//! This migration adds tables to the wallet database that are needed to persist Orchard note
+//! commitment tree data using the `shardtree` crate.
+
+use std::collections::HashSet;
+
+use rusqlite::{named_params, OptionalExtension};
+use schemerz_rusqlite::RusqliteMigration;
+use tracing::debug;
+use uuid::Uuid;
+use zcash_client_backend::data_api::scanning::ScanPriority;
+use zcash_protocol::consensus::{self, BlockHeight, NetworkUpgrade};
+
+use super::shardtree_support;
+use crate::wallet::{chain_tip_height, init::WalletMigrationError, scanning::priority_code};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x3a6487f7_e068_42bb_9d12_6bb8dbe6da00);
+
+const DEPENDENCIES: &[Uuid] = &[shardtree_support::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Add support for storage of Orchard note commitment tree data using the `shardtree` crate."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        // Add shard persistence
+        debug!("Creating tables for Orchard shard persistence");
+        transaction.execute_batch(
+            "CREATE TABLE orchard_tree_shards (
+                shard_index INTEGER PRIMARY KEY,
+                subtree_end_height INTEGER,
+                root_hash BLOB,
+                shard_data BLOB,
+                contains_marked INTEGER,
+                CONSTRAINT root_unique UNIQUE (root_hash)
+            );
+            CREATE TABLE orchard_tree_cap (
+                -- cap_id exists only to be able to take advantage of `ON CONFLICT`
+                -- upsert functionality; the table will only ever contain one row
+                cap_id INTEGER PRIMARY KEY,
+                cap_data BLOB NOT NULL
+            );",
+        )?;
+
+        // Add checkpoint persistence
+        debug!("Creating tables for checkpoint persistence");
+        transaction.execute_batch(
+            "CREATE TABLE orchard_tree_checkpoints (
+                checkpoint_id INTEGER PRIMARY KEY,
+                position INTEGER
+            );
+            CREATE TABLE orchard_tree_checkpoint_marks_removed (
+                checkpoint_id INTEGER NOT NULL,
+                mark_removed_position INTEGER NOT NULL,
+                FOREIGN KEY (checkpoint_id) REFERENCES orchard_tree_checkpoints(checkpoint_id)
+                ON DELETE CASCADE,
+                CONSTRAINT spend_position_unique UNIQUE (checkpoint_id, mark_removed_position)
+            );",
+        )?;
+
+        transaction.execute_batch(&format!(
+            "CREATE VIEW v_orchard_shard_scan_ranges AS
+                SELECT
+                    shard.shard_index,
+                    shard.shard_index << {} AS start_position,
+                    (shard.shard_index + 1) << {} AS end_position_exclusive,
+                    IFNULL(prev_shard.subtree_end_height, {}) AS subtree_start_height,
+                    shard.subtree_end_height,
+                    shard.contains_marked,
+                    scan_queue.block_range_start,
+                    scan_queue.block_range_end,
+                    scan_queue.priority
+                FROM orchard_tree_shards shard
+                LEFT OUTER JOIN orchard_tree_shards prev_shard
+                    ON shard.shard_index = prev_shard.shard_index + 1
+                -- Join with scan ranges that overlap with the subtree's involved blocks.
+                INNER JOIN scan_queue ON (
+                    subtree_start_height < scan_queue.block_range_end AND
+                    (
+                        scan_queue.block_range_start <= shard.subtree_end_height OR
+                        shard.subtree_end_height IS NULL
+                    )
+                )",
+            16, // ORCHARD_SHARD_HEIGHT is only available when `feature = "orchard"` is enabled.
+            16, // ORCHARD_SHARD_HEIGHT is only available when `feature = "orchard"` is enabled.
+            u32::from(self.params.activation_height(NetworkUpgrade::Nu5).unwrap()),
+        ))?;
+
+        transaction.execute_batch(&format!(
+            "CREATE VIEW v_orchard_shard_unscanned_ranges AS
+                WITH wallet_birthday AS (SELECT MIN(birthday_height) AS height FROM accounts)
+                SELECT
+                    shard_index,
+                    start_position,
+                    end_position_exclusive,
+                    subtree_start_height,
+                    subtree_end_height,
+                    contains_marked,
+                    block_range_start,
+                    block_range_end,
+                    priority
+                FROM v_orchard_shard_scan_ranges
+                INNER JOIN wallet_birthday
+                WHERE priority > {}
+                AND block_range_end > wallet_birthday.height;",
+            priority_code(&ScanPriority::Scanned),
+        ))?;
+
+        transaction.execute_batch(
+            "CREATE VIEW v_orchard_shards_scan_state AS
+            SELECT
+                shard_index,
+                start_position,
+                end_position_exclusive,
+                subtree_start_height,
+                subtree_end_height,
+                contains_marked,
+                MAX(priority) AS max_priority
+            FROM v_orchard_shard_scan_ranges
+            GROUP BY
+                shard_index,
+                start_position,
+                end_position_exclusive,
+                subtree_start_height,
+                subtree_end_height,
+                contains_marked;",
+        )?;
+
+        // Treat the current best-known chain tip height as the height to use for Orchard
+        // initialization, bounded below by NU5 activation.
+        if let Some(orchard_init_height) = chain_tip_height(transaction)?.and_then(|h| {
+            self.params
+                .activation_height(NetworkUpgrade::Nu5)
+                .map(|orchard_activation| std::cmp::max(orchard_activation, h))
+        }) {
+            // If a scan range exists that contains the Orchard init height, split it in two at the
+            // init height.
+            if let Some((start, end, range_priority)) = transaction
+                .query_row_and_then(
+                    "SELECT block_range_start, block_range_end, priority
+                     FROM scan_queue
+                     WHERE block_range_start <= :orchard_init_height
+                     AND block_range_end > :orchard_init_height",
+                    named_params![":orchard_init_height": u32::from(orchard_init_height)],
+                    |row| {
+                        let start = BlockHeight::from(row.get::<_, u32>(0)?);
+                        let end = BlockHeight::from(row.get::<_, u32>(1)?);
+                        let range_priority: i64 = row.get(2)?;
+                        Ok((start, end, range_priority))
+                    },
+                )
+                .optional()?
+            {
+                transaction.execute(
+                    "DELETE from scan_queue WHERE block_range_start = :start",
+                    named_params![":start": u32::from(start)],
+                )?;
+                if start < orchard_init_height {
+                    // Rewrite the start of the scan range to be exactly what it was prior to the
+                    // change.
+                    transaction.execute(
+                        "INSERT INTO scan_queue (block_range_start, block_range_end, priority)
+                     VALUES (:block_range_start, :block_range_end, :priority)",
+                        named_params![
+                            ":block_range_start": u32::from(start),
+                            ":block_range_end": u32::from(orchard_init_height),
+                            ":priority": range_priority,
+                        ],
+                    )?;
+                }
+                // Rewrite the remainder of the range to have at least priority `Historic`
+                transaction.execute(
+                    "INSERT INTO scan_queue (block_range_start, block_range_end, priority)
+                     VALUES (:block_range_start, :block_range_end, :priority)",
+                    named_params![
+                        ":block_range_start": u32::from(orchard_init_height),
+                        ":block_range_end": u32::from(end),
+                        ":priority":
+                            std::cmp::max(range_priority, priority_code(&ScanPriority::Historic)),
+                    ],
+                )?;
+                // Rewrite any scanned ranges above the end of the first Orchard
+                // range to have at least priority `Historic`
+                transaction.execute(
+                    "UPDATE scan_queue SET priority = :historic
+                     WHERE :block_range_start >= :orchard_initial_range_end
+                     AND priority < :historic",
+                    named_params![
+                        ":historic": priority_code(&ScanPriority::Historic),
+                        ":orchard_initial_range_end": u32::from(end),
+                    ],
+                )?;
+            }
+        }
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/received_notes_nullable_nf.rs b/zcash_client_sqlite/src/wallet/init/migrations/received_notes_nullable_nf.rs
index 811a1a0e5e..16d505f25f 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/received_notes_nullable_nf.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/received_notes_nullable_nf.rs
@@ -3,30 +3,25 @@
 //! table prior to being mined.
 use std::collections::HashSet;
 
-use rusqlite;
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
 
 use super::v_transactions_net;
 use crate::wallet::init::WalletMigrationError;
 
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0xbdcdcedc,
-    0x7b29,
-    0x4f1c,
-    b"\x83\x07\x35\xf9\x37\xf0\xd3\x2a",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xbdcdcedc_7b29_4f1c_8307_35f937f0d32a);
+
+const DEPENDENCIES: &[Uuid] = &[v_transactions_net::MIGRATION_ID];
 
 pub(crate) struct Migration;
 
-impl schemer::Migration for Migration {
+impl schemerz::Migration<Uuid> for Migration {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [v_transactions_net::MIGRATION_ID].into_iter().collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -222,8 +217,7 @@ impl RusqliteMigration for Migration {
     }
 
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
     }
 }
 
@@ -233,10 +227,9 @@ mod tests {
     use tempfile::NamedTempFile;
 
     use zcash_client_backend::keys::UnifiedSpendingKey;
-    use zcash_primitives::zip32::AccountId;
+    use zcash_primitives::{consensus::Network, zip32::AccountId};
 
     use crate::{
-        tests,
         wallet::init::{init_wallet_db_internal, migrations::v_transactions_net},
         WalletDb,
     };
@@ -244,25 +237,30 @@ mod tests {
     #[test]
     fn received_notes_nullable_migration() {
         let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db_internal(&mut db_data, None, &[v_transactions_net::MIGRATION_ID]).unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+        init_wallet_db_internal(
+            &mut db_data,
+            None,
+            &[v_transactions_net::MIGRATION_ID],
+            false,
+        )
+        .unwrap();
 
         // Create an account in the wallet
-        let usk0 =
-            UnifiedSpendingKey::from_seed(&tests::network(), &[0u8; 32][..], AccountId::from(0))
-                .unwrap();
+        let usk0 = UnifiedSpendingKey::from_seed(&db_data.params, &[0u8; 32][..], AccountId::ZERO)
+            .unwrap();
         let ufvk0 = usk0.to_unified_full_viewing_key();
         db_data
             .conn
             .execute(
                 "INSERT INTO accounts (account, ufvk) VALUES (0, ?)",
-                params![ufvk0.encode(&tests::network())],
+                params![ufvk0.encode(&db_data.params)],
             )
             .unwrap();
 
         // Tx 0 contains two received notes of 2 and 5 zatoshis that are controlled by account 0.
         db_data.conn.execute_batch(
-            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, '');
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'00');
             INSERT INTO transactions (block, id_tx, txid) VALUES (0, 0, 'tx0');
 
             INSERT INTO received_notes (tx, output_index, account, diversifier, value, rcm, nf, is_change)
@@ -271,7 +269,7 @@ mod tests {
             VALUES (0, 3, 0, '', 5, '', 'nf_b', false);").unwrap();
 
         // Apply the current migration
-        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID]).unwrap();
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
 
         {
             let mut q = db_data
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/receiving_key_scopes.rs b/zcash_client_sqlite/src/wallet/init/migrations/receiving_key_scopes.rs
new file mode 100644
index 0000000000..778ea22c28
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/receiving_key_scopes.rs
@@ -0,0 +1,902 @@
+//! This migration adds decryption key scope to persisted information about received notes.
+
+use std::collections::HashSet;
+
+use group::ff::PrimeField;
+use incrementalmerkletree::Position;
+use rusqlite::named_params;
+use schemerz_rusqlite::RusqliteMigration;
+
+use shardtree::{store::ShardStore, ShardTree};
+use uuid::Uuid;
+
+use sapling::{
+    note_encryption::{try_sapling_note_decryption, PreparedIncomingViewingKey, Zip212Enforcement},
+    zip32::DiversifiableFullViewingKey,
+    Diversifier, Node, Rseed,
+};
+use zcash_client_backend::{data_api::SAPLING_SHARD_HEIGHT, keys::UnifiedFullViewingKey};
+use zcash_primitives::{
+    consensus::{self, BlockHeight, BranchId},
+    transaction::{
+        components::{amount::NonNegativeAmount, sapling::zip212_enforcement},
+        Transaction,
+    },
+    zip32::Scope,
+};
+
+use crate::{
+    wallet::{
+        chain_tip_height,
+        commitment_tree::SqliteShardStore,
+        init::{migrations::shardtree_support, WalletMigrationError},
+        scope_code,
+    },
+    PRUNING_DEPTH, SAPLING_TABLES_PREFIX,
+};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xee89ed2b_c1c2_421e_9e98_c1e3e54a7fc2);
+
+const DEPENDENCIES: &[Uuid] = &[shardtree_support::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Add decryption key scope to persisted information about received notes."
+    }
+}
+
+#[allow(clippy::type_complexity)]
+fn select_note_scope<S: ShardStore<H = sapling::Node, CheckpointId = BlockHeight>>(
+    commitment_tree: &mut ShardTree<
+        S,
+        { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+        SAPLING_SHARD_HEIGHT,
+    >,
+    dfvk: &DiversifiableFullViewingKey,
+    diversifier: &sapling::Diversifier,
+    value: &sapling::value::NoteValue,
+    rseed: &sapling::Rseed,
+    note_commitment_tree_position: Position,
+) -> Result<Option<Scope>, WalletMigrationError> {
+    // Attempt to reconstruct the note being spent using both the internal and external dfvks
+    // corresponding to the unified spending key, checking against the witness we are using
+    // to spend the note that we've used the correct key.
+    let external_note = dfvk
+        .diversified_address(*diversifier)
+        .map(|addr| addr.create_note(*value, *rseed));
+    let internal_note = dfvk
+        .diversified_change_address(*diversifier)
+        .map(|addr| addr.create_note(*value, *rseed));
+
+    if let Some(recorded_node) = commitment_tree
+        .get_marked_leaf(note_commitment_tree_position)
+        .map_err(|e| {
+            WalletMigrationError::CorruptedData(format!(
+                "Error querying note commitment tree: {:?}",
+                e
+            ))
+        })?
+    {
+        if external_note.map(|n| Node::from_cmu(&n.cmu())) == Some(recorded_node) {
+            Ok(Some(Scope::External))
+        } else if internal_note.map(|n| Node::from_cmu(&n.cmu())) == Some(recorded_node) {
+            Ok(Some(Scope::Internal))
+        } else {
+            Err(WalletMigrationError::CorruptedData(
+                "Unable to reconstruct note.".to_owned(),
+            ))
+        }
+    } else {
+        Ok(None)
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        transaction.execute_batch(
+            &format!(
+                "ALTER TABLE sapling_received_notes ADD COLUMN recipient_key_scope INTEGER NOT NULL DEFAULT {};",
+                scope_code(Scope::External)
+            )
+        )?;
+
+        // For all notes we have to determine whether they were actually sent to the internal key
+        // or the external key for the account, so we trial-decrypt the original output with the
+        // internal IVK and update the persisted scope value if necessary. We check all notes,
+        // rather than just change notes, because shielding notes may not have been considered
+        // change.
+        let mut stmt_select_notes = transaction.prepare(
+            "SELECT
+                id_note,
+                output_index,
+                transactions.raw,
+                transactions.block,
+                transactions.expiry_height,
+                accounts.ufvk,
+                diversifier,
+                value,
+                rcm,
+                commitment_tree_position
+             FROM sapling_received_notes
+             INNER JOIN accounts on accounts.account = sapling_received_notes.account
+             INNER JOIN transactions ON transactions.id_tx = sapling_received_notes.tx",
+        )?;
+
+        // In the case that we don't have the raw transaction
+        let mut commitment_tree = ShardTree::new(
+            SqliteShardStore::<_, _, SAPLING_SHARD_HEIGHT>::from_connection(
+                transaction,
+                SAPLING_TABLES_PREFIX,
+            )?,
+            PRUNING_DEPTH as usize,
+        );
+
+        let mut rows = stmt_select_notes.query([])?;
+        while let Some(row) = rows.next()? {
+            let note_id: i64 = row.get(0)?;
+            let output_index: usize = row.get(1)?;
+            let tx_data_opt: Option<Vec<u8>> = row.get(2)?;
+
+            let tx_height = row.get::<_, Option<u32>>(3)?.map(BlockHeight::from);
+            let tx_expiry = row.get::<_, Option<u32>>(4)?;
+            let zip212_height = tx_height.map_or_else(
+                || {
+                    tx_expiry.filter(|h| *h != 0).map_or_else(
+                        || chain_tip_height(transaction),
+                        |h| Ok(Some(BlockHeight::from(h))),
+                    )
+                },
+                |h| Ok(Some(h)),
+            )?;
+
+            let zip212_enforcement = zip212_height.map_or_else(
+                || {
+                    // If the transaction has not been mined and the expiry height is set to 0 (no
+                    // expiry) an no chain tip information is available, then we assume it can only
+                    // be mined under ZIP 212 enforcement rules, so we default to `On`
+                    Zip212Enforcement::On
+                },
+                |h| zip212_enforcement(&self.params, h),
+            );
+
+            let ufvk_str: String = row.get(5)?;
+            let ufvk = UnifiedFullViewingKey::decode(&self.params, &ufvk_str).map_err(|e| {
+                WalletMigrationError::CorruptedData(format!("Stored UFVK was invalid: {:?}", e))
+            })?;
+
+            let dfvk = ufvk.sapling().ok_or_else(|| {
+                WalletMigrationError::CorruptedData(
+                    "UFVK must have a Sapling component to have received Sapling notes.".to_owned(),
+                )
+            })?;
+
+            // We previously set the default to external scope, so we now verify whether the output
+            // is decryptable using the intenally-scoped IVK and, if so, mark it as such.
+            if let Some(tx_data) = tx_data_opt {
+                let tx = Transaction::read(&tx_data[..], BranchId::Canopy).map_err(|e| {
+                    WalletMigrationError::CorruptedData(format!(
+                        "Unable to parse raw transaction: {:?}",
+                        e
+                    ))
+                })?;
+                let output = tx
+                    .sapling_bundle()
+                    .and_then(|b| b.shielded_outputs().get(output_index))
+                    .unwrap_or_else(|| {
+                        panic!("A Sapling output must exist at index {}", output_index)
+                    });
+
+                let pivk = PreparedIncomingViewingKey::new(&dfvk.to_ivk(Scope::Internal));
+                if try_sapling_note_decryption(&pivk, output, zip212_enforcement).is_some() {
+                    transaction.execute(
+                        "UPDATE sapling_received_notes SET recipient_key_scope = :scope
+                         WHERE id_note = :note_id",
+                        named_params! {":scope": scope_code(Scope::Internal), ":note_id": note_id},
+                    )?;
+                }
+            } else {
+                let diversifier = {
+                    let d: Vec<_> = row.get(6)?;
+                    Diversifier(d[..].try_into().map_err(|_| {
+                        WalletMigrationError::CorruptedData(
+                            "Invalid diversifier length".to_string(),
+                        )
+                    })?)
+                };
+
+                let note_value =
+                    NonNegativeAmount::from_nonnegative_i64(row.get(7)?).map_err(|_e| {
+                        WalletMigrationError::CorruptedData(
+                            "Note values must be nonnegative".to_string(),
+                        )
+                    })?;
+
+                let rseed = {
+                    let rcm_bytes: [u8; 32] =
+                        row.get::<_, Vec<u8>>(8)?[..].try_into().map_err(|_| {
+                            WalletMigrationError::CorruptedData(format!(
+                                "Note {} is invalid",
+                                note_id
+                            ))
+                        })?;
+
+                    let rcm = Option::from(jubjub::Fr::from_repr(rcm_bytes)).ok_or_else(|| {
+                        WalletMigrationError::CorruptedData(format!("Note {} is invalid", note_id))
+                    })?;
+
+                    // The wallet database always stores the `rcm` value, and not `rseed`,
+                    // so for note reconstruction we always use `BeforeZip212`.
+                    Rseed::BeforeZip212(rcm)
+                };
+
+                let note_commitment_tree_position =
+                    Position::from(u64::try_from(row.get::<_, i64>(9)?).map_err(|_| {
+                        WalletMigrationError::CorruptedData(
+                            "Note commitment tree position invalid.".to_string(),
+                        )
+                    })?);
+
+                let scope = select_note_scope(
+                    &mut commitment_tree,
+                    dfvk,
+                    &diversifier,
+                    &sapling::value::NoteValue::from_raw(note_value.into_u64()),
+                    &rseed,
+                    note_commitment_tree_position,
+                )?;
+
+                if scope == Some(Scope::Internal) {
+                    transaction.execute(
+                        "UPDATE sapling_received_notes SET recipient_key_scope = :scope
+                         WHERE id_note = :note_id",
+                        named_params! {":scope": scope_code(Scope::Internal), ":note_id": note_id},
+                    )?;
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(feature = "transparent-inputs")]
+#[cfg(test)]
+mod tests {
+    use std::convert::Infallible;
+
+    use incrementalmerkletree::Position;
+    use maybe_rayon::{
+        iter::{IndexedParallelIterator, ParallelIterator},
+        slice::ParallelSliceMut,
+    };
+    use rand_core::OsRng;
+    use rusqlite::{named_params, params, Connection, OptionalExtension};
+    use tempfile::NamedTempFile;
+    use zcash_client_backend::{
+        data_api::{BlockMetadata, WalletCommitmentTrees, SAPLING_SHARD_HEIGHT},
+        decrypt_transaction,
+        proto::compact_formats::{CompactBlock, CompactTx},
+        scanning::{scan_block, Nullifiers, ScanningKeys},
+        wallet::WalletTx,
+        TransferType,
+    };
+    use zcash_keys::keys::{UnifiedFullViewingKey, UnifiedSpendingKey};
+    use zcash_primitives::{
+        block::BlockHash,
+        consensus::{BlockHeight, Network, NetworkUpgrade, Parameters},
+        legacy::keys::{IncomingViewingKey, NonHardenedChildIndex},
+        memo::MemoBytes,
+        transaction::{
+            builder::{BuildConfig, BuildResult, Builder},
+            components::{amount::NonNegativeAmount, transparent},
+            fees::fixed,
+            Transaction,
+        },
+        zip32::{self, Scope},
+    };
+    use zcash_proofs::prover::LocalTxProver;
+
+    use crate::{
+        error::SqliteClientError,
+        wallet::{
+            init::{
+                init_wallet_db_internal,
+                migrations::{add_account_birthdays, shardtree_support, wallet_summaries},
+            },
+            memo_repr, parse_scope,
+            sapling::ReceivedSaplingOutput,
+        },
+        AccountRef, TxRef, WalletDb,
+    };
+
+    // These must be different.
+    const EXTERNAL_VALUE: u64 = 10;
+    const INTERNAL_VALUE: u64 = 5;
+
+    fn prepare_wallet_state<P: Parameters>(
+        db_data: &mut WalletDb<Connection, P>,
+    ) -> (UnifiedFullViewingKey, BlockHeight, BuildResult) {
+        // Create an account in the wallet
+        let usk0 =
+            UnifiedSpendingKey::from_seed(&db_data.params, &[0u8; 32][..], zip32::AccountId::ZERO)
+                .unwrap();
+        let ufvk0 = usk0.to_unified_full_viewing_key();
+        let height = db_data
+            .params
+            .activation_height(NetworkUpgrade::Sapling)
+            .unwrap();
+        db_data
+            .conn
+            .execute(
+                "INSERT INTO accounts (account, ufvk, birthday_height) VALUES (0, ?, ?)",
+                params![ufvk0.encode(&db_data.params), u32::from(height)],
+            )
+            .unwrap();
+        let sapling_dfvk = ufvk0.sapling().unwrap();
+        let ovk = sapling_dfvk.to_ovk(Scope::External);
+        let (_, external_addr) = sapling_dfvk.default_address();
+        let (_, internal_addr) = sapling_dfvk.change_address();
+
+        // Create a shielding transaction that has an external note and an internal note.
+        let mut builder = Builder::new(
+            db_data.params.clone(),
+            height,
+            BuildConfig::Standard {
+                sapling_anchor: Some(sapling::Anchor::empty_tree()),
+                orchard_anchor: None,
+            },
+        );
+        builder
+            .add_transparent_input(
+                usk0.transparent()
+                    .derive_external_secret_key(NonHardenedChildIndex::ZERO)
+                    .unwrap(),
+                transparent::OutPoint::fake(),
+                transparent::TxOut {
+                    value: NonNegativeAmount::const_from_u64(EXTERNAL_VALUE + INTERNAL_VALUE),
+                    script_pubkey: usk0
+                        .transparent()
+                        .to_account_pubkey()
+                        .derive_external_ivk()
+                        .unwrap()
+                        .default_address()
+                        .0
+                        .script(),
+                },
+            )
+            .unwrap();
+        builder
+            .add_sapling_output::<Infallible>(
+                Some(ovk),
+                external_addr,
+                NonNegativeAmount::const_from_u64(EXTERNAL_VALUE),
+                MemoBytes::empty(),
+            )
+            .unwrap();
+        builder
+            .add_sapling_output::<Infallible>(
+                Some(ovk),
+                internal_addr,
+                NonNegativeAmount::const_from_u64(INTERNAL_VALUE),
+                MemoBytes::empty(),
+            )
+            .unwrap();
+        let prover = LocalTxProver::bundled();
+        let res = builder
+            .build(
+                OsRng,
+                &prover,
+                &prover,
+                #[allow(deprecated)]
+                &fixed::FeeRule::non_standard(NonNegativeAmount::ZERO),
+            )
+            .unwrap();
+
+        (ufvk0, height, res)
+    }
+
+    fn put_received_note_before_migration<T: ReceivedSaplingOutput<AccountId = AccountRef>>(
+        conn: &Connection,
+        output: &T,
+        tx_ref: i64,
+        spent_in: Option<i64>,
+    ) -> Result<(), SqliteClientError> {
+        let mut stmt_upsert_received_note = conn.prepare_cached(
+            "INSERT INTO sapling_received_notes
+            (tx, output_index, account, diversifier, value, rcm, memo, nf,
+             is_change, spent, commitment_tree_position)
+            VALUES (
+                :tx,
+                :output_index,
+                :account,
+                :diversifier,
+                :value,
+                :rcm,
+                :memo,
+                :nf,
+                :is_change,
+                :spent,
+                :commitment_tree_position
+            )
+            ON CONFLICT (tx, output_index) DO UPDATE
+            SET account = :account,
+                diversifier = :diversifier,
+                value = :value,
+                rcm = :rcm,
+                nf = IFNULL(:nf, nf),
+                memo = IFNULL(:memo, memo),
+                is_change = IFNULL(:is_change, is_change),
+                spent = IFNULL(:spent, spent),
+                commitment_tree_position = IFNULL(:commitment_tree_position, commitment_tree_position)",
+        )?;
+
+        let rcm = output.note().rcm().to_bytes();
+        let to = output.note().recipient();
+        let diversifier = to.diversifier();
+
+        let account = output.account_id();
+        let sql_args = named_params![
+            ":tx": &tx_ref,
+            ":output_index": i64::try_from(output.index()).expect("output indices are representable as i64"),
+            ":account": account.0,
+            ":diversifier": &diversifier.0.as_ref(),
+            ":value": output.note().value().inner(),
+            ":rcm": &rcm.as_ref(),
+            ":nf": output.nullifier().map(|nf| nf.0.as_ref()),
+            ":memo": memo_repr(output.memo()),
+            ":is_change": output.is_change(),
+            ":spent": spent_in,
+            ":commitment_tree_position": output.note_commitment_tree_position().map(u64::from),
+        ];
+
+        stmt_upsert_received_note
+            .execute(sql_args)
+            .map_err(SqliteClientError::from)?;
+
+        Ok(())
+    }
+
+    /// This reproduces [`crate::wallet::put_tx_data`] as it was at the time
+    /// of the creation of this migration.
+    fn put_tx_data(
+        conn: &rusqlite::Connection,
+        tx: &Transaction,
+        fee: Option<NonNegativeAmount>,
+        created_at: Option<time::OffsetDateTime>,
+    ) -> Result<TxRef, SqliteClientError> {
+        let mut stmt_upsert_tx_data = conn.prepare_cached(
+            "INSERT INTO transactions (txid, created, expiry_height, raw, fee)
+            VALUES (:txid, :created_at, :expiry_height, :raw, :fee)
+            ON CONFLICT (txid) DO UPDATE
+            SET expiry_height = :expiry_height,
+                raw = :raw,
+                fee = IFNULL(:fee, fee)
+            RETURNING id_tx",
+        )?;
+
+        let txid = tx.txid();
+        let mut raw_tx = vec![];
+        tx.write(&mut raw_tx)?;
+
+        let tx_params = named_params![
+            ":txid": &txid.as_ref()[..],
+            ":created_at": created_at,
+            ":expiry_height": u32::from(tx.expiry_height()),
+            ":raw": raw_tx,
+            ":fee": fee.map(u64::from),
+        ];
+
+        stmt_upsert_tx_data
+            .query_row(tx_params, |row| row.get::<_, i64>(0).map(TxRef))
+            .map_err(SqliteClientError::from)
+    }
+
+    #[test]
+    fn receiving_key_scopes_migration_enhanced() {
+        let params = Network::TestNetwork;
+
+        // Create wallet upgraded to just before the current migration.
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), params).unwrap();
+        init_wallet_db_internal(
+            &mut db_data,
+            None,
+            &[
+                add_account_birthdays::MIGRATION_ID,
+                shardtree_support::MIGRATION_ID,
+            ],
+            false,
+        )
+        .unwrap();
+
+        let (ufvk0, height, res) = prepare_wallet_state(&mut db_data);
+        let tx = res.transaction();
+        let account_id = AccountRef(0);
+
+        // We can't use `decrypt_and_store_transaction` because we haven't migrated yet.
+        // Replicate its relevant innards here.
+        let d_tx = decrypt_transaction(
+            &params,
+            height,
+            tx,
+            &[(account_id, ufvk0)].into_iter().collect(),
+        );
+
+        db_data
+            .transactionally::<_, _, rusqlite::Error>(|wdb| {
+                let tx_ref = put_tx_data(wdb.conn.0, d_tx.tx(), None, None).unwrap();
+
+                let mut spending_account_id: Option<AccountRef> = None;
+
+                // Orchard outputs were not supported as of the wallet states that could require this
+                // migration.
+                for output in d_tx.sapling_outputs() {
+                    match output.transfer_type() {
+                        TransferType::Outgoing | TransferType::WalletInternal => {
+                            // Don't need to bother with sent outputs for this test.
+                            if output.transfer_type() != TransferType::Outgoing {
+                                put_received_note_before_migration(
+                                    wdb.conn.0, output, tx_ref.0, None,
+                                )
+                                .unwrap();
+                            }
+                        }
+                        TransferType::Incoming => {
+                            match spending_account_id {
+                                Some(id) => assert_eq!(id, *output.account()),
+                                None => {
+                                    spending_account_id = Some(*output.account());
+                                }
+                            }
+
+                            put_received_note_before_migration(wdb.conn.0, output, tx_ref.0, None)
+                                .unwrap();
+                        }
+                    }
+                }
+
+                Ok(())
+            })
+            .unwrap();
+
+        // Apply the current migration
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
+
+        // There should be two rows in the `sapling_received_notes` table with correct scopes.
+        let mut q = db_data
+            .conn
+            .prepare(
+                "SELECT value, recipient_key_scope
+                FROM sapling_received_notes",
+            )
+            .unwrap();
+        let mut rows = q.query([]).unwrap();
+        let mut row_count = 0;
+        while let Some(row) = rows.next().unwrap() {
+            row_count += 1;
+            let value: u64 = row.get(0).unwrap();
+            let scope = parse_scope(row.get(1).unwrap());
+            match value {
+                EXTERNAL_VALUE => assert_eq!(scope, Some(Scope::External)),
+                INTERNAL_VALUE => assert_eq!(scope, Some(Scope::Internal)),
+                _ => {
+                    panic!(
+                        "(Value, Scope) pair {:?} is not expected to exist in the wallet.",
+                        (value, scope),
+                    );
+                }
+            }
+        }
+        assert_eq!(row_count, 2);
+    }
+
+    #[test]
+    fn receiving_key_scopes_migration_non_enhanced() {
+        let params = Network::TestNetwork;
+
+        // Create wallet upgraded to just before the current migration.
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), params).unwrap();
+        init_wallet_db_internal(
+            &mut db_data,
+            None,
+            &[
+                wallet_summaries::MIGRATION_ID,
+                shardtree_support::MIGRATION_ID,
+            ],
+            false,
+        )
+        .unwrap();
+
+        let (ufvk0, height, res) = prepare_wallet_state(&mut db_data);
+        let tx = res.transaction();
+
+        let mut compact_tx = CompactTx {
+            hash: tx.txid().as_ref()[..].into(),
+            ..Default::default()
+        };
+        for output in tx.sapling_bundle().unwrap().shielded_outputs() {
+            compact_tx.outputs.push(output.into());
+        }
+        let prev_hash = BlockHash([4; 32]);
+        let mut block = CompactBlock {
+            height: height.into(),
+            hash: vec![7; 32],
+            prev_hash: prev_hash.0[..].into(),
+            ..Default::default()
+        };
+        block.vtx.push(compact_tx);
+        let scanning_keys = ScanningKeys::from_account_ufvks([(AccountRef(0), ufvk0)]);
+
+        let scanned_block = scan_block(
+            &params,
+            block,
+            &scanning_keys,
+            &Nullifiers::empty(),
+            Some(&BlockMetadata::from_parts(
+                height - 1,
+                prev_hash,
+                Some(0),
+                #[cfg(feature = "orchard")]
+                Some(0),
+            )),
+        )
+        .unwrap();
+
+        // We can't use `put_blocks` because we haven't migrated yet.
+        // Replicate its relevant innards here.
+        let blocks = [scanned_block];
+        db_data
+            .transactionally(|wdb| {
+                let start_positions = blocks.first().map(|block| {
+                    (
+                        block.height(),
+                        Position::from(
+                            u64::from(block.sapling().final_tree_size())
+                                - u64::try_from(block.sapling().commitments().len()).unwrap(),
+                        ),
+                    )
+                });
+                let mut sapling_commitments = vec![];
+                let mut last_scanned_height = None;
+                let mut note_positions = vec![];
+                for block in blocks.into_iter() {
+                    if last_scanned_height
+                        .iter()
+                        .any(|prev| block.height() != *prev + 1)
+                    {
+                        return Err(SqliteClientError::NonSequentialBlocks);
+                    }
+
+                    // Insert the block into the database.
+                    put_block(
+                        wdb.conn.0,
+                        block.height(),
+                        block.block_hash(),
+                        block.block_time(),
+                        block.sapling().final_tree_size(),
+                        block.sapling().commitments().len().try_into().unwrap(),
+                        #[cfg(feature = "orchard")]
+                        block.orchard().final_tree_size(),
+                        #[cfg(feature = "orchard")]
+                        block.orchard().commitments().len().try_into().unwrap(),
+                    )?;
+
+                    for tx in block.transactions() {
+                        let tx_row = put_tx_meta(wdb.conn.0, tx, block.height())?;
+
+                        for output in tx.sapling_outputs() {
+                            put_received_note_before_migration(wdb.conn.0, output, tx_row, None)?;
+                        }
+                    }
+
+                    note_positions.extend(block.transactions().iter().flat_map(|wtx| {
+                        wtx.sapling_outputs()
+                            .iter()
+                            .map(|out| out.note_commitment_tree_position())
+                    }));
+
+                    last_scanned_height = Some(block.height());
+                    let block_commitments = block.into_commitments();
+                    sapling_commitments.extend(block_commitments.sapling.into_iter().map(Some));
+                }
+
+                // We will have a start position and a last scanned height in all cases where
+                // `blocks` is non-empty.
+                if let Some(((_, start_position), _)) = start_positions.zip(last_scanned_height) {
+                    // Create subtrees from the note commitments in parallel.
+                    const CHUNK_SIZE: usize = 1024;
+                    let subtrees = sapling_commitments
+                        .par_chunks_mut(CHUNK_SIZE)
+                        .enumerate()
+                        .filter_map(|(i, chunk)| {
+                            let start = start_position + (i * CHUNK_SIZE) as u64;
+                            let end = start + chunk.len() as u64;
+
+                            shardtree::LocatedTree::from_iter(
+                                start..end,
+                                SAPLING_SHARD_HEIGHT.into(),
+                                chunk.iter_mut().map(|n| n.take().expect("always Some")),
+                            )
+                        })
+                        .map(|res| (res.subtree, res.checkpoints))
+                        .collect::<Vec<_>>();
+
+                    // Update the Sapling note commitment tree with all newly read note commitments
+                    let mut subtrees = subtrees.into_iter();
+                    wdb.with_sapling_tree_mut::<_, _, SqliteClientError>(move |sapling_tree| {
+                        for (tree, checkpoints) in &mut subtrees {
+                            sapling_tree.insert_tree(tree, checkpoints)?;
+                        }
+
+                        Ok(())
+                    })?;
+                }
+
+                Ok(())
+            })
+            .unwrap();
+
+        // Apply the current migration
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
+
+        // There should be two rows in the `sapling_received_notes` table with correct scopes.
+        let mut q = db_data
+            .conn
+            .prepare(
+                "SELECT value, recipient_key_scope
+                FROM sapling_received_notes",
+            )
+            .unwrap();
+        let mut rows = q.query([]).unwrap();
+        let mut row_count = 0;
+        while let Some(row) = rows.next().unwrap() {
+            row_count += 1;
+            let value: u64 = row.get(0).unwrap();
+            let scope = parse_scope(row.get(1).unwrap());
+            match value {
+                EXTERNAL_VALUE => assert_eq!(scope, Some(Scope::External)),
+                INTERNAL_VALUE => assert_eq!(scope, Some(Scope::Internal)),
+                _ => {
+                    panic!(
+                        "(Value, Scope) pair {:?} is not expected to exist in the wallet.",
+                        (value, scope),
+                    );
+                }
+            }
+        }
+        assert_eq!(row_count, 2);
+    }
+
+    /// This is a copy of [`crate::wallet::put_block`] as of the expected database
+    /// state corresponding to this migration. It is duplicated here as later
+    /// updates to the database schema require incompatible changes to `put_block`.
+    #[allow(clippy::too_many_arguments)]
+    fn put_block(
+        conn: &rusqlite::Transaction<'_>,
+        block_height: BlockHeight,
+        block_hash: BlockHash,
+        block_time: u32,
+        sapling_commitment_tree_size: u32,
+        sapling_output_count: u32,
+        #[cfg(feature = "orchard")] orchard_commitment_tree_size: u32,
+        #[cfg(feature = "orchard")] orchard_action_count: u32,
+    ) -> Result<(), SqliteClientError> {
+        let block_hash_data = conn
+            .query_row(
+                "SELECT hash FROM blocks WHERE height = ?",
+                [u32::from(block_height)],
+                |row| row.get::<_, Vec<u8>>(0),
+            )
+            .optional()?;
+
+        // Ensure that in the case of an upsert, we don't overwrite block data
+        // with information for a block with a different hash.
+        if let Some(bytes) = block_hash_data {
+            let expected_hash = BlockHash::try_from_slice(&bytes).ok_or_else(|| {
+                SqliteClientError::CorruptedData(format!(
+                    "Invalid block hash at height {}",
+                    u32::from(block_height)
+                ))
+            })?;
+            if expected_hash != block_hash {
+                return Err(SqliteClientError::BlockConflict(block_height));
+            }
+        }
+
+        let mut stmt_upsert_block = conn.prepare_cached(
+            "INSERT INTO blocks (
+                height,
+                hash,
+                time,
+                sapling_commitment_tree_size,
+                sapling_output_count,
+                sapling_tree,
+                orchard_commitment_tree_size,
+                orchard_action_count
+            )
+            VALUES (
+                :height,
+                :hash,
+                :block_time,
+                :sapling_commitment_tree_size,
+                :sapling_output_count,
+                x'00',
+                :orchard_commitment_tree_size,
+                :orchard_action_count
+            )
+            ON CONFLICT (height) DO UPDATE
+            SET hash = :hash,
+                time = :block_time,
+                sapling_commitment_tree_size = :sapling_commitment_tree_size,
+                sapling_output_count = :sapling_output_count,
+                orchard_commitment_tree_size = :orchard_commitment_tree_size,
+                orchard_action_count = :orchard_action_count",
+        )?;
+
+        #[cfg(not(feature = "orchard"))]
+        let orchard_commitment_tree_size: Option<u32> = None;
+        #[cfg(not(feature = "orchard"))]
+        let orchard_action_count: Option<u32> = None;
+
+        stmt_upsert_block.execute(named_params![
+            ":height": u32::from(block_height),
+            ":hash": &block_hash.0[..],
+            ":block_time": block_time,
+            ":sapling_commitment_tree_size": sapling_commitment_tree_size,
+            ":sapling_output_count": sapling_output_count,
+            ":orchard_commitment_tree_size": orchard_commitment_tree_size,
+            ":orchard_action_count": orchard_action_count,
+        ])?;
+
+        Ok(())
+    }
+
+    /// This is a copy of [`crate::wallet::put_tx_meta`] as of the expected database
+    /// state corresponding to this migration. It is duplicated here as later
+    /// updates to the database schema require incompatible changes to `put_tx_meta`.
+    pub(crate) fn put_tx_meta(
+        conn: &rusqlite::Connection,
+        tx: &WalletTx<AccountRef>,
+        height: BlockHeight,
+    ) -> Result<i64, SqliteClientError> {
+        // It isn't there, so insert our transaction into the database.
+        let mut stmt_upsert_tx_meta = conn.prepare_cached(
+            "INSERT INTO transactions (txid, block, tx_index)
+            VALUES (:txid, :block, :tx_index)
+            ON CONFLICT (txid) DO UPDATE
+            SET block = :block,
+                tx_index = :tx_index
+            RETURNING id_tx",
+        )?;
+
+        let txid_bytes = tx.txid();
+        let tx_params = named_params![
+            ":txid": &txid_bytes.as_ref()[..],
+            ":block": u32::from(height),
+            ":tx_index": i64::try_from(tx.block_index()).expect("transaction indices are representable as i64"),
+        ];
+
+        stmt_upsert_tx_meta
+            .query_row(tx_params, |row| row.get::<_, i64>(0))
+            .map_err(SqliteClientError::from)
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/sapling_memo_consistency.rs b/zcash_client_sqlite/src/wallet/init/migrations/sapling_memo_consistency.rs
new file mode 100644
index 0000000000..4e81b5fc6c
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/sapling_memo_consistency.rs
@@ -0,0 +1,233 @@
+//! This migration reads the wallet's raw transaction data and updates the `sent_notes` table to
+//! ensure that memo entries are consistent with the decrypted transaction's outputs. The empty
+//! memo is now consistently represented as a single `0xf6` byte.
+
+use std::collections::{BTreeMap, HashMap, HashSet};
+
+use rusqlite::named_params;
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_client_backend::{decrypt_transaction, keys::UnifiedFullViewingKey};
+use zcash_primitives::{consensus, transaction::TxId, zip32::AccountId};
+
+use crate::{
+    error::SqliteClientError,
+    wallet::{get_transaction, init::WalletMigrationError, memo_repr},
+};
+
+use super::received_notes_nullable_nf;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x7029b904_6557_4aa1_9da5_6904b65d2ba5);
+
+const DEPENDENCIES: &[Uuid] = &[received_notes_nullable_nf::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "This migration reads the wallet's raw transaction data and updates the `sent_notes` table to
+        ensure that memo entries are consistent with the decrypted transaction's outputs. The empty
+        memo is now consistently represented as a single `0xf6` byte."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        let mut stmt_raw_tx = transaction.prepare(
+            "SELECT DISTINCT
+               transactions.id_tx, transactions.txid,
+               accounts.account, accounts.ufvk
+             FROM sent_notes
+             JOIN accounts ON sent_notes.from_account = accounts.account
+             JOIN transactions ON transactions.id_tx = sent_notes.tx
+             WHERE transactions.raw IS NOT NULL",
+        )?;
+
+        let mut rows = stmt_raw_tx.query([])?;
+
+        let mut tx_sent_notes: BTreeMap<(i64, TxId), HashMap<AccountId, UnifiedFullViewingKey>> =
+            BTreeMap::new();
+        while let Some(row) = rows.next()? {
+            let id_tx: i64 = row.get(0)?;
+            let txid = row.get(1).map(TxId::from_bytes)?;
+            let account: u32 = row.get(2)?;
+            let ufvk_str: String = row.get(3)?;
+            let ufvk = UnifiedFullViewingKey::decode(&self.params, &ufvk_str).map_err(|e| {
+                WalletMigrationError::CorruptedData(format!(
+                    "Could not decode unified full viewing key for account {}: {:?}",
+                    account, e
+                ))
+            })?;
+
+            tx_sent_notes.entry((id_tx, txid)).or_default().insert(
+                AccountId::try_from(account).map_err(|_| {
+                    WalletMigrationError::CorruptedData("Account ID is invalid".to_owned())
+                })?,
+                ufvk,
+            );
+        }
+
+        let mut stmt_update_sent_memo = transaction.prepare(
+            "UPDATE sent_notes
+            SET memo = :memo
+            WHERE tx = :id_tx
+            AND output_index = :output_index",
+        )?;
+
+        for ((id_tx, txid), ufvks) in tx_sent_notes {
+            let (block_height, tx) = get_transaction(transaction, &self.params, txid)
+                .map_err(|err| match err {
+                    SqliteClientError::CorruptedData(msg) => {
+                        WalletMigrationError::CorruptedData(msg)
+                    }
+                    SqliteClientError::DbError(err) => WalletMigrationError::DbError(err),
+                    other => WalletMigrationError::CorruptedData(format!(
+                        "An error was encountered decoding transaction data: {:?}",
+                        other
+                    )),
+                })?
+                .ok_or_else(|| {
+                    WalletMigrationError::CorruptedData(format!(
+                        "Transaction not found for id {:?}",
+                        txid
+                    ))
+                })?;
+
+            let decrypted_outputs = decrypt_transaction(&self.params, block_height, &tx, &ufvks);
+
+            // Orchard outputs were not supported as of the wallet states that could require this
+            // migration.
+            for d_out in decrypted_outputs.sapling_outputs() {
+                stmt_update_sent_memo.execute(named_params![
+                    ":id_tx": id_tx,
+                    ":output_index": d_out.index(),
+                    ":memo": memo_repr(Some(d_out.memo()))
+                ])?;
+            }
+        }
+
+        // Update the `v_transactions` view to avoid counting the empty memo as a memo
+        transaction.execute_batch(
+            "DROP VIEW v_transactions;
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                SELECT sapling_received_notes.account        AS account_id,
+                       sapling_received_notes.tx             AS id_tx,
+                       2                             AS pool,
+                       sapling_received_notes.value          AS value,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 1
+                            ELSE 0
+                       END AS is_change,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (sapling_received_notes.memo IS NULL OR sapling_received_notes.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present
+                FROM   sapling_received_notes
+                UNION
+                SELECT utxos.received_by_account     AS account_id,
+                       transactions.id_tx            AS id_tx,
+                       0                             AS pool,
+                       utxos.value_zat               AS value,
+                       0                             AS is_change,
+                       1                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                JOIN transactions
+                     ON transactions.txid = utxos.prevout_txid
+                UNION
+                SELECT sapling_received_notes.account        AS account_id,
+                       sapling_received_notes.spent          AS id_tx,
+                       2                             AS pool,
+                       -sapling_received_notes.value         AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM   sapling_received_notes
+                WHERE  sapling_received_notes.spent IS NOT NULL
+            ),
+            sent_note_counts AS (
+                SELECT sent_notes.from_account AS account_id,
+                       sent_notes.tx AS id_tx,
+                       COUNT(DISTINCT sent_notes.id_note) as sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6')
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                LEFT JOIN sapling_received_notes
+                          ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                             (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+                WHERE  sapling_received_notes.is_change IS NULL
+                   OR  sapling_received_notes.is_change = 0
+                GROUP BY account_id, id_tx
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) as max_height FROM blocks
+            )
+            SELECT notes.account_id                  AS account_id,
+                   transactions.id_tx                AS id_tx,
+                   transactions.block                AS mined_height,
+                   transactions.tx_index             AS tx_index,
+                   transactions.txid                 AS txid,
+                   transactions.expiry_height        AS expiry_height,
+                   transactions.raw                  AS raw,
+                   SUM(notes.value)                  AS account_balance_delta,
+                   transactions.fee                  AS fee_paid,
+                   SUM(notes.is_change) > 0          AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height <= blocks_max_height.max_height
+                   ) AS expired_unmined
+            FROM transactions
+            JOIN notes ON notes.id_tx = transactions.id_tx
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = transactions.block
+            LEFT JOIN sent_note_counts
+                      ON sent_note_counts.account_id = notes.account_id
+                      AND sent_note_counts.id_tx = notes.id_tx
+            GROUP BY notes.account_id, transactions.id_tx",
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/sent_notes_to_internal.rs b/zcash_client_sqlite/src/wallet/init/migrations/sent_notes_to_internal.rs
index ee191b9570..a549993eb7 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/sent_notes_to_internal.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/sent_notes_to_internal.rs
@@ -2,33 +2,26 @@
 //! on an internal address to the sent_notes table.
 use std::collections::HashSet;
 
-use rusqlite;
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
 
 use super::ufvk_support;
 use crate::wallet::init::WalletMigrationError;
 
 /// This migration adds the `to_account` field to the `sent_notes` table.
-///
-/// 0ddbe561-8259-4212-9ab7-66fdc4a74e1d
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0x0ddbe561,
-    0x8259,
-    0x4212,
-    b"\x9a\xb7\x66\xfd\xc4\xa7\x4e\x1d",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x0ddbe561_8259_4212_9ab7_66fdc4a74e1d);
+
+const DEPENDENCIES: &[Uuid] = &[ufvk_support::MIGRATION_ID];
 
 pub(super) struct Migration;
 
-impl schemer::Migration for Migration {
+impl schemerz::Migration<Uuid> for Migration {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [ufvk_support::MIGRATION_ID].into_iter().collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -81,7 +74,16 @@ impl RusqliteMigration for Migration {
     }
 
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/shardtree_support.rs b/zcash_client_sqlite/src/wallet/init/migrations/shardtree_support.rs
new file mode 100644
index 0000000000..7eaec4f210
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/shardtree_support.rs
@@ -0,0 +1,291 @@
+//! This migration adds tables to the wallet database that are needed to persist Sapling note
+//! commitment tree data using the `shardtree` crate, and migrates existing witness data into these
+//! data structures.
+
+use std::collections::{BTreeSet, HashSet};
+
+use incrementalmerkletree::{Marking, Retention};
+use rusqlite::{named_params, params};
+use schemerz_rusqlite::RusqliteMigration;
+use shardtree::{error::ShardTreeError, store::caching::CachingShardStore, ShardTree};
+use tracing::{debug, trace};
+use uuid::Uuid;
+
+use zcash_client_backend::data_api::{
+    scanning::{ScanPriority, ScanRange},
+    SAPLING_SHARD_HEIGHT,
+};
+use zcash_primitives::{
+    consensus::{self, BlockHeight, NetworkUpgrade},
+    merkle_tree::{read_commitment_tree, read_incremental_witness},
+};
+
+use crate::{
+    wallet::{
+        block_height_extrema,
+        commitment_tree::SqliteShardStore,
+        init::{migrations::received_notes_nullable_nf, WalletMigrationError},
+        scanning::insert_queue_entries,
+    },
+    PRUNING_DEPTH, SAPLING_TABLES_PREFIX,
+};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x7da6489d_e835_4657_8be5_f512bcce6cbf);
+
+const DEPENDENCIES: &[Uuid] = &[received_notes_nullable_nf::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Add support for receiving storage of note commitment tree data using the `shardtree` crate."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        // Add commitment tree sizes to block metadata.
+        debug!("Adding new columns");
+        transaction.execute_batch(
+            "ALTER TABLE blocks ADD COLUMN sapling_commitment_tree_size INTEGER;
+             ALTER TABLE blocks ADD COLUMN orchard_commitment_tree_size INTEGER;
+             ALTER TABLE sapling_received_notes ADD COLUMN commitment_tree_position INTEGER;",
+        )?;
+
+        // Add shard persistence
+        debug!("Creating tables for shard persistence");
+        transaction.execute_batch(
+            "CREATE TABLE sapling_tree_shards (
+                shard_index INTEGER PRIMARY KEY,
+                subtree_end_height INTEGER,
+                root_hash BLOB,
+                shard_data BLOB,
+                contains_marked INTEGER,
+                CONSTRAINT root_unique UNIQUE (root_hash)
+            );
+            CREATE TABLE sapling_tree_cap (
+                -- cap_id exists only to be able to take advantage of `ON CONFLICT`
+                -- upsert functionality; the table will only ever contain one row
+                cap_id INTEGER PRIMARY KEY,
+                cap_data BLOB NOT NULL
+            );",
+        )?;
+
+        // Add checkpoint persistence
+        debug!("Creating tables for checkpoint persistence");
+        transaction.execute_batch(
+            "CREATE TABLE sapling_tree_checkpoints (
+                checkpoint_id INTEGER PRIMARY KEY,
+                position INTEGER
+            );
+            CREATE TABLE sapling_tree_checkpoint_marks_removed (
+                checkpoint_id INTEGER NOT NULL,
+                mark_removed_position INTEGER NOT NULL,
+                FOREIGN KEY (checkpoint_id) REFERENCES sapling_tree_checkpoints(checkpoint_id)
+                ON DELETE CASCADE,
+                CONSTRAINT spend_position_unique UNIQUE (checkpoint_id, mark_removed_position)
+            );",
+        )?;
+
+        let block_height_extrema = block_height_extrema(transaction)?;
+
+        let shard_store =
+            SqliteShardStore::<_, sapling::Node, SAPLING_SHARD_HEIGHT>::from_connection(
+                transaction,
+                SAPLING_TABLES_PREFIX,
+            )?;
+        let shard_store = CachingShardStore::load(shard_store).map_err(ShardTreeError::Storage)?;
+        let mut shard_tree: ShardTree<
+            _,
+            { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+            SAPLING_SHARD_HEIGHT,
+        > = ShardTree::new(shard_store, PRUNING_DEPTH.try_into().unwrap());
+        // Insert all the tree information that we can get from block-end commitment trees
+        {
+            let mut stmt_blocks = transaction.prepare("SELECT height, sapling_tree FROM blocks")?;
+            let mut stmt_update_block_sapling_tree_size = transaction
+                .prepare("UPDATE blocks SET sapling_commitment_tree_size = ? WHERE height = ?")?;
+
+            let mut block_rows = stmt_blocks.query([])?;
+            while let Some(row) = block_rows.next()? {
+                let block_height: u32 = row.get(0)?;
+                let sapling_tree_data: Vec<u8> = row.get(1)?;
+
+                let block_end_tree = read_commitment_tree::<
+                    sapling::Node,
+                    _,
+                    { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+                >(&sapling_tree_data[..])
+                .map_err(|e| {
+                    rusqlite::Error::FromSqlConversionFailure(
+                        sapling_tree_data.len(),
+                        rusqlite::types::Type::Blob,
+                        Box::new(e),
+                    )
+                })?;
+
+                if block_height % 1000 == 0 {
+                    debug!(height = block_height, "Migrating tree data to shardtree");
+                }
+                trace!(
+                    height = block_height,
+                    size = block_end_tree.size(),
+                    "Storing Sapling commitment tree size"
+                );
+                stmt_update_block_sapling_tree_size
+                    .execute(params![block_end_tree.size(), block_height])?;
+
+                // We only need to load frontiers into the ShardTree that are close enough
+                // to the wallet's known chain tip to fill `PRUNING_DEPTH` checkpoints, so
+                // that ShardTree's witness generation will be able to correctly handle
+                // anchor depths. Loading frontiers further back than this doesn't add any
+                // useful nodes to the ShardTree (as we don't support rollbacks beyond
+                // `PRUNING_DEPTH`, and we won't be finding notes in earlier blocks), and
+                // hurts performance (as frontier importing has a significant Merkle tree
+                // hashing cost).
+                if let Some((nonempty_frontier, scanned_range)) = block_end_tree
+                    .to_frontier()
+                    .value()
+                    .zip(block_height_extrema.as_ref())
+                {
+                    let block_height = BlockHeight::from(block_height);
+                    if block_height + PRUNING_DEPTH >= *scanned_range.end() {
+                        trace!(
+                            height = u32::from(block_height),
+                            frontier = ?nonempty_frontier,
+                            "Inserting frontier nodes",
+                        );
+                        shard_tree
+                            .insert_frontier_nodes(
+                                nonempty_frontier.clone(),
+                                Retention::Checkpoint {
+                                    id: block_height,
+                                    marking: Marking::Reference,
+                                },
+                            )
+                            .map_err(|e| match e {
+                                ShardTreeError::Query(e) => ShardTreeError::Query(e),
+                                ShardTreeError::Insert(e) => ShardTreeError::Insert(e),
+                                ShardTreeError::Storage(_) => unreachable!(),
+                            })?
+                    }
+                }
+            }
+        }
+
+        // Insert all the tree information that we can get from existing incremental witnesses
+        debug!("Migrating witness data to shardtree");
+        {
+            let mut stmt_blocks =
+                transaction.prepare("SELECT note, block, witness FROM sapling_witnesses")?;
+            let mut stmt_set_note_position = transaction.prepare(
+                "UPDATE sapling_received_notes
+                SET commitment_tree_position = :position
+                WHERE id_note = :note_id",
+            )?;
+            let mut updated_note_positions = BTreeSet::new();
+            let mut rows = stmt_blocks.query([])?;
+            while let Some(row) = rows.next()? {
+                let note_id: i64 = row.get(0)?;
+                let block_height: u32 = row.get(1)?;
+                let row_data: Vec<u8> = row.get(2)?;
+                let witness = read_incremental_witness::<
+                    sapling::Node,
+                    _,
+                    { sapling::NOTE_COMMITMENT_TREE_DEPTH },
+                >(&row_data[..])
+                .map_err(|e| {
+                    rusqlite::Error::FromSqlConversionFailure(
+                        row_data.len(),
+                        rusqlite::types::Type::Blob,
+                        Box::new(e),
+                    )
+                })?;
+
+                let witnessed_position = witness.witnessed_position();
+                if !updated_note_positions.contains(&witnessed_position) {
+                    stmt_set_note_position.execute(named_params![
+                        ":note_id": note_id,
+                        ":position": u64::from(witnessed_position)
+                    ])?;
+                    updated_note_positions.insert(witnessed_position);
+                }
+
+                shard_tree
+                    .insert_witness_nodes(witness, BlockHeight::from(block_height))
+                    .map_err(|e| match e {
+                        ShardTreeError::Query(e) => ShardTreeError::Query(e),
+                        ShardTreeError::Insert(e) => ShardTreeError::Insert(e),
+                        ShardTreeError::Storage(_) => unreachable!(),
+                    })?;
+            }
+        }
+
+        shard_tree
+            .into_store()
+            .flush()
+            .map_err(ShardTreeError::Storage)?;
+
+        // Establish the scan queue & wallet history table.
+        // block_range_end is exclusive.
+        debug!("Creating table for scan queue");
+        transaction.execute_batch(
+            "CREATE TABLE scan_queue (
+                block_range_start INTEGER NOT NULL,
+                block_range_end INTEGER NOT NULL,
+                priority INTEGER NOT NULL,
+                CONSTRAINT range_start_uniq UNIQUE (block_range_start),
+                CONSTRAINT range_end_uniq UNIQUE (block_range_end),
+                CONSTRAINT range_bounds_order CHECK (
+                    block_range_start < block_range_end
+                )
+            );",
+        )?;
+
+        if let Some(scanned_range) = block_height_extrema {
+            // `ScanRange` uses an exclusive upper bound.
+            let start = *scanned_range.start();
+            let chain_end = *scanned_range.end() + 1;
+            let ignored_range =
+                self.params
+                    .activation_height(NetworkUpgrade::Sapling)
+                    .map(|sapling_activation| {
+                        let ignored_range_start = std::cmp::min(sapling_activation, start);
+                        ScanRange::from_parts(ignored_range_start..start, ScanPriority::Ignored)
+                    });
+            let scanned_range = ScanRange::from_parts(start..chain_end, ScanPriority::Scanned);
+            insert_queue_entries(
+                transaction,
+                ignored_range.iter().chain(Some(scanned_range).iter()),
+            )?;
+        }
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/spend_key_available.rs b/zcash_client_sqlite/src/wallet/init/migrations/spend_key_available.rs
new file mode 100644
index 0000000000..edb0f0b254
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/spend_key_available.rs
@@ -0,0 +1,56 @@
+//! The migration that records ephemeral addresses for each account.
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::full_account_ids;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x07610aac_b0e3_4ba8_aaa6_cda606f0fd7b);
+
+const DEPENDENCIES: &[Uuid] = &[full_account_ids::MIGRATION_ID];
+
+#[allow(dead_code)]
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Track which accounts have associated spending keys."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        transaction.execute_batch(
+            "ALTER TABLE accounts ADD COLUMN has_spend_key INTEGER NOT NULL DEFAULT 1",
+        )?;
+        Ok(())
+    }
+
+    fn down(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        transaction.execute_batch("ALTER TABLE accounts DROP COLUMN has_spend_key")?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/support_legacy_sqlite.rs b/zcash_client_sqlite/src/wallet/init/migrations/support_legacy_sqlite.rs
new file mode 100644
index 0000000000..8af005b51f
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/support_legacy_sqlite.rs
@@ -0,0 +1,88 @@
+//! Modifies definitions to avoid keywords that may not be available in older SQLite versions.
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::{migrations::tx_retrieval_queue, WalletMigrationError};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x156d8c8f_2173_4b59_89b6_75697d5a2103);
+
+const DEPENDENCIES: &[Uuid] = &[tx_retrieval_queue::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Modifies definitions to avoid keywords that may not be available in older SQLite versions."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        transaction.execute_batch(
+            r#"
+            DROP VIEW v_tx_outputs;
+            CREATE VIEW v_tx_outputs AS
+            -- select all outputs received by the wallet
+            SELECT transactions.txid            AS txid,
+                   ro.pool                      AS output_pool,
+                   ro.output_index              AS output_index,
+                   sent_notes.from_account_id   AS from_account_id,
+                   ro.account_id                AS to_account_id,
+                   NULL                         AS to_address,
+                   ro.value                     AS value,
+                   ro.is_change                 AS is_change,
+                   ro.memo                      AS memo
+            FROM v_received_outputs ro
+            JOIN transactions
+                ON transactions.id_tx = ro.transaction_id
+            -- join to the sent_notes table to obtain `from_account_id`
+            LEFT JOIN sent_notes ON sent_notes.id = ro.sent_note_id
+            UNION
+            -- select all outputs sent from the wallet to external recipients
+            SELECT transactions.txid            AS txid,
+                   sent_notes.output_pool       AS output_pool,
+                   sent_notes.output_index      AS output_index,
+                   sent_notes.from_account_id   AS from_account_id,
+                   NULL                         AS to_account_id,
+                   sent_notes.to_address        AS to_address,
+                   sent_notes.value             AS value,
+                   0                            AS is_change,
+                   sent_notes.memo              AS memo
+            FROM sent_notes
+            JOIN transactions
+                ON transactions.id_tx = sent_notes.tx
+            LEFT JOIN v_received_outputs ro ON ro.sent_note_id = sent_notes.id
+            -- exclude any sent notes for which a row exists in the v_received_outputs view
+            WHERE ro.account_id IS NULL
+        "#,
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/tx_retrieval_queue.rs b/zcash_client_sqlite/src/wallet/init/migrations/tx_retrieval_queue.rs
new file mode 100644
index 0000000000..d3ca7193a4
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/tx_retrieval_queue.rs
@@ -0,0 +1,310 @@
+//! Adds tables for tracking transactions to be downloaded for transparent output and/or memo retrieval.
+
+use rusqlite::{named_params, Transaction};
+use schemerz_rusqlite::RusqliteMigration;
+use std::collections::HashSet;
+use uuid::Uuid;
+use zcash_primitives::transaction::builder::DEFAULT_TX_EXPIRY_DELTA;
+use zcash_protocol::consensus;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::{
+    ensure_orchard_ua_receiver, ephemeral_addresses, nullifier_map, orchard_shardtree,
+    spend_key_available,
+};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xfec02b61_3988_4b4f_9699_98977fac9e7f);
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    crate::{
+        error::SqliteClientError,
+        wallet::{
+            queue_transparent_input_retrieval, queue_unmined_tx_retrieval,
+            transparent::{queue_transparent_spend_detection, uivk_legacy_transparent_address},
+        },
+        AccountRef, TxRef,
+    },
+    rusqlite::OptionalExtension as _,
+    std::convert::Infallible,
+    zcash_client_backend::data_api::DecryptedTransaction,
+    zcash_keys::encoding::AddressCodec,
+    zcash_protocol::consensus::{BlockHeight, BranchId},
+};
+
+const DEPENDENCIES: &[Uuid] = &[
+    orchard_shardtree::MIGRATION_ID,
+    ensure_orchard_ua_receiver::MIGRATION_ID,
+    ephemeral_addresses::MIGRATION_ID,
+    spend_key_available::MIGRATION_ID,
+    nullifier_map::MIGRATION_ID,
+];
+
+pub(super) struct Migration<P> {
+    pub(super) _params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Adds tables for tracking transactions to be downloaded for transparent output and/or memo retrieval."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, conn: &Transaction) -> Result<(), WalletMigrationError> {
+        conn.execute_batch(
+            "CREATE TABLE tx_retrieval_queue (
+                txid BLOB NOT NULL UNIQUE,
+                query_type INTEGER NOT NULL,
+                dependent_transaction_id INTEGER,
+                FOREIGN KEY (dependent_transaction_id) REFERENCES transactions(id_tx)
+            );
+
+            ALTER TABLE transactions ADD COLUMN target_height INTEGER;
+
+            CREATE TABLE transparent_spend_search_queue (
+                address TEXT NOT NULL,
+                transaction_id INTEGER NOT NULL,
+                output_index INTEGER NOT NULL,
+                FOREIGN KEY (transaction_id) REFERENCES transactions(id_tx),
+                CONSTRAINT value_received_height UNIQUE (transaction_id, output_index)
+            );
+
+            CREATE TABLE transparent_spend_map (
+                spending_transaction_id INTEGER NOT NULL,
+                prevout_txid BLOB NOT NULL,
+                prevout_output_index INTEGER NOT NULL,
+                FOREIGN KEY (spending_transaction_id) REFERENCES transactions(id_tx)
+                -- NOTE: We can't create a unique constraint on just (prevout_txid, prevout_output_index) 
+                -- because the same output may be attempted to be spent in multiple transactions, even 
+                -- though only one will ever be mined.
+                CONSTRAINT transparent_spend_map_unique UNIQUE (
+                    spending_transaction_id, prevout_txid, prevout_output_index
+                )
+            );",
+        )?;
+
+        // Add estimated target height information for each transaction we know to
+        // have been created by the wallet; transactions that were discovered via
+        // chain scanning will have their `created` field set to `NULL`.
+        conn.execute(
+            "UPDATE transactions
+             SET target_height = expiry_height - :default_expiry_delta
+             WHERE expiry_height > :default_expiry_delta
+             AND created IS NOT NULL",
+            named_params![":default_expiry_delta": DEFAULT_TX_EXPIRY_DELTA],
+        )?;
+
+        // Populate the enhancement queues with any transparent history information that we don't
+        // already have.
+        #[cfg(feature = "transparent-inputs")]
+        {
+            let mut stmt_transactions =
+                conn.prepare("SELECT id_tx, raw, mined_height FROM transactions")?;
+            let mut rows = stmt_transactions.query([])?;
+            while let Some(row) = rows.next()? {
+                let tx_ref = row.get(0).map(TxRef)?;
+                let tx_data = row.get::<_, Option<Vec<u8>>>(1)?;
+                let mined_height = row.get::<_, Option<u32>>(2)?.map(BlockHeight::from);
+
+                if let Some(tx_data) = tx_data {
+                    let tx = zcash_primitives::transaction::Transaction::read(
+                        &tx_data[..],
+                        // We assume unmined transactions are created with the current consensus branch ID.
+                        mined_height.map_or(BranchId::Sapling, |h| {
+                            BranchId::for_height(&self._params, h)
+                        }),
+                    )
+                    .map_err(|_| {
+                        WalletMigrationError::CorruptedData(
+                            "Could not read serialized transaction data.".to_owned(),
+                        )
+                    })?;
+
+                    for (txout, output_index) in tx
+                        .transparent_bundle()
+                        .iter()
+                        .flat_map(|b| b.vout.iter())
+                        .zip(0u32..)
+                    {
+                        if let Some(address) = txout.recipient_address() {
+                            let find_address_account = || {
+                                conn.query_row(
+                                    "SELECT account_id FROM addresses
+                                     WHERE cached_transparent_receiver_address = :address
+                                     UNION
+                                     SELECT account_id from ephemeral_addresses
+                                     WHERE address = :address",
+                                    named_params![":address": address.encode(&self._params)],
+                                    |row| row.get(0).map(AccountRef),
+                                )
+                                .optional()
+                            };
+                            let find_legacy_address_account =
+                                || -> Result<Option<AccountRef>, SqliteClientError> {
+                                    let mut stmt = conn.prepare("SELECT id, uivk FROM accounts")?;
+                                    let mut rows = stmt.query([])?;
+                                    while let Some(row) = rows.next()? {
+                                        let account_id = row.get(0).map(AccountRef)?;
+                                        let uivk_str = row.get::<_, String>(1)?;
+
+                                        if let Some((legacy_taddr, _)) =
+                                            uivk_legacy_transparent_address(
+                                                &self._params,
+                                                &uivk_str,
+                                            )?
+                                        {
+                                            if legacy_taddr == address {
+                                                return Ok(Some(account_id));
+                                            }
+                                        }
+                                    }
+
+                                    Ok(None)
+                                };
+
+                            if find_address_account()?.is_some()
+                                || find_legacy_address_account()?.is_some()
+                            {
+                                queue_transparent_spend_detection(
+                                    conn,
+                                    &self._params,
+                                    address,
+                                    tx_ref,
+                                    output_index,
+                                )?
+                            }
+                        }
+                    }
+
+                    let d_tx = DecryptedTransaction::<'_, Infallible>::new(
+                        mined_height,
+                        &tx,
+                        vec![],
+                        #[cfg(feature = "orchard")]
+                        vec![],
+                    );
+
+                    queue_transparent_input_retrieval(conn, tx_ref, &d_tx)?;
+                    queue_unmined_tx_retrieval(conn, &d_tx)?;
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    fn down(&self, conn: &Transaction) -> Result<(), WalletMigrationError> {
+        conn.execute_batch(
+            "DROP TABLE transparent_spend_map;
+             DROP TABLE transparent_spend_search_queue;
+             ALTER TABLE transactions DROP COLUMN target_height;
+             DROP TABLE tx_retrieval_queue;",
+        )?;
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use rusqlite::named_params;
+    use secrecy::Secret;
+    use tempfile::NamedTempFile;
+    use zcash_primitives::{
+        legacy::{Script, TransparentAddress},
+        transaction::{components::transparent, Authorized, TransactionData, TxVersion},
+    };
+    use zcash_protocol::{
+        consensus::{BranchId, Network},
+        value::Zatoshis,
+    };
+
+    use crate::{
+        wallet::init::{init_wallet_db_internal, migrations::tests::test_migrate},
+        WalletDb,
+    };
+
+    use super::{DEPENDENCIES, MIGRATION_ID};
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[MIGRATION_ID]);
+    }
+
+    #[test]
+    fn migrate_with_data() {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+
+        let seed_bytes = vec![0xab; 32];
+
+        // Migrate to database state just prior to this migration.
+        init_wallet_db_internal(
+            &mut db_data,
+            Some(Secret::new(seed_bytes.clone())),
+            DEPENDENCIES,
+            false,
+        )
+        .unwrap();
+
+        // Add transactions to the wallet that exercise the data migration.
+        let add_tx_to_wallet = |tx: TransactionData<Authorized>| {
+            let tx = tx.freeze().unwrap();
+            let txid = tx.txid();
+            let mut raw_tx = vec![];
+            tx.write(&mut raw_tx).unwrap();
+            db_data
+                .conn
+                .execute(
+                    r#"INSERT INTO transactions (txid, raw) VALUES (:txid, :raw);"#,
+                    named_params! {":txid": txid.as_ref(), ":raw": raw_tx},
+                )
+                .unwrap();
+        };
+        add_tx_to_wallet(TransactionData::from_parts(
+            TxVersion::Zip225,
+            BranchId::Nu5,
+            0,
+            12345678.into(),
+            Some(transparent::Bundle {
+                vin: vec![transparent::TxIn {
+                    prevout: transparent::OutPoint::fake(),
+                    script_sig: Script(vec![]),
+                    sequence: 0,
+                }],
+                vout: vec![transparent::TxOut {
+                    value: Zatoshis::const_from_u64(10_000),
+                    script_pubkey: TransparentAddress::PublicKeyHash([7; 20]).script(),
+                }],
+                authorization: transparent::Authorized,
+            }),
+            None,
+            None,
+            None,
+            None,
+            #[cfg(zcash_unstable = "tze")]
+            None,
+        ));
+
+        // Check that we can apply this migration.
+        init_wallet_db_internal(
+            &mut db_data,
+            Some(Secret::new(seed_bytes)),
+            &[MIGRATION_ID],
+            false,
+        )
+        .unwrap();
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/ufvk_support.rs b/zcash_client_sqlite/src/wallet/init/migrations/ufvk_support.rs
index def63a91d4..17054ee55e 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/ufvk_support.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/ufvk_support.rs
@@ -1,15 +1,13 @@
 //! Migration that adds support for unified full viewing keys.
-use std::collections::HashSet;
+use std::{collections::HashSet, rc::Rc};
 
-use rusqlite::{self, named_params, params};
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use rusqlite::{named_params, params};
+use schemerz_rusqlite::RusqliteMigration;
 use secrecy::{ExposeSecret, SecretVec};
 use uuid::Uuid;
 
-use zcash_client_backend::{
-    address::RecipientAddress, data_api::PoolType, keys::UnifiedSpendingKey,
-};
+use zcash_client_backend::{address::Address, keys::UnifiedSpendingKey, PoolType};
+use zcash_keys::keys::UnifiedAddressRequest;
 use zcash_primitives::{consensus, zip32::AccountId};
 
 #[cfg(feature = "transparent-inputs")]
@@ -18,30 +16,30 @@ use zcash_primitives::legacy::keys::IncomingViewingKey;
 #[cfg(feature = "transparent-inputs")]
 use zcash_client_backend::encoding::AddressCodec;
 
-use crate::wallet::{
-    init::{migrations::initial_setup, WalletMigrationError},
-    pool_code,
+use crate::{
+    wallet::{
+        init::{migrations::initial_setup, WalletMigrationError},
+        pool_code,
+    },
+    UA_TRANSPARENT,
 };
 
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0xbe57ef3b,
-    0x388e,
-    0x42ea,
-    b"\x97\xe2\x67\x8d\xaf\xcf\x97\x54",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xbe57ef3b_388e_42ea_97e2_678dafcf9754);
+
+const DEPENDENCIES: &[Uuid] = &[initial_setup::MIGRATION_ID];
 
 pub(super) struct Migration<P> {
     pub(super) params: P,
-    pub(super) seed: Option<SecretVec<u8>>,
+    pub(super) seed: Option<Rc<SecretVec<u8>>>,
 }
 
-impl<P> schemer::Migration for Migration<P> {
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [initial_setup::MIGRATION_ID].into_iter().collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -69,6 +67,22 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
         let mut stmt_fetch_accounts =
             transaction.prepare("SELECT account, address FROM accounts")?;
 
+        // We track whether we have determined seed relevance or not, in order to
+        // correctly report errors when checking the seed against an account:
+        //
+        // - If we encounter an error with the first account, we can assert that the seed
+        //   is not relevant to the wallet by assuming that:
+        //   - All accounts are from the same seed (which is historically the only use
+        //     case that this migration supported), and
+        //   - All accounts in the wallet must have been able to derive their USKs (in
+        //     order to derive UIVKs).
+        //
+        // - Once the seed has been determined to be relevant (because it matched the
+        //   first account), any subsequent account derivation failure is proving wrong
+        //   our second assumption above, and we report this as corrupted data.
+        let mut seed_is_relevant = false;
+
+        let ua_request = UnifiedAddressRequest::unsafe_new(false, true, UA_TRANSPARENT);
         let mut rows = stmt_fetch_accounts.query([])?;
         while let Some(row) = rows.next()? {
             // We only need to check for the presence of the seed if we have keys that
@@ -76,52 +90,71 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
             // migration is being used to initialize an empty database.
             if let Some(seed) = &self.seed {
                 let account: u32 = row.get(0)?;
-                let account = AccountId::from(account);
+                let account = AccountId::try_from(account).map_err(|_| {
+                    WalletMigrationError::CorruptedData("Account ID is invalid".to_owned())
+                })?;
                 let usk =
                     UnifiedSpendingKey::from_seed(&self.params, seed.expose_secret(), account)
-                        .unwrap();
+                        .map_err(|_| {
+                            if seed_is_relevant {
+                                WalletMigrationError::CorruptedData(
+                                    "Unable to derive spending key from seed.".to_string(),
+                                )
+                            } else {
+                                WalletMigrationError::SeedNotRelevant
+                            }
+                        })?;
                 let ufvk = usk.to_unified_full_viewing_key();
 
                 let address: String = row.get(1)?;
-                let decoded =
-                    RecipientAddress::decode(&self.params, &address).ok_or_else(|| {
-                        WalletMigrationError::CorruptedData(format!(
-                            "Could not decode {} as a valid Zcash address.",
-                            address
-                        ))
-                    })?;
+                let decoded = Address::decode(&self.params, &address).ok_or_else(|| {
+                    WalletMigrationError::CorruptedData(format!(
+                        "Could not decode {} as a valid Zcash address.",
+                        address
+                    ))
+                })?;
                 match decoded {
-                    RecipientAddress::Shielded(decoded_address) => {
-                        let dfvk = ufvk.sapling().expect(
-                            "Derivation should have produced a UFVK containing a Sapling component.",
-                        );
+                    Address::Sapling(decoded_address) => {
+                        let dfvk = ufvk.sapling().ok_or_else(||
+                            WalletMigrationError::CorruptedData("Derivation should have produced a UFVK containing a Sapling component.".to_owned()))?;
                         let (idx, expected_address) = dfvk.default_address();
                         if decoded_address != expected_address {
-                            return Err(WalletMigrationError::CorruptedData(
+                            return Err(if seed_is_relevant {
+                                WalletMigrationError::CorruptedData(
                                 format!("Decoded Sapling address {} does not match the ufvk's Sapling address {} at {:?}.",
                                     address,
-                                    RecipientAddress::Shielded(expected_address).encode(&self.params),
-                                    idx)));
+                                    Address::Sapling(expected_address).encode(&self.params),
+                                    idx))
+                            } else {
+                                WalletMigrationError::SeedNotRelevant
+                            });
                         }
                     }
-                    RecipientAddress::Transparent(_) => {
+                    Address::Transparent(_) | Address::Tex(_) => {
                         return Err(WalletMigrationError::CorruptedData(
                             "Address field value decoded to a transparent address; should have been Sapling or unified.".to_string()));
                     }
-                    RecipientAddress::Unified(decoded_address) => {
-                        let (expected_address, idx) = ufvk.default_address();
+                    Address::Unified(decoded_address) => {
+                        let (expected_address, idx) = ufvk.default_address(ua_request)?;
                         if decoded_address != expected_address {
-                            return Err(WalletMigrationError::CorruptedData(
+                            return Err(if seed_is_relevant {
+                                WalletMigrationError::CorruptedData(
                                 format!("Decoded unified address {} does not match the ufvk's default address {} at {:?}.",
                                     address,
-                                    RecipientAddress::Unified(expected_address).encode(&self.params),
-                                    idx)));
+                                    Address::Unified(expected_address).encode(&self.params),
+                                    idx))
+                            } else {
+                                WalletMigrationError::SeedNotRelevant
+                            });
                         }
                     }
                 }
 
+                // We made it past one derived account, so the seed must be relevant.
+                seed_is_relevant = true;
+
                 let ufvk_str: String = ufvk.encode(&self.params);
-                let address_str: String = ufvk.default_address().0.encode(&self.params);
+                let address_str: String = ufvk.default_address(ua_request)?.0.encode(&self.params);
 
                 // This migration, and the wallet behaviour before it, stored the default
                 // transparent address in the `accounts` table. This does not necessarily
@@ -221,17 +254,18 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
                 let value: i64 = row.get(5)?;
                 let memo: Option<Vec<u8>> = row.get(6)?;
 
-                let decoded_address =
-                    RecipientAddress::decode(&self.params, &address).ok_or_else(|| {
-                        WalletMigrationError::CorruptedData(format!(
-                            "Could not decode {} as a valid Zcash address.",
-                            address
-                        ))
-                    })?;
+                let decoded_address = Address::decode(&self.params, &address).ok_or_else(|| {
+                    WalletMigrationError::CorruptedData(format!(
+                        "Could not decode {} as a valid Zcash address.",
+                        address
+                    ))
+                })?;
                 let output_pool = match decoded_address {
-                    RecipientAddress::Shielded(_) => Ok(pool_code(PoolType::Sapling)),
-                    RecipientAddress::Transparent(_) => Ok(pool_code(PoolType::Transparent)),
-                    RecipientAddress::Unified(_) => Err(WalletMigrationError::CorruptedData(
+                    Address::Sapling(_) => Ok(pool_code(PoolType::SAPLING)),
+                    Address::Transparent(_) | Address::Tex(_) => {
+                        Ok(pool_code(PoolType::TRANSPARENT))
+                    }
+                    Address::Unified(_) => Err(WalletMigrationError::CorruptedData(
                         "Unified addresses should not yet appear in the sent_notes table."
                             .to_string(),
                     )),
@@ -259,7 +293,16 @@ impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
     }
 
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/utxos_table.rs b/zcash_client_sqlite/src/wallet/init/migrations/utxos_table.rs
index 7180394292..e206a26dd4 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/utxos_table.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/utxos_table.rs
@@ -1,29 +1,24 @@
 //! The migration that adds initial support for transparent UTXOs to the wallet.
 use std::collections::HashSet;
 
-use rusqlite;
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
 
 use crate::wallet::init::{migrations::initial_setup, WalletMigrationError};
 
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0xa2e0ed2e,
-    0x8852,
-    0x475e,
-    b"\xb0\xa4\xf1\x54\xb1\x5b\x9d\xbe",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xa2e0ed2e_8852_475e_b0a4_f154b15b9dbe);
+
+const DEPENDENCIES: &[Uuid] = &[initial_setup::MIGRATION_ID];
 
 pub(super) struct Migration;
 
-impl schemer::Migration for Migration {
+impl schemerz::Migration<Uuid> for Migration {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [initial_setup::MIGRATION_ID].into_iter().collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -57,3 +52,13 @@ impl RusqliteMigration for Migration {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/utxos_to_txos.rs b/zcash_client_sqlite/src/wallet/init/migrations/utxos_to_txos.rs
new file mode 100644
index 0000000000..95ed661a9f
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/utxos_to_txos.rs
@@ -0,0 +1,367 @@
+//! A migration that brings transparent UTXO handling into line with that for shielded
+//! outputs, and adds `spent_note_count` and `is_shielding` to `v_transactions`.
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::{migrations::orchard_received_notes, WalletMigrationError};
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x3a2562b3_f174_46a1_aa8c_1d122ca2e884);
+
+const DEPENDENCIES: &[Uuid] = &[orchard_received_notes::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Updates transparent UTXO handling to be similar to that for shielded notes, and adds spent_note_count and is_shielding to v_transactions."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        transaction.execute_batch(r#"
+            PRAGMA legacy_alter_table = ON;
+
+            CREATE TABLE transactions_new (
+                id_tx INTEGER PRIMARY KEY,
+                txid BLOB NOT NULL UNIQUE,
+                created TEXT,
+                block INTEGER,
+                mined_height INTEGER,
+                tx_index INTEGER,
+                expiry_height INTEGER,
+                raw BLOB,
+                fee INTEGER,
+                FOREIGN KEY (block) REFERENCES blocks(height),
+                CONSTRAINT height_consistency CHECK (block IS NULL OR mined_height = block)
+            );
+
+            INSERT INTO transactions_new
+            SELECT id_tx, txid, created, block, block, tx_index, expiry_height, raw, fee
+            FROM transactions;
+
+            -- We may initially set the block height to null, which will mean that the
+            -- transaction may appear to be un-mined until we actually scan the block
+            -- containing the transaction.
+            INSERT INTO transactions_new (txid, block, mined_height)
+            SELECT
+                utxos.prevout_txid,
+                blocks.height,
+                blocks.height
+            FROM utxos
+            LEFT OUTER JOIN blocks ON blocks.height = utxos.height
+            WHERE utxos.prevout_txid NOT IN (
+                SELECT txid FROM transactions
+            );
+
+            DROP TABLE transactions;
+            ALTER TABLE transactions_new RENAME TO transactions;
+
+            CREATE TABLE transparent_received_outputs (
+                id INTEGER PRIMARY KEY,
+                transaction_id INTEGER NOT NULL,
+                output_index INTEGER NOT NULL,
+                account_id INTEGER NOT NULL,
+                address TEXT NOT NULL,
+                script BLOB NOT NULL,
+                value_zat INTEGER NOT NULL,
+                max_observed_unspent_height INTEGER,
+                FOREIGN KEY (transaction_id) REFERENCES transactions(id_tx),
+                FOREIGN KEY (account_id) REFERENCES accounts(id),
+                CONSTRAINT transparent_output_unique UNIQUE (transaction_id, output_index)
+            );
+            CREATE INDEX idx_transparent_received_outputs_account_id
+            ON "transparent_received_outputs" (account_id);
+
+            INSERT INTO transparent_received_outputs SELECT
+                u.id,
+                t.id_tx,
+                prevout_idx,
+                received_by_account_id,
+                address,
+                script,
+                value_zat,
+                NULL
+            FROM utxos u
+            -- This being a `LEFT OUTER JOIN` provides defense in depth against dropping
+            -- TXOs that reference missing `transactions` entries (which should never exist
+            -- given the migrations above).
+            LEFT OUTER JOIN transactions t ON t.txid = u.prevout_txid;
+
+            CREATE TABLE transparent_received_output_spends_new (
+                transparent_received_output_id INTEGER NOT NULL,
+                transaction_id INTEGER NOT NULL,
+                FOREIGN KEY (transparent_received_output_id)
+                    REFERENCES transparent_received_outputs(id)
+                    ON DELETE CASCADE,
+                FOREIGN KEY (transaction_id)
+                    -- We do not delete transactions, so this does not cascade
+                    REFERENCES transactions(id_tx),
+                UNIQUE (transparent_received_output_id, transaction_id)
+            );
+
+            INSERT INTO transparent_received_output_spends_new
+            SELECT * FROM transparent_received_output_spends;
+
+            DROP VIEW v_tx_outputs;
+            DROP VIEW v_transactions;
+            DROP VIEW v_received_notes;
+            DROP VIEW v_received_note_spends;
+            DROP TABLE transparent_received_output_spends;
+            ALTER TABLE transparent_received_output_spends_new
+            RENAME TO transparent_received_output_spends;
+
+            CREATE VIEW v_received_outputs AS
+                SELECT
+                    sapling_received_notes.id AS id_within_pool_table,
+                    sapling_received_notes.tx AS transaction_id,
+                    2 AS pool,
+                    sapling_received_notes.output_index,
+                    account_id,
+                    sapling_received_notes.value,
+                    is_change,
+                    sapling_received_notes.memo,
+                    sent_notes.id AS sent_note_id
+                FROM sapling_received_notes
+                LEFT JOIN sent_notes
+                ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                   (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+            UNION
+                SELECT
+                    orchard_received_notes.id AS id_within_pool_table,
+                    orchard_received_notes.tx AS transaction_id,
+                    3 AS pool,
+                    orchard_received_notes.action_index AS output_index,
+                    account_id,
+                    orchard_received_notes.value,
+                    is_change,
+                    orchard_received_notes.memo,
+                    sent_notes.id AS sent_note_id
+                FROM orchard_received_notes
+                LEFT JOIN sent_notes
+                ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                   (orchard_received_notes.tx, 3, orchard_received_notes.action_index)
+            UNION
+                SELECT
+                    u.id AS id_within_pool_table,
+                    u.transaction_id,
+                    0 AS pool,
+                    u.output_index,
+                    u.account_id,
+                    u.value_zat AS value,
+                    0 AS is_change,
+                    NULL AS memo,
+                    sent_notes.id AS sent_note_id
+                FROM transparent_received_outputs u
+                LEFT JOIN sent_notes
+                ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                   (u.transaction_id, 0, u.output_index);
+
+            CREATE VIEW v_received_output_spends AS
+            SELECT
+                2 AS pool,
+                sapling_received_note_id AS received_output_id,
+                transaction_id
+            FROM sapling_received_note_spends
+            UNION
+            SELECT
+                3 AS pool,
+                orchard_received_note_id AS received_output_id,
+                transaction_id
+            FROM orchard_received_note_spends
+            UNION
+            SELECT
+                0 AS pool,
+                transparent_received_output_id AS received_output_id,
+                transaction_id
+            FROM transparent_received_output_spends;
+
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                -- Outputs received in this transaction
+                SELECT ro.account_id              AS account_id,
+                       transactions.mined_height  AS mined_height,
+                       transactions.txid          AS txid,
+                       ro.pool                    AS pool,
+                       id_within_pool_table,
+                       ro.value                   AS value,
+                       0                          AS spent_note_count,
+                       CASE
+                            WHEN ro.is_change THEN 1
+                            ELSE 0
+                       END AS change_note_count,
+                       CASE
+                            WHEN ro.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (ro.memo IS NULL OR ro.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present,
+                       -- The wallet cannot receive transparent outputs in shielding transactions.
+                       CASE
+                         WHEN ro.pool = 0
+                           THEN 1
+                         ELSE 0
+                       END AS does_not_match_shielding
+                FROM v_received_outputs ro
+                JOIN transactions
+                     ON transactions.id_tx = ro.transaction_id
+                UNION
+                -- Outputs spent in this transaction
+                SELECT ro.account_id              AS account_id,
+                       transactions.mined_height  AS mined_height,
+                       transactions.txid          AS txid,
+                       ro.pool                    AS pool,
+                       id_within_pool_table,
+                       -ro.value                  AS value,
+                       1                          AS spent_note_count,
+                       0                          AS change_note_count,
+                       0                          AS received_count,
+                       0                          AS memo_present,
+                       -- The wallet cannot spend shielded outputs in shielding transactions.
+                       CASE
+                         WHEN ro.pool != 0
+                           THEN 1
+                         ELSE 0
+                       END AS does_not_match_shielding
+                FROM v_received_outputs ro
+                JOIN v_received_output_spends ros
+                     ON ros.pool = ro.pool
+                     AND ros.received_output_id = ro.id_within_pool_table
+                JOIN transactions
+                     ON transactions.id_tx = ros.transaction_id
+            ),
+            -- Obtain a count of the notes that the wallet created in each transaction,
+            -- not counting change notes.
+            sent_note_counts AS (
+                SELECT sent_notes.from_account_id     AS account_id,
+                       transactions.txid              AS txid,
+                       COUNT(DISTINCT sent_notes.id)  AS sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR ro.transaction_id IS NOT NULL)
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                JOIN transactions
+                     ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN v_received_outputs ro
+                     ON sent_notes.id = ro.sent_note_id
+                WHERE COALESCE(ro.is_change, 0) = 0
+                GROUP BY account_id, txid
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) AS max_height FROM blocks
+            )
+            SELECT notes.account_id             AS account_id,
+                   notes.mined_height           AS mined_height,
+                   notes.txid                   AS txid,
+                   transactions.tx_index        AS tx_index,
+                   transactions.expiry_height   AS expiry_height,
+                   transactions.raw             AS raw,
+                   SUM(notes.value)             AS account_balance_delta,
+                   transactions.fee             AS fee_paid,
+                   SUM(notes.change_note_count) > 0  AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                   ) AS expired_unmined,
+                   SUM(notes.spent_note_count) AS spent_note_count,
+                   (
+                        -- All of the wallet-spent and wallet-received notes are consistent with a
+                        -- shielding transaction.
+                        SUM(notes.does_not_match_shielding) = 0
+                        -- The transaction contains at least one wallet-spent output.
+                        AND SUM(notes.spent_note_count) > 0
+                        -- The transaction contains at least one wallet-received note.
+                        AND (SUM(notes.received_count) + SUM(notes.change_note_count)) > 0
+                        -- We do not know about any external outputs of the transaction.
+                        AND MAX(COALESCE(sent_note_counts.sent_notes, 0)) = 0
+                   ) AS is_shielding
+            FROM notes
+            LEFT JOIN transactions
+                 ON notes.txid = transactions.txid
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = notes.mined_height
+            LEFT JOIN sent_note_counts
+                 ON sent_note_counts.account_id = notes.account_id
+                 AND sent_note_counts.txid = notes.txid
+            GROUP BY notes.account_id, notes.txid;
+
+            CREATE VIEW v_tx_outputs AS
+            -- select all outputs received by the wallet
+            SELECT transactions.txid            AS txid,
+                   ro.pool                      AS output_pool,
+                   ro.output_index              AS output_index,
+                   sent_notes.from_account_id   AS from_account_id,
+                   ro.account_id                AS to_account_id,
+                   NULL                         AS to_address,
+                   ro.value                     AS value,
+                   ro.is_change                 AS is_change,
+                   ro.memo                      AS memo
+            FROM v_received_outputs ro
+            JOIN transactions
+                ON transactions.id_tx = ro.transaction_id
+            -- join to the sent_notes table to obtain `from_account_id`
+            LEFT JOIN sent_notes ON sent_notes.id = ro.sent_note_id
+            UNION
+            -- select all outputs sent from the wallet to external recipients
+            SELECT transactions.txid            AS txid,
+                   sent_notes.output_pool       AS output_pool,
+                   sent_notes.output_index      AS output_index,
+                   sent_notes.from_account_id   AS from_account_id,
+                   NULL                         AS to_account_id,
+                   sent_notes.to_address        AS to_address,
+                   sent_notes.value             AS value,
+                   FALSE                        AS is_change,
+                   sent_notes.memo              AS memo
+            FROM sent_notes
+            JOIN transactions
+                ON transactions.id_tx = sent_notes.tx
+            LEFT JOIN v_received_outputs ro ON ro.sent_note_id = sent_notes.id
+            -- exclude any sent notes for which a row exists in the v_received_outputs view
+            WHERE ro.account_id IS NULL;
+
+            DROP TABLE utxos;
+
+            PRAGMA legacy_alter_table = OFF;
+        "#)?;
+
+        Ok(())
+    }
+
+    fn down(&self, _: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/v_sapling_shard_unscanned_ranges.rs b/zcash_client_sqlite/src/wallet/init/migrations/v_sapling_shard_unscanned_ranges.rs
new file mode 100644
index 0000000000..9e64f65d1c
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/v_sapling_shard_unscanned_ranges.rs
@@ -0,0 +1,110 @@
+//! This migration adds a view that returns the un-scanned ranges associated with each sapling note
+//! commitment tree shard.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+use zcash_client_backend::data_api::{scanning::ScanPriority, SAPLING_SHARD_HEIGHT};
+use zcash_primitives::consensus::{self, NetworkUpgrade};
+
+use crate::wallet::{init::WalletMigrationError, scanning::priority_code};
+
+use super::add_account_birthdays;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xfa934bdc_97b6_4980_8a83_b2cb1ac465fd);
+
+const DEPENDENCIES: &[Uuid] = &[add_account_birthdays::MIGRATION_ID];
+
+pub(super) struct Migration<P> {
+    pub(super) params: P,
+}
+
+impl<P> schemerz::Migration<Uuid> for Migration<P> {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Adds a view that returns the un-scanned ranges associated with each sapling note commitment tree shard."
+    }
+}
+
+impl<P: consensus::Parameters> RusqliteMigration for Migration<P> {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(&format!(
+            "CREATE VIEW v_sapling_shard_scan_ranges AS
+                SELECT
+                    shard.shard_index,
+                    shard.shard_index << {} AS start_position,
+                    (shard.shard_index + 1) << {} AS end_position_exclusive,
+                    IFNULL(prev_shard.subtree_end_height, {}) AS subtree_start_height,
+                    shard.subtree_end_height,
+                    shard.contains_marked,
+                    scan_queue.block_range_start,
+                    scan_queue.block_range_end,
+                    scan_queue.priority
+                FROM sapling_tree_shards shard
+                LEFT OUTER JOIN sapling_tree_shards prev_shard
+                    ON shard.shard_index = prev_shard.shard_index + 1
+                -- Join with scan ranges that overlap with the subtree's involved blocks.
+                INNER JOIN scan_queue ON (
+                    subtree_start_height < scan_queue.block_range_end AND
+                    (
+                        scan_queue.block_range_start <= shard.subtree_end_height OR
+                        shard.subtree_end_height IS NULL
+                    )
+                )",
+            SAPLING_SHARD_HEIGHT,
+            SAPLING_SHARD_HEIGHT,
+            u32::from(
+                self.params
+                    .activation_height(NetworkUpgrade::Sapling)
+                    .unwrap()
+            ),
+        ))?;
+
+        transaction.execute_batch(&format!(
+            "CREATE VIEW v_sapling_shard_unscanned_ranges AS
+                WITH wallet_birthday AS (SELECT MIN(birthday_height) AS height FROM accounts)
+                SELECT
+                    shard_index,
+                    start_position,
+                    end_position_exclusive,
+                    subtree_start_height,
+                    subtree_end_height,
+                    contains_marked,
+                    block_range_start,
+                    block_range_end,
+                    priority
+                FROM v_sapling_shard_scan_ranges
+                INNER JOIN wallet_birthday
+                WHERE priority > {}
+                AND block_range_end > wallet_birthday.height;",
+            priority_code(&ScanPriority::Scanned),
+        ))?;
+
+        Ok(())
+    }
+
+    fn down(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch("DROP VIEW v_sapling_shard_unscanned_ranges;")?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_net.rs b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_net.rs
index 10c3a26a9b..c364523487 100644
--- a/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_net.rs
+++ b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_net.rs
@@ -2,30 +2,27 @@
 //! as received value.
 use std::collections::HashSet;
 
-use rusqlite::{self, named_params};
-use schemer;
-use schemer_rusqlite::RusqliteMigration;
+use rusqlite::named_params;
+use schemerz_rusqlite::RusqliteMigration;
 use uuid::Uuid;
+use zcash_client_backend::PoolType;
 
 use super::add_transaction_views;
-use crate::wallet::{init::WalletMigrationError, pool_code, PoolType};
+use crate::wallet::{init::WalletMigrationError, pool_code};
 
-pub(super) const MIGRATION_ID: Uuid = Uuid::from_fields(
-    0x2aa4d24f,
-    0x51aa,
-    0x4a4c,
-    b"\x8d\x9b\xe5\xb8\xa7\x62\x86\x5f",
-);
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0x2aa4d24f_51aa_4a4c_8d9b_e5b8a762865f);
+
+const DEPENDENCIES: &[Uuid] = &[add_transaction_views::MIGRATION_ID];
 
 pub(crate) struct Migration;
 
-impl schemer::Migration for Migration {
+impl schemerz::Migration<Uuid> for Migration {
     fn id(&self) -> Uuid {
         MIGRATION_ID
     }
 
     fn dependencies(&self) -> HashSet<Uuid> {
-        [add_transaction_views::MIGRATION_ID].into_iter().collect()
+        DEPENDENCIES.iter().copied().collect()
     }
 
     fn description(&self) -> &'static str {
@@ -48,7 +45,7 @@ impl RusqliteMigration for Migration {
              SELECT tx, :output_pool, output_index, from_account, from_account, value
              FROM sent_notes",
              named_params![
-                ":output_pool": &pool_code(PoolType::Sapling)
+                ":output_pool": &pool_code(PoolType::SAPLING)
              ]
         )?;
 
@@ -200,8 +197,7 @@ impl RusqliteMigration for Migration {
     }
 
     fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), WalletMigrationError> {
-        // TODO: something better than just panic?
-        panic!("Cannot revert this migration.");
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
     }
 }
 
@@ -211,10 +207,9 @@ mod tests {
     use tempfile::NamedTempFile;
 
     use zcash_client_backend::keys::UnifiedSpendingKey;
-    use zcash_primitives::zip32::AccountId;
+    use zcash_primitives::{consensus::Network, zip32::AccountId};
 
     use crate::{
-        tests,
         wallet::init::{init_wallet_db_internal, migrations::add_transaction_views},
         WalletDb,
     };
@@ -222,38 +217,45 @@ mod tests {
     #[test]
     fn v_transactions_net() {
         let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db_internal(&mut db_data, None, &[add_transaction_views::MIGRATION_ID])
-            .unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+        init_wallet_db_internal(
+            &mut db_data,
+            None,
+            &[add_transaction_views::MIGRATION_ID],
+            false,
+        )
+        .unwrap();
 
         // Create two accounts in the wallet.
-        let usk0 =
-            UnifiedSpendingKey::from_seed(&tests::network(), &[0u8; 32][..], AccountId::from(0))
-                .unwrap();
+        let usk0 = UnifiedSpendingKey::from_seed(&db_data.params, &[0u8; 32][..], AccountId::ZERO)
+            .unwrap();
         let ufvk0 = usk0.to_unified_full_viewing_key();
         db_data
             .conn
             .execute(
                 "INSERT INTO accounts (account, ufvk) VALUES (0, ?)",
-                params![ufvk0.encode(&tests::network())],
+                params![ufvk0.encode(&db_data.params)],
             )
             .unwrap();
 
-        let usk1 =
-            UnifiedSpendingKey::from_seed(&tests::network(), &[1u8; 32][..], AccountId::from(1))
-                .unwrap();
+        let usk1 = UnifiedSpendingKey::from_seed(
+            &db_data.params,
+            &[1u8; 32][..],
+            AccountId::try_from(1).unwrap(),
+        )
+        .unwrap();
         let ufvk1 = usk1.to_unified_full_viewing_key();
         db_data
             .conn
             .execute(
                 "INSERT INTO accounts (account, ufvk) VALUES (1, ?)",
-                params![ufvk1.encode(&tests::network())],
+                params![ufvk1.encode(&db_data.params)],
             )
             .unwrap();
 
         // - Tx 0 contains two received notes of 2 and 5 zatoshis that are controlled by account 0.
         db_data.conn.execute_batch(
-            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, '');
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'00');
             INSERT INTO transactions (block, id_tx, txid) VALUES (0, 0, 'tx0');
 
             INSERT INTO received_notes (tx, output_index, account, diversifier, value, rcm, nf, is_change)
@@ -265,7 +267,7 @@ mod tests {
         //   of 2 zatoshis. This is representative of a historic transaction where no `sent_notes`
         //   entry was created for the change value.
         db_data.conn.execute_batch(
-            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (1, 1, 1, '');
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (1, 1, 1, x'00');
             INSERT INTO transactions (block, id_tx, txid) VALUES (1, 1, 'tx1');
             UPDATE received_notes SET spent = 1 WHERE tx = 0;
             INSERT INTO sent_notes (tx, output_pool, output_index, from_account, to_account, to_address, value)
@@ -279,7 +281,7 @@ mod tests {
         //   other half to the sending account as change. Also there's a random transparent utxo,
         //   received, who knows where it came from but it's for account 0.
         db_data.conn.execute_batch(
-            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (2, 2, 2, '');
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (2, 2, 2, x'00');
             INSERT INTO transactions (block, id_tx, txid) VALUES (2, 2, 'tx2');
             UPDATE received_notes SET spent = 2 WHERE tx = 1;
             INSERT INTO utxos (received_by_account, address, prevout_txid, prevout_idx, script, value_zat, height)
@@ -297,7 +299,7 @@ mod tests {
         // - Tx 3 just receives transparent funds and does nothing else. For this to work, the
         //   transaction must be retrieved by the wallet.
         db_data.conn.execute_batch(
-            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (3, 3, 3, '');
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (3, 3, 3, x'00');
             INSERT INTO transactions (block, id_tx, txid) VALUES (3, 3, 'tx3');
 
             INSERT INTO utxos (received_by_account, address, prevout_txid, prevout_idx, script, value_zat, height)
@@ -387,7 +389,7 @@ mod tests {
         }
 
         // Run this migration
-        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID]).unwrap();
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
 
         // Corrected behavior after v_transactions has been updated
         {
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_note_uniqueness.rs b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_note_uniqueness.rs
new file mode 100644
index 0000000000..6149ecf025
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_note_uniqueness.rs
@@ -0,0 +1,255 @@
+//! This migration fixes a bug in `v_transactions` where distinct but otherwise identical notes
+//! were being incorrectly deduplicated.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::v_transactions_shielding_balance;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xdba47c86_13b5_4601_94b2_0cde0abe1e45);
+
+const DEPENDENCIES: &[Uuid] = &[v_transactions_shielding_balance::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Fixes a bug in v_transactions that was omitting value from identically-valued notes."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(
+            "DROP VIEW v_transactions;
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                SELECT sapling_received_notes.id_note        AS id,
+                       sapling_received_notes.account        AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       sapling_received_notes.value          AS value,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 1
+                            ELSE 0
+                       END AS is_change,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (sapling_received_notes.memo IS NULL OR sapling_received_notes.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.tx
+                UNION
+                SELECT utxos.id_utxo                 AS id,
+                       utxos.received_by_account     AS account_id,
+                       utxos.height                  AS block,
+                       utxos.prevout_txid            AS txid,
+                       0                             AS pool,
+                       utxos.value_zat               AS value,
+                       0                             AS is_change,
+                       1                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                UNION
+                SELECT sapling_received_notes.id_note        AS id,
+                       sapling_received_notes.account        AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       -sapling_received_notes.value         AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.spent
+                UNION
+                SELECT utxos.id_utxo                 AS id,
+                       utxos.received_by_account     AS account_id,
+                       transactions.block            AS block,
+                       transactions.txid             AS txid,
+                       0                             AS pool,
+                       -utxos.value_zat              AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                JOIN transactions
+                     ON transactions.id_tx = utxos.spent_in_tx
+            ),
+            sent_note_counts AS (
+                SELECT sent_notes.from_account AS account_id,
+                       transactions.txid       AS txid,
+                       COUNT(DISTINCT sent_notes.id_note) as sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR sapling_received_notes.tx IS NOT NULL)
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                JOIN transactions
+                     ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN sapling_received_notes
+                          ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                             (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+                WHERE COALESCE(sapling_received_notes.is_change, 0) = 0
+                GROUP BY account_id, txid
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) as max_height FROM blocks
+            )
+            SELECT notes.account_id                  AS account_id,
+                   notes.block                       AS mined_height,
+                   notes.txid                        AS txid,
+                   transactions.tx_index             AS tx_index,
+                   transactions.expiry_height        AS expiry_height,
+                   transactions.raw                  AS raw,
+                   SUM(notes.value)                  AS account_balance_delta,
+                   transactions.fee                  AS fee_paid,
+                   SUM(notes.is_change) > 0          AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                   ) AS expired_unmined
+            FROM notes
+            LEFT JOIN transactions
+                 ON notes.txid = transactions.txid
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = notes.block
+            LEFT JOIN sent_note_counts
+                      ON sent_note_counts.account_id = notes.account_id
+                      AND sent_note_counts.txid = notes.txid
+            GROUP BY notes.account_id, notes.txid;"
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use rusqlite::{self, params};
+    use tempfile::NamedTempFile;
+
+    use zcash_client_backend::keys::UnifiedSpendingKey;
+    use zcash_primitives::{consensus::Network, zip32::AccountId};
+
+    use crate::{
+        wallet::init::{init_wallet_db_internal, migrations::v_transactions_net},
+        WalletDb,
+    };
+
+    #[test]
+    fn v_transactions_note_uniqueness_migration() {
+        let data_file = NamedTempFile::new().unwrap();
+        let mut db_data = WalletDb::for_path(data_file.path(), Network::TestNetwork).unwrap();
+        init_wallet_db_internal(
+            &mut db_data,
+            None,
+            &[v_transactions_net::MIGRATION_ID],
+            false,
+        )
+        .unwrap();
+
+        // Create an account in the wallet
+        let usk0 = UnifiedSpendingKey::from_seed(&db_data.params, &[0u8; 32][..], AccountId::ZERO)
+            .unwrap();
+        let ufvk0 = usk0.to_unified_full_viewing_key();
+        db_data
+            .conn
+            .execute(
+                "INSERT INTO accounts (account, ufvk) VALUES (0, ?)",
+                params![ufvk0.encode(&db_data.params)],
+            )
+            .unwrap();
+
+        // Tx 0 contains two received notes, both of 2 zatoshis, that are controlled by account 0.
+        db_data.conn.execute_batch(
+            "INSERT INTO blocks (height, hash, time, sapling_tree) VALUES (0, 0, 0, x'00');
+            INSERT INTO transactions (block, id_tx, txid) VALUES (0, 0, 'tx0');
+
+            INSERT INTO received_notes (tx, output_index, account, diversifier, value, rcm, nf, is_change)
+            VALUES (0, 0, 0, '', 2, '', 'nf_a', false);
+            INSERT INTO received_notes (tx, output_index, account, diversifier, value, rcm, nf, is_change)
+            VALUES (0, 3, 0, '', 2, '', 'nf_b', false);").unwrap();
+
+        let check_balance_delta = |db_data: &mut WalletDb<rusqlite::Connection, Network>,
+                                   expected_notes: i64| {
+            let mut q = db_data
+                .conn
+                .prepare(
+                    "SELECT account_id, account_balance_delta, has_change, memo_count, sent_note_count, received_note_count
+                    FROM v_transactions",
+                )
+                .unwrap();
+            let mut rows = q.query([]).unwrap();
+            let mut row_count = 0;
+            while let Some(row) = rows.next().unwrap() {
+                row_count += 1;
+                let account: i64 = row.get(0).unwrap();
+                let account_balance_delta: i64 = row.get(1).unwrap();
+                let has_change: bool = row.get(2).unwrap();
+                let memo_count: i64 = row.get(3).unwrap();
+                let sent_note_count: i64 = row.get(4).unwrap();
+                let received_note_count: i64 = row.get(5).unwrap();
+                match account {
+                    0 => {
+                        assert_eq!(account_balance_delta, 2 * expected_notes);
+                        assert!(!has_change);
+                        assert_eq!(memo_count, 0);
+                        assert_eq!(sent_note_count, 0);
+                        assert_eq!(received_note_count, expected_notes);
+                    }
+                    other => {
+                        panic!(
+                            "Account {:?} is not expected to exist in the wallet.",
+                            other
+                        );
+                    }
+                }
+            }
+            assert_eq!(row_count, 1);
+        };
+
+        // Check for the bug (#1020).
+        check_balance_delta(&mut db_data, 1);
+
+        // Apply the current migration.
+        init_wallet_db_internal(&mut db_data, None, &[super::MIGRATION_ID], false).unwrap();
+
+        // Now it should be correct.
+        check_balance_delta(&mut db_data, 2);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_shielding_balance.rs b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_shielding_balance.rs
new file mode 100644
index 0000000000..94e8d54218
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_shielding_balance.rs
@@ -0,0 +1,165 @@
+//! This migration reworks transaction history views to correctly include spent transparent utxo
+//! value.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::v_tx_outputs_use_legacy_false;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xb8fe5112_4365_473c_8b42_2b07c0f0adaf);
+
+const DEPENDENCIES: &[Uuid] = &[v_tx_outputs_use_legacy_false::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Updates v_transactions to include spent UTXOs."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(
+            "DROP VIEW v_transactions;
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                SELECT sapling_received_notes.account        AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       sapling_received_notes.value          AS value,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 1
+                            ELSE 0
+                       END AS is_change,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (sapling_received_notes.memo IS NULL OR sapling_received_notes.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.tx
+                UNION
+                SELECT utxos.received_by_account     AS account_id,
+                       utxos.height                  AS block,
+                       utxos.prevout_txid            AS txid,
+                       0                             AS pool,
+                       utxos.value_zat               AS value,
+                       0                             AS is_change,
+                       1                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                UNION
+                SELECT sapling_received_notes.account        AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       -sapling_received_notes.value         AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.spent
+                UNION
+                SELECT utxos.received_by_account     AS account_id,
+                       transactions.block            AS block,
+                       transactions.txid             AS txid,
+                       0                             AS pool,
+                       -utxos.value_zat              AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                JOIN transactions
+                     ON transactions.id_tx = utxos.spent_in_tx
+            ),
+            sent_note_counts AS (
+                SELECT sent_notes.from_account AS account_id,
+                       transactions.txid       AS txid,
+                       COUNT(DISTINCT sent_notes.id_note) as sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR sapling_received_notes.tx IS NOT NULL)
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                JOIN transactions
+                     ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN sapling_received_notes
+                          ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                             (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+                WHERE COALESCE(sapling_received_notes.is_change, 0) = 0
+                GROUP BY account_id, txid
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) as max_height FROM blocks
+            )
+            SELECT notes.account_id                  AS account_id,
+                   notes.block                       AS mined_height,
+                   notes.txid                        AS txid,
+                   transactions.tx_index             AS tx_index,
+                   transactions.expiry_height        AS expiry_height,
+                   transactions.raw                  AS raw,
+                   SUM(notes.value)                  AS account_balance_delta,
+                   transactions.fee                  AS fee_paid,
+                   SUM(notes.is_change) > 0          AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                   ) AS expired_unmined
+            FROM notes
+            LEFT JOIN transactions
+                 ON notes.txid = transactions.txid
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = notes.block
+            LEFT JOIN sent_note_counts
+                      ON sent_note_counts.account_id = notes.account_id
+                      AND sent_note_counts.txid = notes.txid
+            GROUP BY notes.account_id, notes.txid;"
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_transparent_history.rs b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_transparent_history.rs
new file mode 100644
index 0000000000..196c84cd82
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/v_transactions_transparent_history.rs
@@ -0,0 +1,201 @@
+//! This migration reworks transaction history views to correctly include history
+//! of transparent utxos for which we lack complete transaction information.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::sapling_memo_consistency;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xaa0a4168_b41b_44c5_a47d_c4c66603cfab);
+
+const DEPENDENCIES: &[Uuid] = &[sapling_memo_consistency::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Updates transaction history views to fix potential errors in transparent history."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(
+            "DROP VIEW v_transactions;
+            CREATE VIEW v_transactions AS
+            WITH
+            notes AS (
+                SELECT sapling_received_notes.account        AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       sapling_received_notes.value          AS value,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 1
+                            ELSE 0
+                       END AS is_change,
+                       CASE
+                            WHEN sapling_received_notes.is_change THEN 0
+                            ELSE 1
+                       END AS received_count,
+                       CASE
+                         WHEN (sapling_received_notes.memo IS NULL OR sapling_received_notes.memo = X'F6')
+                           THEN 0
+                         ELSE 1
+                       END AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.tx
+                UNION
+                SELECT utxos.received_by_account     AS account_id,
+                       utxos.height                  AS block,
+                       utxos.prevout_txid            AS txid,
+                       0                             AS pool,
+                       utxos.value_zat               AS value,
+                       0                             AS is_change,
+                       1                             AS received_count,
+                       0                             AS memo_present
+                FROM utxos
+                UNION
+                SELECT sapling_received_notes.account        AS account_id,
+                       transactions.block                    AS block,
+                       transactions.txid                     AS txid,
+                       2                                     AS pool,
+                       -sapling_received_notes.value         AS value,
+                       0                             AS is_change,
+                       0                             AS received_count,
+                       0                             AS memo_present
+                FROM sapling_received_notes
+                JOIN transactions
+                     ON transactions.id_tx = sapling_received_notes.spent
+            ),
+            sent_note_counts AS (
+                SELECT sent_notes.from_account AS account_id,
+                       transactions.txid       AS txid,
+                       COUNT(DISTINCT sent_notes.id_note) as sent_notes,
+                       SUM(
+                         CASE
+                           WHEN (sent_notes.memo IS NULL OR sent_notes.memo = X'F6' OR sapling_received_notes.tx IS NOT NULL)
+                             THEN 0
+                           ELSE 1
+                         END
+                       ) AS memo_count
+                FROM sent_notes
+                JOIN transactions
+                     ON transactions.id_tx = sent_notes.tx
+                LEFT JOIN sapling_received_notes
+                          ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                             (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+                WHERE COALESCE(sapling_received_notes.is_change, 0) = 0
+                GROUP BY account_id, txid
+            ),
+            blocks_max_height AS (
+                SELECT MAX(blocks.height) as max_height FROM blocks
+            )
+            SELECT notes.account_id                  AS account_id,
+                   notes.block                       AS mined_height,
+                   notes.txid                        AS txid,
+                   transactions.tx_index             AS tx_index,
+                   transactions.expiry_height        AS expiry_height,
+                   transactions.raw                  AS raw,
+                   SUM(notes.value)                  AS account_balance_delta,
+                   transactions.fee                  AS fee_paid,
+                   SUM(notes.is_change) > 0          AS has_change,
+                   MAX(COALESCE(sent_note_counts.sent_notes, 0))  AS sent_note_count,
+                   SUM(notes.received_count)         AS received_note_count,
+                   SUM(notes.memo_present) + MAX(COALESCE(sent_note_counts.memo_count, 0)) AS memo_count,
+                   blocks.time                       AS block_time,
+                   (
+                        blocks.height IS NULL
+                        AND transactions.expiry_height BETWEEN 1 AND blocks_max_height.max_height
+                   ) AS expired_unmined
+            FROM notes
+            LEFT JOIN transactions
+                 ON notes.txid = transactions.txid
+            JOIN blocks_max_height
+            LEFT JOIN blocks ON blocks.height = notes.block
+            LEFT JOIN sent_note_counts
+                      ON sent_note_counts.account_id = notes.account_id
+                      AND sent_note_counts.txid = notes.txid
+            GROUP BY notes.account_id, notes.txid;"
+        )?;
+
+        transaction.execute_batch(
+            "DROP VIEW v_tx_outputs;
+            CREATE VIEW v_tx_outputs AS
+            SELECT transactions.txid                   AS txid,
+                   2                                   AS output_pool,
+                   sapling_received_notes.output_index AS output_index,
+                   sent_notes.from_account             AS from_account,
+                   sapling_received_notes.account      AS to_account,
+                   NULL                                AS to_address,
+                   sapling_received_notes.value        AS value,
+                   sapling_received_notes.is_change    AS is_change,
+                   sapling_received_notes.memo         AS memo
+            FROM sapling_received_notes
+            JOIN transactions
+                 ON transactions.id_tx = sapling_received_notes.tx
+            LEFT JOIN sent_notes
+                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                         (sapling_received_notes.tx, 2, sent_notes.output_index)
+            UNION
+            SELECT utxos.prevout_txid          AS txid,
+                   0                           AS output_pool,
+                   utxos.prevout_idx           AS output_index,
+                   NULL                        AS from_account,
+                   utxos.received_by_account   AS to_account,
+                   utxos.address               AS to_address,
+                   utxos.value_zat             AS value,
+                   false                       AS is_change,
+                   NULL                        AS memo
+            FROM utxos
+            UNION
+            SELECT transactions.txid              AS txid,
+                   sent_notes.output_pool         AS output_pool,
+                   sent_notes.output_index        AS output_index,
+                   sent_notes.from_account        AS from_account,
+                   sapling_received_notes.account AS to_account,
+                   sent_notes.to_address          AS to_address,
+                   sent_notes.value               AS value,
+                   false                          AS is_change,
+                   sent_notes.memo                AS memo
+            FROM sent_notes
+            JOIN transactions
+                 ON transactions.id_tx = sent_notes.tx
+            LEFT JOIN sapling_received_notes
+                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                         (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+            WHERE COALESCE(sapling_received_notes.is_change, 0) = 0;",
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/v_tx_outputs_use_legacy_false.rs b/zcash_client_sqlite/src/wallet/init/migrations/v_tx_outputs_use_legacy_false.rs
new file mode 100644
index 0000000000..be25f13617
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/v_tx_outputs_use_legacy_false.rs
@@ -0,0 +1,102 @@
+//! This migration revises the `v_tx_outputs` view to support SQLite 3.19.x
+//! which did not define `TRUE` and `FALSE` constants. This is required in
+//! order to support Android API 27
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::v_transactions_transparent_history;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xb3e21434_286f_41f3_8d71_44cce968ab2b);
+
+const DEPENDENCIES: &[Uuid] = &[v_transactions_transparent_history::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Updates v_tx_outputs to remove use of `true` and `false` constants for legacy SQLite version support."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        transaction.execute_batch(
+            "DROP VIEW v_tx_outputs;
+            CREATE VIEW v_tx_outputs AS
+            SELECT transactions.txid                   AS txid,
+                   2                                   AS output_pool,
+                   sapling_received_notes.output_index AS output_index,
+                   sent_notes.from_account             AS from_account,
+                   sapling_received_notes.account      AS to_account,
+                   NULL                                AS to_address,
+                   sapling_received_notes.value        AS value,
+                   sapling_received_notes.is_change    AS is_change,
+                   sapling_received_notes.memo         AS memo
+            FROM sapling_received_notes
+            JOIN transactions
+                 ON transactions.id_tx = sapling_received_notes.tx
+            LEFT JOIN sent_notes
+                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                         (sapling_received_notes.tx, 2, sent_notes.output_index)
+            UNION
+            SELECT utxos.prevout_txid          AS txid,
+                   0                           AS output_pool,
+                   utxos.prevout_idx           AS output_index,
+                   NULL                        AS from_account,
+                   utxos.received_by_account   AS to_account,
+                   utxos.address               AS to_address,
+                   utxos.value_zat             AS value,
+                   0                           AS is_change,
+                   NULL                        AS memo
+            FROM utxos
+            UNION
+            SELECT transactions.txid              AS txid,
+                   sent_notes.output_pool         AS output_pool,
+                   sent_notes.output_index        AS output_index,
+                   sent_notes.from_account        AS from_account,
+                   sapling_received_notes.account AS to_account,
+                   sent_notes.to_address          AS to_address,
+                   sent_notes.value               AS value,
+                   0                              AS is_change,
+                   sent_notes.memo                AS memo
+            FROM sent_notes
+            JOIN transactions
+                 ON transactions.id_tx = sent_notes.tx
+            LEFT JOIN sapling_received_notes
+                      ON (sent_notes.tx, sent_notes.output_pool, sent_notes.output_index) =
+                         (sapling_received_notes.tx, 2, sapling_received_notes.output_index)
+            WHERE COALESCE(sapling_received_notes.is_change, 0) = 0;",
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/init/migrations/wallet_summaries.rs b/zcash_client_sqlite/src/wallet/init/migrations/wallet_summaries.rs
new file mode 100644
index 0000000000..e6b73a74ed
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/init/migrations/wallet_summaries.rs
@@ -0,0 +1,99 @@
+//! This migration adds views and database changes required to provide accurate wallet summaries.
+
+use std::collections::HashSet;
+
+use schemerz_rusqlite::RusqliteMigration;
+use uuid::Uuid;
+
+use crate::wallet::init::WalletMigrationError;
+
+use super::v_sapling_shard_unscanned_ranges;
+
+pub(super) const MIGRATION_ID: Uuid = Uuid::from_u128(0xc5bf7f71_2297_41ff_89e1_75e07c4e8838);
+
+const DEPENDENCIES: &[Uuid] = &[v_sapling_shard_unscanned_ranges::MIGRATION_ID];
+
+pub(super) struct Migration;
+
+impl schemerz::Migration<Uuid> for Migration {
+    fn id(&self) -> Uuid {
+        MIGRATION_ID
+    }
+
+    fn dependencies(&self) -> HashSet<Uuid> {
+        DEPENDENCIES.iter().copied().collect()
+    }
+
+    fn description(&self) -> &'static str {
+        "Adds views and data required to produce accurate wallet summaries."
+    }
+}
+
+impl RusqliteMigration for Migration {
+    type Error = WalletMigrationError;
+
+    fn up(&self, transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        // Add columns to the `blocks` table to track the number of scanned outputs in each block.
+        // We use the note commitment tree size information that we have in contiguous regions to
+        // populate this data, but we don't make any attempt to handle the boundary cases because
+        // we're just using this information for the progress metric, which can be a bit sloppy.
+        transaction.execute_batch(
+            "ALTER TABLE blocks ADD COLUMN sapling_output_count INTEGER;
+            ALTER TABLE blocks ADD COLUMN orchard_action_count INTEGER;",
+        )?;
+
+        transaction.execute_batch(
+            // set the number of outputs everywhere that we have sequential blocks
+            "CREATE TEMPORARY TABLE block_deltas AS
+                SELECT
+                    cur.height AS height,
+                    (cur.sapling_commitment_tree_size - prev.sapling_commitment_tree_size) AS sapling_delta,
+                    (cur.orchard_commitment_tree_size - prev.orchard_commitment_tree_size) AS orchard_delta
+                FROM blocks cur
+                INNER JOIN blocks prev
+                ON cur.height = prev.height + 1;
+
+            UPDATE blocks
+            SET sapling_output_count = block_deltas.sapling_delta,
+                orchard_action_count = block_deltas.orchard_delta
+            FROM block_deltas
+            WHERE block_deltas.height = blocks.height;"
+        )?;
+
+        transaction.execute_batch(
+            "CREATE VIEW v_sapling_shards_scan_state AS
+            SELECT
+                shard_index,
+                start_position,
+                end_position_exclusive,
+                subtree_start_height,
+                subtree_end_height,
+                contains_marked,
+                MAX(priority) AS max_priority
+            FROM v_sapling_shard_scan_ranges
+            GROUP BY
+                shard_index,
+                start_position,
+                end_position_exclusive,
+                subtree_start_height,
+                subtree_end_height,
+                contains_marked;",
+        )?;
+
+        Ok(())
+    }
+
+    fn down(&self, _transaction: &rusqlite::Transaction) -> Result<(), Self::Error> {
+        Err(WalletMigrationError::CannotRevert(MIGRATION_ID))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::wallet::init::migrations::tests::test_migrate;
+
+    #[test]
+    fn migrate() {
+        test_migrate(&[super::MIGRATION_ID]);
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/orchard.rs b/zcash_client_sqlite/src/wallet/orchard.rs
new file mode 100644
index 0000000000..2c96503aa5
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/orchard.rs
@@ -0,0 +1,529 @@
+use std::{collections::HashSet, rc::Rc};
+
+use incrementalmerkletree::Position;
+use orchard::{
+    keys::Diversifier,
+    note::{Note, Nullifier, RandomSeed, Rho},
+};
+use rusqlite::{named_params, types::Value, Connection, Row, Transaction};
+
+use zcash_client_backend::{
+    data_api::NullifierQuery,
+    wallet::{ReceivedNote, WalletOrchardOutput},
+    DecryptedOutput, ShieldedProtocol, TransferType,
+};
+use zcash_keys::keys::UnifiedFullViewingKey;
+use zcash_primitives::transaction::TxId;
+use zcash_protocol::{
+    consensus::{self, BlockHeight},
+    memo::MemoBytes,
+    value::Zatoshis,
+};
+use zip32::Scope;
+
+use crate::{error::SqliteClientError, AccountUuid, ReceivedNoteId, TxRef};
+
+use super::{get_account_ref, memo_repr, parse_scope, scope_code};
+
+/// This trait provides a generalization over shielded output representations.
+pub(crate) trait ReceivedOrchardOutput {
+    type AccountId;
+
+    fn index(&self) -> usize;
+    fn account_id(&self) -> Self::AccountId;
+    fn note(&self) -> &Note;
+    fn memo(&self) -> Option<&MemoBytes>;
+    fn is_change(&self) -> bool;
+    fn nullifier(&self) -> Option<&Nullifier>;
+    fn note_commitment_tree_position(&self) -> Option<Position>;
+    fn recipient_key_scope(&self) -> Option<Scope>;
+}
+
+impl<AccountId: Copy> ReceivedOrchardOutput for WalletOrchardOutput<AccountId> {
+    type AccountId = AccountId;
+
+    fn index(&self) -> usize {
+        self.index()
+    }
+    fn account_id(&self) -> Self::AccountId {
+        *WalletOrchardOutput::account_id(self)
+    }
+    fn note(&self) -> &Note {
+        WalletOrchardOutput::note(self)
+    }
+    fn memo(&self) -> Option<&MemoBytes> {
+        None
+    }
+    fn is_change(&self) -> bool {
+        WalletOrchardOutput::is_change(self)
+    }
+    fn nullifier(&self) -> Option<&Nullifier> {
+        self.nf()
+    }
+    fn note_commitment_tree_position(&self) -> Option<Position> {
+        Some(WalletOrchardOutput::note_commitment_tree_position(self))
+    }
+    fn recipient_key_scope(&self) -> Option<Scope> {
+        self.recipient_key_scope()
+    }
+}
+
+impl<AccountId: Copy> ReceivedOrchardOutput for DecryptedOutput<Note, AccountId> {
+    type AccountId = AccountId;
+
+    fn index(&self) -> usize {
+        self.index()
+    }
+    fn account_id(&self) -> Self::AccountId {
+        *self.account()
+    }
+    fn note(&self) -> &orchard::note::Note {
+        self.note()
+    }
+    fn memo(&self) -> Option<&MemoBytes> {
+        Some(self.memo())
+    }
+    fn is_change(&self) -> bool {
+        self.transfer_type() == TransferType::WalletInternal
+    }
+    fn nullifier(&self) -> Option<&Nullifier> {
+        None
+    }
+    fn note_commitment_tree_position(&self) -> Option<Position> {
+        None
+    }
+    fn recipient_key_scope(&self) -> Option<Scope> {
+        if self.transfer_type() == TransferType::WalletInternal {
+            Some(Scope::Internal)
+        } else {
+            Some(Scope::External)
+        }
+    }
+}
+
+fn to_spendable_note<P: consensus::Parameters>(
+    params: &P,
+    row: &Row,
+) -> Result<Option<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError> {
+    let note_id = ReceivedNoteId(ShieldedProtocol::Orchard, row.get("id")?);
+    let txid = row.get::<_, [u8; 32]>("txid").map(TxId::from_bytes)?;
+    let action_index = row.get("action_index")?;
+    let diversifier = {
+        let d: Vec<_> = row.get("diversifier")?;
+        if d.len() != 11 {
+            return Err(SqliteClientError::CorruptedData(
+                "Invalid diversifier length".to_string(),
+            ));
+        }
+        let mut tmp = [0; 11];
+        tmp.copy_from_slice(&d);
+        Diversifier::from_bytes(tmp)
+    };
+
+    let note_value: u64 = row.get::<_, i64>("value")?.try_into().map_err(|_e| {
+        SqliteClientError::CorruptedData("Note values must be nonnegative".to_string())
+    })?;
+
+    let rho = {
+        let rho_bytes: [u8; 32] = row.get("rho")?;
+        Option::from(Rho::from_bytes(&rho_bytes))
+            .ok_or_else(|| SqliteClientError::CorruptedData("Invalid rho.".to_string()))
+    }?;
+
+    let rseed = {
+        let rseed_bytes: [u8; 32] = row.get("rseed")?;
+        Option::from(RandomSeed::from_bytes(rseed_bytes, &rho)).ok_or_else(|| {
+            SqliteClientError::CorruptedData("Invalid Orchard random seed.".to_string())
+        })
+    }?;
+
+    let note_commitment_tree_position = Position::from(
+        u64::try_from(row.get::<_, i64>("commitment_tree_position")?).map_err(|_| {
+            SqliteClientError::CorruptedData("Note commitment tree position invalid.".to_string())
+        })?,
+    );
+
+    let ufvk_str: Option<String> = row.get("ufvk")?;
+    let scope_code: Option<i64> = row.get("recipient_key_scope")?;
+
+    // If we don't have information about the recipient key scope or the ufvk we can't determine
+    // which spending key to use. This may be because the received note was associated with an
+    // imported viewing key, so we treat such notes as not spendable. Although this method is
+    // presently only called using the results of queries where both the ufvk and
+    // recipient_key_scope columns are checked to be non-null, this is method is written
+    // defensively to account for the fact that both of these are nullable columns in case it
+    // is used elsewhere in the future.
+    ufvk_str
+        .zip(scope_code)
+        .map(|(ufvk_str, scope_code)| {
+            let ufvk = UnifiedFullViewingKey::decode(params, &ufvk_str)
+                .map_err(SqliteClientError::CorruptedData)?;
+
+            let spending_key_scope = parse_scope(scope_code).ok_or_else(|| {
+                SqliteClientError::CorruptedData(format!("Invalid key scope code {}", scope_code))
+            })?;
+            let recipient = ufvk
+                .orchard()
+                .map(|fvk| fvk.to_ivk(spending_key_scope).address(diversifier))
+                .ok_or_else(|| {
+                    SqliteClientError::CorruptedData("Diversifier invalid.".to_owned())
+                })?;
+
+            let note = Option::from(Note::from_parts(
+                recipient,
+                orchard::value::NoteValue::from_raw(note_value),
+                rho,
+                rseed,
+            ))
+            .ok_or_else(|| SqliteClientError::CorruptedData("Invalid Orchard note.".to_string()))?;
+
+            Ok(ReceivedNote::from_parts(
+                note_id,
+                txid,
+                action_index,
+                note,
+                spending_key_scope,
+                note_commitment_tree_position,
+            ))
+        })
+        .transpose()
+}
+
+pub(crate) fn get_spendable_orchard_note<P: consensus::Parameters>(
+    conn: &Connection,
+    params: &P,
+    txid: &TxId,
+    index: u32,
+) -> Result<Option<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError> {
+    super::common::get_spendable_note(
+        conn,
+        params,
+        txid,
+        index,
+        ShieldedProtocol::Orchard,
+        to_spendable_note,
+    )
+}
+
+pub(crate) fn select_spendable_orchard_notes<P: consensus::Parameters>(
+    conn: &Connection,
+    params: &P,
+    account: AccountUuid,
+    target_value: Zatoshis,
+    anchor_height: BlockHeight,
+    exclude: &[ReceivedNoteId],
+) -> Result<Vec<ReceivedNote<ReceivedNoteId, Note>>, SqliteClientError> {
+    super::common::select_spendable_notes(
+        conn,
+        params,
+        account,
+        target_value,
+        anchor_height,
+        exclude,
+        ShieldedProtocol::Orchard,
+        to_spendable_note,
+    )
+}
+
+/// Records the specified shielded output as having been received.
+///
+/// This implementation relies on the facts that:
+/// - A transaction will not contain more than 2^63 shielded outputs.
+/// - A note value will never exceed 2^63 zatoshis.
+pub(crate) fn put_received_note<T: ReceivedOrchardOutput<AccountId = AccountUuid>>(
+    conn: &Transaction,
+    output: &T,
+    tx_ref: TxRef,
+    spent_in: Option<TxRef>,
+) -> Result<(), SqliteClientError> {
+    let account_id = get_account_ref(conn, output.account_id())?;
+    let mut stmt_upsert_received_note = conn.prepare_cached(
+        "INSERT INTO orchard_received_notes
+        (
+            tx, action_index, account_id,
+            diversifier, value, rho, rseed, memo, nf,
+            is_change, commitment_tree_position,
+            recipient_key_scope
+        )
+        VALUES (
+            :tx, :action_index, :account_id,
+            :diversifier, :value, :rho, :rseed, :memo, :nf,
+            :is_change, :commitment_tree_position,
+            :recipient_key_scope
+        )
+        ON CONFLICT (tx, action_index) DO UPDATE
+        SET account_id = :account_id,
+            diversifier = :diversifier,
+            value = :value,
+            rho = :rho,
+            rseed = :rseed,
+            nf = IFNULL(:nf, nf),
+            memo = IFNULL(:memo, memo),
+            is_change = MAX(:is_change, is_change),
+            commitment_tree_position = IFNULL(:commitment_tree_position, commitment_tree_position),
+            recipient_key_scope = :recipient_key_scope
+        RETURNING orchard_received_notes.id",
+    )?;
+
+    let rseed = output.note().rseed();
+    let to = output.note().recipient();
+    let diversifier = to.diversifier();
+
+    let sql_args = named_params![
+        ":tx": tx_ref.0,
+        ":action_index": i64::try_from(output.index()).expect("output indices are representable as i64"),
+        ":account_id": account_id.0,
+        ":diversifier": diversifier.as_array(),
+        ":value": output.note().value().inner(),
+        ":rho": output.note().rho().to_bytes(),
+        ":rseed": &rseed.as_bytes(),
+        ":nf": output.nullifier().map(|nf| nf.to_bytes()),
+        ":memo": memo_repr(output.memo()),
+        ":is_change": output.is_change(),
+        ":commitment_tree_position": output.note_commitment_tree_position().map(u64::from),
+        ":recipient_key_scope": output.recipient_key_scope().map(scope_code),
+    ];
+
+    let received_note_id = stmt_upsert_received_note
+        .query_row(sql_args, |row| row.get::<_, i64>(0))
+        .map_err(SqliteClientError::from)?;
+
+    if let Some(spent_in) = spent_in {
+        conn.execute(
+            "INSERT INTO orchard_received_note_spends (orchard_received_note_id, transaction_id)
+             VALUES (:orchard_received_note_id, :transaction_id)
+             ON CONFLICT (orchard_received_note_id, transaction_id) DO NOTHING",
+            named_params![
+                ":orchard_received_note_id": received_note_id,
+                ":transaction_id": spent_in.0
+            ],
+        )?;
+    }
+    Ok(())
+}
+
+/// Retrieves the set of nullifiers for "potentially spendable" Orchard notes that the
+/// wallet is tracking.
+///
+/// "Potentially spendable" means:
+/// - The transaction in which the note was created has been observed as mined.
+/// - No transaction in which the note's nullifier appears has been observed as mined.
+pub(crate) fn get_orchard_nullifiers(
+    conn: &Connection,
+    query: NullifierQuery,
+) -> Result<Vec<(AccountUuid, Nullifier)>, SqliteClientError> {
+    // Get the nullifiers for the notes we are tracking
+    let mut stmt_fetch_nullifiers = match query {
+        NullifierQuery::Unspent => conn.prepare(
+            "SELECT a.uuid, rn.nf
+             FROM orchard_received_notes rn
+             JOIN accounts a ON a.id = rn.account_id
+             JOIN transactions tx ON tx.id_tx = rn.tx
+             WHERE rn.nf IS NOT NULL
+             AND tx.block IS NOT NULL
+             AND rn.id NOT IN (
+               SELECT spends.orchard_received_note_id
+               FROM orchard_received_note_spends spends
+               JOIN transactions stx ON stx.id_tx = spends.transaction_id
+               WHERE stx.block IS NOT NULL  -- the spending tx is mined
+               OR stx.expiry_height IS NULL -- the spending tx will not expire
+             )",
+        )?,
+        NullifierQuery::All => conn.prepare(
+            "SELECT a.uuid, rn.nf
+             FROM orchard_received_notes rn
+             JOIN accounts a ON a.id = rn.account_id
+             WHERE nf IS NOT NULL",
+        )?,
+    };
+
+    let nullifiers = stmt_fetch_nullifiers.query_and_then([], |row| {
+        let account = AccountUuid(row.get(0)?);
+        let nf_bytes: [u8; 32] = row.get(1)?;
+        Ok::<_, rusqlite::Error>((account, Nullifier::from_bytes(&nf_bytes).unwrap()))
+    })?;
+
+    let res: Vec<_> = nullifiers.collect::<Result<_, _>>()?;
+    Ok(res)
+}
+
+pub(crate) fn detect_spending_accounts<'a>(
+    conn: &Connection,
+    nfs: impl Iterator<Item = &'a Nullifier>,
+) -> Result<HashSet<AccountUuid>, rusqlite::Error> {
+    let mut account_q = conn.prepare_cached(
+        "SELECT a.uuid
+         FROM orchard_received_notes rn
+         JOIN accounts a ON a.id = rn.account_id
+         WHERE rn.nf IN rarray(:nf_ptr)",
+    )?;
+
+    let nf_values: Vec<Value> = nfs.map(|nf| Value::Blob(nf.to_bytes().to_vec())).collect();
+    let nf_ptr = Rc::new(nf_values);
+    let res = account_q
+        .query_and_then(named_params![":nf_ptr": &nf_ptr], |row| {
+            row.get(0).map(AccountUuid)
+        })?
+        .collect::<Result<HashSet<_>, _>>()?;
+
+    Ok(res)
+}
+
+/// Marks a given nullifier as having been revealed in the construction
+/// of the specified transaction.
+///
+/// Marking a note spent in this fashion does NOT imply that the
+/// spending transaction has been mined.
+pub(crate) fn mark_orchard_note_spent(
+    conn: &Connection,
+    tx_ref: TxRef,
+    nf: &Nullifier,
+) -> Result<bool, SqliteClientError> {
+    let mut stmt_mark_orchard_note_spent = conn.prepare_cached(
+        "INSERT INTO orchard_received_note_spends (orchard_received_note_id, transaction_id)
+         SELECT id, :transaction_id FROM orchard_received_notes WHERE nf = :nf
+         ON CONFLICT (orchard_received_note_id, transaction_id) DO NOTHING",
+    )?;
+
+    match stmt_mark_orchard_note_spent.execute(named_params![
+       ":nf": nf.to_bytes(),
+       ":transaction_id": tx_ref.0
+    ])? {
+        0 => Ok(false),
+        1 => Ok(true),
+        _ => unreachable!("nf column is marked as UNIQUE"),
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+
+    use zcash_client_backend::data_api::testing::{
+        orchard::OrchardPoolTester, sapling::SaplingPoolTester,
+    };
+
+    use crate::testing::{self};
+
+    #[test]
+    fn send_single_step_proposed_transfer() {
+        testing::pool::send_single_step_proposed_transfer::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn send_with_multiple_change_outputs() {
+        testing::pool::send_with_multiple_change_outputs::<OrchardPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn send_multi_step_proposed_transfer() {
+        testing::pool::send_multi_step_proposed_transfer::<OrchardPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn proposal_fails_if_not_all_ephemeral_outputs_consumed() {
+        testing::pool::proposal_fails_if_not_all_ephemeral_outputs_consumed::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn create_to_address_fails_on_incorrect_usk() {
+        testing::pool::create_to_address_fails_on_incorrect_usk::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn proposal_fails_with_no_blocks() {
+        testing::pool::proposal_fails_with_no_blocks::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn spend_fails_on_unverified_notes() {
+        testing::pool::spend_fails_on_unverified_notes::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn spend_fails_on_locked_notes() {
+        testing::pool::spend_fails_on_locked_notes::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn ovk_policy_prevents_recovery_from_chain() {
+        testing::pool::ovk_policy_prevents_recovery_from_chain::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn spend_succeeds_to_t_addr_zero_change() {
+        testing::pool::spend_succeeds_to_t_addr_zero_change::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn change_note_spends_succeed() {
+        testing::pool::change_note_spends_succeed::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn external_address_change_spends_detected_in_restore_from_seed() {
+        testing::pool::external_address_change_spends_detected_in_restore_from_seed::<
+            OrchardPoolTester,
+        >()
+    }
+
+    #[test]
+    #[ignore] // FIXME: #1316 This requires support for dust outputs.
+    #[cfg(not(feature = "expensive-tests"))]
+    fn zip317_spend() {
+        testing::pool::zip317_spend::<OrchardPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn shield_transparent() {
+        testing::pool::shield_transparent::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn birthday_in_anchor_shard() {
+        testing::pool::birthday_in_anchor_shard::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn checkpoint_gaps() {
+        testing::pool::checkpoint_gaps::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn scan_cached_blocks_detects_spends_out_of_order() {
+        testing::pool::scan_cached_blocks_detects_spends_out_of_order::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn metadata_queries_exclude_unwanted_notes() {
+        testing::pool::metadata_queries_exclude_unwanted_notes::<OrchardPoolTester>()
+    }
+
+    #[test]
+    fn pool_crossing_required() {
+        testing::pool::pool_crossing_required::<OrchardPoolTester, SaplingPoolTester>()
+    }
+
+    #[test]
+    fn fully_funded_fully_private() {
+        testing::pool::fully_funded_fully_private::<OrchardPoolTester, SaplingPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn fully_funded_send_to_t() {
+        testing::pool::fully_funded_send_to_t::<OrchardPoolTester, SaplingPoolTester>()
+    }
+
+    #[test]
+    fn multi_pool_checkpoint() {
+        testing::pool::multi_pool_checkpoint::<OrchardPoolTester, SaplingPoolTester>()
+    }
+
+    #[test]
+    fn multi_pool_checkpoints_with_pruning() {
+        testing::pool::multi_pool_checkpoints_with_pruning::<OrchardPoolTester, SaplingPoolTester>()
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/sapling.rs b/zcash_client_sqlite/src/wallet/sapling.rs
index a18281dc87..f37b2b4987 100644
--- a/zcash_client_sqlite/src/wallet/sapling.rs
+++ b/zcash_client_sqlite/src/wallet/sapling.rs
@@ -1,42 +1,53 @@
 //! Functions for Sapling support in the wallet.
+
+use std::{collections::HashSet, rc::Rc};
+
 use group::ff::PrimeField;
-use rusqlite::{named_params, types::Value, OptionalExtension, Row};
-use std::rc::Rc;
+use incrementalmerkletree::Position;
+use rusqlite::{named_params, types::Value, Connection, Row, Transaction};
 
-use zcash_primitives::{
-    consensus::BlockHeight,
+use sapling::{self, Diversifier, Nullifier, Rseed};
+use zcash_client_backend::{
+    data_api::NullifierQuery,
+    wallet::{ReceivedNote, WalletSaplingOutput},
+    DecryptedOutput, ShieldedProtocol, TransferType,
+};
+use zcash_keys::keys::UnifiedFullViewingKey;
+use zcash_primitives::transaction::{components::amount::NonNegativeAmount, TxId};
+use zcash_protocol::{
+    consensus::{self, BlockHeight},
     memo::MemoBytes,
-    merkle_tree::{read_commitment_tree, read_incremental_witness},
-    sapling::{self, Diversifier, Note, Nullifier, Rseed},
-    transaction::components::Amount,
-    zip32::AccountId,
 };
+use zip32::Scope;
 
-use zcash_client_backend::{
-    wallet::{ReceivedSaplingNote, WalletSaplingOutput},
-    DecryptedOutput, TransferType,
-};
+use crate::{error::SqliteClientError, AccountUuid, ReceivedNoteId, TxRef};
 
-use crate::{error::SqliteClientError, DataConnStmtCache, NoteId, WalletDb};
+use super::{get_account_ref, memo_repr, parse_scope, scope_code};
 
 /// This trait provides a generalization over shielded output representations.
 pub(crate) trait ReceivedSaplingOutput {
+    type AccountId;
+
     fn index(&self) -> usize;
-    fn account(&self) -> AccountId;
-    fn note(&self) -> &Note;
+    fn account_id(&self) -> Self::AccountId;
+    fn note(&self) -> &sapling::Note;
     fn memo(&self) -> Option<&MemoBytes>;
     fn is_change(&self) -> bool;
-    fn nullifier(&self) -> Option<&Nullifier>;
+    fn nullifier(&self) -> Option<&sapling::Nullifier>;
+    fn note_commitment_tree_position(&self) -> Option<Position>;
+    fn recipient_key_scope(&self) -> Option<Scope>;
 }
 
-impl ReceivedSaplingOutput for WalletSaplingOutput<Nullifier> {
+impl<AccountId: Copy> ReceivedSaplingOutput for WalletSaplingOutput<AccountId> {
+    type AccountId = AccountId;
+
     fn index(&self) -> usize {
         self.index()
     }
-    fn account(&self) -> AccountId {
-        WalletSaplingOutput::account(self)
+    fn account_id(&self) -> Self::AccountId {
+        *WalletSaplingOutput::account_id(self)
     }
-    fn note(&self) -> &Note {
+    fn note(&self) -> &sapling::Note {
         WalletSaplingOutput::note(self)
     }
     fn memo(&self) -> Option<&MemoBytes> {
@@ -45,37 +56,59 @@ impl ReceivedSaplingOutput for WalletSaplingOutput<Nullifier> {
     fn is_change(&self) -> bool {
         WalletSaplingOutput::is_change(self)
     }
-
-    fn nullifier(&self) -> Option<&Nullifier> {
-        Some(self.nf())
+    fn nullifier(&self) -> Option<&sapling::Nullifier> {
+        self.nf()
+    }
+    fn note_commitment_tree_position(&self) -> Option<Position> {
+        Some(WalletSaplingOutput::note_commitment_tree_position(self))
+    }
+    fn recipient_key_scope(&self) -> Option<Scope> {
+        self.recipient_key_scope()
     }
 }
 
-impl ReceivedSaplingOutput for DecryptedOutput<Note> {
+impl<AccountId: Copy> ReceivedSaplingOutput for DecryptedOutput<sapling::Note, AccountId> {
+    type AccountId = AccountId;
+
     fn index(&self) -> usize {
-        self.index
+        self.index()
     }
-    fn account(&self) -> AccountId {
-        self.account
+    fn account_id(&self) -> Self::AccountId {
+        *self.account()
     }
-    fn note(&self) -> &Note {
-        &self.note
+    fn note(&self) -> &sapling::Note {
+        self.note()
     }
     fn memo(&self) -> Option<&MemoBytes> {
-        Some(&self.memo)
+        Some(self.memo())
     }
     fn is_change(&self) -> bool {
-        self.transfer_type == TransferType::WalletInternal
+        self.transfer_type() == TransferType::WalletInternal
+    }
+    fn nullifier(&self) -> Option<&sapling::Nullifier> {
+        None
     }
-    fn nullifier(&self) -> Option<&Nullifier> {
+    fn note_commitment_tree_position(&self) -> Option<Position> {
         None
     }
+    fn recipient_key_scope(&self) -> Option<Scope> {
+        if self.transfer_type() == TransferType::WalletInternal {
+            Some(Scope::Internal)
+        } else {
+            Some(Scope::External)
+        }
+    }
 }
 
-fn to_spendable_note(row: &Row) -> Result<ReceivedSaplingNote<NoteId>, SqliteClientError> {
-    let note_id = NoteId::ReceivedNoteId(row.get(0)?);
+fn to_spendable_note<P: consensus::Parameters>(
+    params: &P,
+    row: &Row,
+) -> Result<Option<ReceivedNote<ReceivedNoteId, sapling::Note>>, SqliteClientError> {
+    let note_id = ReceivedNoteId(ShieldedProtocol::Sapling, row.get("id")?);
+    let txid = row.get::<_, [u8; 32]>("txid").map(TxId::from_bytes)?;
+    let output_index = row.get("output_index")?;
     let diversifier = {
-        let d: Vec<_> = row.get(1)?;
+        let d: Vec<_> = row.get("diversifier")?;
         if d.len() != 11 {
             return Err(SqliteClientError::CorruptedData(
                 "Invalid diversifier length".to_string(),
@@ -86,10 +119,12 @@ fn to_spendable_note(row: &Row) -> Result<ReceivedSaplingNote<NoteId>, SqliteCli
         Diversifier(tmp)
     };
 
-    let note_value = Amount::from_i64(row.get(2)?).unwrap();
+    let note_value: u64 = row.get::<_, i64>("value")?.try_into().map_err(|_e| {
+        SqliteClientError::CorruptedData("Note values must be nonnegative".to_string())
+    })?;
 
     let rseed = {
-        let rcm_bytes: Vec<_> = row.get(3)?;
+        let rcm_bytes: Vec<_> = row.get("rcm")?;
 
         // We store rcm directly in the data DB, regardless of whether the note
         // used a v1 or v2 note plaintext, so for the purposes of spending let's
@@ -103,187 +138,101 @@ fn to_spendable_note(row: &Row) -> Result<ReceivedSaplingNote<NoteId>, SqliteCli
         Rseed::BeforeZip212(rcm)
     };
 
-    let witness = {
-        let d: Vec<_> = row.get(4)?;
-        read_incremental_witness(&d[..])?
-    };
-
-    Ok(ReceivedSaplingNote {
-        note_id,
-        diversifier,
-        note_value,
-        rseed,
-        witness,
-    })
-}
-
-pub(crate) fn get_spendable_sapling_notes<P>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-    anchor_height: BlockHeight,
-    exclude: &[NoteId],
-) -> Result<Vec<ReceivedSaplingNote<NoteId>>, SqliteClientError> {
-    let mut stmt_select_notes = wdb.conn.prepare(
-        "SELECT id_note, diversifier, value, rcm, witness
-            FROM sapling_received_notes
-            INNER JOIN transactions ON transactions.id_tx = sapling_received_notes.tx
-            INNER JOIN sapling_witnesses ON sapling_witnesses.note = sapling_received_notes.id_note
-            WHERE account = :account
-            AND spent IS NULL
-            AND transactions.block <= :anchor_height
-            AND sapling_witnesses.block = :anchor_height
-            AND id_note NOT IN rarray(:exclude)",
-    )?;
-
-    let excluded: Vec<Value> = exclude
-        .iter()
-        .filter_map(|n| match n {
-            NoteId::ReceivedNoteId(i) => Some(Value::from(*i)),
-            NoteId::SentNoteId(_) => None,
+    let note_commitment_tree_position = Position::from(
+        u64::try_from(row.get::<_, i64>("commitment_tree_position")?).map_err(|_| {
+            SqliteClientError::CorruptedData("Note commitment tree position invalid.".to_string())
+        })?,
+    );
+
+    let ufvk_str: Option<String> = row.get("ufvk")?;
+    let scope_code: Option<i64> = row.get("recipient_key_scope")?;
+
+    // If we don't have information about the recipient key scope or the ufvk we can't determine
+    // which spending key to use. This may be because the received note was associated with an
+    // imported viewing key, so we treat such notes as not spendable. Although this method is
+    // presently only called using the results of queries where both the ufvk and
+    // recipient_key_scope columns are checked to be non-null, this is method is written
+    // defensively to account for the fact that both of these are nullable columns in case it
+    // is used elsewhere in the future.
+    ufvk_str
+        .zip(scope_code)
+        .map(|(ufvk_str, scope_code)| {
+            let ufvk = UnifiedFullViewingKey::decode(params, &ufvk_str)
+                .map_err(SqliteClientError::CorruptedData)?;
+
+            let spending_key_scope = parse_scope(scope_code).ok_or_else(|| {
+                SqliteClientError::CorruptedData(format!("Invalid key scope code {}", scope_code))
+            })?;
+
+            let recipient = match spending_key_scope {
+                Scope::Internal => ufvk
+                    .sapling()
+                    .and_then(|dfvk| dfvk.diversified_change_address(diversifier)),
+                Scope::External => ufvk
+                    .sapling()
+                    .and_then(|dfvk| dfvk.diversified_address(diversifier)),
+            }
+            .ok_or_else(|| SqliteClientError::CorruptedData("Diversifier invalid.".to_owned()))?;
+
+            Ok(ReceivedNote::from_parts(
+                note_id,
+                txid,
+                output_index,
+                sapling::Note::from_parts(
+                    recipient,
+                    sapling::value::NoteValue::from_raw(note_value),
+                    rseed,
+                ),
+                spending_key_scope,
+                note_commitment_tree_position,
+            ))
         })
-        .collect();
-    let excluded_ptr = Rc::new(excluded);
+        .transpose()
+}
 
-    let notes = stmt_select_notes.query_and_then(
-        named_params![
-            ":account": &u32::from(account),
-            ":anchor_height": &u32::from(anchor_height),
-            ":exclude": &excluded_ptr,
-        ],
+// The `clippy::let_and_return` lint is explicitly allowed here because a bug in Clippy
+// (https://github.com/rust-lang/rust-clippy/issues/11308) means it fails to identify that the `result` temporary
+// is required in order to resolve the borrows involved in the `query_and_then` call.
+#[allow(clippy::let_and_return)]
+pub(crate) fn get_spendable_sapling_note<P: consensus::Parameters>(
+    conn: &Connection,
+    params: &P,
+    txid: &TxId,
+    index: u32,
+) -> Result<Option<ReceivedNote<ReceivedNoteId, sapling::Note>>, SqliteClientError> {
+    super::common::get_spendable_note(
+        conn,
+        params,
+        txid,
+        index,
+        ShieldedProtocol::Sapling,
         to_spendable_note,
-    )?;
-
-    notes.collect::<Result<_, _>>()
+    )
 }
 
-pub(crate) fn select_spendable_sapling_notes<P>(
-    wdb: &WalletDb<P>,
-    account: AccountId,
-    target_value: Amount,
+/// Utility method for determining whether we have any spendable notes
+///
+/// If the tip shard has unscanned ranges below the anchor height and greater than or equal to
+/// the wallet birthday, none of our notes can be spent because we cannot construct witnesses at
+/// the provided anchor height.
+pub(crate) fn select_spendable_sapling_notes<P: consensus::Parameters>(
+    conn: &Connection,
+    params: &P,
+    account: AccountUuid,
+    target_value: NonNegativeAmount,
     anchor_height: BlockHeight,
-    exclude: &[NoteId],
-) -> Result<Vec<ReceivedSaplingNote<NoteId>>, SqliteClientError> {
-    // The goal of this SQL statement is to select the oldest notes until the required
-    // value has been reached, and then fetch the witnesses at the desired height for the
-    // selected notes. This is achieved in several steps:
-    //
-    // 1) Use a window function to create a view of all notes, ordered from oldest to
-    //    newest, with an additional column containing a running sum:
-    //    - Unspent notes accumulate the values of all unspent notes in that note's
-    //      account, up to itself.
-    //    - Spent notes accumulate the values of all notes in the transaction they were
-    //      spent in, up to itself.
-    //
-    // 2) Select all unspent notes in the desired account, along with their running sum.
-    //
-    // 3) Select all notes for which the running sum was less than the required value, as
-    //    well as a single note for which the sum was greater than or equal to the
-    //    required value, bringing the sum of all selected notes across the threshold.
-    //
-    // 4) Match the selected notes against the witnesses at the desired height.
-    let mut stmt_select_notes = wdb.conn.prepare(
-        "WITH selected AS (
-            WITH eligible AS (
-                SELECT id_note, diversifier, value, rcm,
-                    SUM(value) OVER
-                        (PARTITION BY account, spent ORDER BY id_note) AS so_far
-                FROM sapling_received_notes
-                INNER JOIN transactions ON transactions.id_tx = sapling_received_notes.tx
-                WHERE account = :account 
-                AND spent IS NULL 
-                AND transactions.block <= :anchor_height
-                AND id_note NOT IN rarray(:exclude)
-            )
-            SELECT * FROM eligible WHERE so_far < :target_value
-            UNION
-            SELECT * FROM (SELECT * FROM eligible WHERE so_far >= :target_value LIMIT 1)
-        ), witnesses AS (
-            SELECT note, witness FROM sapling_witnesses
-            WHERE block = :anchor_height
-        )
-        SELECT selected.id_note, selected.diversifier, selected.value, selected.rcm, witnesses.witness
-        FROM selected
-        INNER JOIN witnesses ON selected.id_note = witnesses.note",
-    )?;
-
-    let excluded: Vec<Value> = exclude
-        .iter()
-        .filter_map(|n| match n {
-            NoteId::ReceivedNoteId(i) => Some(Value::from(*i)),
-            NoteId::SentNoteId(_) => None,
-        })
-        .collect();
-    let excluded_ptr = Rc::new(excluded);
-
-    let notes = stmt_select_notes.query_and_then(
-        named_params![
-            ":account": &u32::from(account),
-            ":anchor_height": &u32::from(anchor_height),
-            ":target_value": &i64::from(target_value),
-            ":exclude": &excluded_ptr
-        ],
+    exclude: &[ReceivedNoteId],
+) -> Result<Vec<ReceivedNote<ReceivedNoteId, sapling::Note>>, SqliteClientError> {
+    super::common::select_spendable_notes(
+        conn,
+        params,
+        account,
+        target_value,
+        anchor_height,
+        exclude,
+        ShieldedProtocol::Sapling,
         to_spendable_note,
-    )?;
-
-    notes.collect::<Result<_, _>>()
-}
-
-/// Returns the commitment tree for the block at the specified height,
-/// if any.
-pub(crate) fn get_sapling_commitment_tree<P>(
-    wdb: &WalletDb<P>,
-    block_height: BlockHeight,
-) -> Result<Option<sapling::CommitmentTree>, SqliteClientError> {
-    wdb.conn
-        .query_row_and_then(
-            "SELECT sapling_tree FROM blocks WHERE height = ?",
-            [u32::from(block_height)],
-            |row| {
-                let row_data: Vec<u8> = row.get(0)?;
-                read_commitment_tree(&row_data[..]).map_err(|e| {
-                    rusqlite::Error::FromSqlConversionFailure(
-                        row_data.len(),
-                        rusqlite::types::Type::Blob,
-                        Box::new(e),
-                    )
-                })
-            },
-        )
-        .optional()
-        .map_err(SqliteClientError::from)
-}
-
-/// Returns the incremental witnesses for the block at the specified height,
-/// if any.
-pub(crate) fn get_sapling_witnesses<P>(
-    wdb: &WalletDb<P>,
-    block_height: BlockHeight,
-) -> Result<Vec<(NoteId, sapling::IncrementalWitness)>, SqliteClientError> {
-    let mut stmt_fetch_witnesses = wdb
-        .conn
-        .prepare("SELECT note, witness FROM sapling_witnesses WHERE block = ?")?;
-    let witnesses = stmt_fetch_witnesses
-        .query_map([u32::from(block_height)], |row| {
-            let id_note = NoteId::ReceivedNoteId(row.get(0)?);
-            let wdb: Vec<u8> = row.get(1)?;
-            Ok(read_incremental_witness(&wdb[..]).map(|witness| (id_note, witness)))
-        })
-        .map_err(SqliteClientError::from)?;
-
-    // unwrap database error & IO error from IncrementalWitness::read
-    let res: Vec<_> = witnesses.collect::<Result<Result<_, _>, _>>()??;
-    Ok(res)
-}
-
-/// Records the incremental witness for the specified note,
-/// as of the given block height.
-pub(crate) fn insert_witness<'a, P>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    note_id: i64,
-    witness: &sapling::IncrementalWitness,
-    height: BlockHeight,
-) -> Result<(), SqliteClientError> {
-    stmts.stmt_insert_witness(NoteId::ReceivedNoteId(note_id), height, witness)
+    )
 }
 
 /// Retrieves the set of nullifiers for "potentially spendable" Sapling notes that the
@@ -292,51 +241,64 @@ pub(crate) fn insert_witness<'a, P>(
 /// "Potentially spendable" means:
 /// - The transaction in which the note was created has been observed as mined.
 /// - No transaction in which the note's nullifier appears has been observed as mined.
-pub(crate) fn get_sapling_nullifiers<P>(
-    wdb: &WalletDb<P>,
-) -> Result<Vec<(AccountId, Nullifier)>, SqliteClientError> {
+pub(crate) fn get_sapling_nullifiers(
+    conn: &Connection,
+    query: NullifierQuery,
+) -> Result<Vec<(AccountUuid, Nullifier)>, SqliteClientError> {
     // Get the nullifiers for the notes we are tracking
-    let mut stmt_fetch_nullifiers = wdb.conn.prepare(
-        "SELECT rn.id_note, rn.account, rn.nf, tx.block as block
-         FROM sapling_received_notes rn
-         LEFT OUTER JOIN transactions tx
-         ON tx.id_tx = rn.spent
-         WHERE block IS NULL
-         AND nf IS NOT NULL",
-    )?;
-    let nullifiers = stmt_fetch_nullifiers.query_map([], |row| {
-        let account: u32 = row.get(1)?;
-        let nf_bytes: Vec<u8> = row.get(2)?;
-        Ok((
-            AccountId::from(account),
-            Nullifier::from_slice(&nf_bytes).unwrap(),
-        ))
+    let mut stmt_fetch_nullifiers = match query {
+        NullifierQuery::Unspent => conn.prepare(
+            "SELECT a.uuid, rn.nf
+             FROM sapling_received_notes rn
+             JOIN accounts a ON a.id = rn.account_id
+             JOIN transactions tx ON tx.id_tx = rn.tx
+             WHERE rn.nf IS NOT NULL
+             AND tx.block IS NOT NULL
+             AND rn.id NOT IN (
+               SELECT spends.sapling_received_note_id
+               FROM sapling_received_note_spends spends
+               JOIN transactions stx ON stx.id_tx = spends.transaction_id
+               WHERE stx.block IS NOT NULL  -- the spending tx is mined
+               OR stx.expiry_height IS NULL -- the spending tx will not expire
+             )",
+        ),
+        NullifierQuery::All => conn.prepare(
+            "SELECT a.uuid, rn.nf
+             FROM sapling_received_notes rn
+             JOIN accounts a ON a.id = rn.account_id
+             WHERE nf IS NOT NULL",
+        ),
+    }?;
+
+    let nullifiers = stmt_fetch_nullifiers.query_and_then([], |row| {
+        let account = AccountUuid(row.get(0)?);
+        let nf_bytes: Vec<u8> = row.get(1)?;
+        Ok::<_, rusqlite::Error>((account, sapling::Nullifier::from_slice(&nf_bytes).unwrap()))
     })?;
 
     let res: Vec<_> = nullifiers.collect::<Result<_, _>>()?;
     Ok(res)
 }
 
-/// Returns the nullifiers for the notes that this wallet is tracking.
-pub(crate) fn get_all_sapling_nullifiers<P>(
-    wdb: &WalletDb<P>,
-) -> Result<Vec<(AccountId, Nullifier)>, SqliteClientError> {
-    // Get the nullifiers for the notes we are tracking
-    let mut stmt_fetch_nullifiers = wdb.conn.prepare(
-        "SELECT rn.id_note, rn.account, rn.nf
-         FROM sapling_received_notes rn
-         WHERE nf IS NOT NULL",
+pub(crate) fn detect_spending_accounts<'a>(
+    conn: &Connection,
+    nfs: impl Iterator<Item = &'a Nullifier>,
+) -> Result<HashSet<AccountUuid>, rusqlite::Error> {
+    let mut account_q = conn.prepare_cached(
+        "SELECT accounts.uuid
+        FROM sapling_received_notes rn
+        JOIN accounts ON accounts.id = rn.account_id
+        WHERE rn.nf IN rarray(:nf_ptr)",
     )?;
-    let nullifiers = stmt_fetch_nullifiers.query_map([], |row| {
-        let account: u32 = row.get(1)?;
-        let nf_bytes: Vec<u8> = row.get(2)?;
-        Ok((
-            AccountId::from(account),
-            Nullifier::from_slice(&nf_bytes).unwrap(),
-        ))
-    })?;
 
-    let res: Vec<_> = nullifiers.collect::<Result<_, _>>()?;
+    let nf_values: Vec<Value> = nfs.map(|nf| Value::Blob(nf.to_vec())).collect();
+    let nf_ptr = Rc::new(nf_values);
+    let res = account_q
+        .query_and_then(named_params![":nf_ptr": &nf_ptr], |row| {
+            row.get(0).map(AccountUuid)
+        })?
+        .collect::<Result<HashSet<_>, _>>()?;
+
     Ok(res)
 }
 
@@ -345,13 +307,25 @@ pub(crate) fn get_all_sapling_nullifiers<P>(
 ///
 /// Marking a note spent in this fashion does NOT imply that the
 /// spending transaction has been mined.
-pub(crate) fn mark_sapling_note_spent<'a, P>(
-    stmts: &mut DataConnStmtCache<'a, P>,
-    tx_ref: i64,
-    nf: &Nullifier,
-) -> Result<(), SqliteClientError> {
-    stmts.stmt_mark_sapling_note_spent(tx_ref, nf)?;
-    Ok(())
+pub(crate) fn mark_sapling_note_spent(
+    conn: &Connection,
+    tx_ref: TxRef,
+    nf: &sapling::Nullifier,
+) -> Result<bool, SqliteClientError> {
+    let mut stmt_mark_sapling_note_spent = conn.prepare_cached(
+        "INSERT INTO sapling_received_note_spends (sapling_received_note_id, transaction_id)
+         SELECT id, :transaction_id FROM sapling_received_notes WHERE nf = :nf
+         ON CONFLICT (sapling_received_note_id, transaction_id) DO NOTHING",
+    )?;
+
+    match stmt_mark_sapling_note_spent.execute(named_params![
+       ":nf": &nf.0[..],
+       ":transaction_id": tx_ref.0
+    ])? {
+        0 => Ok(false),
+        1 => Ok(true),
+        _ => unreachable!("nf column is marked as UNIQUE"),
+    }
 }
 
 /// Records the specified shielded output as having been received.
@@ -359,891 +333,214 @@ pub(crate) fn mark_sapling_note_spent<'a, P>(
 /// This implementation relies on the facts that:
 /// - A transaction will not contain more than 2^63 shielded outputs.
 /// - A note value will never exceed 2^63 zatoshis.
-pub(crate) fn put_received_note<'a, P, T: ReceivedSaplingOutput>(
-    stmts: &mut DataConnStmtCache<'a, P>,
+pub(crate) fn put_received_note<T: ReceivedSaplingOutput<AccountId = AccountUuid>>(
+    conn: &Transaction,
     output: &T,
-    tx_ref: i64,
-) -> Result<NoteId, SqliteClientError> {
+    tx_ref: TxRef,
+    spent_in: Option<TxRef>,
+) -> Result<(), SqliteClientError> {
+    let account_id = get_account_ref(conn, output.account_id())?;
+    let mut stmt_upsert_received_note = conn.prepare_cached(
+        "INSERT INTO sapling_received_notes
+        (tx, output_index, account_id, diversifier, value, rcm, memo, nf,
+         is_change, commitment_tree_position,
+         recipient_key_scope)
+        VALUES (
+            :tx,
+            :output_index,
+            :account_id,
+            :diversifier,
+            :value,
+            :rcm,
+            :memo,
+            :nf,
+            :is_change,
+            :commitment_tree_position,
+            :recipient_key_scope
+        )
+        ON CONFLICT (tx, output_index) DO UPDATE
+        SET account_id = :account_id,
+            diversifier = :diversifier,
+            value = :value,
+            rcm = :rcm,
+            nf = IFNULL(:nf, nf),
+            memo = IFNULL(:memo, memo),
+            is_change = MAX(:is_change, is_change),
+            commitment_tree_position = IFNULL(:commitment_tree_position, commitment_tree_position),
+            recipient_key_scope = :recipient_key_scope
+        RETURNING sapling_received_notes.id",
+    )?;
+
     let rcm = output.note().rcm().to_repr();
-    let account = output.account();
     let to = output.note().recipient();
     let diversifier = to.diversifier();
-    let value = output.note().value();
-    let memo = output.memo();
-    let is_change = output.is_change();
-    let output_index = output.index();
-    let nf = output.nullifier();
 
-    // First try updating an existing received note into the database.
-    if !stmts.stmt_update_received_note(
-        account,
-        diversifier,
-        value.inner(),
-        rcm,
-        nf,
-        memo,
-        is_change,
-        tx_ref,
-        output_index,
-    )? {
-        // It isn't there, so insert our note into the database.
-        stmts.stmt_insert_received_note(
-            tx_ref,
-            output_index,
-            account,
-            diversifier,
-            value.inner(),
-            rcm,
-            nf,
-            memo,
-            is_change,
-        )
-    } else {
-        // It was there, so grab its row number.
-        stmts.stmt_select_received_note(tx_ref, output.index())
+    let sql_args = named_params![
+        ":tx": tx_ref.0,
+        ":output_index": i64::try_from(output.index()).expect("output indices are representable as i64"),
+        ":account_id": account_id.0,
+        ":diversifier": &diversifier.0.as_ref(),
+        ":value": output.note().value().inner(),
+        ":rcm": &rcm.as_ref(),
+        ":nf": output.nullifier().map(|nf| nf.0.as_ref()),
+        ":memo": memo_repr(output.memo()),
+        ":is_change": output.is_change(),
+        ":commitment_tree_position": output.note_commitment_tree_position().map(u64::from),
+        ":recipient_key_scope": output.recipient_key_scope().map(scope_code)
+    ];
+
+    let received_note_id = stmt_upsert_received_note
+        .query_row(sql_args, |row| row.get::<_, i64>(0))
+        .map_err(SqliteClientError::from)?;
+
+    if let Some(spent_in) = spent_in {
+        conn.execute(
+            "INSERT INTO sapling_received_note_spends (sapling_received_note_id, transaction_id)
+             VALUES (:sapling_received_note_id, :transaction_id)
+             ON CONFLICT (sapling_received_note_id, transaction_id) DO NOTHING",
+            named_params![
+                ":sapling_received_note_id": received_note_id,
+                ":transaction_id": spent_in.0
+            ],
+        )?;
     }
+
+    Ok(())
 }
 
 #[cfg(test)]
-#[allow(deprecated)]
-mod tests {
-    use rusqlite::Connection;
-    use secrecy::Secret;
-    use tempfile::NamedTempFile;
+pub(crate) mod tests {
+    use zcash_client_backend::data_api::testing::sapling::SaplingPoolTester;
 
-    use zcash_proofs::prover::LocalTxProver;
+    use crate::testing;
 
-    use zcash_primitives::{
-        block::BlockHash,
-        consensus::{BlockHeight, BranchId},
-        legacy::TransparentAddress,
-        sapling::{note_encryption::try_sapling_output_recovery, prover::TxProver},
-        transaction::{components::Amount, fees::zip317::FeeRule as Zip317FeeRule, Transaction},
-        zip32::{sapling::ExtendedSpendingKey, Scope},
-    };
+    #[cfg(feature = "orchard")]
+    use zcash_client_backend::data_api::testing::orchard::OrchardPoolTester;
 
-    use zcash_client_backend::{
-        address::RecipientAddress,
-        data_api::{
-            self,
-            chain::scan_cached_blocks,
-            error::Error,
-            wallet::{create_spend_to_address, input_selection::GreedyInputSelector, spend},
-            WalletRead, WalletWrite,
-        },
-        fees::{zip317, DustOutputPolicy},
-        keys::UnifiedSpendingKey,
-        wallet::OvkPolicy,
-        zip321::{Payment, TransactionRequest},
-    };
+    #[test]
+    fn send_single_step_proposed_transfer() {
+        testing::pool::send_single_step_proposed_transfer::<SaplingPoolTester>()
+    }
 
-    use crate::{
-        chain::init::init_cache_database,
-        tests::{
-            self, fake_compact_block, insert_into_cache, network, sapling_activation_height,
-            AddressType,
-        },
-        wallet::{
-            get_balance, get_balance_at,
-            init::{init_blocks_table, init_wallet_db},
-        },
-        AccountId, BlockDb, DataConnStmtCache, WalletDb,
-    };
+    #[test]
+    fn send_with_multiple_change_outputs() {
+        testing::pool::send_with_multiple_change_outputs::<SaplingPoolTester>()
+    }
 
+    #[test]
     #[cfg(feature = "transparent-inputs")]
-    use {
-        zcash_client_backend::{
-            data_api::wallet::shield_transparent_funds, fees::fixed,
-            wallet::WalletTransparentOutput,
-        },
-        zcash_primitives::{
-            memo::MemoBytes,
-            transaction::{
-                components::{amount::NonNegativeAmount, OutPoint, TxOut},
-                fees::fixed::FeeRule as FixedFeeRule,
-            },
-        },
-    };
-
-    fn test_prover() -> impl TxProver {
-        match LocalTxProver::with_default_location() {
-            Some(tx_prover) => tx_prover,
-            None => {
-                panic!("Cannot locate the Zcash parameters. Please run zcash-fetch-params or fetch-params.sh to download the parameters, and then re-run the tests.");
-            }
-        }
+    fn send_multi_step_proposed_transfer() {
+        testing::pool::send_multi_step_proposed_transfer::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_fails_on_incorrect_usk() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-        let to = dfvk.default_address().1.into();
-
-        // Create a USK that doesn't exist in the wallet
-        let acct1 = AccountId::from(1);
-        let usk1 = UnifiedSpendingKey::from_seed(&network(), &[1u8; 32], acct1).unwrap();
-
-        // Attempting to spend with a USK that is not in the wallet results in an error
-        let mut db_write = db_data.get_update_ops().unwrap();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk1,
-                &to,
-                Amount::from_u64(1).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::KeyNotRecognized)
-        );
+    #[cfg(feature = "transparent-inputs")]
+    fn proposal_fails_if_not_all_ephemeral_outputs_consumed() {
+        testing::pool::proposal_fails_if_not_all_ephemeral_outputs_consumed::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_fails_with_no_blocks() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-        let to = dfvk.default_address().1.into();
-
-        // We cannot do anything if we aren't synchronised
-        let mut db_write = db_data.get_update_ops().unwrap();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(1).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::ScanRequired)
-        );
+    fn create_to_address_fails_on_incorrect_usk() {
+        testing::pool::create_to_address_fails_on_incorrect_usk::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_fails_on_insufficient_balance() {
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-        init_blocks_table(
-            &db_data,
-            BlockHeight::from(1u32),
-            BlockHash([1; 32]),
-            1,
-            &[],
-        )
-        .unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-        let to = dfvk.default_address().1.into();
-
-        // Account balance should be zero
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            Amount::zero()
-        );
-
-        // We cannot spend anything
-        let mut db_write = db_data.get_update_ops().unwrap();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(1).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::InsufficientFunds {
-                available,
-                required
-            })
-            if available == Amount::zero() && required == Amount::from_u64(10001).unwrap()
-        );
+    fn proposal_fails_with_no_blocks() {
+        testing::pool::proposal_fails_with_no_blocks::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_fails_on_unverified_notes() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-
-        // Add funds to the wallet in a single note
-        let value = Amount::from_u64(50000).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Verified balance matches total balance
-        let (_, anchor_height) = db_data.get_target_and_anchor_heights(10).unwrap().unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-        assert_eq!(
-            get_balance_at(&db_data, AccountId::from(0), anchor_height).unwrap(),
-            value
-        );
-
-        // Add more funds to the wallet in a second note
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height() + 1,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Verified balance does not include the second note
-        let (_, anchor_height2) = db_data.get_target_and_anchor_heights(10).unwrap().unwrap();
-        assert_eq!(
-            get_balance(&db_data, AccountId::from(0)).unwrap(),
-            (value + value).unwrap()
-        );
-        assert_eq!(
-            get_balance_at(&db_data, AccountId::from(0), anchor_height2).unwrap(),
-            value
-        );
-
-        // Spend fails because there are insufficient verified notes
-        let extsk2 = ExtendedSpendingKey::master(&[]);
-        let to = extsk2.default_address().1.into();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(70000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::InsufficientFunds {
-                available,
-                required
-            })
-            if available == Amount::from_u64(50000).unwrap()
-                && required == Amount::from_u64(80000).unwrap()
-        );
-
-        // Mine blocks SAPLING_ACTIVATION_HEIGHT + 2 to 9 until just before the second
-        // note is verified
-        for i in 2..10 {
-            let (cb, _) = fake_compact_block(
-                sapling_activation_height() + i,
-                cb.hash(),
-                &dfvk,
-                AddressType::DefaultExternal,
-                value,
-            );
-            insert_into_cache(&db_cache, &cb);
-        }
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Second spend still fails
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(70000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::InsufficientFunds {
-                available,
-                required
-            })
-            if available == Amount::from_u64(50000).unwrap()
-                && required == Amount::from_u64(80000).unwrap()
-        );
-
-        // Mine block 11 so that the second note becomes verified
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height() + 10,
-            cb.hash(),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Second spend should now succeed
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(70000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Ok(_)
-        );
+    fn spend_fails_on_unverified_notes() {
+        testing::pool::spend_fails_on_unverified_notes::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_fails_on_locked_notes() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, Some(Secret::new(vec![]))).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-
-        // Add funds to the wallet in a single note
-        let value = Amount::from_u64(50000).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-
-        // Send some of the funds to another address
-        let extsk2 = ExtendedSpendingKey::master(&[]);
-        let to = extsk2.default_address().1.into();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(15000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Ok(_)
-        );
-
-        // A second spend fails because there are no usable notes
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(2000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::InsufficientFunds {
-                available,
-                required
-            })
-            if available == Amount::zero() && required == Amount::from_u64(12000).unwrap()
-        );
-
-        // Mine blocks SAPLING_ACTIVATION_HEIGHT + 1 to 41 (that don't send us funds)
-        // until just before the first transaction expires
-        for i in 1..42 {
-            let (cb, _) = fake_compact_block(
-                sapling_activation_height() + i,
-                cb.hash(),
-                &ExtendedSpendingKey::master(&[i as u8]).to_diversifiable_full_viewing_key(),
-                AddressType::DefaultExternal,
-                value,
-            );
-            insert_into_cache(&db_cache, &cb);
-        }
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Second spend still fails
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(2000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Err(data_api::error::Error::InsufficientFunds {
-                available,
-                required
-            })
-            if available == Amount::zero() && required == Amount::from_u64(12000).unwrap()
-        );
-
-        // Mine block SAPLING_ACTIVATION_HEIGHT + 42 so that the first transaction expires
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height() + 42,
-            cb.hash(),
-            &ExtendedSpendingKey::master(&[42]).to_diversifiable_full_viewing_key(),
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Second spend should now succeed
-        create_spend_to_address(
-            &mut db_write,
-            &tests::network(),
-            test_prover(),
-            &usk,
-            &to,
-            Amount::from_u64(2000).unwrap(),
-            None,
-            OvkPolicy::Sender,
-            10,
-        )
-        .unwrap();
+    fn spend_fails_on_locked_notes() {
+        testing::pool::spend_fails_on_locked_notes::<SaplingPoolTester>()
     }
 
     #[test]
     fn ovk_policy_prevents_recovery_from_chain() {
-        let network = tests::network();
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), network).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-
-        // Add funds to the wallet in a single note
-        let value = Amount::from_u64(50000).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-
-        let extsk2 = ExtendedSpendingKey::master(&[]);
-        let addr2 = extsk2.default_address().1;
-        let to = addr2.into();
-
-        let send_and_recover_with_policy = |db_write: &mut DataConnStmtCache<'_, _>, ovk_policy| {
-            let tx_row = create_spend_to_address(
-                db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(15000).unwrap(),
-                None,
-                ovk_policy,
-                10,
-            )
-            .unwrap();
-
-            // Fetch the transaction from the database
-            let raw_tx: Vec<_> = db_write
-                .wallet_db
-                .conn
-                .query_row(
-                    "SELECT raw FROM transactions
-                    WHERE id_tx = ?",
-                    [tx_row],
-                    |row| row.get(0),
-                )
-                .unwrap();
-            let tx = Transaction::read(&raw_tx[..], BranchId::Canopy).unwrap();
-
-            for output in tx.sapling_bundle().unwrap().shielded_outputs() {
-                // Find the output that decrypts with the external OVK
-                let result = try_sapling_output_recovery(
-                    &network,
-                    sapling_activation_height(),
-                    &dfvk.to_ovk(Scope::External),
-                    output,
-                );
-
-                if result.is_some() {
-                    return result;
-                }
-            }
-
-            None
-        };
-
-        // Send some of the funds to another address, keeping history.
-        // The recipient output is decryptable by the sender.
-        let (_, recovered_to, _) =
-            send_and_recover_with_policy(&mut db_write, OvkPolicy::Sender).unwrap();
-        assert_eq!(&recovered_to, &addr2);
-
-        // Mine blocks SAPLING_ACTIVATION_HEIGHT + 1 to 42 (that don't send us funds)
-        // so that the first transaction expires
-        for i in 1..=42 {
-            let (cb, _) = fake_compact_block(
-                sapling_activation_height() + i,
-                cb.hash(),
-                &ExtendedSpendingKey::master(&[i as u8]).to_diversifiable_full_viewing_key(),
-                AddressType::DefaultExternal,
-                value,
-            );
-            insert_into_cache(&db_cache, &cb);
-        }
-        scan_cached_blocks(&network, &db_cache, &mut db_write, None).unwrap();
-
-        // Send the funds again, discarding history.
-        // Neither transaction output is decryptable by the sender.
-        assert!(send_and_recover_with_policy(&mut db_write, OvkPolicy::Discard).is_none());
+        testing::pool::ovk_policy_prevents_recovery_from_chain::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_succeeds_to_t_addr_zero_change() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-
-        // Add funds to the wallet in a single note
-        let value = Amount::from_u64(60000).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::DefaultExternal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Verified balance matches total balance
-        let (_, anchor_height) = db_data.get_target_and_anchor_heights(10).unwrap().unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-        assert_eq!(
-            get_balance_at(&db_data, AccountId::from(0), anchor_height).unwrap(),
-            value
-        );
-
-        let to = TransparentAddress::PublicKey([7; 20]).into();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(50000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Ok(_)
-        );
+    fn spend_succeeds_to_t_addr_zero_change() {
+        testing::pool::spend_succeeds_to_t_addr_zero_change::<SaplingPoolTester>()
     }
 
     #[test]
-    fn create_to_address_spends_a_change_note() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-
-        // Add funds to the wallet in a single note
-        let value = Amount::from_u64(60000).unwrap();
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::Internal,
-            value,
-        );
-        insert_into_cache(&db_cache, &cb);
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Verified balance matches total balance
-        let (_, anchor_height) = db_data.get_target_and_anchor_heights(10).unwrap().unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), value);
-        assert_eq!(
-            get_balance_at(&db_data, AccountId::from(0), anchor_height).unwrap(),
-            value
-        );
+    fn change_note_spends_succeed() {
+        testing::pool::change_note_spends_succeed::<SaplingPoolTester>()
+    }
 
-        let to = TransparentAddress::PublicKey([7; 20]).into();
-        assert_matches!(
-            create_spend_to_address(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &usk,
-                &to,
-                Amount::from_u64(50000).unwrap(),
-                None,
-                OvkPolicy::Sender,
-                10,
-            ),
-            Ok(_)
-        );
+    #[test]
+    fn external_address_change_spends_detected_in_restore_from_seed() {
+        testing::pool::external_address_change_spends_detected_in_restore_from_seed::<
+            SaplingPoolTester,
+        >()
     }
 
     #[test]
+    #[ignore] // FIXME: #1316 This requires support for dust outputs.
+    #[cfg(not(feature = "expensive-tests"))]
     fn zip317_spend() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
-
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
-
-        // Add an account to the wallet
-        let mut ops = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (_, usk) = ops.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-
-        // Add funds to the wallet
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::Internal,
-            Amount::from_u64(50000).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb);
-
-        // Add 10 dust notes to the wallet
-        for i in 1..=10 {
-            let (cb, _) = fake_compact_block(
-                sapling_activation_height() + i,
-                cb.hash(),
-                &dfvk,
-                AddressType::DefaultExternal,
-                Amount::from_u64(1000).unwrap(),
-            );
-            insert_into_cache(&db_cache, &cb);
-        }
-
-        let mut db_write = db_data.get_update_ops().unwrap();
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
-
-        // Verified balance matches total balance
-        let total = Amount::from_u64(60000).unwrap();
-        let (_, anchor_height) = db_data.get_target_and_anchor_heights(1).unwrap().unwrap();
-        assert_eq!(get_balance(&db_data, AccountId::from(0)).unwrap(), total);
-        assert_eq!(
-            get_balance_at(&db_data, AccountId::from(0), anchor_height).unwrap(),
-            total
-        );
-
-        let input_selector = GreedyInputSelector::new(
-            zip317::SingleOutputChangeStrategy::new(Zip317FeeRule::standard()),
-            DustOutputPolicy::default(),
-        );
-
-        // This first request will fail due to insufficient non-dust funds
-        let req = TransactionRequest::new(vec![Payment {
-            recipient_address: RecipientAddress::Shielded(dfvk.default_address().1),
-            amount: Amount::from_u64(50000).unwrap(),
-            memo: None,
-            label: None,
-            message: None,
-            other_params: vec![],
-        }])
-        .unwrap();
-
-        assert_matches!(
-            spend(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &input_selector,
-                &usk,
-                req,
-                OvkPolicy::Sender,
-                1,
-            ),
-            Err(Error::InsufficientFunds { available, required })
-                if available == Amount::from_u64(51000).unwrap()
-                && required == Amount::from_u64(60000).unwrap()
-        );
-
-        // This request will succeed, spending a single dust input to pay the 10000
-        // ZAT fee in addition to the 41000 ZAT output to the recipient
-        let req = TransactionRequest::new(vec![Payment {
-            recipient_address: RecipientAddress::Shielded(dfvk.default_address().1),
-            amount: Amount::from_u64(41000).unwrap(),
-            memo: None,
-            label: None,
-            message: None,
-            other_params: vec![],
-        }])
-        .unwrap();
-
-        assert_matches!(
-            spend(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &input_selector,
-                &usk,
-                req,
-                OvkPolicy::Sender,
-                1,
-            ),
-            Ok(_)
-        );
+        testing::pool::zip317_spend::<SaplingPoolTester>()
     }
 
     #[test]
     #[cfg(feature = "transparent-inputs")]
     fn shield_transparent() {
-        let cache_file = NamedTempFile::new().unwrap();
-        let db_cache = BlockDb(Connection::open(cache_file.path()).unwrap());
-        init_cache_database(&db_cache).unwrap();
+        testing::pool::shield_transparent::<SaplingPoolTester>()
+    }
 
-        let data_file = NamedTempFile::new().unwrap();
-        let mut db_data = WalletDb::for_path(data_file.path(), tests::network()).unwrap();
-        init_wallet_db(&mut db_data, None).unwrap();
+    #[test]
+    fn birthday_in_anchor_shard() {
+        testing::pool::birthday_in_anchor_shard::<SaplingPoolTester>()
+    }
 
-        // Add an account to the wallet
-        let mut db_write = db_data.get_update_ops().unwrap();
-        let seed = Secret::new([0u8; 32].to_vec());
-        let (account_id, usk) = db_write.create_account(&seed).unwrap();
-        let dfvk = usk.sapling().to_diversifiable_full_viewing_key();
-        let uaddr = db_data.get_current_address(account_id).unwrap().unwrap();
-        let taddr = uaddr.transparent().unwrap();
+    #[test]
+    fn checkpoint_gaps() {
+        testing::pool::checkpoint_gaps::<SaplingPoolTester>()
+    }
 
-        let utxo = WalletTransparentOutput::from_parts(
-            OutPoint::new([1u8; 32], 1),
-            TxOut {
-                value: Amount::from_u64(10000).unwrap(),
-                script_pubkey: taddr.script(),
-            },
-            sapling_activation_height(),
-        )
-        .unwrap();
+    #[test]
+    fn scan_cached_blocks_detects_spends_out_of_order() {
+        testing::pool::scan_cached_blocks_detects_spends_out_of_order::<SaplingPoolTester>()
+    }
+
+    #[test]
+    fn metadata_queries_exclude_unwanted_notes() {
+        testing::pool::metadata_queries_exclude_unwanted_notes::<SaplingPoolTester>()
+    }
 
-        let res0 = db_write.put_received_transparent_utxo(&utxo);
-        assert!(matches!(res0, Ok(_)));
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn pool_crossing_required() {
+        testing::pool::pool_crossing_required::<SaplingPoolTester, OrchardPoolTester>()
+    }
 
-        let input_selector = GreedyInputSelector::new(
-            fixed::SingleOutputChangeStrategy::new(FixedFeeRule::standard()),
-            DustOutputPolicy::default(),
-        );
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn fully_funded_fully_private() {
+        testing::pool::fully_funded_fully_private::<SaplingPoolTester, OrchardPoolTester>()
+    }
 
-        // Add funds to the wallet
-        let (cb, _) = fake_compact_block(
-            sapling_activation_height(),
-            BlockHash([0; 32]),
-            &dfvk,
-            AddressType::Internal,
-            Amount::from_u64(50000).unwrap(),
-        );
-        insert_into_cache(&db_cache, &cb);
-        scan_cached_blocks(&tests::network(), &db_cache, &mut db_write, None).unwrap();
+    #[test]
+    #[cfg(all(feature = "orchard", feature = "transparent-inputs"))]
+    fn fully_funded_send_to_t() {
+        testing::pool::fully_funded_send_to_t::<SaplingPoolTester, OrchardPoolTester>()
+    }
 
-        assert_matches!(
-            shield_transparent_funds(
-                &mut db_write,
-                &tests::network(),
-                test_prover(),
-                &input_selector,
-                NonNegativeAmount::from_u64(10000).unwrap(),
-                &usk,
-                &[*taddr],
-                &MemoBytes::empty(),
-                0
-            ),
-            Ok(_)
-        );
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn multi_pool_checkpoint() {
+        testing::pool::multi_pool_checkpoint::<SaplingPoolTester, OrchardPoolTester>()
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn multi_pool_checkpoints_with_pruning() {
+        testing::pool::multi_pool_checkpoints_with_pruning::<SaplingPoolTester, OrchardPoolTester>()
     }
 }
diff --git a/zcash_client_sqlite/src/wallet/scanning.rs b/zcash_client_sqlite/src/wallet/scanning.rs
new file mode 100644
index 0000000000..041f7482d6
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/scanning.rs
@@ -0,0 +1,1901 @@
+use incrementalmerkletree::{Address, Position};
+use rusqlite::{self, named_params, types::Value, OptionalExtension};
+use std::cmp::{max, min};
+use std::collections::BTreeSet;
+use std::ops::Range;
+use std::rc::Rc;
+use tracing::{debug, trace};
+
+use zcash_client_backend::{
+    data_api::{
+        scanning::{spanning_tree::SpanningTree, ScanPriority, ScanRange},
+        SAPLING_SHARD_HEIGHT,
+    },
+    ShieldedProtocol,
+};
+use zcash_primitives::consensus::{self, BlockHeight, NetworkUpgrade};
+
+use crate::{
+    error::SqliteClientError,
+    wallet::{block_height_extrema, init::WalletMigrationError},
+    PRUNING_DEPTH, SAPLING_TABLES_PREFIX, VERIFY_LOOKAHEAD,
+};
+
+use super::wallet_birthday;
+
+#[cfg(feature = "orchard")]
+use {crate::ORCHARD_TABLES_PREFIX, zcash_client_backend::data_api::ORCHARD_SHARD_HEIGHT};
+
+#[cfg(not(feature = "orchard"))]
+use zcash_client_backend::PoolType;
+
+pub(crate) fn priority_code(priority: &ScanPriority) -> i64 {
+    use ScanPriority::*;
+    match priority {
+        Ignored => 0,
+        Scanned => 10,
+        Historic => 20,
+        OpenAdjacent => 30,
+        FoundNote => 40,
+        ChainTip => 50,
+        Verify => 60,
+    }
+}
+
+pub(crate) fn parse_priority_code(code: i64) -> Option<ScanPriority> {
+    use ScanPriority::*;
+    match code {
+        0 => Some(Ignored),
+        10 => Some(Scanned),
+        20 => Some(Historic),
+        30 => Some(OpenAdjacent),
+        40 => Some(FoundNote),
+        50 => Some(ChainTip),
+        60 => Some(Verify),
+        _ => None,
+    }
+}
+
+pub(crate) fn suggest_scan_ranges(
+    conn: &rusqlite::Connection,
+    min_priority: ScanPriority,
+) -> Result<Vec<ScanRange>, SqliteClientError> {
+    let mut stmt_scan_ranges = conn.prepare_cached(
+        "SELECT block_range_start, block_range_end, priority
+         FROM scan_queue
+         WHERE priority >= :min_priority
+         ORDER BY priority DESC, block_range_end DESC",
+    )?;
+
+    let mut rows =
+        stmt_scan_ranges.query(named_params![":min_priority": priority_code(&min_priority)])?;
+
+    let mut result = vec![];
+    while let Some(row) = rows.next()? {
+        let range = Range {
+            start: row.get::<_, u32>(0).map(BlockHeight::from)?,
+            end: row.get::<_, u32>(1).map(BlockHeight::from)?,
+        };
+        let code = row.get::<_, i64>(2)?;
+        let priority = parse_priority_code(code).ok_or_else(|| {
+            SqliteClientError::CorruptedData(format!("scan priority not recognized: {}", code))
+        })?;
+
+        result.push(ScanRange::from_parts(range, priority));
+    }
+
+    Ok(result)
+}
+
+pub(crate) fn insert_queue_entries<'a>(
+    conn: &rusqlite::Connection,
+    entries: impl Iterator<Item = &'a ScanRange>,
+) -> Result<(), rusqlite::Error> {
+    let mut stmt = conn.prepare_cached(
+        "INSERT INTO scan_queue (block_range_start, block_range_end, priority)
+        VALUES (:block_range_start, :block_range_end, :priority)",
+    )?;
+
+    for entry in entries {
+        trace!("Inserting queue entry {}", entry);
+        if !entry.is_empty() {
+            stmt.execute(named_params![
+                ":block_range_start": u32::from(entry.block_range().start),
+                ":block_range_end": u32::from(entry.block_range().end),
+                ":priority": priority_code(&entry.priority())
+            ])?;
+        }
+    }
+
+    Ok(())
+}
+
+/// A trait that abstracts over the construction of wallet errors.
+///
+/// In order to make it possible to use [`replace_queue_entries`] in database migrations as well as
+/// in code that returns `SqliteClientError`, it is necessary for that method to be polymorphic in
+/// the error type.
+pub(crate) trait WalletError {
+    fn db_error(err: rusqlite::Error) -> Self;
+    fn corrupt(message: String) -> Self;
+}
+
+impl WalletError for SqliteClientError {
+    fn db_error(err: rusqlite::Error) -> Self {
+        SqliteClientError::DbError(err)
+    }
+
+    fn corrupt(message: String) -> Self {
+        SqliteClientError::CorruptedData(message)
+    }
+}
+
+impl WalletError for WalletMigrationError {
+    fn db_error(err: rusqlite::Error) -> Self {
+        WalletMigrationError::DbError(err)
+    }
+
+    fn corrupt(message: String) -> Self {
+        WalletMigrationError::CorruptedData(message)
+    }
+}
+
+pub(crate) fn replace_queue_entries<E: WalletError>(
+    conn: &rusqlite::Transaction<'_>,
+    query_range: &Range<BlockHeight>,
+    entries: impl Iterator<Item = ScanRange>,
+    force_rescans: bool,
+) -> Result<(), E> {
+    let (to_create, to_delete_ends) = {
+        let mut suggested_stmt = conn
+            .prepare_cached(
+                "SELECT block_range_start, block_range_end, priority
+                 FROM scan_queue
+                 -- Ignore ranges that do not overlap and are not adjacent to the query range.
+                 WHERE NOT (block_range_start > :end OR :start > block_range_end)
+                 ORDER BY block_range_end",
+            )
+            .map_err(E::db_error)?;
+
+        let mut rows = suggested_stmt
+            .query(named_params![
+                ":start": u32::from(query_range.start),
+                ":end": u32::from(query_range.end),
+            ])
+            .map_err(E::db_error)?;
+
+        // Iterate over the ranges in the scan queue that overlap the range that we have
+        // identified as needing to be fully scanned. For each such range add it to the
+        // spanning tree (these should all be nonoverlapping ranges, but we might coalesce
+        // some in the process).
+        let mut to_create: Option<SpanningTree> = None;
+        let mut to_delete_ends: Vec<Value> = vec![];
+        while let Some(row) = rows.next().map_err(E::db_error)? {
+            let entry = ScanRange::from_parts(
+                Range {
+                    start: BlockHeight::from(row.get::<_, u32>(0).map_err(E::db_error)?),
+                    end: BlockHeight::from(row.get::<_, u32>(1).map_err(E::db_error)?),
+                },
+                {
+                    let code = row.get::<_, i64>(2).map_err(E::db_error)?;
+                    parse_priority_code(code).ok_or_else(|| {
+                        E::corrupt(format!("scan priority not recognized: {}", code))
+                    })?
+                },
+            );
+            to_delete_ends.push(Value::from(u32::from(entry.block_range().end)));
+            to_create = if let Some(cur) = to_create {
+                Some(cur.insert(entry, force_rescans))
+            } else {
+                Some(SpanningTree::Leaf(entry))
+            };
+        }
+
+        // Update the tree that we read from the database, or if we didn't find any ranges
+        // start with the scanned range.
+        for entry in entries {
+            to_create = if let Some(cur) = to_create {
+                Some(cur.insert(entry, force_rescans))
+            } else {
+                Some(SpanningTree::Leaf(entry))
+            };
+        }
+
+        (to_create, to_delete_ends)
+    };
+
+    if let Some(tree) = to_create {
+        let ends_ptr = Rc::new(to_delete_ends);
+        conn.execute(
+            "DELETE FROM scan_queue WHERE block_range_end IN rarray(:ends)",
+            named_params![":ends": ends_ptr],
+        )
+        .map_err(E::db_error)?;
+
+        let scan_ranges = tree.into_vec();
+        insert_queue_entries(conn, scan_ranges.iter()).map_err(E::db_error)?;
+    }
+
+    Ok(())
+}
+
+fn extend_range(
+    conn: &rusqlite::Transaction<'_>,
+    range: &Range<BlockHeight>,
+    required_subtree_indices: BTreeSet<u64>,
+    table_prefix: &'static str,
+    fallback_start_height: Option<BlockHeight>,
+    birthday_height: Option<BlockHeight>,
+) -> Result<Option<Range<BlockHeight>>, SqliteClientError> {
+    // we'll either have both min and max bounds, or we'll have neither
+    let subtree_index_bounds = required_subtree_indices
+        .iter()
+        .min()
+        .zip(required_subtree_indices.iter().max());
+
+    let mut shard_end_stmt = conn.prepare_cached(&format!(
+        "SELECT subtree_end_height
+                FROM {}_tree_shards
+                WHERE shard_index = :shard_index",
+        table_prefix
+    ))?;
+
+    let mut shard_end = |index: u64| -> Result<Option<BlockHeight>, rusqlite::Error> {
+        Ok(shard_end_stmt
+            .query_row(named_params![":shard_index": index], |row| {
+                row.get::<_, Option<u32>>(0)
+                    .map(|opt| opt.map(BlockHeight::from))
+            })
+            .optional()?
+            .flatten())
+    };
+
+    // If no notes belonging to the wallet were found, we don't need to extend the scanning
+    // range suggestions to include the associated subtrees, and our bounds are just the
+    // scanned range. Otherwise, ensure that all shard ranges starting from the wallet
+    // birthday are included.
+    subtree_index_bounds
+        .map(|(min_idx, max_idx)| {
+            let range_min = if *min_idx > 0 {
+                // get the block height of the end of the previous shard
+                shard_end(*min_idx - 1)?
+            } else {
+                // our lower bound is going to be the fallback height
+                fallback_start_height
+            };
+
+            // bound the minimum to the wallet birthday
+            let range_min = range_min.map(|h| birthday_height.map_or(h, |b| std::cmp::max(b, h)));
+
+            // Get the block height for the end of the current shard, and make it an
+            // exclusive end bound.
+            let range_max = shard_end(*max_idx)?.map(|end| end + 1);
+
+            Ok::<Range<BlockHeight>, rusqlite::Error>(Range {
+                start: range.start.min(range_min.unwrap_or(range.start)),
+                end: range.end.max(range_max.unwrap_or(range.end)),
+            })
+        })
+        .transpose()
+        .map_err(SqliteClientError::from)
+}
+
+pub(crate) fn scan_complete<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction<'_>,
+    params: &P,
+    range: Range<BlockHeight>,
+    wallet_note_positions: &[(ShieldedProtocol, Position)],
+) -> Result<(), SqliteClientError> {
+    // Read the wallet birthday (if known).
+    // TODO: use per-pool birthdays?
+    let wallet_birthday = wallet_birthday(conn)?;
+
+    // Determine the range of block heights for which we will be updating the scan queue.
+    let extended_range = {
+        // If notes have been detected in the scan, we need to extend any adjacent un-scanned
+        // ranges starting from the wallet birthday to include the blocks needed to complete
+        // the note commitment tree subtrees containing the positions of the discovered notes.
+        // We will query by subtree index to find these bounds.
+        let mut required_sapling_subtrees = BTreeSet::new();
+        #[cfg(feature = "orchard")]
+        let mut required_orchard_subtrees = BTreeSet::new();
+        for (protocol, position) in wallet_note_positions {
+            match protocol {
+                ShieldedProtocol::Sapling => {
+                    required_sapling_subtrees.insert(
+                        Address::above_position(SAPLING_SHARD_HEIGHT.into(), *position).index(),
+                    );
+                }
+                ShieldedProtocol::Orchard => {
+                    #[cfg(feature = "orchard")]
+                    required_orchard_subtrees.insert(
+                        Address::above_position(ORCHARD_SHARD_HEIGHT.into(), *position).index(),
+                    );
+
+                    #[cfg(not(feature = "orchard"))]
+                    return Err(SqliteClientError::UnsupportedPoolType(PoolType::Shielded(
+                        *protocol,
+                    )));
+                }
+            }
+        }
+
+        let extended_range = extend_range(
+            conn,
+            &range,
+            required_sapling_subtrees,
+            SAPLING_TABLES_PREFIX,
+            params.activation_height(NetworkUpgrade::Sapling),
+            wallet_birthday,
+        )?;
+
+        #[cfg(feature = "orchard")]
+        let extended_range = extend_range(
+            conn,
+            extended_range.as_ref().unwrap_or(&range),
+            required_orchard_subtrees,
+            ORCHARD_TABLES_PREFIX,
+            params.activation_height(NetworkUpgrade::Nu5),
+            wallet_birthday,
+        )?
+        .or(extended_range);
+
+        #[allow(clippy::let_and_return)]
+        extended_range
+    };
+
+    let query_range = extended_range.clone().unwrap_or_else(|| range.clone());
+
+    let scanned = ScanRange::from_parts(range.clone(), ScanPriority::Scanned);
+
+    // If any of the extended range actually extends beyond the scanned range, we need to
+    // scan that extension in order to make the found note(s) spendable. We need to avoid
+    // creating empty ranges here, as that acts as an optimization barrier preventing
+    // `SpanningTree` from merging non-empty scanned ranges on either side.
+    let extended_before = extended_range
+        .as_ref()
+        .map(|extended| ScanRange::from_parts(extended.start..range.start, ScanPriority::FoundNote))
+        .filter(|range| !range.is_empty());
+    let extended_after = extended_range
+        .map(|extended| ScanRange::from_parts(range.end..extended.end, ScanPriority::FoundNote))
+        .filter(|range| !range.is_empty());
+
+    let replacement = Some(scanned)
+        .into_iter()
+        .chain(extended_before)
+        .chain(extended_after);
+
+    replace_queue_entries::<SqliteClientError>(conn, &query_range, replacement, false)?;
+
+    Ok(())
+}
+
+fn tip_shard_end_height(
+    conn: &rusqlite::Transaction<'_>,
+    table_prefix: &'static str,
+) -> Result<Option<BlockHeight>, rusqlite::Error> {
+    conn.query_row(
+        &format!(
+            "SELECT MAX(subtree_end_height) FROM {}_tree_shards",
+            table_prefix
+        ),
+        [],
+        |row| Ok(row.get::<_, Option<u32>>(0)?.map(BlockHeight::from)),
+    )
+}
+
+pub(crate) fn update_chain_tip<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction<'_>,
+    params: &P,
+    new_tip: BlockHeight,
+) -> Result<(), SqliteClientError> {
+    // If the caller provided a chain tip that is before Sapling activation, do nothing.
+    let sapling_activation = match params.activation_height(NetworkUpgrade::Sapling) {
+        Some(h) if h <= new_tip => h,
+        _ => return Ok(()),
+    };
+
+    // Read the previous max scanned height from the blocks table
+    let max_scanned = block_height_extrema(conn)?.map(|range| *range.end());
+
+    // Read the wallet birthday (if known).
+    let wallet_birthday = wallet_birthday(conn)?;
+
+    // If the chain tip is below the prior max scanned height, then the caller has caught
+    // the chain in the middle of a reorg. Do nothing; the caller will continue using the
+    // old scan ranges and either:
+    // - encounter an error trying to fetch the blocks (and thus trigger the same handling
+    //   logic as if this happened with the old linear scanning code); or
+    // - encounter a discontinuity error in `scan_cached_blocks`, at which point they will
+    //   call `WalletDb::truncate_to_height` as part of their reorg handling which will
+    //   resolve the problem.
+    //
+    // We don't check the shard height, as normal usage would have the caller update the
+    // shard state prior to this call, so it is possible and expected to be in a situation
+    // where we should update the tip-related scan ranges but not the shard-related ones.
+    match max_scanned {
+        Some(h) if new_tip < h => return Ok(()),
+        _ => (),
+    };
+
+    // `ScanRange` uses an exclusive upper bound.
+    let chain_end = new_tip + 1;
+
+    // Read the maximum height from each of the shards tables. The minimum of the two
+    // gives the start of a height range that covers the last incomplete shard of both the
+    // Sapling and Orchard pools.
+    let sapling_shard_tip = tip_shard_end_height(conn, SAPLING_TABLES_PREFIX)?;
+    #[cfg(feature = "orchard")]
+    let orchard_shard_tip = tip_shard_end_height(conn, ORCHARD_TABLES_PREFIX)?;
+
+    #[cfg(feature = "orchard")]
+    let min_shard_tip = match (sapling_shard_tip, orchard_shard_tip) {
+        (None, None) => None,
+        (None, Some(o)) => Some(o),
+        (Some(s), None) => Some(s),
+        (Some(s), Some(o)) => Some(std::cmp::min(s, o)),
+    };
+    #[cfg(not(feature = "orchard"))]
+    let min_shard_tip = sapling_shard_tip;
+
+    // Create a scanning range for the fragment of the last shard leading up to new tip.
+    // We set a lower bound at the wallet birthday (if known), because account creation
+    // requires specifying a tree frontier that ensures we don't need tree information
+    // prior to the birthday.
+    let tip_shard_entry = min_shard_tip.filter(|h| h < &chain_end).map(|h| {
+        let min_to_scan = wallet_birthday.filter(|b| b > &h).unwrap_or(h);
+        ScanRange::from_parts(min_to_scan..chain_end, ScanPriority::ChainTip)
+    });
+
+    // Create scan ranges to either validate potentially invalid blocks at the wallet's
+    // view of the chain tip, or connect the prior tip to the new tip.
+    let tip_entry = max_scanned.map_or_else(
+        || {
+            // No blocks have been scanned, so we need to anchor the start of the new scan
+            // range to something else.
+            wallet_birthday.map_or_else(
+                // We don't have a wallet birthday, which means we have no accounts yet.
+                // We can therefore ignore all blocks up to the chain tip.
+                || ScanRange::from_parts(sapling_activation..chain_end, ScanPriority::Ignored),
+                // We have a wallet birthday, so mark all blocks between that and the
+                // chain tip as `Historic` (performing wallet recovery).
+                |wallet_birthday| {
+                    ScanRange::from_parts(wallet_birthday..chain_end, ScanPriority::Historic)
+                },
+            )
+        },
+        |max_scanned| {
+            // The scan range starts at the block after the max scanned height. Since
+            // `scan_cached_blocks` retrieves the metadata for the block being connected to
+            // (if it exists), the connectivity of the scan range to the max scanned block
+            // will always be checked if relevant.
+            let min_unscanned = max_scanned + 1;
+
+            // If we don't have shard metadata, this means we're doing linear scanning, so
+            // create a scan range from the prior tip to the current tip with `Historic`
+            // priority.
+            if tip_shard_entry.is_none() {
+                ScanRange::from_parts(min_unscanned..chain_end, ScanPriority::Historic)
+            } else {
+                // Determine the height to which we expect new blocks retrieved from the
+                // block source to be stable and not subject to being reorg'ed.
+                let stable_height = new_tip.saturating_sub(PRUNING_DEPTH);
+
+                // If the wallet's max scanned height is above the stable height,
+                // prioritize the range between it and the new tip as `ChainTip`.
+                if max_scanned > stable_height {
+                    // We are in the steady-state case, where a wallet is close to the
+                    // chain tip and just needs to catch up.
+                    //
+                    // This overlaps the `tip_shard_entry` range and so will be coalesced
+                    // with it.
+                    ScanRange::from_parts(min_unscanned..chain_end, ScanPriority::ChainTip)
+                } else {
+                    // In this case, the max scanned height is considered stable relative
+                    // to the chain tip. However, it may be stable or unstable relative to
+                    // the prior chain tip, which we could determine by looking up the
+                    // prior chain tip height from the scan queue. For simplicity we merge
+                    // these two cases together, and proceed as though the max scanned
+                    // block is unstable relative to the prior chain tip.
+                    //
+                    // To confirm its stability, prioritize the `VERIFY_LOOKAHEAD` blocks
+                    // above the max scanned height as `Verify`:
+                    //
+                    // - We use `Verify` to ensure that a connectivity check is performed,
+                    //   along with any required rewinds, before any `ChainTip` ranges
+                    //   (from this or any prior `update_chain_tip` call) are scanned.
+                    //
+                    // - We prioritize `VERIFY_LOOKAHEAD` blocks because this is expected
+                    //   to be 12.5 minutes, within which it is reasonable for a user to
+                    //   have potentially received a transaction (if they opened their
+                    //   wallet to provide an address to someone else, or spent their own
+                    //   funds creating a change output), without necessarily having left
+                    //   their wallet open long enough for the transaction to be mined and
+                    //   the corresponding block to be scanned.
+                    //
+                    // - We limit the range to at most the stable region, to prevent any
+                    //   `Verify` ranges from being susceptible to reorgs, and potentially
+                    //   interfering with subsequent `Verify` ranges defined by future
+                    //   calls to `update_chain_tip`. Any gap between `stable_height` and
+                    //   `shard_start_height` will be filled by the scan range merging
+                    //   logic with a `Historic` range.
+                    //
+                    // If `max_scanned == stable_height` then this is a zero-length range.
+                    // In this case, any non-empty `(stable_height+1)..shard_start_height`
+                    // will be marked `Historic`, minimising the prioritised blocks at the
+                    // chain tip and allowing for other ranges (for example, `FoundNote`)
+                    // to take priority.
+                    ScanRange::from_parts(
+                        min_unscanned..min(stable_height + 1, min_unscanned + VERIFY_LOOKAHEAD),
+                        ScanPriority::Verify,
+                    )
+                }
+            }
+        },
+    );
+    if let Some(entry) = &tip_shard_entry {
+        debug!("{} will update latest shard", entry);
+    }
+    debug!("{} will connect prior scanned state to new tip", tip_entry);
+
+    let query_range = match tip_shard_entry.as_ref() {
+        Some(se) => Range {
+            start: min(se.block_range().start, tip_entry.block_range().start),
+            end: max(se.block_range().end, tip_entry.block_range().end),
+        },
+        None => tip_entry.block_range().clone(),
+    };
+
+    replace_queue_entries::<SqliteClientError>(
+        conn,
+        &query_range,
+        tip_shard_entry.into_iter().chain(Some(tip_entry)),
+        false,
+    )?;
+
+    Ok(())
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::num::NonZeroU8;
+
+    use incrementalmerkletree::{frontier::Frontier, Hashable, Position};
+
+    use secrecy::SecretVec;
+    use zcash_client_backend::data_api::{
+        chain::{ChainState, CommitmentTreeRoot},
+        scanning::{spanning_tree::testing::scan_range, ScanPriority},
+        testing::{
+            pool::ShieldedPoolTester, sapling::SaplingPoolTester, AddressType, FakeCompactOutput,
+            InitialChainState, TestBuilder, TestState,
+        },
+        AccountBirthday, Ratio, WalletRead, WalletWrite,
+    };
+    use zcash_primitives::{
+        block::BlockHash,
+        consensus::{BlockHeight, NetworkUpgrade, Parameters},
+        transaction::components::amount::NonNegativeAmount,
+    };
+    use zcash_protocol::local_consensus::LocalNetwork;
+
+    use crate::{
+        error::SqliteClientError,
+        testing::{
+            db::{TestDb, TestDbFactory},
+            BlockCache,
+        },
+        wallet::scanning::{insert_queue_entries, replace_queue_entries, suggest_scan_ranges},
+        VERIFY_LOOKAHEAD,
+    };
+
+    #[cfg(feature = "orchard")]
+    use {
+        incrementalmerkletree::Level,
+        orchard::tree::MerkleHashOrchard,
+        std::{convert::Infallible, num::NonZeroU32},
+        zcash_client_backend::{
+            data_api::{
+                testing::orchard::OrchardPoolTester, wallet::input_selection::GreedyInputSelector,
+                WalletCommitmentTrees,
+            },
+            fees::{standard, DustOutputPolicy, StandardFeeRule},
+            wallet::OvkPolicy,
+        },
+        zcash_primitives::memo::Memo,
+    };
+
+    #[test]
+    fn sapling_scan_complete() {
+        scan_complete::<SaplingPoolTester>();
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn orchard_scan_complete() {
+        scan_complete::<OrchardPoolTester>();
+    }
+
+    fn scan_complete<T: ShieldedPoolTester>() {
+        use ScanPriority::*;
+
+        // We'll start inserting leaf notes 5 notes after the end of the third subtree, with a gap
+        // of 10 blocks. After `scan_cached_blocks`, the scan queue should have a requested scan
+        // range of 300..310 with `FoundNote` priority, 310..320 with `Scanned` priority.
+        // We set both Sapling and Orchard to the same initial tree size for simplicity.
+        let prior_block_hash = BlockHash([0; 32]);
+        let initial_sapling_tree_size: u32 = (0x1 << 16) * 3 + 5;
+        let initial_orchard_tree_size: u32 = (0x1 << 16) * 3 + 5;
+        let initial_height_offset = 310;
+
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_initial_chain_state(|rng, network| {
+                let sapling_activation_height =
+                    network.activation_height(NetworkUpgrade::Sapling).unwrap();
+                // Construct a fake chain state for the end of block 300
+                let (prior_sapling_roots, sapling_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        initial_sapling_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                let prior_sapling_roots = prior_sapling_roots
+                    .into_iter()
+                    .zip(1u32..)
+                    .map(|(root, i)| {
+                        CommitmentTreeRoot::from_parts(sapling_activation_height + (100 * i), root)
+                    })
+                    .collect::<Vec<_>>();
+
+                #[cfg(feature = "orchard")]
+                let (prior_orchard_roots, orchard_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        initial_orchard_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                #[cfg(feature = "orchard")]
+                let prior_orchard_roots = prior_orchard_roots
+                    .into_iter()
+                    .zip(1u32..)
+                    .map(|(root, i)| {
+                        CommitmentTreeRoot::from_parts(sapling_activation_height + (100 * i), root)
+                    })
+                    .collect::<Vec<_>>();
+
+                InitialChainState {
+                    chain_state: ChainState::new(
+                        sapling_activation_height + initial_height_offset - 1,
+                        prior_block_hash,
+                        sapling_initial_tree,
+                        #[cfg(feature = "orchard")]
+                        orchard_initial_tree,
+                    ),
+                    prior_sapling_roots,
+                    #[cfg(feature = "orchard")]
+                    prior_orchard_roots,
+                }
+            })
+            .with_account_from_sapling_activation(BlockHash([3; 32]))
+            .build();
+
+        let sapling_activation_height = st.sapling_activation_height();
+
+        let dfvk = T::test_account_fvk(&st);
+        let value = NonNegativeAmount::const_from_u64(50000);
+        let initial_height = sapling_activation_height + initial_height_offset;
+        st.generate_block_at(
+            initial_height,
+            prior_block_hash,
+            &[FakeCompactOutput::new(
+                &dfvk,
+                AddressType::DefaultExternal,
+                value,
+            )],
+            initial_sapling_tree_size,
+            initial_orchard_tree_size,
+            false,
+        );
+
+        for _ in 1..=10 {
+            st.generate_next_block(
+                &dfvk,
+                AddressType::DefaultExternal,
+                NonNegativeAmount::const_from_u64(10000),
+            );
+        }
+
+        st.scan_cached_blocks(initial_height, 10);
+
+        // Verify the that adjacent range needed to make the note spendable has been prioritized.
+        let sap_active = u32::from(sapling_activation_height);
+        assert_matches!(
+            suggest_scan_ranges(st.wallet().conn(), Historic),
+            Ok(scan_ranges) if scan_ranges == vec![
+                scan_range((sap_active + 300)..(sap_active + 310), FoundNote)
+            ]
+        );
+
+        // Check that the scanned range has been properly persisted.
+        assert_matches!(
+            suggest_scan_ranges(st.wallet().conn(), Scanned),
+            Ok(scan_ranges) if scan_ranges == vec![
+                scan_range((sap_active + 300)..(sap_active + 310), FoundNote),
+                scan_range((sap_active + 310)..(sap_active + 320), Scanned)
+            ]
+        );
+
+        // Simulate the wallet going offline for a bit, update the chain tip to 20 blocks in the
+        // future.
+        assert_matches!(
+            st.wallet_mut()
+                .update_chain_tip(sapling_activation_height + 340),
+            Ok(())
+        );
+
+        // Check the scan range again, we should see a `ChainTip` range for the period we've been
+        // offline.
+        assert_matches!(
+            suggest_scan_ranges(st.wallet().conn(), Historic),
+            Ok(scan_ranges) if scan_ranges == vec![
+                scan_range((sap_active + 320)..(sap_active + 341), ChainTip),
+                scan_range((sap_active + 300)..(sap_active + 310), ChainTip)
+            ]
+        );
+
+        // Now simulate a jump ahead more than 100 blocks.
+        assert_matches!(
+            st.wallet_mut()
+                .update_chain_tip(sapling_activation_height + 450),
+            Ok(())
+        );
+
+        // Check the scan range again, we should see a `Validate` range for the previous wallet
+        // tip, and then a `ChainTip` for the remaining range.
+        assert_matches!(
+            suggest_scan_ranges(st.wallet().conn(), Historic),
+            Ok(scan_ranges) if scan_ranges == vec![
+                scan_range((sap_active + 320)..(sap_active + 330), Verify),
+                scan_range((sap_active + 330)..(sap_active + 451), ChainTip),
+                scan_range((sap_active + 300)..(sap_active + 310), ChainTip)
+            ]
+        );
+
+        // The wallet summary should be requesting the second-to-last root, as the last
+        // shard is incomplete.
+        assert_eq!(
+            st.wallet()
+                .get_wallet_summary(0)
+                .unwrap()
+                .map(|s| T::next_subtree_index(&s)),
+            Some(2),
+        );
+    }
+
+    /// Creates wallet and chain state such that:
+    /// * Shielded chain history begins at NU5 activation
+    /// * Both the Sapling and the Orchard note commitment trees have the following structure:
+    /// * The initial 2^16 shard of the note commitment tree covers `initial_shard_blocks` blocks.
+    ///   If `insert_prior_roots` is set, the root of the initial shard is inserted into each note
+    ///   commitment tree. This can be used to simulate the circumstance where note commitment tree
+    ///   roots have been inserted prior to scanning.
+    /// * The wallet birthday is located `birthday_offset` blocks into the second shard.
+    /// * The note commitment tree contains 2^16+1235 notes at the end of the block prior to the
+    ///   wallet birthday.
+    pub(crate) fn test_with_nu5_birthday_offset<T: ShieldedPoolTester>(
+        initial_shard_blocks: u32,
+        birthday_offset: u32,
+        prior_block_hash: BlockHash,
+        insert_prior_roots: bool,
+    ) -> (
+        TestState<BlockCache, TestDb, LocalNetwork>,
+        T::Fvk,
+        AccountBirthday,
+        u32,
+    ) {
+        let st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_initial_chain_state(|rng, network| {
+                // We set the Sapling and Orchard frontiers at the birthday height to be
+                // 1234 notes into the second shard.
+                let frontier_position = Position::from((0x1 << 16) + 1234);
+                let initial_shard_end =
+                    network.activation_height(NetworkUpgrade::Nu5).unwrap() + initial_shard_blocks;
+                let birthday_height = initial_shard_end + birthday_offset;
+
+                // Construct a fake chain state for the end of the block with the given
+                // birthday_offset from the end of the last shard.
+                let (prior_sapling_roots, sapling_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        (frontier_position + 1).into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                #[cfg(feature = "orchard")]
+                let (prior_orchard_roots, orchard_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        (frontier_position + 1).into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+
+                InitialChainState {
+                    chain_state: ChainState::new(
+                        birthday_height,
+                        prior_block_hash,
+                        sapling_initial_tree,
+                        #[cfg(feature = "orchard")]
+                        orchard_initial_tree,
+                    ),
+                    prior_sapling_roots: if insert_prior_roots {
+                        prior_sapling_roots
+                            .into_iter()
+                            .map(|root| CommitmentTreeRoot::from_parts(initial_shard_end, root))
+                            .collect()
+                    } else {
+                        vec![]
+                    },
+                    #[cfg(feature = "orchard")]
+                    prior_orchard_roots: if insert_prior_roots {
+                        prior_orchard_roots
+                            .into_iter()
+                            .map(|root| CommitmentTreeRoot::from_parts(initial_shard_end, root))
+                            .collect()
+                    } else {
+                        vec![]
+                    },
+                }
+            })
+            .with_account_having_current_birthday()
+            .build();
+
+        let birthday = st.test_account().unwrap().birthday().clone();
+        let dfvk = T::test_account_fvk(&st);
+        let sap_active = st.sapling_activation_height();
+
+        (st, dfvk, birthday, sap_active.into())
+    }
+
+    #[test]
+    fn sapling_create_account_creates_ignored_range() {
+        create_account_creates_ignored_range::<SaplingPoolTester>();
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn orchard_create_account_creates_ignored_range() {
+        create_account_creates_ignored_range::<OrchardPoolTester>();
+    }
+
+    fn create_account_creates_ignored_range<T: ShieldedPoolTester>() {
+        use ScanPriority::*;
+
+        // Use a non-zero birthday offset because Sapling and NU5 are activated at the same height.
+        let (st, _, birthday, sap_active) =
+            test_with_nu5_birthday_offset::<T>(50, 26, BlockHash([0; 32]), true);
+        let birthday_height = birthday.height().into();
+
+        let expected = vec![
+            // The range up to the wallet's birthday height is ignored.
+            scan_range(sap_active..birthday_height, Ignored),
+        ];
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    #[test]
+    fn update_chain_tip_before_create_account() {
+        use ScanPriority::*;
+
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .build();
+        let sap_active = st.sapling_activation_height();
+
+        // Update the chain tip.
+        let new_tip = sap_active + 1000;
+        st.wallet_mut().update_chain_tip(new_tip).unwrap();
+        let chain_end = u32::from(new_tip + 1);
+
+        let expected = vec![
+            // The range up to the chain end is ignored.
+            scan_range(sap_active.into()..chain_end, Ignored),
+        ];
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // Now add an account.
+        let wallet_birthday = sap_active + 500;
+        st.wallet_mut()
+            .create_account(
+                "",
+                &SecretVec::new(vec![0; 32]),
+                &AccountBirthday::from_parts(
+                    ChainState::empty(wallet_birthday - 1, BlockHash([0; 32])),
+                    None,
+                ),
+                None,
+            )
+            .unwrap();
+
+        let expected = vec![
+            // The account's birthday onward is marked for recovery.
+            scan_range(wallet_birthday.into()..chain_end, Historic),
+            // The range up to the wallet's birthday height is ignored.
+            scan_range(sap_active.into()..wallet_birthday.into(), Ignored),
+        ];
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    #[test]
+    fn sapling_update_chain_tip_with_no_subtree_roots() {
+        update_chain_tip_with_no_subtree_roots::<SaplingPoolTester>();
+    }
+
+    #[cfg(feature = "orchard")]
+    #[test]
+    fn orchard_update_chain_tip_with_no_subtree_roots() {
+        update_chain_tip_with_no_subtree_roots::<OrchardPoolTester>();
+    }
+
+    fn update_chain_tip_with_no_subtree_roots<T: ShieldedPoolTester>() {
+        use ScanPriority::*;
+
+        // Use a non-zero birthday offset because Sapling and NU5 are activated at the same height.
+        let (mut st, _, birthday, sap_active) =
+            test_with_nu5_birthday_offset::<T>(50, 26, BlockHash([0; 32]), false);
+
+        // Set up the following situation:
+        //
+        //   prior_tip      new_tip
+        //       |<--- 500 --->|
+        // wallet_birthday
+        let prior_tip = birthday.height();
+        let wallet_birthday = birthday.height().into();
+
+        // Update the chain tip.
+        let new_tip = prior_tip + 500;
+        st.wallet_mut().update_chain_tip(new_tip).unwrap();
+        let chain_end = u32::from(new_tip + 1);
+
+        // Verify that the suggested scan ranges match what is expected.
+        let expected = vec![
+            // The wallet's birthday onward is marked for recovery. Because we don't
+            // yet have any chain state, it is marked with `Historic` priority rather
+            // than `ChainTip`.
+            scan_range(wallet_birthday..chain_end, Historic),
+            // The range below the wallet's birthday height is ignored.
+            scan_range(sap_active..wallet_birthday, Ignored),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    #[test]
+    fn sapling_update_chain_tip_when_never_scanned() {
+        update_chain_tip_when_never_scanned::<SaplingPoolTester>();
+    }
+
+    #[cfg(feature = "orchard")]
+    #[test]
+    fn orchard_update_chain_tip_when_never_scanned() {
+        update_chain_tip_when_never_scanned::<OrchardPoolTester>();
+    }
+
+    fn update_chain_tip_when_never_scanned<T: ShieldedPoolTester>() {
+        use ScanPriority::*;
+
+        // Use a non-zero birthday offset because Sapling and NU5 are activated at the same height.
+        let (mut st, _, birthday, sap_active) =
+            test_with_nu5_birthday_offset::<T>(76, 1000, BlockHash([0; 32]), true);
+
+        // Set up the following situation:
+        //
+        // last_shard_start      prior_tip      new_tip
+        //        |<----- 1000 ----->|<--- 500 --->|
+        //                    wallet_birthday
+        let prior_tip_height = birthday.height();
+
+        // Update the chain tip.
+        let tip_height = prior_tip_height + 500;
+        st.wallet_mut().update_chain_tip(tip_height).unwrap();
+        let chain_end = u32::from(tip_height + 1);
+
+        // Verify that the suggested scan ranges match what is expected.
+        let expected = vec![
+            // The last (incomplete) shard's range starting from the wallet birthday is
+            // marked for catching up to the chain tip, to ensure that if any notes are
+            // discovered after the wallet's birthday, they will be spendable.
+            scan_range(birthday.height().into()..chain_end, ChainTip),
+            // The range below the birthday height is ignored.
+            scan_range(sap_active..birthday.height().into(), Ignored),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    #[test]
+    fn sapling_update_chain_tip_unstable_max_scanned() {
+        update_chain_tip_unstable_max_scanned::<SaplingPoolTester>();
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn orchard_update_chain_tip_unstable_max_scanned() {
+        update_chain_tip_unstable_max_scanned::<OrchardPoolTester>();
+    }
+
+    fn update_chain_tip_unstable_max_scanned<T: ShieldedPoolTester>() {
+        use ScanPriority::*;
+        // Set up the following situation:
+        //
+        //                                                prior_tip           new_tip
+        //        |<------- 10 ------->|<--- 500 --->|<- 40 ->|<-- 70 -->|<- 20 ->|
+        // initial_shard_end    wallet_birthday  max_scanned     last_shard_start
+        //
+        let birthday_offset = 76;
+        let birthday_prior_block_hash = BlockHash([0; 32]);
+        // We set the Sapling and Orchard frontiers at the birthday block initial state to 1234
+        // notes beyond the end of the first shard.
+        let frontier_tree_size: u32 = (0x1 << 16) + 1234;
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_initial_chain_state(|rng, network| {
+                let birthday_height =
+                    network.activation_height(NetworkUpgrade::Nu5).unwrap() + birthday_offset;
+
+                // Construct a fake chain state for the end of the block with the given
+                // birthday_offset from the Nu5 birthday.
+                let (prior_sapling_roots, sapling_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        frontier_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                // There will only be one prior root
+                let prior_sapling_roots = prior_sapling_roots
+                    .into_iter()
+                    .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 10, root))
+                    .collect::<Vec<_>>();
+
+                #[cfg(feature = "orchard")]
+                let (prior_orchard_roots, orchard_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        frontier_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                // There will only be one prior root
+                #[cfg(feature = "orchard")]
+                let prior_orchard_roots = prior_orchard_roots
+                    .into_iter()
+                    .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 10, root))
+                    .collect::<Vec<_>>();
+
+                InitialChainState {
+                    chain_state: ChainState::new(
+                        birthday_height - 1,
+                        birthday_prior_block_hash,
+                        sapling_initial_tree,
+                        #[cfg(feature = "orchard")]
+                        orchard_initial_tree,
+                    ),
+                    prior_sapling_roots,
+                    #[cfg(feature = "orchard")]
+                    prior_orchard_roots,
+                }
+            })
+            .with_account_having_current_birthday()
+            .build();
+
+        let account = st.test_account().cloned().unwrap();
+        let dfvk = T::test_account_fvk(&st);
+        let sap_active = st.sapling_activation_height();
+        let max_scanned = account.birthday().height() + 500;
+
+        // Set up prior chain state. This simulates us having imported a wallet
+        // with a birthday 520 blocks below the chain tip.
+        let prior_tip = max_scanned + 40;
+        st.wallet_mut().update_chain_tip(prior_tip).unwrap();
+
+        let pre_birthday_range = scan_range(
+            sap_active.into()..account.birthday().height().into(),
+            Ignored,
+        );
+
+        // Verify that the suggested scan ranges match what is expected.
+        let expected = vec![
+            scan_range(
+                account.birthday().height().into()..(prior_tip + 1).into(),
+                ChainTip,
+            ),
+            pre_birthday_range.clone(),
+        ];
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // Simulate that in the blocks between the wallet birthday and the max_scanned height,
+        // there are 10 Sapling notes and 10 Orchard notes created on the chain.
+        st.generate_block_at(
+            max_scanned,
+            BlockHash([1u8; 32]),
+            &[FakeCompactOutput::new(
+                &dfvk,
+                AddressType::DefaultExternal,
+                // 1235 notes into the second shard
+                NonNegativeAmount::const_from_u64(10000),
+            )],
+            frontier_tree_size + 10,
+            frontier_tree_size + 10,
+            false,
+        );
+        st.scan_cached_blocks(max_scanned, 1);
+
+        // Verify that the suggested scan ranges match what is expected.
+        let expected = vec![
+            scan_range((max_scanned + 1).into()..(prior_tip + 1).into(), ChainTip),
+            scan_range(
+                account.birthday().height().into()..max_scanned.into(),
+                ChainTip,
+            ),
+            scan_range(max_scanned.into()..(max_scanned + 1).into(), Scanned),
+            pre_birthday_range.clone(),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // Now simulate shutting down, and then restarting 90 blocks later, after a shard
+        // has been completed. We have to update both trees, because otherwise we will pick the
+        // lesser of the tip shard start heights as where we must scan from.
+        let last_shard_start = prior_tip + 70;
+        st.put_subtree_roots(
+            1,
+            &[CommitmentTreeRoot::from_parts(
+                last_shard_start,
+                // fake a hash, the value doesn't matter
+                sapling::Node::empty_leaf(),
+            )],
+            #[cfg(feature = "orchard")]
+            1,
+            #[cfg(feature = "orchard")]
+            &[CommitmentTreeRoot::from_parts(
+                last_shard_start,
+                // fake a hash, the value doesn't matter
+                MerkleHashOrchard::empty_leaf(),
+            )],
+        )
+        .unwrap();
+
+        // Just inserting the subtree roots doesn't affect the scan ranges.
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        let new_tip = last_shard_start + 20;
+        st.wallet_mut().update_chain_tip(new_tip).unwrap();
+
+        // Verify that the suggested scan ranges match what is expected
+        let expected = vec![
+            // The max scanned block's connectivity is verified by scanning the next 10 blocks.
+            scan_range(
+                (max_scanned + 1).into()..(max_scanned + 1 + VERIFY_LOOKAHEAD).into(),
+                Verify,
+            ),
+            // The last shard needs to catch up to the chain tip in order to make notes spendable.
+            scan_range(last_shard_start.into()..u32::from(new_tip + 1), ChainTip),
+            // The range between the verification blocks and the prior tip is still in the queue.
+            scan_range(
+                (max_scanned + 1 + VERIFY_LOOKAHEAD).into()..(prior_tip + 1).into(),
+                ChainTip,
+            ),
+            // The remainder of the second-to-last shard's range is still in the queue.
+            scan_range(
+                account.birthday().height().into()..max_scanned.into(),
+                ChainTip,
+            ),
+            // The gap between the prior tip and the last shard is deferred as low priority.
+            scan_range((prior_tip + 1).into()..last_shard_start.into(), Historic),
+            // The max scanned block itself is left as-is.
+            scan_range(max_scanned.into()..(max_scanned + 1).into(), Scanned),
+            // The range below the second-to-last shard is ignored.
+            pre_birthday_range,
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    #[test]
+    fn sapling_update_chain_tip_stable_max_scanned() {
+        update_chain_tip_stable_max_scanned::<SaplingPoolTester>();
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn orchard_update_chain_tip_stable_max_scanned() {
+        update_chain_tip_stable_max_scanned::<OrchardPoolTester>();
+    }
+
+    fn update_chain_tip_stable_max_scanned<T: ShieldedPoolTester>() {
+        use ScanPriority::*;
+
+        // Set up the following situation:
+        //
+        //                            prior_tip           new_tip
+        //        |<--- 500 --->|<- 20 ->|<-- 50 -->|<- 20 ->|
+        // wallet_birthday  max_scanned     last_shard_start
+        //
+        let birthday_offset = 76;
+        let birthday_prior_block_hash = BlockHash([0; 32]);
+        // We set the Sapling and Orchard frontiers at the birthday block initial state to 1234
+        // notes beyond the end of the first shard.
+        let frontier_tree_size: u32 = (0x1 << 16) + 1234;
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_initial_chain_state(|rng, network| {
+                let birthday_height =
+                    network.activation_height(NetworkUpgrade::Nu5).unwrap() + birthday_offset;
+
+                // Construct a fake chain state for the end of the block with the given
+                // birthday_offset from the Nu5 birthday.
+                let (prior_sapling_roots, sapling_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        frontier_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                // There will only be one prior root
+                let prior_sapling_roots = prior_sapling_roots
+                    .into_iter()
+                    .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 10, root))
+                    .collect::<Vec<_>>();
+
+                #[cfg(feature = "orchard")]
+                let (prior_orchard_roots, orchard_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        frontier_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+                // There will only be one prior root
+                #[cfg(feature = "orchard")]
+                let prior_orchard_roots = prior_orchard_roots
+                    .into_iter()
+                    .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 10, root))
+                    .collect::<Vec<_>>();
+
+                InitialChainState {
+                    chain_state: ChainState::new(
+                        birthday_height - 1,
+                        birthday_prior_block_hash,
+                        sapling_initial_tree,
+                        #[cfg(feature = "orchard")]
+                        orchard_initial_tree,
+                    ),
+                    prior_sapling_roots,
+                    #[cfg(feature = "orchard")]
+                    prior_orchard_roots,
+                }
+            })
+            .with_account_having_current_birthday()
+            .build();
+
+        let account = st.test_account().cloned().unwrap();
+        let dfvk = T::test_account_fvk(&st);
+        let birthday = account.birthday();
+        let sap_active = st.sapling_activation_height();
+
+        // If none of the wallet's accounts have a recover-until height, then there
+        // is no recovery phase for the wallet, and therefore the denominator in the
+        // resulting ratio (the number of notes in the recovery range) is zero.
+        let no_recovery = Some(Ratio::new(0, 0));
+
+        // We have scan ranges and a subtree, but have scanned no blocks. Given the number of
+        // blocks scanned in the previous subtree, we estimate the number of notes in the current
+        // subtree
+        let summary = st.get_wallet_summary(1);
+        assert_eq!(
+            summary.as_ref().and_then(|s| s.progress().recovery()),
+            no_recovery,
+        );
+        assert_matches!(
+            summary.map(|s| s.progress().scan()),
+            Some(ratio) if *ratio.numerator() == 0
+        );
+
+        // Set up prior chain state. This simulates us having imported a wallet
+        // with a birthday 520 blocks below the chain tip.
+        let max_scanned = birthday.height() + 500;
+        let prior_tip = max_scanned + 20;
+        st.wallet_mut().update_chain_tip(prior_tip).unwrap();
+
+        // Verify that the suggested scan ranges match what is expected.
+        let expected = vec![
+            scan_range(birthday.height().into()..(prior_tip + 1).into(), ChainTip),
+            scan_range(sap_active.into()..birthday.height().into(), Ignored),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // Simulate that in the blocks between the wallet birthday and the max_scanned height,
+        // there are 10 Sapling notes and 10 Orchard notes created on the chain.
+        st.generate_block_at(
+            max_scanned,
+            BlockHash([1; 32]),
+            &[FakeCompactOutput::new(
+                &dfvk,
+                AddressType::DefaultExternal,
+                NonNegativeAmount::const_from_u64(10000),
+            )],
+            frontier_tree_size + 10,
+            frontier_tree_size + 10,
+            false,
+        );
+        st.scan_cached_blocks(max_scanned, 1);
+
+        // We have scanned a block, so we now have a starting tree position, 500 blocks above the
+        // wallet birthday but before the end of the shard.
+        let summary = st.get_wallet_summary(1);
+        assert_eq!(summary.as_ref().map(|s| T::next_subtree_index(s)), Some(0));
+
+        assert_eq!(
+            summary.as_ref().and_then(|s| s.progress().recovery()),
+            no_recovery
+        );
+
+        // Progress denominator depends on which pools are enabled (which changes the
+        // initial tree states), and is extrapolated from the scanned range.
+        let expected_denom = 10
+            + ((1234 + 10) * (prior_tip - max_scanned)) / (max_scanned - (birthday.height() - 10));
+        #[cfg(feature = "orchard")]
+        let expected_denom = expected_denom * 2;
+        let expected_denom = expected_denom + 1;
+        assert_eq!(
+            summary.map(|s| s.progress().scan()),
+            Some(Ratio::new(1, u64::from(expected_denom)))
+        );
+
+        // Now simulate shutting down, and then restarting 70 blocks later, after the
+        // shard containing our birthday has been completed in one pool.
+        let last_shard_start = prior_tip + 50;
+        T::put_subtree_roots(
+            &mut st,
+            1,
+            &[CommitmentTreeRoot::from_parts(
+                last_shard_start,
+                // fake a hash, the value doesn't matter
+                T::empty_tree_leaf(),
+            )],
+        )
+        .unwrap();
+
+        {
+            let mut shard_stmt = st
+                .wallet_mut()
+                .db_mut()
+                .conn
+                .prepare("SELECT shard_index, subtree_end_height FROM sapling_tree_shards")
+                .unwrap();
+            assert_eq!(
+                (shard_stmt
+                    .query_and_then::<_, rusqlite::Error, _, _>([], |row| {
+                        Ok((row.get::<_, u32>(0)?, row.get::<_, Option<u32>>(1)?))
+                    })
+                    .unwrap()
+                    .collect::<Result<Vec<_>, _>>())
+                .unwrap()
+                .len(),
+                2,
+            );
+        }
+
+        {
+            let mut shard_stmt = st
+                .wallet_mut()
+                .db_mut()
+                .conn
+                .prepare("SELECT shard_index, subtree_end_height FROM orchard_tree_shards")
+                .unwrap();
+            #[cfg(not(feature = "orchard"))]
+            let expected_shards = 0;
+            #[cfg(feature = "orchard")]
+            let expected_shards = 2;
+            assert_eq!(
+                (shard_stmt
+                    .query_and_then::<_, rusqlite::Error, _, _>([], |row| {
+                        Ok((row.get::<_, u32>(0)?, row.get::<_, Option<u32>>(1)?))
+                    })
+                    .unwrap()
+                    .collect::<Result<Vec<_>, _>>())
+                .unwrap()
+                .len(),
+                expected_shards,
+            );
+        }
+
+        let new_tip = last_shard_start + 20;
+        st.wallet_mut().update_chain_tip(new_tip).unwrap();
+        let chain_end = u32::from(new_tip + 1);
+
+        // Verify that the suggested scan ranges match what is expected.
+        let expected = vec![
+            // The blocks after the max scanned block up to the chain tip are prioritised.
+            scan_range((max_scanned + 1).into()..chain_end, ChainTip),
+            // The remainder of the second-to-last shard's range is still in the queue.
+            scan_range(birthday.height().into()..max_scanned.into(), ChainTip),
+            // The max scanned block itself is left as-is.
+            scan_range(max_scanned.into()..(max_scanned + 1).into(), Scanned),
+            // The range below the second-to-last shard is ignored.
+            scan_range(sap_active.into()..birthday.height().into(), Ignored),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // We've crossed a subtree boundary, but only in one pool.
+        let expected_denom = (1 << 16) * 2
+            + ((1 << 16) * (new_tip - last_shard_start))
+                / (last_shard_start - (birthday.height() - 10))
+            - frontier_tree_size;
+        #[cfg(feature = "orchard")]
+        let expected_denom = expected_denom
+            + (10
+                + ((1234 + 10) * (new_tip - max_scanned))
+                    / (max_scanned - (birthday.height() - 10)));
+        let summary = st.get_wallet_summary(1);
+        assert_eq!(
+            summary.map(|s| s.progress().scan()),
+            Some(Ratio::new(1, u64::from(expected_denom)))
+        );
+    }
+
+    #[test]
+    fn replace_queue_entries_merges_previous_range() {
+        use ScanPriority::*;
+
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
+
+        let ranges = vec![
+            scan_range(150..200, ChainTip),
+            scan_range(100..150, Scanned),
+            scan_range(0..100, Ignored),
+        ];
+
+        {
+            let tx = st.wallet_mut().conn_mut().transaction().unwrap();
+            insert_queue_entries(&tx, ranges.iter()).unwrap();
+            tx.commit().unwrap();
+        }
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, ranges);
+
+        {
+            let tx = st.wallet_mut().conn_mut().transaction().unwrap();
+            replace_queue_entries::<SqliteClientError>(
+                &tx,
+                &(BlockHeight::from(150)..BlockHeight::from(160)),
+                vec![scan_range(150..160, Scanned)].into_iter(),
+                false,
+            )
+            .unwrap();
+            tx.commit().unwrap();
+        }
+
+        let expected = vec![
+            scan_range(160..200, ChainTip),
+            scan_range(100..160, Scanned),
+            scan_range(0..100, Ignored),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    #[test]
+    fn replace_queue_entries_merges_subsequent_range() {
+        use ScanPriority::*;
+
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .build();
+
+        let ranges = vec![
+            scan_range(150..200, ChainTip),
+            scan_range(100..150, Scanned),
+            scan_range(0..100, Ignored),
+        ];
+
+        {
+            let tx = st.wallet_mut().conn_mut().transaction().unwrap();
+            insert_queue_entries(&tx, ranges.iter()).unwrap();
+            tx.commit().unwrap();
+        }
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, ranges);
+
+        {
+            let tx = st.wallet_mut().conn_mut().transaction().unwrap();
+            replace_queue_entries::<SqliteClientError>(
+                &tx,
+                &(BlockHeight::from(90)..BlockHeight::from(100)),
+                vec![scan_range(90..100, Scanned)].into_iter(),
+                false,
+            )
+            .unwrap();
+            tx.commit().unwrap();
+        }
+
+        let expected = vec![
+            scan_range(150..200, ChainTip),
+            scan_range(90..150, Scanned),
+            scan_range(0..90, Ignored),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), Ignored).unwrap();
+        assert_eq!(actual, expected);
+    }
+
+    /// This sets up the case wherein:
+    /// * The wallet birthday is in the shard prior to the chain tip
+    /// * The user receives funds in the last complete block in the birthday shard,
+    ///   in the last note in that block.
+    /// * The next block crosses the shard boundary, with two notes in the prior
+    ///   shard and two notes in the subsequent shard.
+    /// * An additional 110 blocks are scanned, to ensure that the checkpoint
+    ///   is pruned.
+    ///
+    /// The diagram below shows the arrangement. the position of the X indicates the
+    /// note commitment for the note belonging to our wallet.
+    /// ```
+    /// blocks:      |<---- 5000 ---->|<----- 10 ---->|<--- 11 --->|<- 1  ->|<- 1 ->|<----- 110 ----->|
+    ///       nu5_activation                       birthday                                       chain_tip
+    /// commitments: |<---- 2^16 ---->|<--(2^16-50)-->|<--- 44 --->|<-___X->|<- 4 ->|<----- 110 ------|
+    /// shards:      |<--- shard0 --->|<---------------- shard1 --------------->|<-------- shard2 -------->...
+    /// ```
+    ///
+    /// # Parameters:
+    /// - `with_birthday_subtree_root`: When this is set to `true`, the wallet state will be
+    ///   initialized such that the subtree root containing the wallet birthday has been inserted
+    ///   into the note commitment tree.
+    #[cfg(feature = "orchard")]
+    fn prepare_orchard_block_spanning_test(
+        with_birthday_subtree_root: bool,
+    ) -> TestState<BlockCache, TestDb, LocalNetwork> {
+        let birthday_nu5_offset = 5000;
+        let birthday_prior_block_hash = BlockHash([0; 32]);
+        // We set the Sapling and Orchard frontiers at the birthday block initial state to 50
+        // notes back from the end of the second shard.
+        let birthday_tree_size: u32 = (0x1 << 17) - 50;
+        let mut st = TestBuilder::new()
+            .with_data_store_factory(TestDbFactory::default())
+            .with_block_cache(BlockCache::new())
+            .with_initial_chain_state(|rng, network| {
+                let birthday_height =
+                    network.activation_height(NetworkUpgrade::Nu5).unwrap() + birthday_nu5_offset;
+
+                let (prior_orchard_roots, orchard_initial_tree) =
+                    Frontier::random_with_prior_subtree_roots(
+                        rng,
+                        birthday_tree_size.into(),
+                        NonZeroU8::new(16).unwrap(),
+                    );
+
+                // There will only be one prior root. The completion height of the first shard will
+                // be 10 blocks prior to the wallet birthday height. This isn't actually enough
+                // block space to fit in 2^16-50 note commitments, but that's irrelevant here since
+                // we never need to look at those blocks or those notes.
+                let prior_orchard_roots = prior_orchard_roots
+                    .into_iter()
+                    .map(|root| CommitmentTreeRoot::from_parts(birthday_height - 10, root))
+                    .collect::<Vec<_>>();
+
+                InitialChainState {
+                    chain_state: ChainState::new(
+                        birthday_height - 1,
+                        birthday_prior_block_hash,
+                        Frontier::empty(), // the Sapling tree is unused in this test
+                        orchard_initial_tree,
+                    ),
+                    prior_sapling_roots: vec![],
+                    prior_orchard_roots,
+                }
+            })
+            .with_account_having_current_birthday()
+            .build();
+
+        let account = st.test_account().cloned().unwrap();
+        let birthday = account.birthday();
+
+        let ofvk = OrchardPoolTester::random_fvk(st.rng_mut());
+        let dfvk = OrchardPoolTester::test_account_fvk(&st);
+
+        // Create the cache by adding:
+        // * 11 blocks each containing 4 Orchard notes that are not for this wallet
+        // * 1 block containing 4 Orchard notes, the last of which belongs to this wallet
+        // * 1 block containing 4 Orchard notes not for this wallet, this will cross the shard
+        //   boundary
+        // * another 110 blocks each containing a single note not for this wallet
+        {
+            let fake_output = |for_this_wallet| {
+                FakeCompactOutput::new(
+                    if for_this_wallet {
+                        dfvk.clone()
+                    } else {
+                        ofvk.clone()
+                    },
+                    AddressType::DefaultExternal,
+                    NonNegativeAmount::const_from_u64(100000),
+                )
+            };
+
+            let mut final_orchard_tree = birthday.orchard_frontier().clone();
+            // Generate the birthday block plus 10 more
+            for _ in 0..11 {
+                let (_, res, _) = st.generate_next_block_multi(&vec![fake_output(false); 4]);
+                for c in res.orchard() {
+                    final_orchard_tree.append(*c);
+                }
+            }
+
+            // Generate a block with the last note in the block belonging to the wallet
+            let (_, res, _) = st.generate_next_block_multi(&vec![
+                // 3 Orchard notes not for this wallet
+                fake_output(false),
+                fake_output(false),
+                fake_output(false),
+                // One Orchard note for this wallet
+                fake_output(true),
+            ]);
+            for c in res.orchard() {
+                final_orchard_tree.append(*c);
+            }
+
+            // Generate one block spanning the shard boundary
+            let (spanning_block_height, res, _) =
+                st.generate_next_block_multi(&vec![fake_output(false); 4]);
+
+            // Add two note commitments to the Orchard frontier to complete the 2^16 subtree. We
+            // can then add that subtree root to the Orchard frontier, so that we can compute the
+            // root of the completed subtree.
+            for c in res.orchard().iter().take(2) {
+                final_orchard_tree.append(*c);
+            }
+
+            assert_eq!(final_orchard_tree.tree_size(), 0x1 << 17);
+            assert_eq!(spanning_block_height, birthday.height() + 12);
+
+            // Insert the root of the completed subtree if `with_birthday_subtree_root` is set.
+            // This simulates the situation where the subtree roots have all been inserted prior
+            // to scanning.
+            if with_birthday_subtree_root {
+                st.wallet_mut()
+                    .put_orchard_subtree_roots(
+                        1,
+                        &[CommitmentTreeRoot::from_parts(
+                            spanning_block_height,
+                            final_orchard_tree
+                                .value()
+                                .unwrap()
+                                .root(Some(Level::from(16))),
+                        )],
+                    )
+                    .unwrap();
+            }
+
+            // Add blocks up to the chain tip.
+            let mut chain_tip_height = spanning_block_height;
+            for _ in 0..110 {
+                let (h, res, _) = st.generate_next_block_multi(&vec![fake_output(false)]);
+                for c in res.orchard() {
+                    final_orchard_tree.append(*c);
+                }
+                chain_tip_height = h;
+            }
+
+            assert_eq!(chain_tip_height, birthday.height() + 122);
+        }
+
+        st
+    }
+
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn orchard_block_spanning_tip_boundary_complete() {
+        use zcash_client_backend::data_api::Account as _;
+
+        let mut st = prepare_orchard_block_spanning_test(true);
+        let account = st.test_account().cloned().unwrap();
+        let birthday = account.birthday();
+
+        // set the chain tip to the final block height we expect
+        let new_tip = birthday.height() + 122;
+        st.wallet_mut().update_chain_tip(new_tip).unwrap();
+
+        // Verify that the suggested scan ranges includes only the chain-tip range with ChainTip
+        // priority, and that the range from the wallet birthday to the end of the birthday shard
+        // has Historic priority.
+        let birthday_height = birthday.height().into();
+        let expected = vec![
+            scan_range(
+                (birthday_height + 12)..(new_tip + 1).into(),
+                ScanPriority::ChainTip,
+            ),
+            scan_range(
+                birthday_height..(birthday_height + 12),
+                ScanPriority::Historic,
+            ),
+            scan_range(
+                st.sapling_activation_height().into()..birthday.height().into(),
+                ScanPriority::Ignored,
+            ),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), ScanPriority::Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // Scan the chain-tip range.
+        st.scan_cached_blocks(birthday.height() + 12, 112);
+
+        // We haven't yet discovered our note, so balances should still be zero
+        assert_eq!(st.get_total_balance(account.id()), NonNegativeAmount::ZERO);
+
+        // Now scan the historic range; this should discover our note, which should now be
+        // spendable.
+        st.scan_cached_blocks(birthday.height(), 12);
+        assert_eq!(
+            st.get_total_balance(account.id()),
+            NonNegativeAmount::const_from_u64(100000)
+        );
+        assert_eq!(
+            st.get_spendable_balance(account.id(), 10),
+            NonNegativeAmount::const_from_u64(100000)
+        );
+
+        // Spend the note.
+        let to_extsk = OrchardPoolTester::sk(&[0xf5; 32]);
+        let to = OrchardPoolTester::sk_default_address(&to_extsk);
+        let request = zip321::TransactionRequest::new(vec![zip321::Payment::without_memo(
+            to.to_zcash_address(st.network()),
+            NonNegativeAmount::const_from_u64(10000),
+        )])
+        .unwrap();
+
+        let fee_rule = StandardFeeRule::Zip317;
+
+        let change_memo = "Test change memo".parse::<Memo>().unwrap();
+        let change_strategy = standard::SingleOutputChangeStrategy::new(
+            fee_rule,
+            Some(change_memo.into()),
+            OrchardPoolTester::SHIELDED_PROTOCOL,
+            DustOutputPolicy::default(),
+        );
+        let input_selector = GreedyInputSelector::new();
+
+        let proposal = st
+            .propose_transfer(
+                account.id(),
+                &input_selector,
+                &change_strategy,
+                request,
+                NonZeroU32::new(10).unwrap(),
+            )
+            .unwrap();
+
+        let create_proposed_result = st.create_proposed_transactions::<Infallible, _, Infallible>(
+            account.usk(),
+            OvkPolicy::Sender,
+            &proposal,
+        );
+        assert_matches!(&create_proposed_result, Ok(txids) if txids.len() == 1);
+    }
+
+    /// This test verifies that missing a single block that is required for computing a witness is
+    /// sufficient to prevent witness construction.
+    #[test]
+    #[cfg(feature = "orchard")]
+    fn orchard_block_spanning_tip_boundary_incomplete() {
+        use zcash_client_backend::data_api::Account as _;
+
+        let mut st = prepare_orchard_block_spanning_test(false);
+        let account = st.test_account().cloned().unwrap();
+        let birthday = account.birthday();
+
+        // set the chain tip to the final position we expect
+        let new_tip = birthday.height() + 122;
+        st.wallet_mut().update_chain_tip(new_tip).unwrap();
+
+        // Verify that the suggested scan ranges includes only the chain-tip range with ChainTip
+        // priority, and that the range from the wallet birthday to the end of the birthday shard
+        // has Historic priority.
+        let birthday_height = birthday.height().into();
+        let expected = vec![
+            scan_range(
+                birthday_height..(new_tip + 1).into(),
+                ScanPriority::ChainTip,
+            ),
+            scan_range(
+                st.sapling_activation_height().into()..birthday_height,
+                ScanPriority::Ignored,
+            ),
+        ];
+
+        let actual = suggest_scan_ranges(st.wallet().conn(), ScanPriority::Ignored).unwrap();
+        assert_eq!(actual, expected);
+
+        // Scan the chain-tip range, but omitting the spanning block.
+        st.scan_cached_blocks(birthday.height() + 13, 112);
+
+        // We haven't yet discovered our note, so balances should still be zero
+        assert_eq!(st.get_total_balance(account.id()), NonNegativeAmount::ZERO);
+
+        // Now scan the historic range; this should discover our note but not
+        // complete the tree. The note should not be considered spendable.
+        st.scan_cached_blocks(birthday.height(), 12);
+        assert_eq!(
+            st.get_total_balance(account.id()),
+            NonNegativeAmount::const_from_u64(100000)
+        );
+        assert_eq!(
+            st.get_spendable_balance(account.id(), 10),
+            NonNegativeAmount::ZERO
+        );
+
+        // Attempting to spend the note should fail to generate a proposal
+        let to_extsk = OrchardPoolTester::sk(&[0xf5; 32]);
+        let to = OrchardPoolTester::sk_default_address(&to_extsk);
+        let request = zip321::TransactionRequest::new(vec![zip321::Payment::without_memo(
+            to.to_zcash_address(st.network()),
+            NonNegativeAmount::const_from_u64(10000),
+        )])
+        .unwrap();
+
+        let fee_rule = StandardFeeRule::Zip317;
+
+        let change_memo = "Test change memo".parse::<Memo>().unwrap();
+        let change_strategy = standard::SingleOutputChangeStrategy::new(
+            fee_rule,
+            Some(change_memo.into()),
+            OrchardPoolTester::SHIELDED_PROTOCOL,
+            DustOutputPolicy::default(),
+        );
+        let input_selector = GreedyInputSelector::new();
+
+        let proposal = st.propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            request.clone(),
+            NonZeroU32::new(10).unwrap(),
+        );
+
+        assert_matches!(proposal, Err(_));
+
+        // Scan the missing block
+        st.scan_cached_blocks(birthday.height() + 12, 1);
+
+        // Verify that it's now possible to create the proposal
+        let proposal = st.propose_transfer(
+            account.id(),
+            &input_selector,
+            &change_strategy,
+            request,
+            NonZeroU32::new(10).unwrap(),
+        );
+
+        assert_matches!(proposal, Ok(_));
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/transparent.rs b/zcash_client_sqlite/src/wallet/transparent.rs
new file mode 100644
index 0000000000..091b0c8f5f
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/transparent.rs
@@ -0,0 +1,873 @@
+//! Functions for transparent input support in the wallet.
+use std::collections::{HashMap, HashSet};
+
+use rusqlite::OptionalExtension;
+use rusqlite::{named_params, Connection, Row};
+use zcash_client_backend::data_api::TransactionDataRequest;
+use zcash_primitives::transaction::builder::DEFAULT_TX_EXPIRY_DELTA;
+use zip32::{DiversifierIndex, Scope};
+
+use zcash_address::unified::{Ivk, Uivk};
+use zcash_client_backend::{
+    data_api::AccountBalance,
+    wallet::{TransparentAddressMetadata, WalletTransparentOutput},
+};
+use zcash_keys::{address::Address, encoding::AddressCodec};
+use zcash_primitives::{
+    legacy::{
+        keys::{IncomingViewingKey, NonHardenedChildIndex},
+        Script, TransparentAddress,
+    },
+    transaction::components::{amount::NonNegativeAmount, Amount, OutPoint, TxOut},
+};
+use zcash_protocol::consensus::{self, BlockHeight};
+
+use super::{chain_tip_height, get_account_ids};
+use crate::AccountUuid;
+use crate::{error::SqliteClientError, TxRef, UtxoId};
+
+pub(crate) mod ephemeral;
+
+pub(crate) fn detect_spending_accounts<'a>(
+    conn: &Connection,
+    spent: impl Iterator<Item = &'a OutPoint>,
+) -> Result<HashSet<AccountUuid>, rusqlite::Error> {
+    let mut account_q = conn.prepare_cached(
+        "SELECT accounts.uuid
+        FROM transparent_received_outputs o
+        JOIN accounts ON accounts.id = o.account_id
+        JOIN transactions t ON t.id_tx = o.transaction_id
+        WHERE t.txid = :prevout_txid
+        AND o.output_index = :prevout_idx",
+    )?;
+
+    let mut acc = HashSet::new();
+    for prevout in spent {
+        for account in account_q.query_and_then(
+            named_params![
+                ":prevout_txid": prevout.hash(),
+                ":prevout_idx": prevout.n()
+            ],
+            |row| row.get(0).map(AccountUuid),
+        )? {
+            acc.insert(account?);
+        }
+    }
+
+    Ok(acc)
+}
+
+/// Returns the `NonHardenedChildIndex` corresponding to a diversifier index
+/// given as bytes in big-endian order (the reverse of the usual order).
+fn address_index_from_diversifier_index_be(
+    diversifier_index_be: &[u8],
+) -> Result<NonHardenedChildIndex, SqliteClientError> {
+    let mut di: [u8; 11] = diversifier_index_be.try_into().map_err(|_| {
+        SqliteClientError::CorruptedData("Diversifier index is not an 11-byte value".to_owned())
+    })?;
+    di.reverse(); // BE -> LE conversion
+
+    NonHardenedChildIndex::from_index(DiversifierIndex::from(di).try_into().map_err(|_| {
+        SqliteClientError::CorruptedData(
+            "Unable to get diversifier for transparent address.".to_string(),
+        )
+    })?)
+    .ok_or_else(|| {
+        SqliteClientError::CorruptedData(
+            "Unexpected hardened index for transparent address.".to_string(),
+        )
+    })
+}
+
+pub(crate) fn get_transparent_receivers<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_uuid: AccountUuid,
+) -> Result<HashMap<TransparentAddress, Option<TransparentAddressMetadata>>, SqliteClientError> {
+    let mut ret: HashMap<TransparentAddress, Option<TransparentAddressMetadata>> = HashMap::new();
+
+    // Get all UAs derived
+    let mut ua_query = conn.prepare(
+        "SELECT address, diversifier_index_be 
+         FROM addresses 
+         JOIN accounts ON accounts.id = addresses.account_id
+         WHERE accounts.uuid = :account_uuid",
+    )?;
+    let mut rows = ua_query.query(named_params![":account_uuid": account_uuid.0])?;
+
+    while let Some(row) = rows.next()? {
+        let ua_str: String = row.get(0)?;
+        let di_vec: Vec<u8> = row.get(1)?;
+
+        let ua = Address::decode(params, &ua_str)
+            .ok_or_else(|| {
+                SqliteClientError::CorruptedData("Not a valid Zcash recipient address".to_owned())
+            })
+            .and_then(|addr| match addr {
+                Address::Unified(ua) => Ok(ua),
+                _ => Err(SqliteClientError::CorruptedData(format!(
+                    "Addresses table contains {} which is not a unified address",
+                    ua_str,
+                ))),
+            })?;
+
+        if let Some(taddr) = ua.transparent() {
+            let address_index = address_index_from_diversifier_index_be(&di_vec)?;
+            let metadata = TransparentAddressMetadata::new(Scope::External.into(), address_index);
+            ret.insert(*taddr, Some(metadata));
+        }
+    }
+
+    if let Some((taddr, address_index)) =
+        get_legacy_transparent_address(params, conn, account_uuid)?
+    {
+        let metadata = TransparentAddressMetadata::new(Scope::External.into(), address_index);
+        ret.insert(taddr, Some(metadata));
+    }
+
+    Ok(ret)
+}
+
+pub(crate) fn uivk_legacy_transparent_address<P: consensus::Parameters>(
+    params: &P,
+    uivk_str: &str,
+) -> Result<Option<(TransparentAddress, NonHardenedChildIndex)>, SqliteClientError> {
+    use zcash_address::unified::{Container as _, Encoding as _};
+    use zcash_primitives::legacy::keys::ExternalIvk;
+
+    let (network, uivk) = Uivk::decode(uivk_str)
+        .map_err(|e| SqliteClientError::CorruptedData(format!("Unable to parse UIVK: {e}")))?;
+
+    if params.network_type() != network {
+        let network_name = |n| match n {
+            consensus::NetworkType::Main => "mainnet",
+            consensus::NetworkType::Test => "testnet",
+            consensus::NetworkType::Regtest => "regtest",
+        };
+        return Err(SqliteClientError::CorruptedData(format!(
+            "Network type mismatch: account UIVK is for {} but a {} address was requested.",
+            network_name(network),
+            network_name(params.network_type())
+        )));
+    }
+
+    // Derive the default transparent address (if it wasn't already part of a derived UA).
+    for item in uivk.items() {
+        if let Ivk::P2pkh(tivk_bytes) = item {
+            let tivk = ExternalIvk::deserialize(&tivk_bytes)?;
+            return Ok(Some(tivk.default_address()));
+        }
+    }
+
+    Ok(None)
+}
+
+pub(crate) fn get_legacy_transparent_address<P: consensus::Parameters>(
+    params: &P,
+    conn: &rusqlite::Connection,
+    account_uuid: AccountUuid,
+) -> Result<Option<(TransparentAddress, NonHardenedChildIndex)>, SqliteClientError> {
+    // Get the UIVK for the account.
+    let uivk_str: Option<String> = conn
+        .query_row(
+            "SELECT uivk FROM accounts WHERE uuid = :account_uuid",
+            named_params![":account_uuid": account_uuid.0],
+            |row| row.get(0),
+        )
+        .optional()?;
+
+    if let Some(uivk_str) = uivk_str {
+        return uivk_legacy_transparent_address(params, &uivk_str);
+    }
+
+    Ok(None)
+}
+
+fn to_unspent_transparent_output(row: &Row) -> Result<WalletTransparentOutput, SqliteClientError> {
+    let txid: Vec<u8> = row.get("txid")?;
+    let mut txid_bytes = [0u8; 32];
+    txid_bytes.copy_from_slice(&txid);
+
+    let index: u32 = row.get("output_index")?;
+    let script_pubkey = Script(row.get("script")?);
+    let raw_value: i64 = row.get("value_zat")?;
+    let value = NonNegativeAmount::from_nonnegative_i64(raw_value).map_err(|_| {
+        SqliteClientError::CorruptedData(format!("Invalid UTXO value: {}", raw_value))
+    })?;
+    let height: Option<u32> = row.get("received_height")?;
+
+    let outpoint = OutPoint::new(txid_bytes, index);
+    WalletTransparentOutput::from_parts(
+        outpoint,
+        TxOut {
+            value,
+            script_pubkey,
+        },
+        height.map(BlockHeight::from),
+    )
+    .ok_or_else(|| {
+        SqliteClientError::CorruptedData(
+            "Txout script_pubkey value did not correspond to a P2PKH or P2SH address".to_string(),
+        )
+    })
+}
+
+/// Select an output to fund a new transaction that is targeting at least `chain_tip_height + 1`.
+pub(crate) fn get_wallet_transparent_output(
+    conn: &rusqlite::Connection,
+    outpoint: &OutPoint,
+    allow_unspendable: bool,
+) -> Result<Option<WalletTransparentOutput>, SqliteClientError> {
+    let chain_tip_height = chain_tip_height(conn)?;
+
+    // This could return as unspent outputs that are actually not spendable, if they are the
+    // outputs of deshielding transactions where the spend anchors have been invalidated by a
+    // rewind or spent in a transaction that has not been observed by this wallet. There isn't a
+    // way to detect the circumstance related to anchor invalidation at present, but it should be
+    // vanishingly rare as the vast majority of rewinds are of a single block.
+    let mut stmt_select_utxo = conn.prepare_cached(
+        "SELECT t.txid, u.output_index, u.script,
+                u.value_zat, t.mined_height AS received_height
+         FROM transparent_received_outputs u
+         JOIN transactions t ON t.id_tx = u.transaction_id
+         WHERE t.txid = :txid
+         AND u.output_index = :output_index
+         -- the transaction that created the output is mined or is definitely unexpired
+         AND (
+             :allow_unspendable
+             OR (
+                 (
+                    t.mined_height IS NOT NULL -- tx is mined
+                    -- TODO: uncomment the following two lines in order to enable zero-conf spends
+                    -- OR t.expiry_height = 0 -- tx will not expire
+                    -- OR t.expiry_height >= :mempool_height -- tx has not yet expired
+                 )
+                 -- and the output is unspent
+                 AND u.id NOT IN (
+                    SELECT txo_spends.transparent_received_output_id
+                    FROM transparent_received_output_spends txo_spends
+                    JOIN transactions tx ON tx.id_tx = txo_spends.transaction_id
+                    WHERE tx.mined_height IS NOT NULL  -- the spending tx is mined
+                    OR tx.expiry_height = 0 -- the spending tx will not expire
+                    OR tx.expiry_height >= :mempool_height -- the spending tx has not yet expired
+                 )
+             )
+         )",
+    )?;
+
+    let result: Result<Option<WalletTransparentOutput>, SqliteClientError> = stmt_select_utxo
+        .query_and_then(
+            named_params![
+                ":txid": outpoint.hash(),
+                ":output_index": outpoint.n(),
+                ":mempool_height": chain_tip_height.map(|h| u32::from(h) + 1),
+                ":allow_unspendable": allow_unspendable
+            ],
+            to_unspent_transparent_output,
+        )?
+        .next()
+        .transpose();
+
+    result
+}
+
+/// Returns the list of spendable transparent outputs received by this wallet at `address`
+/// such that, at height `target_height`:
+/// * the transaction that produced the output had or will have at least `min_confirmations`
+///   confirmations; and
+/// * the output is unspent as of the current chain tip.
+///
+/// An output that is potentially spent by an unmined transaction in the mempool is excluded
+/// iff the spending transaction will not be expired at `target_height`.
+///
+/// This could, in very rare circumstances, return as unspent outputs that are actually not
+/// spendable, if they are the outputs of deshielding transactions where the spend anchors have
+/// been invalidated by a rewind. There isn't a way to detect this circumstance at present, but
+/// it should be vanishingly rare as the vast majority of rewinds are of a single block.
+pub(crate) fn get_spendable_transparent_outputs<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    address: &TransparentAddress,
+    target_height: BlockHeight,
+    min_confirmations: u32,
+) -> Result<Vec<WalletTransparentOutput>, SqliteClientError> {
+    let confirmed_height = target_height - min_confirmations;
+
+    let mut stmt_utxos = conn.prepare(
+        "SELECT t.txid, u.output_index, u.script,
+                u.value_zat, t.mined_height AS received_height
+         FROM transparent_received_outputs u
+         JOIN transactions t ON t.id_tx = u.transaction_id
+         WHERE u.address = :address
+         -- the transaction that created the output is mined or unexpired as of `confirmed_height`
+         AND (
+            t.mined_height <= :confirmed_height -- tx is mined
+            -- TODO: uncomment the following lines in order to enable zero-conf spends
+            -- OR (
+            --     :min_confirmations = 0
+            --     AND (
+            --         t.expiry_height = 0 -- tx will not expire
+            --         OR t.expiry_height >= :target_height
+            --     )
+            -- )
+         )
+         -- and the output is unspent
+         AND u.id NOT IN (
+            SELECT txo_spends.transparent_received_output_id
+            FROM transparent_received_output_spends txo_spends
+            JOIN transactions tx ON tx.id_tx = txo_spends.transaction_id
+            WHERE tx.mined_height IS NOT NULL -- the spending transaction is mined
+            OR tx.expiry_height = 0 -- the spending tx will not expire
+            OR tx.expiry_height >= :target_height -- the spending tx has not yet expired
+            -- we are intentionally conservative and exclude outputs that are potentially spent
+            -- as of the target height, even if they might actually be spendable due to expiry
+            -- of the spending transaction as of the chain tip
+         )",
+    )?;
+
+    let addr_str = address.encode(params);
+    let mut rows = stmt_utxos.query(named_params![
+        ":address": addr_str,
+        ":confirmed_height": u32::from(confirmed_height),
+        ":target_height": u32::from(target_height),
+        //":min_confirmations": min_confirmations
+    ])?;
+
+    let mut utxos = Vec::<WalletTransparentOutput>::new();
+    while let Some(row) = rows.next()? {
+        let output = to_unspent_transparent_output(row)?;
+        utxos.push(output);
+    }
+
+    Ok(utxos)
+}
+
+/// Returns a mapping from each transparent receiver associated with the specified account
+/// to its not-yet-shielded UTXO balance, including only the effects of transactions mined
+/// at a block height less than or equal to `summary_height`.
+///
+/// Only non-ephemeral transparent receivers with a non-zero balance at the summary height
+/// will be included.
+pub(crate) fn get_transparent_balances<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_uuid: AccountUuid,
+    summary_height: BlockHeight,
+) -> Result<HashMap<TransparentAddress, NonNegativeAmount>, SqliteClientError> {
+    let chain_tip_height = chain_tip_height(conn)?.ok_or(SqliteClientError::ChainHeightUnknown)?;
+
+    let mut stmt_address_balances = conn.prepare(
+        "SELECT u.address, SUM(u.value_zat)
+         FROM transparent_received_outputs u
+         JOIN accounts ON accounts.id = u.account_id
+         JOIN transactions t ON t.id_tx = u.transaction_id
+         WHERE accounts.uuid = :account_uuid
+         -- the transaction that created the output is mined or is definitely unexpired
+         AND (
+            t.mined_height <= :summary_height -- tx is mined
+            OR ( -- or the caller has requested to include zero-conf funds that are not expired
+                :summary_height > :chain_tip_height
+                AND (
+                    t.expiry_height = 0 -- tx will not expire
+                    OR t.expiry_height >= :summary_height
+                )
+            )
+         )
+         -- and the output is unspent
+         AND u.id NOT IN (
+            SELECT txo_spends.transparent_received_output_id
+            FROM transparent_received_output_spends txo_spends
+            JOIN transactions tx ON tx.id_tx = txo_spends.transaction_id
+            WHERE tx.mined_height IS NOT NULL -- the spending tx is mined
+            OR tx.expiry_height = 0 -- the spending tx will not expire
+            OR tx.expiry_height >= :spend_expiry_height -- the spending tx is unexpired
+         )
+         GROUP BY u.address",
+    )?;
+
+    let mut res = HashMap::new();
+    let mut rows = stmt_address_balances.query(named_params![
+        ":account_uuid": account_uuid.0,
+        ":summary_height": u32::from(summary_height),
+        ":chain_tip_height": u32::from(chain_tip_height),
+        ":spend_expiry_height": u32::from(std::cmp::min(summary_height, chain_tip_height + 1)),
+    ])?;
+    while let Some(row) = rows.next()? {
+        let taddr_str: String = row.get(0)?;
+        let taddr = TransparentAddress::decode(params, &taddr_str)?;
+        let value = NonNegativeAmount::from_nonnegative_i64(row.get(1)?)?;
+
+        res.insert(taddr, value);
+    }
+
+    Ok(res)
+}
+
+#[tracing::instrument(skip(conn, account_balances))]
+pub(crate) fn add_transparent_account_balances(
+    conn: &rusqlite::Connection,
+    mempool_height: BlockHeight,
+    account_balances: &mut HashMap<AccountUuid, AccountBalance>,
+) -> Result<(), SqliteClientError> {
+    let mut stmt_account_balances = conn.prepare(
+        "SELECT a.uuid, SUM(u.value_zat)
+         FROM transparent_received_outputs u
+         JOIN accounts a ON a.id = u.account_id
+         JOIN transactions t ON t.id_tx = u.transaction_id
+         -- the transaction that created the output is mined or is definitely unexpired
+         WHERE (
+            t.mined_height < :mempool_height -- tx is mined
+            OR t.expiry_height = 0 -- tx will not expire
+            OR t.expiry_height >= :mempool_height
+         )
+         -- and the received txo is unspent
+         AND u.id NOT IN (
+           SELECT transparent_received_output_id
+           FROM transparent_received_output_spends txo_spends
+           JOIN transactions tx
+             ON tx.id_tx = txo_spends.transaction_id
+           WHERE tx.mined_height IS NOT NULL -- the spending tx is mined
+           OR tx.expiry_height = 0 -- the spending tx will not expire
+           OR tx.expiry_height >= :mempool_height -- the spending tx is unexpired
+         )
+         GROUP BY a.uuid",
+    )?;
+    let mut rows = stmt_account_balances
+        .query(named_params![":mempool_height": u32::from(mempool_height),])?;
+
+    while let Some(row) = rows.next()? {
+        let account = AccountUuid(row.get(0)?);
+        let raw_value = row.get(1)?;
+        let value = NonNegativeAmount::from_nonnegative_i64(raw_value).map_err(|_| {
+            SqliteClientError::CorruptedData(format!("Negative UTXO value {:?}", raw_value))
+        })?;
+
+        account_balances
+            .entry(account)
+            .or_insert(AccountBalance::ZERO)
+            .add_unshielded_value(value)?;
+    }
+    Ok(())
+}
+
+/// Marks the given UTXO as having been spent.
+///
+/// Returns `true` if the UTXO was known to the wallet.
+pub(crate) fn mark_transparent_utxo_spent(
+    conn: &rusqlite::Connection,
+    spent_in_tx: TxRef,
+    outpoint: &OutPoint,
+) -> Result<bool, SqliteClientError> {
+    let spend_params = named_params![
+        ":spent_in_tx": spent_in_tx.0,
+        ":prevout_txid": outpoint.hash().as_ref(),
+        ":prevout_idx": outpoint.n(),
+    ];
+    let mut stmt_mark_transparent_utxo_spent = conn.prepare_cached(
+        "INSERT INTO transparent_received_output_spends (transparent_received_output_id, transaction_id)
+         SELECT txo.id, :spent_in_tx
+         FROM transparent_received_outputs txo
+         JOIN transactions t ON t.id_tx = txo.transaction_id
+         WHERE t.txid = :prevout_txid
+         AND txo.output_index = :prevout_idx
+         ON CONFLICT (transparent_received_output_id, transaction_id)
+         -- The following UPDATE is effectively a no-op, but we perform it anyway so that the
+         -- number of affected rows can be used to determine whether a record existed.
+         DO UPDATE SET transaction_id = :spent_in_tx",
+    )?;
+    let affected_rows = stmt_mark_transparent_utxo_spent.execute(spend_params)?;
+
+    // Since we know that the output is spent, we no longer need to search for
+    // it to find out if it has been spent.
+    let mut stmt_remove_spend_detection = conn.prepare_cached(
+        "DELETE FROM transparent_spend_search_queue
+         WHERE output_index = :prevout_idx
+         AND transaction_id IN (
+            SELECT id_tx FROM transactions WHERE txid = :prevout_txid
+         )",
+    )?;
+    stmt_remove_spend_detection.execute(named_params![
+        ":prevout_txid": outpoint.hash().as_ref(),
+        ":prevout_idx": outpoint.n(),
+    ])?;
+
+    // If no rows were affected, we know that we don't actually have the output in
+    // `transparent_received_outputs` yet, so we have to record the output as spent
+    // so that when we eventually detect the output, we can create the spend record.
+    if affected_rows == 0 {
+        conn.execute(
+            "INSERT INTO transparent_spend_map (
+                spending_transaction_id,
+                prevout_txid,
+                prevout_output_index
+            )
+            VALUES (:spent_in_tx, :prevout_txid, :prevout_idx)
+            ON CONFLICT (spending_transaction_id, prevout_txid, prevout_output_index)
+            DO NOTHING",
+            spend_params,
+        )?;
+    }
+
+    Ok(affected_rows > 0)
+}
+
+/// Adds the given received UTXO to the datastore.
+pub(crate) fn put_received_transparent_utxo<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    output: &WalletTransparentOutput,
+) -> Result<UtxoId, SqliteClientError> {
+    let address = output.recipient_address();
+    if let Some(receiving_account) =
+        find_account_uuid_for_transparent_address(conn, params, address)?
+    {
+        put_transparent_output(
+            conn,
+            params,
+            output.outpoint(),
+            output.txout(),
+            output.mined_height(),
+            address,
+            receiving_account,
+            true,
+        )
+    } else {
+        // The UTXO was not for any of our transparent addresses.
+        Err(SqliteClientError::AddressNotRecognized(*address))
+    }
+}
+
+/// Returns the vector of [`TransactionDataRequest`]s that represents the information needed by the
+/// wallet backend in order to be able to present a complete view of wallet history and memo data.
+pub(crate) fn transaction_data_requests<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+) -> Result<Vec<TransactionDataRequest>, SqliteClientError> {
+    // `lightwalletd` will return an error for `GetTaddressTxids` requests having an end height
+    // greater than the current chain tip height, so we take the chain tip height into account
+    // here in order to make this pothole easier for clients of the API to avoid.
+    let chain_tip_height = super::chain_tip_height(conn)?;
+
+    // We cannot construct address-based transaction data requests for the case where we cannot
+    // determine the height at which to begin, so we require that either the target height or mined
+    // height be set.
+    let mut address_request_stmt = conn.prepare_cached(
+        "SELECT ssq.address, IFNULL(t.target_height, t.mined_height)
+         FROM transparent_spend_search_queue ssq
+         JOIN transactions t ON t.id_tx = ssq.transaction_id
+         WHERE t.target_height IS NOT NULL
+         OR t.mined_height IS NOT NULL",
+    )?;
+
+    let result = address_request_stmt
+        .query_and_then([], |row| {
+            let address = TransparentAddress::decode(params, &row.get::<_, String>(0)?)?;
+            let block_range_start = BlockHeight::from(row.get::<_, u32>(1)?);
+            let max_end_height = block_range_start + DEFAULT_TX_EXPIRY_DELTA + 1;
+
+            Ok::<TransactionDataRequest, SqliteClientError>(
+                TransactionDataRequest::SpendsFromAddress {
+                    address,
+                    block_range_start,
+                    block_range_end: Some(
+                        chain_tip_height
+                            .map_or(max_end_height, |h| std::cmp::min(h + 1, max_end_height)),
+                    ),
+                },
+            )
+        })?
+        .collect::<Result<Vec<_>, _>>()?;
+
+    Ok(result)
+}
+
+pub(crate) fn get_transparent_address_metadata<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_uuid: AccountUuid,
+    address: &TransparentAddress,
+) -> Result<Option<TransparentAddressMetadata>, SqliteClientError> {
+    let address_str = address.encode(params);
+
+    if let Some(di_vec) = conn
+        .query_row(
+            "SELECT diversifier_index_be FROM addresses
+             JOIN accounts ON addresses.account_id = accounts.id
+             WHERE accounts.uuid = :account_uuid 
+             AND cached_transparent_receiver_address = :address",
+            named_params![":account_uuid": account_uuid.0, ":address": &address_str],
+            |row| row.get::<_, Vec<u8>>(0),
+        )
+        .optional()?
+    {
+        let address_index = address_index_from_diversifier_index_be(&di_vec)?;
+        let metadata = TransparentAddressMetadata::new(Scope::External.into(), address_index);
+        return Ok(Some(metadata));
+    }
+
+    if let Some((legacy_taddr, address_index)) =
+        get_legacy_transparent_address(params, conn, account_uuid)?
+    {
+        if &legacy_taddr == address {
+            let metadata = TransparentAddressMetadata::new(Scope::External.into(), address_index);
+            return Ok(Some(metadata));
+        }
+    }
+
+    // Search known ephemeral addresses.
+    if let Some(address_index) =
+        ephemeral::find_index_for_ephemeral_address_str(conn, account_uuid, &address_str)?
+    {
+        return Ok(Some(ephemeral::metadata(address_index)));
+    }
+
+    Ok(None)
+}
+
+/// Attempts to determine the account that received the given transparent output.
+///
+/// The following three locations in the wallet's key tree are searched:
+/// - Transparent receivers that have been generated as part of a Unified Address.
+/// - Transparent ephemeral addresses that have been reserved or are within
+///   the gap limit from the last reserved address.
+/// - "Legacy transparent addresses" (at BIP 44 address index 0 within an account).
+///
+/// Returns `Ok(None)` if the transparent output's recipient address is not in any of the
+/// above locations. This means the wallet considers the output "not interesting".
+pub(crate) fn find_account_uuid_for_transparent_address<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    address: &TransparentAddress,
+) -> Result<Option<AccountUuid>, SqliteClientError> {
+    let address_str = address.encode(params);
+
+    if let Some(account_id) = conn
+        .query_row(
+            "SELECT accounts.uuid 
+             FROM addresses 
+             JOIN accounts ON accounts.id = addresses.account_id
+             WHERE cached_transparent_receiver_address = :address",
+            named_params![":address": &address_str],
+            |row| Ok(AccountUuid(row.get(0)?)),
+        )
+        .optional()?
+    {
+        return Ok(Some(account_id));
+    }
+
+    // Search known ephemeral addresses.
+    if let Some(account_id) = ephemeral::find_account_for_ephemeral_address_str(conn, &address_str)?
+    {
+        return Ok(Some(account_id));
+    }
+
+    let account_ids = get_account_ids(conn)?;
+
+    // If the UTXO is received at the legacy transparent address (at BIP 44 address
+    // index 0 within its particular account, which we specifically ensure is returned
+    // from `get_transparent_receivers`), there may be no entry in the addresses table
+    // that can be used to tie the address to a particular account. In this case, we
+    // look up the legacy address for each account in the wallet, and check whether it
+    // matches the address for the received UTXO.
+    for &account_id in account_ids.iter() {
+        if let Some((legacy_taddr, _)) = get_legacy_transparent_address(params, conn, account_id)? {
+            if &legacy_taddr == address {
+                return Ok(Some(account_id));
+            }
+        }
+    }
+
+    Ok(None)
+}
+
+/// Add a transparent output relevant to this wallet to the database.
+///
+/// `output_height` may be None if this is an ephemeral output from a
+/// transaction we created, that we do not yet know to have been mined.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn put_transparent_output<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    outpoint: &OutPoint,
+    txout: &TxOut,
+    output_height: Option<BlockHeight>,
+    address: &TransparentAddress,
+    receiving_account_uuid: AccountUuid,
+    known_unspent: bool,
+) -> Result<UtxoId, SqliteClientError> {
+    let output_height = output_height.map(u32::from);
+    let receiving_account_id = super::get_account_ref(conn, receiving_account_uuid)?;
+
+    // Check whether we have an entry in the blocks table for the output height;
+    // if not, the transaction will be updated with its mined height when the
+    // associated block is scanned.
+    let block = match output_height {
+        Some(height) => conn
+            .query_row(
+                "SELECT height FROM blocks WHERE height = :height",
+                named_params![":height": height],
+                |row| row.get::<_, u32>(0),
+            )
+            .optional()?,
+        None => None,
+    };
+
+    let id_tx = conn.query_row(
+        "INSERT INTO transactions (txid, block, mined_height)
+         VALUES (:txid, :block, :mined_height)
+         ON CONFLICT (txid) DO UPDATE
+         SET block = IFNULL(block, :block),
+             mined_height = :mined_height
+         RETURNING id_tx",
+        named_params![
+           ":txid": &outpoint.hash().to_vec(),
+           ":block": block,
+           ":mined_height": output_height
+        ],
+        |row| row.get::<_, i64>(0),
+    )?;
+
+    let spent_height = conn
+        .query_row(
+            "SELECT t.mined_height
+             FROM transactions t
+             JOIN transparent_received_output_spends ts ON ts.transaction_id = t.id_tx
+             JOIN transparent_received_outputs tro ON tro.id = ts.transparent_received_output_id
+             WHERE tro.transaction_id = :transaction_id
+             AND tro.output_index = :output_index",
+            named_params![
+                ":transaction_id": id_tx,
+                ":output_index": &outpoint.n(),
+            ],
+            |row| {
+                row.get::<_, Option<u32>>(0)
+                    .map(|o| o.map(BlockHeight::from))
+            },
+        )
+        .optional()?
+        .flatten();
+
+    // The max observed unspent height is either the spending transaction's mined height - 1, or
+    // the current chain tip height if the UTXO was received via a path that confirmed that it was
+    // unspent, such as by querying the UTXO set of the network.
+    let max_observed_unspent = match spent_height {
+        Some(h) => Some(h - 1),
+        None => {
+            if known_unspent {
+                chain_tip_height(conn)?
+            } else {
+                None
+            }
+        }
+    };
+
+    let mut stmt_upsert_transparent_output = conn.prepare_cached(
+        "INSERT INTO transparent_received_outputs (
+            transaction_id, output_index,
+            account_id, address, script,
+            value_zat, max_observed_unspent_height
+        )
+        VALUES (
+            :transaction_id, :output_index,
+            :account_id, :address, :script,
+            :value_zat, :max_observed_unspent_height
+        )
+        ON CONFLICT (transaction_id, output_index) DO UPDATE
+        SET account_id = :account_id,
+            address = :address,
+            script = :script,
+            value_zat = :value_zat,
+            max_observed_unspent_height = IFNULL(:max_observed_unspent_height, max_observed_unspent_height)
+        RETURNING id",
+    )?;
+
+    let sql_args = named_params![
+        ":transaction_id": id_tx,
+        ":output_index": &outpoint.n(),
+        ":account_id": receiving_account_id.0,
+        ":address": &address.encode(params),
+        ":script": &txout.script_pubkey.0,
+        ":value_zat": &i64::from(Amount::from(txout.value)),
+        ":max_observed_unspent_height": max_observed_unspent.map(u32::from),
+    ];
+
+    let utxo_id = stmt_upsert_transparent_output
+        .query_row(sql_args, |row| row.get::<_, i64>(0).map(UtxoId))?;
+
+    // If we have a record of the output already having been spent, then mark it as spent using the
+    // stored reference to the spending transaction.
+    let spending_tx_ref = conn
+        .query_row(
+            "SELECT ts.spending_transaction_id
+             FROM transparent_spend_map ts
+             JOIN transactions t ON t.id_tx = ts.spending_transaction_id
+             WHERE ts.prevout_txid = :prevout_txid
+             AND ts.prevout_output_index = :prevout_idx
+             ORDER BY t.block NULLS LAST LIMIT 1",
+            named_params![
+                ":prevout_txid": outpoint.txid().as_ref(),
+                ":prevout_idx": outpoint.n()
+            ],
+            |row| row.get::<_, i64>(0).map(TxRef),
+        )
+        .optional()?;
+
+    if let Some(spending_transaction_id) = spending_tx_ref {
+        mark_transparent_utxo_spent(conn, spending_transaction_id, outpoint)?;
+    }
+
+    Ok(utxo_id)
+}
+
+/// Adds a request to retrieve transactions involving the specified address to the transparent
+/// spend search queue. Note that such requests are _not_ for data related to `tx_ref`, but instead
+/// a request to find where the UTXO with the outpoint `(tx_ref, output_index)` is spent.
+///
+/// ### Parameters
+/// - `receiving_address`: The address that received the UTXO.
+/// - `tx_ref`: The transaction in which the UTXO was received.
+/// - `output_index`: The index of the output within `vout` of the specified transaction.
+pub(crate) fn queue_transparent_spend_detection<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction<'_>,
+    params: &P,
+    receiving_address: TransparentAddress,
+    tx_ref: TxRef,
+    output_index: u32,
+) -> Result<(), SqliteClientError> {
+    let mut stmt = conn.prepare_cached(
+        "INSERT INTO transparent_spend_search_queue
+         (address, transaction_id, output_index)
+         VALUES
+         (:address, :transaction_id, :output_index)
+         ON CONFLICT (transaction_id, output_index) DO NOTHING",
+    )?;
+
+    let addr_str = receiving_address.encode(params);
+    stmt.execute(named_params! {
+        ":address": addr_str,
+        ":transaction_id": tx_ref.0,
+        ":output_index": output_index
+    })?;
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::testing::{db::TestDbFactory, BlockCache};
+
+    #[test]
+    fn put_received_transparent_utxo() {
+        zcash_client_backend::data_api::testing::transparent::put_received_transparent_utxo(
+            TestDbFactory::default(),
+        );
+    }
+
+    #[test]
+    fn transparent_balance_across_shielding() {
+        zcash_client_backend::data_api::testing::transparent::transparent_balance_across_shielding(
+            TestDbFactory::default(),
+            BlockCache::new(),
+        );
+    }
+}
diff --git a/zcash_client_sqlite/src/wallet/transparent/ephemeral.rs b/zcash_client_sqlite/src/wallet/transparent/ephemeral.rs
new file mode 100644
index 0000000000..21b2f9d371
--- /dev/null
+++ b/zcash_client_sqlite/src/wallet/transparent/ephemeral.rs
@@ -0,0 +1,467 @@
+//! Functions for wallet support of ephemeral transparent addresses.
+use std::cmp::{max, min};
+use std::ops::Range;
+
+use rusqlite::{named_params, OptionalExtension};
+
+use zcash_client_backend::{data_api::GAP_LIMIT, wallet::TransparentAddressMetadata};
+use zcash_keys::keys::UnifiedFullViewingKey;
+use zcash_keys::{encoding::AddressCodec, keys::AddressGenerationError};
+use zcash_primitives::{
+    legacy::{
+        keys::{EphemeralIvk, NonHardenedChildIndex, TransparentKeyScope},
+        TransparentAddress,
+    },
+    transaction::TxId,
+};
+use zcash_protocol::consensus;
+
+use crate::wallet::{self, get_account_ref};
+use crate::AccountUuid;
+use crate::{error::SqliteClientError, AccountRef, TxRef};
+
+// Returns `TransparentAddressMetadata` in the ephemeral scope for the
+// given address index.
+pub(crate) fn metadata(address_index: NonHardenedChildIndex) -> TransparentAddressMetadata {
+    TransparentAddressMetadata::new(TransparentKeyScope::EPHEMERAL, address_index)
+}
+
+/// Returns the first unstored ephemeral address index in the given account.
+pub(crate) fn first_unstored_index(
+    conn: &rusqlite::Connection,
+    account_id: AccountRef,
+) -> Result<u32, SqliteClientError> {
+    match conn
+        .query_row(
+            "SELECT address_index FROM ephemeral_addresses
+             WHERE account_id = :account_id
+             ORDER BY address_index DESC
+             LIMIT 1",
+            named_params![":account_id": account_id.0],
+            |row| row.get::<_, u32>(0),
+        )
+        .optional()?
+    {
+        Some(i) if i >= (1 << 31) + GAP_LIMIT => {
+            unreachable!("violates constraint index_range_and_address_nullity")
+        }
+        Some(i) => Ok(i.checked_add(1).unwrap()),
+        None => Ok(0),
+    }
+}
+
+/// Returns the first unreserved ephemeral address index in the given account.
+pub(crate) fn first_unreserved_index(
+    conn: &rusqlite::Connection,
+    account_id: AccountRef,
+) -> Result<u32, SqliteClientError> {
+    first_unstored_index(conn, account_id)?
+        .checked_sub(GAP_LIMIT)
+        .ok_or(SqliteClientError::CorruptedData(
+            "ephemeral_addresses table has not been initialized".to_owned(),
+        ))
+}
+
+/// Returns the first ephemeral address index in the given account that
+/// would violate the gap invariant if used.
+pub(crate) fn first_unsafe_index(
+    conn: &rusqlite::Connection,
+    account_id: AccountRef,
+) -> Result<u32, SqliteClientError> {
+    // The inner join with `transactions` excludes addresses for which
+    // `seen_in_tx` is NULL. The query also excludes addresses observed
+    // to have been mined in a transaction that we currently see as unmined.
+    // This is conservative in terms of avoiding violation of the gap
+    // invariant: it can only cause us to get to the end of the gap sooner.
+    //
+    // TODO: do we want to only consider transactions with a minimum number
+    // of confirmations here?
+    let first_unmined_index: u32 = match conn
+        .query_row(
+            "SELECT address_index FROM ephemeral_addresses
+             JOIN transactions t ON t.id_tx = seen_in_tx
+             WHERE account_id = :account_id AND t.mined_height IS NOT NULL
+             ORDER BY address_index DESC
+             LIMIT 1",
+            named_params![":account_id": account_id.0],
+            |row| row.get::<_, u32>(0),
+        )
+        .optional()?
+    {
+        Some(i) if i >= 1 << 31 => {
+            unreachable!("violates constraint index_range_and_address_nullity")
+        }
+        Some(i) => i.checked_add(1).unwrap(),
+        None => 0,
+    };
+    Ok(min(
+        1 << 31,
+        first_unmined_index.checked_add(GAP_LIMIT).unwrap(),
+    ))
+}
+
+/// Utility function to return an `Range<u32>` that starts at `i`
+/// and is of length up to `n`. The range is truncated if necessary
+/// so that it contains no elements beyond the maximum valid address
+/// index, `(1 << 31) - 1`.
+pub(crate) fn range_from(i: u32, n: u32) -> Range<u32> {
+    let first = min(1 << 31, i);
+    let last = min(1 << 31, i.saturating_add(n));
+    first..last
+}
+
+/// Returns the ephemeral transparent IVK for a given account ID.
+pub(crate) fn get_ephemeral_ivk<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_id: AccountRef,
+) -> Result<Option<EphemeralIvk>, SqliteClientError> {
+    let ufvk = conn
+        .query_row(
+            "SELECT ufvk FROM accounts WHERE id = :account_id",
+            named_params![":account_id": account_id.0],
+            |row| {
+                let ufvk_str: Option<String> = row.get("ufvk")?;
+                Ok(ufvk_str.map(|s| {
+                    UnifiedFullViewingKey::decode(params, &s[..])
+                        .map_err(SqliteClientError::BadAccountData)
+                }))
+            },
+        )
+        .optional()?
+        .ok_or(SqliteClientError::AccountUnknown)?
+        .transpose()?;
+
+    let eivk = ufvk
+        .as_ref()
+        .and_then(|ufvk| ufvk.transparent())
+        .map(|t| t.derive_ephemeral_ivk())
+        .transpose()?;
+
+    Ok(eivk)
+}
+
+/// Returns a vector of ephemeral transparent addresses associated with the given
+/// account controlled by this wallet, along with their metadata. The result includes
+/// reserved addresses, and addresses for `GAP_LIMIT` additional indices (capped to
+/// the maximum index).
+///
+/// If `index_range` is some `Range`, it limits the result to addresses with indices
+/// in that range.
+pub(crate) fn get_known_ephemeral_addresses<P: consensus::Parameters>(
+    conn: &rusqlite::Connection,
+    params: &P,
+    account_id: AccountRef,
+    index_range: Option<Range<u32>>,
+) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, SqliteClientError> {
+    let index_range = index_range.unwrap_or(0..(1 << 31));
+
+    let mut stmt = conn.prepare(
+        "SELECT address, address_index 
+         FROM ephemeral_addresses ea
+         WHERE ea.account_id = :account_id
+         AND address_index >= :start 
+         AND address_index < :end
+         ORDER BY address_index",
+    )?;
+    let mut rows = stmt.query(named_params![
+        ":account_id": account_id.0,
+        ":start": index_range.start,
+        ":end": min(1 << 31, index_range.end),
+    ])?;
+
+    let mut result = vec![];
+
+    while let Some(row) = rows.next()? {
+        let addr_str: String = row.get(0)?;
+        let raw_index: u32 = row.get(1)?;
+        let address_index = NonHardenedChildIndex::from_index(raw_index)
+            .expect("where clause ensures this is in range");
+        let address = TransparentAddress::decode(params, &addr_str)?;
+        result.push((address, metadata(address_index)));
+    }
+    Ok(result)
+}
+
+/// If this is a known ephemeral address in any account, return its account id.
+pub(crate) fn find_account_for_ephemeral_address_str(
+    conn: &rusqlite::Connection,
+    address_str: &str,
+) -> Result<Option<AccountUuid>, SqliteClientError> {
+    Ok(conn
+        .query_row(
+            "SELECT accounts.uuid 
+             FROM ephemeral_addresses ea
+             JOIN accounts ON accounts.id = ea.account_id
+             WHERE address = :address",
+            named_params![":address": &address_str],
+            |row| Ok(AccountUuid(row.get(0)?)),
+        )
+        .optional()?)
+}
+
+/// If this is a known ephemeral address in the given account, return its index.
+pub(crate) fn find_index_for_ephemeral_address_str(
+    conn: &rusqlite::Connection,
+    account_uuid: AccountUuid,
+    address_str: &str,
+) -> Result<Option<NonHardenedChildIndex>, SqliteClientError> {
+    let account_id = get_account_ref(conn, account_uuid)?;
+    Ok(conn
+        .query_row(
+            "SELECT address_index FROM ephemeral_addresses
+            WHERE account_id = :account_id AND address = :address",
+            named_params![":account_id": account_id.0, ":address": &address_str],
+            |row| row.get::<_, u32>(0),
+        )
+        .optional()?
+        .map(|index| {
+            NonHardenedChildIndex::from_index(index)
+                .expect("valid by constraint index_range_and_address_nullity")
+        }))
+}
+
+/// Returns a vector with the next `n` previously unreserved ephemeral addresses for
+/// the given account.
+///
+/// # Errors
+///
+/// * `SqliteClientError::AccountUnknown`, if there is no account with the given id.
+/// * `SqliteClientError::UnknownZip32Derivation`, if the account is imported and
+///   it is not possible to derive new addresses for it.
+/// * `SqliteClientError::ReachedGapLimit`, if it is not possible to reserve `n` addresses
+///   within the gap limit after the last address in this account that is known to have an
+///   output in a mined transaction.
+/// * `SqliteClientError::AddressGeneration(AddressGenerationError::DiversifierSpaceExhausted)`,
+///   if the limit on transparent address indices has been reached.
+pub(crate) fn reserve_next_n_ephemeral_addresses<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    account_id: AccountRef,
+    n: usize,
+) -> Result<Vec<(TransparentAddress, TransparentAddressMetadata)>, SqliteClientError> {
+    if n == 0 {
+        return Ok(vec![]);
+    }
+
+    let first_unreserved = first_unreserved_index(conn, account_id)?;
+    let first_unsafe = first_unsafe_index(conn, account_id)?;
+    let allocation = range_from(
+        first_unreserved,
+        u32::try_from(n).map_err(|_| AddressGenerationError::DiversifierSpaceExhausted)?,
+    );
+
+    if allocation.len() < n {
+        return Err(AddressGenerationError::DiversifierSpaceExhausted.into());
+    }
+    if allocation.end > first_unsafe {
+        let account_uuid = wallet::get_account_uuid(conn, account_id)?;
+        return Err(SqliteClientError::ReachedGapLimit(
+            account_uuid,
+            max(first_unreserved, first_unsafe),
+        ));
+    }
+    reserve_until(conn, params, account_id, allocation.end)?;
+    get_known_ephemeral_addresses(conn, params, account_id, Some(allocation))
+}
+
+/// Initialize the `ephemeral_addresses` table. This must be called when
+/// creating or migrating an account.
+pub(crate) fn init_account<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    account_id: AccountRef,
+) -> Result<(), SqliteClientError> {
+    reserve_until(conn, params, account_id, 0)
+}
+
+/// Extend the range of stored addresses in an account if necessary so that the index of the next
+/// address to reserve will be *at least* `next_to_reserve`. If no transparent key exists for the
+/// given account or it would already have been at least `next_to_reserve`, then do nothing.
+///
+/// Note that this is called from database migration code.
+///
+/// # Panics
+///
+/// Panics if the precondition `next_to_reserve <= (1 << 31)` does not hold.
+fn reserve_until<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    account_id: AccountRef,
+    next_to_reserve: u32,
+) -> Result<(), SqliteClientError> {
+    assert!(next_to_reserve <= 1 << 31);
+
+    if let Some(ephemeral_ivk) = get_ephemeral_ivk(conn, params, account_id)? {
+        let first_unstored = first_unstored_index(conn, account_id)?;
+        let range_to_store = first_unstored..(next_to_reserve.checked_add(GAP_LIMIT).unwrap());
+        if range_to_store.is_empty() {
+            return Ok(());
+        }
+
+        // used_in_tx and seen_in_tx are initially NULL
+        let mut stmt_insert_ephemeral_address = conn.prepare_cached(
+            "INSERT INTO ephemeral_addresses (account_id, address_index, address)
+             VALUES (:account_id, :address_index, :address)",
+        )?;
+
+        for raw_index in range_to_store {
+            // The range to store may contain indicies that are out of the valid range of non hardened
+            // child indices; we still store explicit rows in the ephemeral_addresses table for these
+            // so that it's possible to find the first unused address using dead reckoning with the gap
+            // limit.
+            let address_str_opt = NonHardenedChildIndex::from_index(raw_index)
+                .map(|address_index| {
+                    ephemeral_ivk
+                        .derive_ephemeral_address(address_index)
+                        .map(|addr| addr.encode(params))
+                })
+                .transpose()?;
+
+            stmt_insert_ephemeral_address.execute(named_params![
+                ":account_id": account_id.0,
+                ":address_index": raw_index,
+                ":address": address_str_opt,
+            ])?;
+        }
+    }
+
+    Ok(())
+}
+
+/// Returns a `SqliteClientError::EphemeralAddressReuse` error if the address was
+/// already used.
+fn ephemeral_address_reuse_check(
+    conn: &rusqlite::Transaction,
+    address_str: &str,
+) -> Result<(), SqliteClientError> {
+    // It is intentional that we don't require `t.mined_height` to be non-null.
+    // That is, we conservatively treat an ephemeral address as potentially
+    // reused even if we think that the transaction where we had evidence of
+    // its use is at present unmined. This should never occur in supported
+    // situations where only a single correctly operating wallet instance is
+    // using a given seed, because such a wallet will not reuse an address that
+    // it ever reserved.
+    //
+    // `COALESCE(used_in_tx, seen_in_tx)` can only differ from `used_in_tx`
+    // if the address was reserved, an error occurred in transaction creation
+    // before calling `mark_ephemeral_address_as_used`, and then we saw the
+    // address in another transaction (presumably created by another wallet
+    // instance, or as a result of a bug) anyway.
+    let res = conn
+        .query_row(
+            "SELECT t.txid FROM ephemeral_addresses
+             LEFT OUTER JOIN transactions t
+             ON t.id_tx = COALESCE(used_in_tx, seen_in_tx)
+             WHERE address = :address",
+            named_params![":address": address_str],
+            |row| row.get::<_, Option<Vec<u8>>>(0),
+        )
+        .optional()?
+        .flatten();
+
+    if let Some(txid_bytes) = res {
+        let txid = TxId::from_bytes(
+            txid_bytes
+                .try_into()
+                .map_err(|_| SqliteClientError::CorruptedData("invalid txid".to_owned()))?,
+        );
+        Err(SqliteClientError::EphemeralAddressReuse(
+            address_str.to_owned(),
+            txid,
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+/// If `address` is one of our ephemeral addresses, mark it as having an output
+/// in a transaction that we have just created. This has no effect if `address` is
+/// not one of our ephemeral addresses.
+///
+/// Returns a `SqliteClientError::EphemeralAddressReuse` error if the address was
+/// already used.
+pub(crate) fn mark_ephemeral_address_as_used<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    ephemeral_address: &TransparentAddress,
+    tx_ref: TxRef,
+) -> Result<(), SqliteClientError> {
+    let address_str = ephemeral_address.encode(params);
+    ephemeral_address_reuse_check(conn, &address_str)?;
+
+    // We update both `used_in_tx` and `seen_in_tx` here, because a used address has
+    // necessarily been seen in a transaction. We will not treat this as extending the
+    // range of addresses that are safe to reserve unless and until the transaction is
+    // observed as mined.
+    let update_result = conn
+        .query_row(
+            "UPDATE ephemeral_addresses
+             SET used_in_tx = :tx_ref, seen_in_tx = :tx_ref
+             WHERE address = :address
+             RETURNING account_id, address_index",
+            named_params![":tx_ref": tx_ref.0, ":address": address_str],
+            |row| Ok((AccountRef(row.get::<_, u32>(0)?), row.get::<_, u32>(1)?)),
+        )
+        .optional()?;
+
+    // Maintain the invariant that the last `GAP_LIMIT` addresses are unused and unseen.
+    if let Some((account_id, address_index)) = update_result {
+        let next_to_reserve = address_index.checked_add(1).expect("ensured by constraint");
+        reserve_until(conn, params, account_id, next_to_reserve)?;
+    }
+    Ok(())
+}
+
+/// If `address` is one of our ephemeral addresses, mark it as having an output
+/// in the given mined transaction (which may or may not be a transaction we sent).
+///
+/// `tx_ref` must be a valid transaction reference. This call has no effect if
+/// `address` is not one of our ephemeral addresses.
+pub(crate) fn mark_ephemeral_address_as_seen<P: consensus::Parameters>(
+    conn: &rusqlite::Transaction,
+    params: &P,
+    address: &TransparentAddress,
+    tx_ref: TxRef,
+) -> Result<(), SqliteClientError> {
+    let address_str = address.encode(params);
+
+    // Figure out which transaction was mined earlier: `tx_ref`, or any existing
+    // tx referenced by `seen_in_tx` for the given address. Prefer the existing
+    // reference in case of a tie or if both transactions are unmined.
+    // This slightly reduces the chance of unnecessarily reaching the gap limit
+    // too early in some corner cases (because the earlier transaction is less
+    // likely to be unmined).
+    //
+    // The query should always return a value if `tx_ref` is valid.
+    let earlier_ref = conn.query_row(
+        "SELECT id_tx FROM transactions
+         LEFT OUTER JOIN ephemeral_addresses e
+         ON id_tx = e.seen_in_tx
+         WHERE id_tx = :tx_ref OR e.address = :address
+         ORDER BY mined_height ASC NULLS LAST,
+                  tx_index ASC NULLS LAST,
+                  e.seen_in_tx ASC NULLS LAST
+         LIMIT 1",
+        named_params![":tx_ref": tx_ref.0, ":address": address_str],
+        |row| row.get::<_, i64>(0),
+    )?;
+
+    let update_result = conn
+        .query_row(
+            "UPDATE ephemeral_addresses
+             SET seen_in_tx = :seen_in_tx
+             WHERE address = :address
+             RETURNING account_id, address_index",
+            named_params![":seen_in_tx": &earlier_ref, ":address": address_str],
+            |row| Ok((AccountRef(row.get::<_, u32>(0)?), row.get::<_, u32>(1)?)),
+        )
+        .optional()?;
+
+    // Maintain the invariant that the last `GAP_LIMIT` addresses are unused and unseen.
+    if let Some((account_id, address_index)) = update_result {
+        let next_to_reserve = address_index.checked_add(1).expect("ensured by constraint");
+        reserve_until(conn, params, account_id, next_to_reserve)?;
+    }
+    Ok(())
+}
diff --git a/zcash_extensions/CHANGELOG.md b/zcash_extensions/CHANGELOG.md
index 27ea222fe6..7a8ec8a7e3 100644
--- a/zcash_extensions/CHANGELOG.md
+++ b/zcash_extensions/CHANGELOG.md
@@ -6,5 +6,10 @@ and this library adheres to Rust's notion of
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+### Changed
+- MSRV is now 1.77.0.
+
+## [0.1.0] - 2024-07-15
 Initial release.
-MSRV is 1.65.0.
+MSRV is 1.70.0.
diff --git a/zcash_extensions/Cargo.toml b/zcash_extensions/Cargo.toml
index 912d78c7fa..fff06dc1d5 100644
--- a/zcash_extensions/Cargo.toml
+++ b/zcash_extensions/Cargo.toml
@@ -1,24 +1,31 @@
 [package]
 name = "zcash_extensions"
 description = "Zcash Extension implementations & consensus node integration layer."
-version = "0.0.0"
+version = "0.1.0"
 authors = ["Jack Grigg <jack@z.cash>", "Kris Nuttycombe <kris@z.cash>"]
 homepage = "https://github.com/zcash/librustzcash"
-repository = "https://github.com/zcash/librustzcash"
-license = "MIT OR Apache-2.0"
-edition = "2021"
-rust-version = "1.65"
+repository.workspace = true
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
 
 [dependencies]
-blake2b_simd = "1"
-zcash_primitives = { version = "0.12", path = "../zcash_primitives", default-features = false, features = ["zfuture" ] }
+blake2b_simd.workspace = true
+zcash_primitives.workspace = true
 
 [dev-dependencies]
-ff = "0.13"
-jubjub = "0.10"
-rand_core = "0.6"
-zcash_address = { version = "0.3", path = "../components/zcash_address" }
-zcash_proofs = { version = "0.12", path = "../zcash_proofs" }
+ff.workspace = true
+jubjub.workspace = true
+rand_core.workspace = true
+sapling.workspace = true
+orchard.workspace = true
+zcash_address.workspace = true
+zcash_proofs.workspace = true
 
 [features]
 transparent-inputs = []
diff --git a/zcash_extensions/README.md b/zcash_extensions/README.md
index 0b38603caf..b0af0d6cec 100644
--- a/zcash_extensions/README.md
+++ b/zcash_extensions/README.md
@@ -12,16 +12,6 @@ Licensed under either of
 
 at your option.
 
-Downstream code forks should note that 'zcash_extensions' depends on the
-'orchard' crate, which is licensed under the
-[Bootstrap Open Source License](https://github.com/zcash/orchard/blob/main/LICENSE-BOSL).
-A license exception is provided allowing some derived works that are linked or
-combined with the 'orchard' crate to be copied or distributed under the original
-licenses (in this case MIT / Apache 2.0), provided that the included portions of
-the 'orchard' code remain subject to BOSL.
-See https://github.com/zcash/orchard/blob/main/COPYING for details of which
-derived works can make use of this exception.
-
 ### Contribution
 
 Unless you explicitly state otherwise, any contribution intentionally
diff --git a/zcash_extensions/src/lib.rs b/zcash_extensions/src/lib.rs
index 4ccb49efb6..087369b314 100644
--- a/zcash_extensions/src/lib.rs
+++ b/zcash_extensions/src/lib.rs
@@ -1,5 +1,12 @@
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
 // Catch documentation errors caused by code changes.
 #![deny(rustdoc::broken_intra_doc_links)]
 
+// For workspace compilation reasons, we have this crate in the workspace and just leave
+// it empty if `zfuture` is not enabled.
+
+#[cfg(zcash_unstable = "tze")]
 pub mod consensus;
+#[cfg(zcash_unstable = "tze")]
 pub mod transparent;
diff --git a/zcash_extensions/src/transparent/demo.rs b/zcash_extensions/src/transparent/demo.rs
index b949817327..28ed54fb24 100644
--- a/zcash_extensions/src/transparent/demo.rs
+++ b/zcash_extensions/src/transparent/demo.rs
@@ -476,26 +476,26 @@ impl<'a, B: ExtensionTxBuilder<'a>> DemoBuilder<B> {
 
 #[cfg(test)]
 mod tests {
+    use std::convert::Infallible;
+
     use blake2b_simd::Params;
     use ff::Field;
     use rand_core::OsRng;
 
+    use sapling::{zip32::ExtendedSpendingKey, Node, Rseed};
     use zcash_primitives::{
-        consensus::{BlockHeight, BranchId, NetworkUpgrade, Parameters},
-        constants,
+        consensus::{BlockHeight, BranchId, NetworkType, NetworkUpgrade, Parameters},
         extensions::transparent::{self as tze, Extension, FromPayload, ToPayload},
         legacy::TransparentAddress,
-        sapling::{self, Node, Rseed},
         transaction::{
-            builder::Builder,
+            builder::{BuildConfig, Builder},
             components::{
-                amount::Amount,
+                amount::{Amount, NonNegativeAmount},
                 tze::{Authorized, Bundle, OutPoint, TzeIn, TzeOut},
             },
-            fees::fixed,
+            fees::{fixed, zip317::MINIMUM_FEE},
             Transaction, TransactionData, TxVersion,
         },
-        zip32::ExtendedSpendingKey,
     };
     use zcash_proofs::prover::LocalTxProver;
 
@@ -513,38 +513,17 @@ mod tests {
                 NetworkUpgrade::Heartwood => Some(BlockHeight::from_u32(903_800)),
                 NetworkUpgrade::Canopy => Some(BlockHeight::from_u32(1_028_500)),
                 NetworkUpgrade::Nu5 => Some(BlockHeight::from_u32(1_200_000)),
+                NetworkUpgrade::Nu6 => Some(BlockHeight::from_u32(1_300_000)),
+                NetworkUpgrade::Nu7 => Some(BlockHeight::from_u32(1_350_000)),
                 NetworkUpgrade::ZFuture => Some(BlockHeight::from_u32(1_400_000)),
             }
         }
 
-        fn address_network(&self) -> Option<zcash_address::Network> {
-            None
-        }
-
-        fn coin_type(&self) -> u32 {
-            constants::testnet::COIN_TYPE
-        }
-
-        fn hrp_sapling_extended_spending_key(&self) -> &str {
-            constants::testnet::HRP_SAPLING_EXTENDED_SPENDING_KEY
-        }
-
-        fn hrp_sapling_extended_full_viewing_key(&self) -> &str {
-            constants::testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY
-        }
-
-        fn hrp_sapling_payment_address(&self) -> &str {
-            constants::testnet::HRP_SAPLING_PAYMENT_ADDRESS
-        }
-
-        fn b58_pubkey_address_prefix(&self) -> [u8; 2] {
-            constants::testnet::B58_PUBKEY_ADDRESS_PREFIX
-        }
-
-        fn b58_script_address_prefix(&self) -> [u8; 2] {
-            constants::testnet::B58_SCRIPT_ADDRESS_PREFIX
+        fn network_type(&self) -> NetworkType {
+            NetworkType::Test
         }
     }
+
     fn demo_hashes(preimage_1: &[u8; 32], preimage_2: &[u8; 32]) -> ([u8; 32], [u8; 32]) {
         let hash_2 = {
             let mut hash = [0; 32];
@@ -636,9 +615,19 @@ mod tests {
         }
     }
 
-    fn demo_builder<'a>(height: BlockHeight) -> DemoBuilder<Builder<'a, FutureNetwork, OsRng>> {
+    fn demo_builder<'a>(
+        height: BlockHeight,
+        sapling_anchor: sapling::Anchor,
+    ) -> DemoBuilder<Builder<'a, FutureNetwork, ()>> {
         DemoBuilder {
-            txn_builder: Builder::new(FutureNetwork, height),
+            txn_builder: Builder::new(
+                FutureNetwork,
+                height,
+                BuildConfig::Standard {
+                    sapling_anchor: Some(sapling_anchor),
+                    orchard_anchor: Some(orchard::Anchor::empty_tree()),
+                },
+            ),
             extension_id: 0,
         }
     }
@@ -684,7 +673,7 @@ mod tests {
             precondition: tze::Precondition::from(0, &Precondition::open(hash_1)),
         };
 
-        let tx_a = TransactionData::from_parts_zfuture(
+        let tx_a = TransactionData::from_parts(
             TxVersion::ZFuture,
             BranchId::ZFuture,
             0,
@@ -693,6 +682,7 @@ mod tests {
             None,
             None,
             None,
+            None,
             Some(Bundle {
                 vin: vec![],
                 vout: vec![out_a],
@@ -715,7 +705,7 @@ mod tests {
             precondition: tze::Precondition::from(0, &Precondition::close(hash_2)),
         };
 
-        let tx_b = TransactionData::from_parts_zfuture(
+        let tx_b = TransactionData::from_parts(
             TxVersion::ZFuture,
             BranchId::ZFuture,
             0,
@@ -724,6 +714,7 @@ mod tests {
             None,
             None,
             None,
+            None,
             Some(Bundle {
                 vin: vec![in_b],
                 vout: vec![out_b],
@@ -742,7 +733,7 @@ mod tests {
             witness: tze::Witness::from(0, &Witness::close(preimage_2)),
         };
 
-        let tx_c = TransactionData::from_parts_zfuture(
+        let tx_c = TransactionData::from_parts(
             TxVersion::ZFuture,
             BranchId::ZFuture,
             0,
@@ -751,6 +742,7 @@ mod tests {
             None,
             None,
             None,
+            None,
             Some(Bundle {
                 vin: vec![in_c],
                 vout: vec![],
@@ -796,11 +788,7 @@ mod tests {
             .activation_height(NetworkUpgrade::ZFuture)
             .unwrap();
 
-        // Only run the test if we have the prover parameters.
-        let prover = match LocalTxProver::with_default_location() {
-            Some(prover) => prover,
-            None => return,
-        };
+        let prover = LocalTxProver::bundled();
 
         //
         // Opening transaction
@@ -810,12 +798,15 @@ mod tests {
 
         // FIXME: implement zcash_primitives::transaction::fees::FutureFeeRule for zip317::FeeRule.
         #[allow(deprecated)]
-        let fee_rule = fixed::FeeRule::standard();
+        let fee_rule = fixed::FeeRule::non_standard(MINIMUM_FEE);
 
         // create some inputs to spend
         let extsk = ExtendedSpendingKey::master(&[]);
         let to = extsk.default_address().1;
-        let note1 = to.create_note(110000, Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)));
+        let note1 = to.create_note(
+            sapling::value::NoteValue::from_raw(110000),
+            Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)),
+        );
         let cm1 = Node::from_cmu(&note1.cmu());
         let mut tree = sapling::CommitmentTree::empty();
         // fake that the note appears in some previous
@@ -823,48 +814,54 @@ mod tests {
         tree.append(cm1).unwrap();
         let witness1 = sapling::IncrementalWitness::from_tree(tree);
 
-        let mut builder_a = demo_builder(tx_height);
+        let mut builder_a = demo_builder(tx_height, witness1.root().into());
         builder_a
-            .add_sapling_spend(extsk, *to.diversifier(), note1, witness1.path().unwrap())
+            .add_sapling_spend::<Infallible>(&extsk, note1, witness1.path().unwrap())
             .unwrap();
 
-        let value = Amount::from_u64(100000).unwrap();
+        let value = NonNegativeAmount::const_from_u64(100000);
         let (h1, h2) = demo_hashes(&preimage_1, &preimage_2);
         builder_a
-            .demo_open(value, h1)
+            .demo_open(value.into(), h1)
             .map_err(|e| format!("open failure: {:?}", e))
             .unwrap();
-        let (tx_a, _) = builder_a
+        let res_a = builder_a
             .txn_builder
-            .build_zfuture(&prover, &fee_rule)
+            .build_zfuture(OsRng, &prover, &prover, &fee_rule)
             .map_err(|e| format!("build failure: {:?}", e))
             .unwrap();
-        let tze_a = tx_a.tze_bundle().unwrap();
+        let tze_a = res_a.transaction().tze_bundle().unwrap();
 
         //
         // Transfer
         //
 
-        let mut builder_b = demo_builder(tx_height + 1);
-        let prevout_a = (OutPoint::new(tx_a.txid(), 0), tze_a.vout[0].clone());
+        let mut builder_b = demo_builder(tx_height + 1, sapling::Anchor::empty_tree());
+        let prevout_a = (
+            OutPoint::new(res_a.transaction().txid(), 0),
+            tze_a.vout[0].clone(),
+        );
         let value_xfr = (value - fee_rule.fixed_fee()).unwrap();
         builder_b
-            .demo_transfer_to_close(prevout_a, value_xfr, preimage_1, h2)
+            .demo_transfer_to_close(prevout_a, value_xfr.into(), preimage_1, h2)
             .map_err(|e| format!("transfer failure: {:?}", e))
             .unwrap();
-        let (tx_b, _) = builder_b
+        let res_b = builder_b
             .txn_builder
-            .build_zfuture(&prover, &fee_rule)
+            .build_zfuture(OsRng, &prover, &prover, &fee_rule)
             .map_err(|e| format!("build failure: {:?}", e))
             .unwrap();
-        let tze_b = tx_b.tze_bundle().unwrap();
+        let tze_b = res_b.transaction().tze_bundle().unwrap();
 
         //
         // Closing transaction
         //
 
-        let mut builder_c = demo_builder(tx_height + 2);
-        let prevout_b = (OutPoint::new(tx_a.txid(), 0), tze_b.vout[0].clone());
+        let mut builder_c = demo_builder(tx_height + 2, sapling::Anchor::empty_tree());
+        let prevout_b = (
+            OutPoint::new(res_a.transaction().txid(), 0),
+            tze_b.vout[0].clone(),
+        );
         builder_c
             .demo_close(prevout_b, preimage_2)
             .map_err(|e| format!("close failure: {:?}", e))
@@ -872,27 +869,31 @@ mod tests {
 
         builder_c
             .add_transparent_output(
-                &TransparentAddress::PublicKey([0; 20]),
+                &TransparentAddress::PublicKeyHash([0; 20]),
                 (value_xfr - fee_rule.fixed_fee()).unwrap(),
             )
             .unwrap();
 
-        let (tx_c, _) = builder_c
+        let res_c = builder_c
             .txn_builder
-            .build_zfuture(&prover, &fee_rule)
+            .build_zfuture(OsRng, &prover, &prover, &fee_rule)
             .map_err(|e| format!("build failure: {:?}", e))
             .unwrap();
-        let tze_c = tx_c.tze_bundle().unwrap();
+        let tze_c = res_c.transaction().tze_bundle().unwrap();
 
         // Verify tx_b
-        let ctx0 = Ctx { tx: &tx_b };
+        let ctx0 = Ctx {
+            tx: res_b.transaction(),
+        };
         assert_eq!(
             Program.verify(&tze_a.vout[0].precondition, &tze_b.vin[0].witness, &ctx0),
             Ok(())
         );
 
         // Verify tx_c
-        let ctx1 = Ctx { tx: &tx_c };
+        let ctx1 = Ctx {
+            tx: res_c.transaction(),
+        };
         assert_eq!(
             Program.verify(&tze_b.vout[0].precondition, &tze_c.vin[0].witness, &ctx1),
             Ok(())
diff --git a/zcash_history/CHANGELOG.md b/zcash_history/CHANGELOG.md
index df9f83a6b1..5d3d5157d9 100644
--- a/zcash_history/CHANGELOG.md
+++ b/zcash_history/CHANGELOG.md
@@ -7,6 +7,10 @@ and this library adheres to Rust's notion of
 
 ## [Unreleased]
 ### Changed
+- MSRV is now 1.77.0.
+
+## [0.4.0] - 2023-03-01
+### Changed
 - MSRV is now 1.65.0.
 - Bumped dependencies to `primitive-types 0.12`.
 
diff --git a/zcash_history/Cargo.toml b/zcash_history/Cargo.toml
index c9de761fb9..591c24f224 100644
--- a/zcash_history/Cargo.toml
+++ b/zcash_history/Cargo.toml
@@ -1,26 +1,26 @@
 [package]
 name = "zcash_history"
-version = "0.3.0"
+version = "0.4.0"
 authors = ["NikVolf <nikvolf@gmail.com>"]
-edition = "2021"
-rust-version = "1.65"
-license = "MIT/Apache-2.0"
-documentation = "https://docs.rs/zcash_history/"
+edition.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+license.workspace = true
 description = "Library for Zcash blockchain history tools"
-categories = ["cryptography::cryptocurrencies"]
+categories.workspace = true
 
 [dev-dependencies]
-assert_matches = "1.3.0"
-proptest = "1.0.0"
+assert_matches.workspace = true
+proptest.workspace = true
 
 [dependencies]
 primitive-types = { version = "0.12", default-features = false }
-byteorder = "1"
-blake2 = { package = "blake2b_simd", version = "1" }
-proptest = { version = "1.0.0", optional = true }
+byteorder.workspace = true
+blake2b_simd.workspace = true
+proptest = { workspace = true, optional = true }
 
 [features]
-test-dependencies = ["proptest"]
+test-dependencies = ["dep:proptest"]
 
 [lib]
 bench = false
diff --git a/zcash_history/src/lib.rs b/zcash_history/src/lib.rs
index 60e347803e..deb4867fc0 100644
--- a/zcash_history/src/lib.rs
+++ b/zcash_history/src/lib.rs
@@ -35,7 +35,7 @@ impl std::fmt::Display for Error {
     }
 }
 
-/// Reference to to the tree node.
+/// Reference to the tree node.
 #[repr(C)]
 #[derive(Clone, Copy, Debug)]
 pub enum EntryLink {
diff --git a/zcash_history/src/tree.rs b/zcash_history/src/tree.rs
index 5d543c7387..3a16ea005a 100644
--- a/zcash_history/src/tree.rs
+++ b/zcash_history/src/tree.rs
@@ -72,7 +72,7 @@ impl<V: Version> Tree<V> {
         }
     }
 
-    /// New view into the the tree array representation
+    /// New view into the tree array representation
     ///
     /// `length` is total length of the array representation (is generally not a sum of
     ///     peaks.len + extra.len)
@@ -245,7 +245,7 @@ impl<V: Version> Tree<V> {
             }
         }
 
-        let mut new_root = *peaks.get(0).expect("At lest 1 elements in peaks");
+        let mut new_root = *peaks.first().expect("At lest 1 elements in peaks");
 
         for next_peak in peaks.into_iter().skip(1) {
             new_root = self.push_generated(combine_nodes(
diff --git a/zcash_history/src/version.rs b/zcash_history/src/version.rs
index c9e53157d8..bfc18fa6f0 100644
--- a/zcash_history/src/version.rs
+++ b/zcash_history/src/version.rs
@@ -1,7 +1,7 @@
 use std::fmt;
 use std::io;
 
-use blake2::Params as Blake2Params;
+use blake2b_simd::Params as Blake2Params;
 use byteorder::{ByteOrder, LittleEndian};
 
 use crate::{node_data, NodeData, MAX_NODE_DATA_SIZE};
diff --git a/zcash_keys/CHANGELOG.md b/zcash_keys/CHANGELOG.md
new file mode 100644
index 0000000000..54a42f5849
--- /dev/null
+++ b/zcash_keys/CHANGELOG.md
@@ -0,0 +1,142 @@
+All notable changes to this library will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this library adheres to Rust's notion of
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.5.0] - 2024-11-14
+
+### Changed
+- Migrated to `zcash_primitives 0.20.0`
+- MSRV is now 1.77.0.
+
+## [0.4.0] - 2024-10-04
+
+### Added
+- `zcash_keys::encoding::decode_extfvk_with_network`
+- `impl std::error::Error for Bech32DecodeError`
+- `impl std::error::Error for DecodingError`
+- `impl std::error::Error for DerivationError`
+
+### Changed
+- Migrated to `orchard 0.10`, `sapling-crypto 0.3`, `zcash_address 0.6`,
+  `zcash_primitives 0.19`, `zcash_protocol 0.4`.
+
+## [0.3.0] - 2024-08-19
+### Notable changes
+- `zcash_keys`:
+  - Now supports TEX (transparent-source-only) addresses as specified
+    in [ZIP 320](https://zips.z.cash/zip-0320).
+  - An `unstable-frost` feature has been added in order to be able to
+    temporarily expose API features that are needed specifically when creating
+    FROST threshold signatures. The features under this flag will be removed
+    once key derivation for FROST has been fully specified and implemented.
+
+### Added
+- `zcash_keys::address::Address::try_from_zcash_address`
+- `zcash_keys::address::Receiver`
+- `zcash_keys::keys::UnifiedAddressRequest`
+  - `intersect`
+  - `to_address_request`
+
+### Changed
+- MSRV is now 1.70.0.
+- Updated dependencies:
+  - `zcash_address-0.4`
+  - `zcash_encoding-0.2.1`
+  - `zcash_primitives-0.16`
+  - `zcash_protocol-0.2`
+- `zcash_keys::Address` has a new variant `Tex`.
+- `zcash_keys::address::Address::has_receiver` has been renamed to `can_receive_as`.
+- `zcash_keys::keys`:
+  - The (unstable) encoding of `UnifiedSpendingKey` has changed.
+  - `DerivationError::Transparent` now contains `bip32::Error`.
+
+## [0.2.0] - 2024-03-25
+
+### Added
+- `zcash_keys::address::Address::has_receiver`
+- `impl Display for zcash_keys::keys::AddressGenerationError`
+- `impl std::error::Error for zcash_keys::keys::AddressGenerationError`
+- `impl From<hdwallet::error::Error> for zcash_keys::keys::DerivationError`
+  when the `transparent-inputs` feature is enabled.
+- `zcash_keys::keys::DecodingError`
+- `zcash_keys::keys::UnifiedFullViewingKey::{parse, to_unified_incoming_viewing_key}`
+- `zcash_keys::keys::UnifiedIncomingViewingKey`
+
+### Changed
+- `zcash_keys::keys::UnifiedFullViewingKey::{find_address, default_address}`
+  now return `Result<(UnifiedAddress, DiversifierIndex), AddressGenerationError>`
+  (instead of `Option<(UnifiedAddress, DiversifierIndex)>` for `find_address`).
+- `zcash_keys::keys::AddressGenerationError`
+  - Added `DiversifierSpaceExhausted` variant.
+- At least one of the `orchard`, `sapling`, or `transparent-inputs` features
+  must be enabled for the `keys` module to be accessible.
+- Updated to `zcash_primitives-0.15.0`
+
+### Removed
+- `UnifiedFullViewingKey::new` has been placed behind the `test-dependencies`
+  feature flag. UFVKs should only be produced by derivation from the USK, or
+  parsed from their string representation.
+
+### Fixed
+- `UnifiedFullViewingKey::find_address` can now find an address for a diversifier
+  index outside the valid transparent range if you aren't requesting a
+  transparent receiver.
+
+## [0.1.1] - 2024-03-04
+
+### Added
+- `zcash_keys::keys::UnifiedAddressRequest::all`
+
+### Fixed
+- A missing application of the `sapling` feature flag was remedied;
+  prior to this fix it was not possible to use this crate without the
+  `sapling` feature enabled.
+
+## [0.1.0] - 2024-03-01
+The entries below are relative to the `zcash_client_backend` crate as of
+`zcash_client_backend 0.10.0`.
+
+### Added
+- `zcash_keys::address` (moved from `zcash_client_backend::address`). Further
+  additions to this module:
+  - `UnifiedAddress::{has_orchard, has_sapling, has_transparent}`
+  - `UnifiedAddress::receiver_types`
+  - `UnifiedAddress::unknown`
+- `zcash_keys::encoding` (moved from `zcash_client_backend::encoding`).
+- `zcash_keys::keys` (moved from `zcash_client_backend::keys`). Further
+  additions to this module:
+  - `AddressGenerationError`
+  - `UnifiedAddressRequest`
+- A new `orchard` feature flag has been added to make it possible to
+  build client code without `orchard` dependendencies.
+- `zcash_keys::address::Address::to_zcash_address`
+
+### Changed
+- The following methods and enum variants have been placed behind an `orchard`
+  feature flag:
+  - `zcash_keys::address::UnifiedAddress::orchard`
+  - `zcash_keys::keys::DerivationError::Orchard`
+  - `zcash_keys::keys::UnifiedSpendingKey::orchard`
+- `zcash_keys::address`:
+  - `RecipientAddress` has been renamed to `Address`.
+  - `Address::Shielded` has been renamed to `Address::Sapling`.
+  - `UnifiedAddress::from_receivers` no longer takes an Orchard receiver
+    argument unless the `orchard` feature is enabled.
+- `zcash_keys::keys`:
+  - `UnifiedSpendingKey::address` now takes an argument that specifies the
+    receivers to be generated in the resulting address. Also, it now returns
+    `Result<UnifiedAddress, AddressGenerationError>` instead of
+    `Option<UnifiedAddress>` so that we may better report to the user how
+    address generation has failed.
+  - `UnifiedSpendingKey::transparent` is now only available when the
+    `transparent-inputs` feature is enabled.
+  - `UnifiedFullViewingKey::new` no longer takes an Orchard full viewing key
+    argument unless the `orchard` feature is enabled.
+
+### Removed
+- `zcash_keys::address::AddressMetadata`
+  (use `zcash_client_backend::data_api::TransparentAddressMetadata` instead).
diff --git a/zcash_keys/Cargo.toml b/zcash_keys/Cargo.toml
new file mode 100644
index 0000000000..aa86997105
--- /dev/null
+++ b/zcash_keys/Cargo.toml
@@ -0,0 +1,103 @@
+[package]
+name = "zcash_keys"
+description = "Zcash key and address management"
+version = "0.5.0"
+authors = [
+    "Jack Grigg <jack@z.cash>",
+    "Kris Nuttycombe <kris@electriccoin.co>"
+]
+homepage = "https://github.com/zcash/librustzcash"
+repository.workspace = true
+readme = "README.md"
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[dependencies]
+zcash_address.workspace = true
+zcash_encoding.workspace = true
+zcash_primitives.workspace = true
+zcash_protocol.workspace = true
+zip32.workspace = true
+
+# Dependencies exposed in a public API:
+nonempty.workspace = true
+
+# - CSPRNG
+rand_core.workspace = true
+
+# - Encodings
+bech32.workspace = true
+bs58.workspace = true
+
+# - Transparent protocols
+bip32 = { workspace = true, optional = true }
+
+# - Logging and metrics
+memuse.workspace = true
+tracing.workspace = true
+
+# - Secret management
+secrecy.workspace = true
+subtle.workspace = true
+
+# - Shielded protocols
+bls12_381.workspace = true
+group.workspace = true
+orchard = { workspace = true, optional = true }
+sapling = { workspace = true, optional = true }
+
+# - Test dependencies
+proptest = { workspace = true, optional = true }
+
+# Dependencies used internally:
+# (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Documentation
+document-features.workspace = true
+
+# - Encodings
+byteorder = { workspace = true, optional = true }
+
+# - Digests
+blake2b_simd = { workspace = true }
+
+[dev-dependencies]
+hex.workspace = true
+jubjub.workspace = true
+proptest.workspace = true
+rand_core.workspace = true
+zcash_address = { workspace = true, features = ["test-dependencies"] }
+zcash_primitives = { workspace = true, features = ["test-dependencies"] }
+
+[features]
+## Enables use of transparent key parts and addresses
+transparent-inputs = ["dep:bip32", "zcash_primitives/transparent-inputs"]
+
+## Enables use of Orchard key parts and addresses
+orchard = ["dep:orchard"]
+
+## Enables use of Sapling key parts and addresses
+sapling = ["dep:sapling"]
+
+## Exposes APIs that are useful for testing, such as `proptest` strategies.
+test-dependencies = [
+    "dep:proptest",
+    "orchard?/test-dependencies",
+    "zcash_primitives/test-dependencies",
+]
+
+#! ### Experimental features
+
+## Exposes unstable APIs that are compatible with FROST key management
+unstable-frost = ["orchard"]
+
+## Exposes unstable APIs. Their behaviour may change at any time.
+unstable = ["dep:byteorder"]
+
+[badges]
+maintenance = { status = "actively-developed" }
diff --git a/zcash_keys/LICENSE-APACHE b/zcash_keys/LICENSE-APACHE
new file mode 100644
index 0000000000..1e5006dc14
--- /dev/null
+++ b/zcash_keys/LICENSE-APACHE
@@ -0,0 +1,202 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
diff --git a/zcash_keys/LICENSE-MIT b/zcash_keys/LICENSE-MIT
new file mode 100644
index 0000000000..1581c90d16
--- /dev/null
+++ b/zcash_keys/LICENSE-MIT
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017-2019 Electric Coin Company
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/zcash_keys/README.md b/zcash_keys/README.md
new file mode 100644
index 0000000000..a8852a3ba3
--- /dev/null
+++ b/zcash_keys/README.md
@@ -0,0 +1,22 @@
+# zcash_keys
+
+This library contains Rust structs and traits for Zcash key and address parsing
+and encoding.
+
+## License
+
+Licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual licensed as above, without any additional terms or
+conditions.
+
diff --git a/zcash_keys/src/address.rs b/zcash_keys/src/address.rs
new file mode 100644
index 0000000000..665c03a34e
--- /dev/null
+++ b/zcash_keys/src/address.rs
@@ -0,0 +1,556 @@
+//! Structs for handling supported address types.
+
+use zcash_address::{
+    unified::{self, Container, Encoding, Typecode},
+    ConversionError, ToAddress, TryFromRawAddress, ZcashAddress,
+};
+use zcash_primitives::legacy::TransparentAddress;
+use zcash_protocol::consensus::{self, NetworkType};
+
+#[cfg(feature = "sapling")]
+use sapling::PaymentAddress;
+use zcash_protocol::{PoolType, ShieldedProtocol};
+
+/// A Unified Address.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct UnifiedAddress {
+    #[cfg(feature = "orchard")]
+    orchard: Option<orchard::Address>,
+    #[cfg(feature = "sapling")]
+    sapling: Option<PaymentAddress>,
+    transparent: Option<TransparentAddress>,
+    unknown: Vec<(u32, Vec<u8>)>,
+}
+
+impl TryFrom<unified::Address> for UnifiedAddress {
+    type Error = &'static str;
+
+    fn try_from(ua: unified::Address) -> Result<Self, Self::Error> {
+        #[cfg(feature = "orchard")]
+        let mut orchard = None;
+        #[cfg(feature = "sapling")]
+        let mut sapling = None;
+        let mut transparent = None;
+
+        let mut unknown: Vec<(u32, Vec<u8>)> = vec![];
+
+        // We can use as-parsed order here for efficiency, because we're breaking out the
+        // receivers we support from the unknown receivers.
+        for item in ua.items_as_parsed() {
+            match item {
+                unified::Receiver::Orchard(data) => {
+                    #[cfg(feature = "orchard")]
+                    {
+                        orchard = Some(
+                            Option::from(orchard::Address::from_raw_address_bytes(data))
+                                .ok_or("Invalid Orchard receiver in Unified Address")?,
+                        );
+                    }
+                    #[cfg(not(feature = "orchard"))]
+                    {
+                        unknown.push((unified::Typecode::Orchard.into(), data.to_vec()));
+                    }
+                }
+
+                unified::Receiver::Sapling(data) => {
+                    #[cfg(feature = "sapling")]
+                    {
+                        sapling = Some(
+                            PaymentAddress::from_bytes(data)
+                                .ok_or("Invalid Sapling receiver in Unified Address")?,
+                        );
+                    }
+                    #[cfg(not(feature = "sapling"))]
+                    {
+                        unknown.push((unified::Typecode::Sapling.into(), data.to_vec()));
+                    }
+                }
+
+                unified::Receiver::P2pkh(data) => {
+                    transparent = Some(TransparentAddress::PublicKeyHash(*data));
+                }
+
+                unified::Receiver::P2sh(data) => {
+                    transparent = Some(TransparentAddress::ScriptHash(*data));
+                }
+
+                unified::Receiver::Unknown { typecode, data } => {
+                    unknown.push((*typecode, data.clone()));
+                }
+            }
+        }
+
+        Ok(Self {
+            #[cfg(feature = "orchard")]
+            orchard,
+            #[cfg(feature = "sapling")]
+            sapling,
+            transparent,
+            unknown,
+        })
+    }
+}
+
+impl UnifiedAddress {
+    /// Constructs a Unified Address from a given set of receivers.
+    ///
+    /// Returns `None` if the receivers would produce an invalid Unified Address (namely,
+    /// if no shielded receiver is provided).
+    pub fn from_receivers(
+        #[cfg(feature = "orchard")] orchard: Option<orchard::Address>,
+        #[cfg(feature = "sapling")] sapling: Option<PaymentAddress>,
+        transparent: Option<TransparentAddress>,
+        // TODO: Add handling for address metadata items.
+    ) -> Option<Self> {
+        #[cfg(feature = "orchard")]
+        let has_orchard = orchard.is_some();
+        #[cfg(not(feature = "orchard"))]
+        let has_orchard = false;
+
+        #[cfg(feature = "sapling")]
+        let has_sapling = sapling.is_some();
+        #[cfg(not(feature = "sapling"))]
+        let has_sapling = false;
+
+        if has_orchard || has_sapling {
+            Some(Self {
+                #[cfg(feature = "orchard")]
+                orchard,
+                #[cfg(feature = "sapling")]
+                sapling,
+                transparent,
+                unknown: vec![],
+            })
+        } else {
+            // UAs require at least one shielded receiver.
+            None
+        }
+    }
+
+    /// Returns whether this address has an Orchard receiver.
+    ///
+    /// This method is available irrespective of whether the `orchard` feature flag is enabled.
+    pub fn has_orchard(&self) -> bool {
+        #[cfg(not(feature = "orchard"))]
+        return false;
+        #[cfg(feature = "orchard")]
+        return self.orchard.is_some();
+    }
+
+    /// Returns the Orchard receiver within this Unified Address, if any.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> Option<&orchard::Address> {
+        self.orchard.as_ref()
+    }
+
+    /// Returns whether this address has a Sapling receiver.
+    pub fn has_sapling(&self) -> bool {
+        #[cfg(not(feature = "sapling"))]
+        return false;
+
+        #[cfg(feature = "sapling")]
+        return self.sapling.is_some();
+    }
+
+    /// Returns the Sapling receiver within this Unified Address, if any.
+    #[cfg(feature = "sapling")]
+    pub fn sapling(&self) -> Option<&PaymentAddress> {
+        self.sapling.as_ref()
+    }
+
+    /// Returns whether this address has a Transparent receiver.
+    pub fn has_transparent(&self) -> bool {
+        self.transparent.is_some()
+    }
+
+    /// Returns the transparent receiver within this Unified Address, if any.
+    pub fn transparent(&self) -> Option<&TransparentAddress> {
+        self.transparent.as_ref()
+    }
+
+    /// Returns the set of unknown receivers of the unified address.
+    pub fn unknown(&self) -> &[(u32, Vec<u8>)] {
+        &self.unknown
+    }
+
+    fn to_address(&self, net: NetworkType) -> ZcashAddress {
+        let items = self
+            .unknown
+            .iter()
+            .map(|(typecode, data)| unified::Receiver::Unknown {
+                typecode: *typecode,
+                data: data.clone(),
+            });
+
+        #[cfg(feature = "orchard")]
+        let items = items.chain(
+            self.orchard
+                .as_ref()
+                .map(|addr| addr.to_raw_address_bytes())
+                .map(unified::Receiver::Orchard),
+        );
+
+        #[cfg(feature = "sapling")]
+        let items = items.chain(
+            self.sapling
+                .as_ref()
+                .map(|pa| pa.to_bytes())
+                .map(unified::Receiver::Sapling),
+        );
+
+        let items = items.chain(self.transparent.as_ref().map(|taddr| match taddr {
+            TransparentAddress::PublicKeyHash(data) => unified::Receiver::P2pkh(*data),
+            TransparentAddress::ScriptHash(data) => unified::Receiver::P2sh(*data),
+        }));
+
+        let ua = unified::Address::try_from_items(items.collect())
+            .expect("UnifiedAddress should only be constructed safely");
+        ZcashAddress::from_unified(net, ua)
+    }
+
+    /// Returns the string encoding of this `UnifiedAddress` for the given network.
+    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
+        self.to_address(params.network_type()).to_string()
+    }
+
+    /// Returns the set of receiver typecodes.
+    pub fn receiver_types(&self) -> Vec<Typecode> {
+        let result = std::iter::empty();
+        #[cfg(feature = "orchard")]
+        let result = result.chain(self.orchard.map(|_| Typecode::Orchard));
+        #[cfg(feature = "sapling")]
+        let result = result.chain(self.sapling.map(|_| Typecode::Sapling));
+        let result = result.chain(self.transparent.map(|taddr| match taddr {
+            TransparentAddress::PublicKeyHash(_) => Typecode::P2pkh,
+            TransparentAddress::ScriptHash(_) => Typecode::P2sh,
+        }));
+        let result = result.chain(
+            self.unknown()
+                .iter()
+                .map(|(typecode, _)| Typecode::Unknown(*typecode)),
+        );
+        result.collect()
+    }
+}
+
+/// An enumeration of protocol-level receiver types.
+///
+/// While these correspond to unified address receiver types, this is a distinct type because it is
+/// used to represent the protocol-level recipient of a transfer, instead of a part of an encoded
+/// address.
+pub enum Receiver {
+    #[cfg(feature = "orchard")]
+    Orchard(orchard::Address),
+    #[cfg(feature = "sapling")]
+    Sapling(PaymentAddress),
+    Transparent(TransparentAddress),
+}
+
+impl Receiver {
+    /// Converts this receiver to a [`ZcashAddress`] for the given network.
+    ///
+    /// This conversion function selects the least-capable address format possible; this means that
+    /// Orchard receivers will be rendered as Unified addresses, Sapling receivers will be rendered
+    /// as bare Sapling addresses, and Transparent receivers will be rendered as taddrs.
+    pub fn to_zcash_address(&self, net: NetworkType) -> ZcashAddress {
+        match self {
+            #[cfg(feature = "orchard")]
+            Receiver::Orchard(addr) => {
+                let receiver = unified::Receiver::Orchard(addr.to_raw_address_bytes());
+                let ua = unified::Address::try_from_items(vec![receiver])
+                    .expect("A unified address may contain a single Orchard receiver.");
+                ZcashAddress::from_unified(net, ua)
+            }
+            #[cfg(feature = "sapling")]
+            Receiver::Sapling(addr) => ZcashAddress::from_sapling(net, addr.to_bytes()),
+            Receiver::Transparent(TransparentAddress::PublicKeyHash(data)) => {
+                ZcashAddress::from_transparent_p2pkh(net, *data)
+            }
+            Receiver::Transparent(TransparentAddress::ScriptHash(data)) => {
+                ZcashAddress::from_transparent_p2sh(net, *data)
+            }
+        }
+    }
+
+    /// Returns whether or not this receiver corresponds to `addr`, or is contained
+    /// in `addr` when the latter is a Unified Address.
+    pub fn corresponds(&self, addr: &ZcashAddress) -> bool {
+        addr.matches_receiver(&match self {
+            #[cfg(feature = "orchard")]
+            Receiver::Orchard(addr) => unified::Receiver::Orchard(addr.to_raw_address_bytes()),
+            #[cfg(feature = "sapling")]
+            Receiver::Sapling(addr) => unified::Receiver::Sapling(addr.to_bytes()),
+            Receiver::Transparent(TransparentAddress::PublicKeyHash(data)) => {
+                unified::Receiver::P2pkh(*data)
+            }
+            Receiver::Transparent(TransparentAddress::ScriptHash(data)) => {
+                unified::Receiver::P2sh(*data)
+            }
+        })
+    }
+}
+
+/// An address that funds can be sent to.
+#[derive(Debug, PartialEq, Eq, Clone)]
+pub enum Address {
+    /// A Sapling payment address.
+    #[cfg(feature = "sapling")]
+    Sapling(PaymentAddress),
+
+    /// A transparent address corresponding to either a public key hash or a script hash.
+    Transparent(TransparentAddress),
+
+    /// A [ZIP 316] Unified Address.
+    ///
+    /// [ZIP 316]: https://zips.z.cash/zip-0316
+    Unified(UnifiedAddress),
+
+    /// A [ZIP 320] transparent-source-only P2PKH address, or "TEX address".
+    ///
+    /// [ZIP 320]: https://zips.z.cash/zip-0320
+    Tex([u8; 20]),
+}
+
+#[cfg(feature = "sapling")]
+impl From<PaymentAddress> for Address {
+    fn from(addr: PaymentAddress) -> Self {
+        Address::Sapling(addr)
+    }
+}
+
+impl From<TransparentAddress> for Address {
+    fn from(addr: TransparentAddress) -> Self {
+        Address::Transparent(addr)
+    }
+}
+
+impl From<UnifiedAddress> for Address {
+    fn from(addr: UnifiedAddress) -> Self {
+        Address::Unified(addr)
+    }
+}
+
+impl TryFromRawAddress for Address {
+    type Error = &'static str;
+
+    #[cfg(feature = "sapling")]
+    fn try_from_raw_sapling(data: [u8; 43]) -> Result<Self, ConversionError<Self::Error>> {
+        let pa = PaymentAddress::from_bytes(&data).ok_or("Invalid Sapling payment address")?;
+        Ok(pa.into())
+    }
+
+    fn try_from_raw_unified(
+        ua: zcash_address::unified::Address,
+    ) -> Result<Self, ConversionError<Self::Error>> {
+        UnifiedAddress::try_from(ua)
+            .map_err(ConversionError::User)
+            .map(Address::from)
+    }
+
+    fn try_from_raw_transparent_p2pkh(
+        data: [u8; 20],
+    ) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(TransparentAddress::PublicKeyHash(data).into())
+    }
+
+    fn try_from_raw_transparent_p2sh(data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(TransparentAddress::ScriptHash(data).into())
+    }
+
+    fn try_from_raw_tex(data: [u8; 20]) -> Result<Self, ConversionError<Self::Error>> {
+        Ok(Address::Tex(data))
+    }
+}
+
+impl Address {
+    /// Attempts to decode an [`Address`] value from its [`ZcashAddress`] encoded representation.
+    ///
+    /// Returns `None` if any error is encountered in decoding. Use
+    /// [`Self::try_from_zcash_address(s.parse()?)?`] if you need detailed error information.
+    pub fn decode<P: consensus::Parameters>(params: &P, s: &str) -> Option<Self> {
+        Self::try_from_zcash_address(params, s.parse::<ZcashAddress>().ok()?).ok()
+    }
+
+    /// Attempts to decode an [`Address`] value from its [`ZcashAddress`] encoded representation.
+    pub fn try_from_zcash_address<P: consensus::Parameters>(
+        params: &P,
+        zaddr: ZcashAddress,
+    ) -> Result<Self, ConversionError<&'static str>> {
+        zaddr.convert_if_network(params.network_type())
+    }
+
+    /// Converts this [`Address`] to its encoded [`ZcashAddress`] representation.
+    pub fn to_zcash_address<P: consensus::Parameters>(&self, params: &P) -> ZcashAddress {
+        let net = params.network_type();
+
+        match self {
+            #[cfg(feature = "sapling")]
+            Address::Sapling(pa) => ZcashAddress::from_sapling(net, pa.to_bytes()),
+            Address::Transparent(addr) => match addr {
+                TransparentAddress::PublicKeyHash(data) => {
+                    ZcashAddress::from_transparent_p2pkh(net, *data)
+                }
+                TransparentAddress::ScriptHash(data) => {
+                    ZcashAddress::from_transparent_p2sh(net, *data)
+                }
+            },
+            Address::Unified(ua) => ua.to_address(net),
+            Address::Tex(data) => ZcashAddress::from_tex(net, *data),
+        }
+    }
+
+    /// Converts this [`Address`] to its encoded string representation.
+    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
+        self.to_zcash_address(params).to_string()
+    }
+
+    /// Returns whether or not this [`Address`] can receive funds in the specified pool.
+    pub fn can_receive_as(&self, pool_type: PoolType) -> bool {
+        match self {
+            #[cfg(feature = "sapling")]
+            Address::Sapling(_) => {
+                matches!(pool_type, PoolType::Shielded(ShieldedProtocol::Sapling))
+            }
+            Address::Transparent(_) | Address::Tex(_) => {
+                matches!(pool_type, PoolType::Transparent)
+            }
+            Address::Unified(ua) => match pool_type {
+                PoolType::Transparent => ua.has_transparent(),
+                PoolType::Shielded(ShieldedProtocol::Sapling) => ua.has_sapling(),
+                PoolType::Shielded(ShieldedProtocol::Orchard) => ua.has_orchard(),
+            },
+        }
+    }
+}
+
+#[cfg(all(
+    any(
+        feature = "orchard",
+        feature = "sapling",
+        feature = "transparent-inputs"
+    ),
+    any(test, feature = "test-dependencies")
+))]
+pub mod testing {
+    use proptest::prelude::*;
+    use zcash_primitives::consensus::Network;
+
+    use crate::keys::{testing::arb_unified_spending_key, UnifiedAddressRequest};
+
+    use super::{Address, UnifiedAddress};
+
+    #[cfg(feature = "sapling")]
+    use sapling::testing::arb_payment_address;
+    use zcash_primitives::legacy::testing::arb_transparent_addr;
+
+    pub fn arb_unified_addr(
+        params: Network,
+        request: UnifiedAddressRequest,
+    ) -> impl Strategy<Value = UnifiedAddress> {
+        arb_unified_spending_key(params).prop_map(move |k| k.default_address(request).0)
+    }
+
+    #[cfg(feature = "sapling")]
+    pub fn arb_addr(request: UnifiedAddressRequest) -> impl Strategy<Value = Address> {
+        prop_oneof![
+            arb_payment_address().prop_map(Address::Sapling),
+            arb_transparent_addr().prop_map(Address::Transparent),
+            arb_unified_addr(Network::TestNetwork, request).prop_map(Address::Unified),
+            proptest::array::uniform20(any::<u8>()).prop_map(Address::Tex),
+        ]
+    }
+
+    #[cfg(not(feature = "sapling"))]
+    pub fn arb_addr(request: UnifiedAddressRequest) -> impl Strategy<Value = Address> {
+        return prop_oneof![
+            arb_transparent_addr().prop_map(Address::Transparent),
+            arb_unified_addr(Network::TestNetwork, request).prop_map(Address::Unified),
+            proptest::array::uniform20(any::<u8>()).prop_map(Address::Tex),
+        ];
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use zcash_address::test_vectors;
+    use zcash_primitives::consensus::MAIN_NETWORK;
+
+    use super::{Address, UnifiedAddress};
+
+    #[cfg(feature = "sapling")]
+    use crate::keys::sapling;
+
+    #[cfg(any(feature = "orchard", feature = "sapling"))]
+    use zcash_primitives::zip32::AccountId;
+
+    #[test]
+    #[cfg(any(feature = "orchard", feature = "sapling"))]
+    fn ua_round_trip() {
+        #[cfg(feature = "orchard")]
+        let orchard = {
+            let sk =
+                orchard::keys::SpendingKey::from_zip32_seed(&[0; 32], 0, AccountId::ZERO).unwrap();
+            let fvk = orchard::keys::FullViewingKey::from(&sk);
+            Some(fvk.address_at(0u32, orchard::keys::Scope::External))
+        };
+
+        #[cfg(feature = "sapling")]
+        let sapling = {
+            let extsk = sapling::spending_key(&[0; 32], 0, AccountId::ZERO);
+            let dfvk = extsk.to_diversifiable_full_viewing_key();
+            Some(dfvk.default_address().1)
+        };
+
+        let transparent = None;
+
+        #[cfg(all(feature = "orchard", feature = "sapling"))]
+        let ua = UnifiedAddress::from_receivers(orchard, sapling, transparent).unwrap();
+
+        #[cfg(all(not(feature = "orchard"), feature = "sapling"))]
+        let ua = UnifiedAddress::from_receivers(sapling, transparent).unwrap();
+
+        #[cfg(all(feature = "orchard", not(feature = "sapling")))]
+        let ua = UnifiedAddress::from_receivers(orchard, transparent).unwrap();
+
+        let addr = Address::Unified(ua);
+        let addr_str = addr.encode(&MAIN_NETWORK);
+        assert_eq!(Address::decode(&MAIN_NETWORK, &addr_str), Some(addr));
+    }
+
+    #[test]
+    #[cfg(not(any(feature = "orchard", feature = "sapling")))]
+    fn ua_round_trip() {
+        let transparent = None;
+        assert_eq!(UnifiedAddress::from_receivers(transparent), None)
+    }
+
+    #[test]
+    fn ua_parsing() {
+        for tv in test_vectors::UNIFIED {
+            match Address::decode(&MAIN_NETWORK, tv.unified_addr) {
+                Some(Address::Unified(ua)) => {
+                    assert_eq!(
+                        ua.has_transparent(),
+                        tv.p2pkh_bytes.is_some() || tv.p2sh_bytes.is_some()
+                    );
+                    #[cfg(feature = "sapling")]
+                    assert_eq!(ua.has_sapling(), tv.sapling_raw_addr.is_some());
+                    #[cfg(feature = "orchard")]
+                    assert_eq!(ua.has_orchard(), tv.orchard_raw_addr.is_some());
+                }
+                Some(_) => {
+                    panic!(
+                        "{} did not decode to a unified address value.",
+                        tv.unified_addr
+                    );
+                }
+                None => {
+                    panic!(
+                        "Failed to decode unified address from test vector: {}",
+                        tv.unified_addr
+                    );
+                }
+            }
+        }
+    }
+}
diff --git a/zcash_client_backend/src/encoding.rs b/zcash_keys/src/encoding.rs
similarity index 76%
rename from zcash_client_backend/src/encoding.rs
rename to zcash_keys/src/encoding.rs
index 9484122c7e..cb31b625a8 100644
--- a/zcash_client_backend/src/encoding.rs
+++ b/zcash_keys/src/encoding.rs
@@ -1,23 +1,25 @@
 //! Encoding and decoding functions for Zcash key and address structs.
 //!
 //! Human-Readable Prefixes (HRPs) for Bech32 encodings are located in the
-//! [zcash_primitives::constants][constants] module.
-//!
-//! [constants]: zcash_primitives::constants
+//! [zcash_primitives::constants] module.
 
 use crate::address::UnifiedAddress;
-use bech32::{self, Error, FromBase32, ToBase32, Variant};
 use bs58::{self, decode::Error as Bs58Error};
 use std::fmt;
-use std::io::{self, Write};
+use zcash_primitives::consensus::NetworkConstants;
+
 use zcash_address::unified::{self, Encoding};
-use zcash_primitives::{
-    consensus,
-    legacy::TransparentAddress,
-    sapling,
-    zip32::{ExtendedFullViewingKey, ExtendedSpendingKey},
+use zcash_primitives::{consensus, legacy::TransparentAddress};
+
+#[cfg(feature = "sapling")]
+use {
+    bech32::{self, Error, FromBase32, ToBase32, Variant},
+    sapling::zip32::{ExtendedFullViewingKey, ExtendedSpendingKey},
+    std::io::{self, Write},
+    zcash_primitives::consensus::NetworkType,
 };
 
+#[cfg(feature = "sapling")]
 fn bech32_encode<F>(hrp: &str, write: F) -> String
 where
     F: Fn(&mut dyn Write) -> io::Result<()>,
@@ -28,6 +30,7 @@ where
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
+#[cfg(feature = "sapling")]
 pub enum Bech32DecodeError {
     Bech32Error(Error),
     IncorrectVariant(Variant),
@@ -35,12 +38,14 @@ pub enum Bech32DecodeError {
     HrpMismatch { expected: String, actual: String },
 }
 
+#[cfg(feature = "sapling")]
 impl From<Error> for Bech32DecodeError {
     fn from(err: Error) -> Self {
         Bech32DecodeError::Bech32Error(err)
     }
 }
 
+#[cfg(feature = "sapling")]
 impl fmt::Display for Bech32DecodeError {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         match &self {
@@ -62,6 +67,17 @@ impl fmt::Display for Bech32DecodeError {
     }
 }
 
+#[cfg(feature = "sapling")]
+impl std::error::Error for Bech32DecodeError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match &self {
+            Bech32DecodeError::Bech32Error(e) => Some(e),
+            _ => None,
+        }
+    }
+}
+
+#[cfg(feature = "sapling")]
 fn bech32_decode<T, F>(hrp: &str, s: &str, read: F) -> Result<T, Bech32DecodeError>
 where
     F: Fn(Vec<u8>) -> Option<T>,
@@ -79,13 +95,24 @@ where
     }
 }
 
+/// A trait for encoding and decoding Zcash addresses.
 pub trait AddressCodec<P>
 where
     Self: std::marker::Sized,
 {
     type Error;
 
+    /// Encode a Zcash address.
+    ///
+    /// # Arguments
+    /// * `params` - The network the address is to be used on.
     fn encode(&self, params: &P) -> String;
+
+    /// Decodes a Zcash address from its string representation.
+    ///
+    /// # Arguments
+    /// * `params` - The network the address is to be used on.
+    /// * `address` - The string representation of the address.
     fn decode(params: &P, address: &str) -> Result<Self, Self::Error>;
 }
 
@@ -134,6 +161,7 @@ impl<P: consensus::Parameters> AddressCodec<P> for TransparentAddress {
     }
 }
 
+#[cfg(feature = "sapling")]
 impl<P: consensus::Parameters> AddressCodec<P> for sapling::PaymentAddress {
     type Error = Bech32DecodeError;
 
@@ -157,7 +185,7 @@ impl<P: consensus::Parameters> AddressCodec<P> for UnifiedAddress {
         unified::Address::decode(address)
             .map_err(|e| format!("{}", e))
             .and_then(|(network, addr)| {
-                if params.address_network() == Some(network) {
+                if params.network_type() == network {
                     UnifiedAddress::try_from(addr).map_err(|e| e.to_owned())
                 } else {
                     Err(format!(
@@ -178,22 +206,24 @@ impl<P: consensus::Parameters> AddressCodec<P> for UnifiedAddress {
 ///     constants::testnet::{COIN_TYPE, HRP_SAPLING_EXTENDED_SPENDING_KEY},
 ///     zip32::AccountId,
 /// };
-/// use zcash_client_backend::{
+/// use zcash_keys::{
 ///     encoding::encode_extended_spending_key,
 ///     keys::sapling,
 /// };
 ///
-/// let extsk = sapling::spending_key(&[0; 32][..], COIN_TYPE, AccountId::from(0));
+/// let extsk = sapling::spending_key(&[0; 32][..], COIN_TYPE, AccountId::ZERO);
 /// let encoded = encode_extended_spending_key(HRP_SAPLING_EXTENDED_SPENDING_KEY, &extsk);
 /// ```
-/// [`ExtendedSpendingKey`]: zcash_primitives::zip32::ExtendedSpendingKey
+/// [`ExtendedSpendingKey`]: sapling::zip32::ExtendedSpendingKey
+#[cfg(feature = "sapling")]
 pub fn encode_extended_spending_key(hrp: &str, extsk: &ExtendedSpendingKey) -> String {
     bech32_encode(hrp, |w| extsk.write(w))
 }
 
 /// Decodes an [`ExtendedSpendingKey`] from a Bech32-encoded string.
 ///
-/// [`ExtendedSpendingKey`]: zcash_primitives::zip32::ExtendedSpendingKey
+/// [`ExtendedSpendingKey`]: sapling::zip32::ExtendedSpendingKey
+#[cfg(feature = "sapling")]
 pub fn decode_extended_spending_key(
     hrp: &str,
     s: &str,
@@ -206,28 +236,29 @@ pub fn decode_extended_spending_key(
 /// # Examples
 ///
 /// ```
+/// use ::sapling::zip32::ExtendedFullViewingKey;
 /// use zcash_primitives::{
 ///     constants::testnet::{COIN_TYPE, HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY},
 ///     zip32::AccountId,
 /// };
-/// use zcash_client_backend::{
+/// use zcash_keys::{
 ///     encoding::encode_extended_full_viewing_key,
 ///     keys::sapling,
 /// };
-/// use zcash_primitives::zip32::ExtendedFullViewingKey;
 ///
-/// let extsk = sapling::spending_key(&[0; 32][..], COIN_TYPE, AccountId::from(0));
+/// let extsk = sapling::spending_key(&[0; 32][..], COIN_TYPE, AccountId::ZERO);
 /// let extfvk = extsk.to_extended_full_viewing_key();
 /// let encoded = encode_extended_full_viewing_key(HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY, &extfvk);
 /// ```
-/// [`ExtendedFullViewingKey`]: zcash_primitives::zip32::ExtendedFullViewingKey
+/// [`ExtendedFullViewingKey`]: sapling::zip32::ExtendedFullViewingKey
+#[cfg(feature = "sapling")]
 pub fn encode_extended_full_viewing_key(hrp: &str, extfvk: &ExtendedFullViewingKey) -> String {
     bech32_encode(hrp, |w| extfvk.write(w))
 }
 
-/// Decodes an [`ExtendedFullViewingKey`] from a Bech32-encoded string.
-///
-/// [`ExtendedFullViewingKey`]: zcash_primitives::zip32::ExtendedFullViewingKey
+/// Decodes an [`ExtendedFullViewingKey`] from a Bech32-encoded string, verifying that it matches
+/// the provided human-readable prefix.
+#[cfg(feature = "sapling")]
 pub fn decode_extended_full_viewing_key(
     hrp: &str,
     s: &str,
@@ -235,18 +266,51 @@ pub fn decode_extended_full_viewing_key(
     bech32_decode(hrp, s, |data| ExtendedFullViewingKey::read(&data[..]).ok())
 }
 
+/// Decodes an [`ExtendedFullViewingKey`] and the [`NetworkType`] that it is intended for use with
+/// from a Bech32-encoded string.
+#[cfg(feature = "sapling")]
+pub fn decode_extfvk_with_network(
+    s: &str,
+) -> Result<(NetworkType, ExtendedFullViewingKey), Bech32DecodeError> {
+    use zcash_protocol::constants::{mainnet, regtest, testnet};
+
+    let (decoded_hrp, data, variant) = bech32::decode(s)?;
+    if variant != Variant::Bech32 {
+        Err(Bech32DecodeError::IncorrectVariant(variant))
+    } else {
+        let network = match &decoded_hrp[..] {
+            mainnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY => Ok(NetworkType::Main),
+            testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY => Ok(NetworkType::Test),
+            regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY => Ok(NetworkType::Regtest),
+            other => Err(Bech32DecodeError::HrpMismatch {
+                expected: format!(
+                    "One of {}, {}, or {}",
+                    mainnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+                    testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+                    regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+                ),
+                actual: other.to_string(),
+            }),
+        }?;
+        let fvk = ExtendedFullViewingKey::read(&Vec::<u8>::from_base32(&data)?[..])
+            .map_err(|_| Bech32DecodeError::ReadError)?;
+
+        Ok((network, fvk))
+    }
+}
+
 /// Writes a [`PaymentAddress`] as a Bech32-encoded string.
 ///
 /// # Examples
 ///
 /// ```
 /// use group::Group;
-/// use zcash_client_backend::{
+/// use sapling::{Diversifier, PaymentAddress};
+/// use zcash_keys::{
 ///     encoding::encode_payment_address,
 /// };
 /// use zcash_primitives::{
 ///     constants::testnet::HRP_SAPLING_PAYMENT_ADDRESS,
-///     sapling::{Diversifier, PaymentAddress},
 /// };
 ///
 /// let pa = PaymentAddress::from_bytes(&[
@@ -262,7 +326,8 @@ pub fn decode_extended_full_viewing_key(
 ///     "ztestsapling1qqqqqqqqqqqqqqqqqqcguyvaw2vjk4sdyeg0lc970u659lvhqq7t0np6hlup5lusxle75ss7jnk",
 /// );
 /// ```
-/// [`PaymentAddress`]: zcash_primitives::sapling::PaymentAddress
+/// [`PaymentAddress`]: sapling::PaymentAddress
+#[cfg(feature = "sapling")]
 pub fn encode_payment_address(hrp: &str, addr: &sapling::PaymentAddress) -> String {
     bech32_encode(hrp, |w| w.write_all(&addr.to_bytes()))
 }
@@ -271,7 +336,8 @@ pub fn encode_payment_address(hrp: &str, addr: &sapling::PaymentAddress) -> Stri
 /// using the human-readable prefix values defined in the specified
 /// network parameters.
 ///
-/// [`PaymentAddress`]: zcash_primitives::sapling::PaymentAddress
+/// [`PaymentAddress`]: sapling::PaymentAddress
+#[cfg(feature = "sapling")]
 pub fn encode_payment_address_p<P: consensus::Parameters>(
     params: &P,
     addr: &sapling::PaymentAddress,
@@ -285,12 +351,12 @@ pub fn encode_payment_address_p<P: consensus::Parameters>(
 ///
 /// ```
 /// use group::Group;
-/// use zcash_client_backend::{
+/// use sapling::{Diversifier, PaymentAddress};
+/// use zcash_keys::{
 ///     encoding::decode_payment_address,
 /// };
 /// use zcash_primitives::{
-///     consensus::{TEST_NETWORK, Parameters},
-///     sapling::{Diversifier, PaymentAddress},
+///     consensus::{TEST_NETWORK, NetworkConstants, Parameters},
 /// };
 ///
 /// let pa = PaymentAddress::from_bytes(&[
@@ -309,7 +375,8 @@ pub fn encode_payment_address_p<P: consensus::Parameters>(
 ///     Ok(pa),
 /// );
 /// ```
-/// [`PaymentAddress`]: zcash_primitives::sapling::PaymentAddress
+/// [`PaymentAddress`]: sapling::PaymentAddress
+#[cfg(feature = "sapling")]
 pub fn decode_payment_address(
     hrp: &str,
     s: &str,
@@ -330,11 +397,11 @@ pub fn decode_payment_address(
 /// # Examples
 ///
 /// ```
-/// use zcash_client_backend::{
+/// use zcash_keys::{
 ///     encoding::encode_transparent_address,
 /// };
 /// use zcash_primitives::{
-///     consensus::{TEST_NETWORK, Parameters},
+///     consensus::{TEST_NETWORK, NetworkConstants, Parameters},
 ///     legacy::TransparentAddress,
 /// };
 ///
@@ -342,7 +409,7 @@ pub fn decode_payment_address(
 ///     encode_transparent_address(
 ///         &TEST_NETWORK.b58_pubkey_address_prefix(),
 ///         &TEST_NETWORK.b58_script_address_prefix(),
-///         &TransparentAddress::PublicKey([0; 20]),
+///         &TransparentAddress::PublicKeyHash([0; 20]),
 ///     ),
 ///     "tm9iMLAuYMzJ6jtFLcA7rzUmfreGuKvr7Ma",
 /// );
@@ -351,7 +418,7 @@ pub fn decode_payment_address(
 ///     encode_transparent_address(
 ///         &TEST_NETWORK.b58_pubkey_address_prefix(),
 ///         &TEST_NETWORK.b58_script_address_prefix(),
-///         &TransparentAddress::Script([0; 20]),
+///         &TransparentAddress::ScriptHash([0; 20]),
 ///     ),
 ///     "t26YoyZ1iPgiMEWL4zGUm74eVWfhyDMXzY2",
 /// );
@@ -363,13 +430,13 @@ pub fn encode_transparent_address(
     addr: &TransparentAddress,
 ) -> String {
     let decoded = match addr {
-        TransparentAddress::PublicKey(key_id) => {
+        TransparentAddress::PublicKeyHash(key_id) => {
             let mut decoded = vec![0; pubkey_version.len() + 20];
             decoded[..pubkey_version.len()].copy_from_slice(pubkey_version);
             decoded[pubkey_version.len()..].copy_from_slice(key_id);
             decoded
         }
-        TransparentAddress::Script(script_id) => {
+        TransparentAddress::ScriptHash(script_id) => {
             let mut decoded = vec![0; script_version.len() + 20];
             decoded[..script_version.len()].copy_from_slice(script_version);
             decoded[script_version.len()..].copy_from_slice(script_id);
@@ -399,12 +466,12 @@ pub fn encode_transparent_address_p<P: consensus::Parameters>(
 ///
 /// ```
 /// use zcash_primitives::{
-///     consensus::{TEST_NETWORK, Parameters},
+///     consensus::{TEST_NETWORK, NetworkConstants, Parameters},
+///     legacy::TransparentAddress,
 /// };
-/// use zcash_client_backend::{
+/// use zcash_keys::{
 ///     encoding::decode_transparent_address,
 /// };
-/// use zcash_primitives::legacy::TransparentAddress;
 ///
 /// assert_eq!(
 ///     decode_transparent_address(
@@ -412,7 +479,7 @@ pub fn encode_transparent_address_p<P: consensus::Parameters>(
 ///         &TEST_NETWORK.b58_script_address_prefix(),
 ///         "tm9iMLAuYMzJ6jtFLcA7rzUmfreGuKvr7Ma",
 ///     ),
-///     Ok(Some(TransparentAddress::PublicKey([0; 20]))),
+///     Ok(Some(TransparentAddress::PublicKeyHash([0; 20]))),
 /// );
 ///
 /// assert_eq!(
@@ -421,7 +488,7 @@ pub fn encode_transparent_address_p<P: consensus::Parameters>(
 ///         &TEST_NETWORK.b58_script_address_prefix(),
 ///         "t26YoyZ1iPgiMEWL4zGUm74eVWfhyDMXzY2",
 ///     ),
-///     Ok(Some(TransparentAddress::Script([0; 20]))),
+///     Ok(Some(TransparentAddress::ScriptHash([0; 20]))),
 /// );
 /// ```
 /// [`TransparentAddress`]: zcash_primitives::legacy::TransparentAddress
@@ -435,12 +502,12 @@ pub fn decode_transparent_address(
             decoded[pubkey_version.len()..]
                 .try_into()
                 .ok()
-                .map(TransparentAddress::PublicKey)
+                .map(TransparentAddress::PublicKeyHash)
         } else if decoded.starts_with(script_version) {
             decoded[script_version.len()..]
                 .try_into()
                 .ok()
-                .map(TransparentAddress::Script)
+                .map(TransparentAddress::ScriptHash)
         } else {
             None
         }
@@ -448,14 +515,15 @@ pub fn decode_transparent_address(
 }
 
 #[cfg(test)]
-mod tests {
-    use zcash_primitives::{constants, sapling::PaymentAddress, zip32::ExtendedSpendingKey};
-
+#[cfg(feature = "sapling")]
+mod tests_sapling {
     use super::{
         decode_extended_full_viewing_key, decode_extended_spending_key, decode_payment_address,
         encode_extended_full_viewing_key, encode_extended_spending_key, encode_payment_address,
         Bech32DecodeError,
     };
+    use sapling::{zip32::ExtendedSpendingKey, PaymentAddress};
+    use zcash_primitives::constants;
 
     #[test]
     fn extended_spending_key() {
@@ -504,7 +572,7 @@ mod tests {
 
         let encoded_main = "zxviews1qqqqqqqqqqqqqq8n3zjjmvhhr854uy3qhpda3ml34haf0x388z5r7h4st4kpsf6qy3zw4wc246aw9rlfyg5ndlwvne7mwdq0qe6vxl42pqmcf8pvmmd5slmjxduqa9evgej6wa3th2505xq4nggrxdm93rxk4rpdjt5nmq2vn44e2uhm7h0hsagfvkk4n7n6nfer6u57v9cac84t7nl2zth0xpyfeg0w2p2wv2yn6jn923aaz0vdaml07l60ahapk6efchyxwysrvjsxmansf";
         let encoded_test = "zxviewtestsapling1qqqqqqqqqqqqqq8n3zjjmvhhr854uy3qhpda3ml34haf0x388z5r7h4st4kpsf6qy3zw4wc246aw9rlfyg5ndlwvne7mwdq0qe6vxl42pqmcf8pvmmd5slmjxduqa9evgej6wa3th2505xq4nggrxdm93rxk4rpdjt5nmq2vn44e2uhm7h0hsagfvkk4n7n6nfer6u57v9cac84t7nl2zth0xpyfeg0w2p2wv2yn6jn923aaz0vdaml07l60ahapk6efchyxwysrvjs8evfkz";
-
+        let encoded_regtest = "zxviewregtestsapling1qqqqqqqqqqqqqq8n3zjjmvhhr854uy3qhpda3ml34haf0x388z5r7h4st4kpsf6qy3zw4wc246aw9rlfyg5ndlwvne7mwdq0qe6vxl42pqmcf8pvmmd5slmjxduqa9evgej6wa3th2505xq4nggrxdm93rxk4rpdjt5nmq2vn44e2uhm7h0hsagfvkk4n7n6nfer6u57v9cac84t7nl2zth0xpyfeg0w2p2wv2yn6jn923aaz0vdaml07l60ahapk6efchyxwysrvjskjkzax";
         assert_eq!(
             encode_extended_full_viewing_key(
                 constants::mainnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
@@ -528,10 +596,19 @@ mod tests {
             ),
             encoded_test
         );
+
+        assert_eq!(
+            encode_extended_full_viewing_key(
+                constants::regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+                &extfvk
+            ),
+            encoded_regtest
+        );
+
         assert_eq!(
             decode_extended_full_viewing_key(
-                constants::testnet::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
-                encoded_test
+                constants::regtest::HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY,
+                encoded_regtest
             )
             .unwrap(),
             extfvk
@@ -552,11 +629,14 @@ mod tests {
             "zs1qqqqqqqqqqqqqqqqqqcguyvaw2vjk4sdyeg0lc970u659lvhqq7t0np6hlup5lusxle75c8v35z";
         let encoded_test =
             "ztestsapling1qqqqqqqqqqqqqqqqqqcguyvaw2vjk4sdyeg0lc970u659lvhqq7t0np6hlup5lusxle75ss7jnk";
+        let encoded_regtest =
+            "zregtestsapling1qqqqqqqqqqqqqqqqqqcguyvaw2vjk4sdyeg0lc970u659lvhqq7t0np6hlup5lusxle7505hlz3";
 
         assert_eq!(
             encode_payment_address(constants::mainnet::HRP_SAPLING_PAYMENT_ADDRESS, &addr),
             encoded_main
         );
+
         assert_eq!(
             decode_payment_address(
                 constants::mainnet::HRP_SAPLING_PAYMENT_ADDRESS,
@@ -570,6 +650,12 @@ mod tests {
             encode_payment_address(constants::testnet::HRP_SAPLING_PAYMENT_ADDRESS, &addr),
             encoded_test
         );
+
+        assert_eq!(
+            encode_payment_address(constants::regtest::HRP_SAPLING_PAYMENT_ADDRESS, &addr),
+            encoded_regtest
+        );
+
         assert_eq!(
             decode_payment_address(
                 constants::testnet::HRP_SAPLING_PAYMENT_ADDRESS,
@@ -578,6 +664,15 @@ mod tests {
             .unwrap(),
             addr
         );
+
+        assert_eq!(
+            decode_payment_address(
+                constants::regtest::HRP_SAPLING_PAYMENT_ADDRESS,
+                encoded_regtest
+            )
+            .unwrap(),
+            addr
+        );
     }
 
     #[test]
diff --git a/zcash_keys/src/keys.rs b/zcash_keys/src/keys.rs
new file mode 100644
index 0000000000..fc78facfe7
--- /dev/null
+++ b/zcash_keys/src/keys.rs
@@ -0,0 +1,1757 @@
+//! Helper functions for managing light client key material.
+use std::{
+    error,
+    fmt::{self, Display},
+};
+
+use zcash_address::unified::{self, Container, Encoding, Typecode, Ufvk, Uivk};
+use zcash_protocol::consensus;
+use zip32::{AccountId, DiversifierIndex};
+
+use crate::address::UnifiedAddress;
+
+#[cfg(any(feature = "sapling", feature = "orchard"))]
+use zcash_protocol::consensus::NetworkConstants;
+
+#[cfg(feature = "transparent-inputs")]
+use {
+    std::convert::TryInto,
+    zcash_primitives::legacy::keys::{self as legacy, IncomingViewingKey, NonHardenedChildIndex},
+};
+
+#[cfg(all(
+    feature = "transparent-inputs",
+    any(test, feature = "test-dependencies")
+))]
+use zcash_primitives::legacy::TransparentAddress;
+
+#[cfg(feature = "unstable")]
+use {
+    byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt},
+    std::convert::TryFrom,
+    std::io::{Read, Write},
+    zcash_encoding::CompactSize,
+    zcash_primitives::consensus::BranchId,
+};
+
+#[cfg(feature = "orchard")]
+use orchard::{self, keys::Scope};
+
+#[cfg(all(feature = "sapling", feature = "unstable"))]
+use ::sapling::zip32::ExtendedFullViewingKey;
+
+#[cfg(feature = "sapling")]
+pub mod sapling {
+    pub use sapling::zip32::{
+        DiversifiableFullViewingKey, ExtendedFullViewingKey, ExtendedSpendingKey,
+    };
+    use zip32::{AccountId, ChildIndex};
+
+    /// Derives the ZIP 32 [`ExtendedSpendingKey`] for a given coin type and account from the
+    /// given seed.
+    ///
+    /// # Panics
+    ///
+    /// Panics if `seed` is shorter than 32 bytes.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use zcash_primitives::constants::testnet::COIN_TYPE;
+    /// use zcash_keys::keys::sapling;
+    /// use zip32::AccountId;
+    ///
+    /// let extsk = sapling::spending_key(&[0; 32][..], COIN_TYPE, AccountId::ZERO);
+    /// ```
+    /// [`ExtendedSpendingKey`]: sapling::zip32::ExtendedSpendingKey
+    pub fn spending_key(seed: &[u8], coin_type: u32, account: AccountId) -> ExtendedSpendingKey {
+        if seed.len() < 32 {
+            panic!("ZIP 32 seeds MUST be at least 32 bytes");
+        }
+
+        ExtendedSpendingKey::from_path(
+            &ExtendedSpendingKey::master(seed),
+            &[
+                ChildIndex::hardened(32),
+                ChildIndex::hardened(coin_type),
+                account.into(),
+            ],
+        )
+    }
+}
+
+#[cfg(feature = "transparent-inputs")]
+fn to_transparent_child_index(j: DiversifierIndex) -> Option<NonHardenedChildIndex> {
+    let (low_4_bytes, rest) = j.as_bytes().split_at(4);
+    let transparent_j = u32::from_le_bytes(low_4_bytes.try_into().unwrap());
+    if rest.iter().any(|b| b != &0) {
+        None
+    } else {
+        NonHardenedChildIndex::from_index(transparent_j)
+    }
+}
+
+#[derive(Debug)]
+pub enum DerivationError {
+    #[cfg(feature = "orchard")]
+    Orchard(orchard::zip32::Error),
+    #[cfg(feature = "transparent-inputs")]
+    Transparent(bip32::Error),
+}
+
+impl Display for DerivationError {
+    fn fmt(&self, _f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            #[cfg(feature = "orchard")]
+            DerivationError::Orchard(e) => write!(_f, "Orchard error: {}", e),
+            #[cfg(feature = "transparent-inputs")]
+            DerivationError::Transparent(e) => write!(_f, "Transparent error: {}", e),
+            #[cfg(not(any(feature = "orchard", feature = "transparent-inputs")))]
+            other => {
+                unreachable!("Unhandled DerivationError variant {:?}", other)
+            }
+        }
+    }
+}
+
+impl std::error::Error for DerivationError {}
+
+/// A version identifier for the encoding of unified spending keys.
+///
+/// Each era corresponds to a range of block heights. During an era, the unified spending key
+/// parsed from an encoded form tagged with that era's identifier is expected to provide
+/// sufficient spending authority to spend any non-Sprout shielded note created in a transaction
+/// within the era's block range.
+#[cfg(feature = "unstable")]
+#[derive(Debug, PartialEq, Eq)]
+pub enum Era {
+    /// The Orchard era begins at Orchard activation, and will end if a new pool that requires a
+    /// change to unified spending keys is introduced.
+    Orchard,
+}
+
+/// A type for errors that can occur when decoding keys from their serialized representations.
+#[derive(Debug, PartialEq, Eq)]
+pub enum DecodingError {
+    #[cfg(feature = "unstable")]
+    ReadError(&'static str),
+    #[cfg(feature = "unstable")]
+    EraInvalid,
+    #[cfg(feature = "unstable")]
+    EraMismatch(Era),
+    #[cfg(feature = "unstable")]
+    TypecodeInvalid,
+    #[cfg(feature = "unstable")]
+    LengthInvalid,
+    #[cfg(feature = "unstable")]
+    LengthMismatch(Typecode, u32),
+    #[cfg(feature = "unstable")]
+    InsufficientData(Typecode),
+    /// The key data could not be decoded from its string representation to a valid key.
+    KeyDataInvalid(Typecode),
+}
+
+impl std::fmt::Display for DecodingError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            #[cfg(feature = "unstable")]
+            DecodingError::ReadError(s) => write!(f, "Read error: {}", s),
+            #[cfg(feature = "unstable")]
+            DecodingError::EraInvalid => write!(f, "Invalid era"),
+            #[cfg(feature = "unstable")]
+            DecodingError::EraMismatch(e) => write!(f, "Era mismatch: actual {:?}", e),
+            #[cfg(feature = "unstable")]
+            DecodingError::TypecodeInvalid => write!(f, "Invalid typecode"),
+            #[cfg(feature = "unstable")]
+            DecodingError::LengthInvalid => write!(f, "Invalid length"),
+            #[cfg(feature = "unstable")]
+            DecodingError::LengthMismatch(t, l) => {
+                write!(
+                    f,
+                    "Length mismatch: received {} bytes for typecode {:?}",
+                    l, t
+                )
+            }
+            #[cfg(feature = "unstable")]
+            DecodingError::InsufficientData(t) => {
+                write!(f, "Insufficient data for typecode {:?}", t)
+            }
+            DecodingError::KeyDataInvalid(t) => write!(f, "Invalid key data for key type {:?}", t),
+        }
+    }
+}
+
+impl std::error::Error for DecodingError {}
+
+#[cfg(feature = "unstable")]
+impl Era {
+    /// Returns the unique identifier for the era.
+    fn id(&self) -> u32 {
+        // We use the consensus branch id of the network upgrade that introduced a
+        // new USK format as the identifier for the era.
+        match self {
+            Era::Orchard => u32::from(BranchId::Nu5),
+        }
+    }
+
+    fn try_from_id(id: u32) -> Option<Self> {
+        BranchId::try_from(id).ok().and_then(|b| match b {
+            BranchId::Nu5 => Some(Era::Orchard),
+            _ => None,
+        })
+    }
+}
+
+/// A set of spending keys that are all associated with a single ZIP-0032 account identifier.
+#[derive(Clone, Debug)]
+pub struct UnifiedSpendingKey {
+    #[cfg(feature = "transparent-inputs")]
+    transparent: legacy::AccountPrivKey,
+    #[cfg(feature = "sapling")]
+    sapling: sapling::ExtendedSpendingKey,
+    #[cfg(feature = "orchard")]
+    orchard: orchard::keys::SpendingKey,
+}
+
+impl UnifiedSpendingKey {
+    pub fn from_seed<P: consensus::Parameters>(
+        _params: &P,
+        seed: &[u8],
+        _account: AccountId,
+    ) -> Result<UnifiedSpendingKey, DerivationError> {
+        if seed.len() < 32 {
+            panic!("ZIP 32 seeds MUST be at least 32 bytes");
+        }
+
+        UnifiedSpendingKey::from_checked_parts(
+            #[cfg(feature = "transparent-inputs")]
+            legacy::AccountPrivKey::from_seed(_params, seed, _account)
+                .map_err(DerivationError::Transparent)?,
+            #[cfg(feature = "sapling")]
+            sapling::spending_key(seed, _params.coin_type(), _account),
+            #[cfg(feature = "orchard")]
+            orchard::keys::SpendingKey::from_zip32_seed(seed, _params.coin_type(), _account)
+                .map_err(DerivationError::Orchard)?,
+        )
+    }
+
+    /// Construct a USK from its constituent parts, after verifying that UIVK derivation can
+    /// succeed.
+    fn from_checked_parts(
+        #[cfg(feature = "transparent-inputs")] transparent: legacy::AccountPrivKey,
+        #[cfg(feature = "sapling")] sapling: sapling::ExtendedSpendingKey,
+        #[cfg(feature = "orchard")] orchard: orchard::keys::SpendingKey,
+    ) -> Result<UnifiedSpendingKey, DerivationError> {
+        // Verify that FVK and IVK derivation succeed; we don't want to construct a USK
+        // that can't derive transparent addresses.
+        #[cfg(feature = "transparent-inputs")]
+        let _ = transparent.to_account_pubkey().derive_external_ivk()?;
+
+        Ok(UnifiedSpendingKey {
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        })
+    }
+
+    pub fn to_unified_full_viewing_key(&self) -> UnifiedFullViewingKey {
+        UnifiedFullViewingKey {
+            #[cfg(feature = "transparent-inputs")]
+            transparent: Some(self.transparent.to_account_pubkey()),
+            #[cfg(feature = "sapling")]
+            sapling: Some(self.sapling.to_diversifiable_full_viewing_key()),
+            #[cfg(feature = "orchard")]
+            orchard: Some((&self.orchard).into()),
+            unknown: vec![],
+        }
+    }
+
+    /// Returns the transparent component of the unified key at the
+    /// BIP44 path `m/44'/<coin_type>'/<account>'`.
+    #[cfg(feature = "transparent-inputs")]
+    pub fn transparent(&self) -> &legacy::AccountPrivKey {
+        &self.transparent
+    }
+
+    /// Returns the Sapling extended spending key component of this unified spending key.
+    #[cfg(feature = "sapling")]
+    pub fn sapling(&self) -> &sapling::ExtendedSpendingKey {
+        &self.sapling
+    }
+
+    /// Returns the Orchard spending key component of this unified spending key.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> &orchard::keys::SpendingKey {
+        &self.orchard
+    }
+
+    /// Returns a binary encoding of this key suitable for decoding with [`Self::from_bytes`].
+    ///
+    /// The encoded form of a unified spending key is only intended for use
+    /// within wallets when required for storage and/or crossing FFI boundaries;
+    /// unified spending keys should not be exposed to users, and consequently
+    /// no string-based encoding is defined. This encoding does not include any
+    /// internal validation metadata (such as checksums) as keys decoded from
+    /// this form will necessarily be validated when the attempt is made to
+    /// spend a note that they have authority for.
+    #[cfg(feature = "unstable")]
+    pub fn to_bytes(&self, era: Era) -> Vec<u8> {
+        let mut result = vec![];
+        result.write_u32::<LittleEndian>(era.id()).unwrap();
+
+        #[cfg(feature = "orchard")]
+        {
+            let orchard_key = self.orchard();
+            CompactSize::write(&mut result, usize::try_from(Typecode::Orchard).unwrap()).unwrap();
+
+            let orchard_key_bytes = orchard_key.to_bytes();
+            CompactSize::write(&mut result, orchard_key_bytes.len()).unwrap();
+            result.write_all(orchard_key_bytes).unwrap();
+        }
+
+        #[cfg(feature = "sapling")]
+        {
+            let sapling_key = self.sapling();
+            CompactSize::write(&mut result, usize::try_from(Typecode::Sapling).unwrap()).unwrap();
+
+            let sapling_key_bytes = sapling_key.to_bytes();
+            CompactSize::write(&mut result, sapling_key_bytes.len()).unwrap();
+            result.write_all(&sapling_key_bytes).unwrap();
+        }
+
+        #[cfg(feature = "transparent-inputs")]
+        {
+            let account_tkey = self.transparent();
+            CompactSize::write(&mut result, usize::try_from(Typecode::P2pkh).unwrap()).unwrap();
+
+            let account_tkey_bytes = account_tkey.to_bytes();
+            CompactSize::write(&mut result, account_tkey_bytes.len()).unwrap();
+            result.write_all(&account_tkey_bytes).unwrap();
+        }
+
+        result
+    }
+
+    /// Decodes a [`UnifiedSpendingKey`] value from its serialized representation.
+    ///
+    /// See [`Self::to_bytes`] for additional detail about the encoded form.
+    #[allow(clippy::unnecessary_unwrap)]
+    #[cfg(feature = "unstable")]
+    pub fn from_bytes(era: Era, encoded: &[u8]) -> Result<Self, DecodingError> {
+        let mut source = std::io::Cursor::new(encoded);
+        let decoded_era = source
+            .read_u32::<LittleEndian>()
+            .map_err(|_| DecodingError::ReadError("era"))
+            .and_then(|id| Era::try_from_id(id).ok_or(DecodingError::EraInvalid))?;
+
+        if decoded_era != era {
+            return Err(DecodingError::EraMismatch(decoded_era));
+        }
+
+        #[cfg(feature = "orchard")]
+        let mut orchard = None;
+        #[cfg(feature = "sapling")]
+        let mut sapling = None;
+        #[cfg(feature = "transparent-inputs")]
+        let mut transparent = None;
+        loop {
+            let tc = CompactSize::read_t::<_, u32>(&mut source)
+                .map_err(|_| DecodingError::ReadError("typecode"))
+                .and_then(|v| Typecode::try_from(v).map_err(|_| DecodingError::TypecodeInvalid))?;
+
+            let len = CompactSize::read_t::<_, u32>(&mut source)
+                .map_err(|_| DecodingError::ReadError("key length"))?;
+
+            match tc {
+                Typecode::Orchard => {
+                    if len != 32 {
+                        return Err(DecodingError::LengthMismatch(Typecode::Orchard, len));
+                    }
+
+                    let mut key = [0u8; 32];
+                    source
+                        .read_exact(&mut key)
+                        .map_err(|_| DecodingError::InsufficientData(Typecode::Orchard))?;
+
+                    #[cfg(feature = "orchard")]
+                    {
+                        orchard = Some(
+                            Option::<orchard::keys::SpendingKey>::from(
+                                orchard::keys::SpendingKey::from_bytes(key),
+                            )
+                            .ok_or(DecodingError::KeyDataInvalid(Typecode::Orchard))?,
+                        );
+                    }
+                }
+                Typecode::Sapling => {
+                    if len != 169 {
+                        return Err(DecodingError::LengthMismatch(Typecode::Sapling, len));
+                    }
+
+                    let mut key = [0u8; 169];
+                    source
+                        .read_exact(&mut key)
+                        .map_err(|_| DecodingError::InsufficientData(Typecode::Sapling))?;
+
+                    #[cfg(feature = "sapling")]
+                    {
+                        sapling = Some(
+                            sapling::ExtendedSpendingKey::from_bytes(&key)
+                                .map_err(|_| DecodingError::KeyDataInvalid(Typecode::Sapling))?,
+                        );
+                    }
+                }
+                Typecode::P2pkh => {
+                    if len != 74 {
+                        return Err(DecodingError::LengthMismatch(Typecode::P2pkh, len));
+                    }
+
+                    let mut key = [0u8; 74];
+                    source
+                        .read_exact(&mut key)
+                        .map_err(|_| DecodingError::InsufficientData(Typecode::P2pkh))?;
+
+                    #[cfg(feature = "transparent-inputs")]
+                    {
+                        transparent = Some(
+                            legacy::AccountPrivKey::from_bytes(&key)
+                                .ok_or(DecodingError::KeyDataInvalid(Typecode::P2pkh))?,
+                        );
+                    }
+                }
+                _ => {
+                    return Err(DecodingError::TypecodeInvalid);
+                }
+            }
+
+            #[cfg(feature = "orchard")]
+            let has_orchard = orchard.is_some();
+            #[cfg(not(feature = "orchard"))]
+            let has_orchard = true;
+
+            #[cfg(feature = "sapling")]
+            let has_sapling = sapling.is_some();
+            #[cfg(not(feature = "sapling"))]
+            let has_sapling = true;
+
+            #[cfg(feature = "transparent-inputs")]
+            let has_transparent = transparent.is_some();
+            #[cfg(not(feature = "transparent-inputs"))]
+            let has_transparent = true;
+
+            if has_orchard && has_sapling && has_transparent {
+                return UnifiedSpendingKey::from_checked_parts(
+                    #[cfg(feature = "transparent-inputs")]
+                    transparent.unwrap(),
+                    #[cfg(feature = "sapling")]
+                    sapling.unwrap(),
+                    #[cfg(feature = "orchard")]
+                    orchard.unwrap(),
+                )
+                .map_err(|_| DecodingError::KeyDataInvalid(Typecode::P2pkh));
+            }
+        }
+    }
+
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub fn default_address(
+        &self,
+        request: UnifiedAddressRequest,
+    ) -> (UnifiedAddress, DiversifierIndex) {
+        self.to_unified_full_viewing_key()
+            .default_address(request)
+            .unwrap()
+    }
+
+    #[cfg(all(
+        feature = "transparent-inputs",
+        any(test, feature = "test-dependencies")
+    ))]
+    pub fn default_transparent_address(&self) -> (TransparentAddress, NonHardenedChildIndex) {
+        self.transparent()
+            .to_account_pubkey()
+            .derive_external_ivk()
+            .unwrap()
+            .default_address()
+    }
+}
+
+/// Errors that can occur in the generation of unified addresses.
+#[derive(Clone, Debug)]
+pub enum AddressGenerationError {
+    /// The requested diversifier index was outside the range of valid transparent
+    /// child address indices.
+    #[cfg(feature = "transparent-inputs")]
+    InvalidTransparentChildIndex(DiversifierIndex),
+    /// The diversifier index could not be mapped to a valid Sapling diversifier.
+    #[cfg(feature = "sapling")]
+    InvalidSaplingDiversifierIndex(DiversifierIndex),
+    /// The space of available diversifier indices has been exhausted.
+    DiversifierSpaceExhausted,
+    /// A requested address typecode was not recognized, so we are unable to generate the address
+    /// as requested.
+    ReceiverTypeNotSupported(Typecode),
+    /// A requested address typecode was recognized, but the unified key being used to generate the
+    /// address lacks an item of the requested type.
+    KeyNotAvailable(Typecode),
+    /// A Unified address cannot be generated without at least one shielded receiver being
+    /// included.
+    ShieldedReceiverRequired,
+}
+
+impl fmt::Display for AddressGenerationError {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match &self {
+            #[cfg(feature = "transparent-inputs")]
+            AddressGenerationError::InvalidTransparentChildIndex(i) => {
+                write!(
+                    f,
+                    "Child index {:?} does not generate a valid transparent receiver",
+                    i
+                )
+            }
+            #[cfg(feature = "sapling")]
+            AddressGenerationError::InvalidSaplingDiversifierIndex(i) => {
+                write!(
+                    f,
+                    "Child index {:?} does not generate a valid Sapling receiver",
+                    i
+                )
+            }
+            AddressGenerationError::DiversifierSpaceExhausted => {
+                write!(
+                    f,
+                    "Exhausted the space of diversifier indices without finding an address."
+                )
+            }
+            AddressGenerationError::ReceiverTypeNotSupported(t) => {
+                write!(
+                    f,
+                    "Unified Address generation does not yet support receivers of type {:?}.",
+                    t
+                )
+            }
+            AddressGenerationError::KeyNotAvailable(t) => {
+                write!(
+                    f,
+                    "The Unified Viewing Key does not contain a key for typecode {:?}.",
+                    t
+                )
+            }
+            AddressGenerationError::ShieldedReceiverRequired => {
+                write!(f, "A Unified Address requires at least one shielded (Sapling or Orchard) receiver.")
+            }
+        }
+    }
+}
+
+impl error::Error for AddressGenerationError {}
+
+/// Specification for how a unified address should be generated from a unified viewing key.
+#[derive(Clone, Copy, Debug)]
+pub struct UnifiedAddressRequest {
+    has_orchard: bool,
+    has_sapling: bool,
+    has_p2pkh: bool,
+}
+
+impl UnifiedAddressRequest {
+    /// Construct a new unified address request from its constituent parts.
+    ///
+    /// Returns `None` if the resulting unified address would not include at least one shielded receiver.
+    pub fn new(has_orchard: bool, has_sapling: bool, has_p2pkh: bool) -> Option<Self> {
+        let has_shielded_receiver = has_orchard || has_sapling;
+
+        if !has_shielded_receiver {
+            None
+        } else {
+            Some(Self {
+                has_orchard,
+                has_sapling,
+                has_p2pkh,
+            })
+        }
+    }
+
+    /// Constructs a new unified address request that includes a request for a receiver of each
+    /// type that is supported given the active feature flags.
+    pub fn all() -> Option<Self> {
+        let _has_orchard = false;
+        #[cfg(feature = "orchard")]
+        let _has_orchard = true;
+
+        let _has_sapling = false;
+        #[cfg(feature = "sapling")]
+        let _has_sapling = true;
+
+        let _has_p2pkh = false;
+        #[cfg(feature = "transparent-inputs")]
+        let _has_p2pkh = true;
+
+        Self::new(_has_orchard, _has_sapling, _has_p2pkh)
+    }
+
+    /// Constructs a new unified address request that includes only the receivers
+    /// that appear both in itself and a given other request.
+    pub fn intersect(&self, other: &UnifiedAddressRequest) -> Option<UnifiedAddressRequest> {
+        Self::new(
+            self.has_orchard && other.has_orchard,
+            self.has_sapling && other.has_sapling,
+            self.has_p2pkh && other.has_p2pkh,
+        )
+    }
+
+    /// Construct a new unified address request from its constituent parts.
+    ///
+    /// Panics: at least one of `has_orchard` or `has_sapling` must be `true`.
+    pub const fn unsafe_new(has_orchard: bool, has_sapling: bool, has_p2pkh: bool) -> Self {
+        if !(has_orchard || has_sapling) {
+            panic!("At least one shielded receiver must be requested.")
+        }
+
+        Self {
+            has_orchard,
+            has_sapling,
+            has_p2pkh,
+        }
+    }
+}
+
+#[cfg(feature = "transparent-inputs")]
+impl From<bip32::Error> for DerivationError {
+    fn from(e: bip32::Error) -> Self {
+        DerivationError::Transparent(e)
+    }
+}
+
+/// A [ZIP 316](https://zips.z.cash/zip-0316) unified full viewing key.
+#[derive(Clone, Debug)]
+pub struct UnifiedFullViewingKey {
+    #[cfg(feature = "transparent-inputs")]
+    transparent: Option<legacy::AccountPubKey>,
+    #[cfg(feature = "sapling")]
+    sapling: Option<sapling::DiversifiableFullViewingKey>,
+    #[cfg(feature = "orchard")]
+    orchard: Option<orchard::keys::FullViewingKey>,
+    unknown: Vec<(u32, Vec<u8>)>,
+}
+
+impl UnifiedFullViewingKey {
+    /// Construct a new unified full viewing key.
+    ///
+    /// This method is only available when the `test-dependencies` feature is enabled,
+    /// as derivation from the USK or deserialization from the serialized form should
+    /// be used instead.
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub fn new(
+        #[cfg(feature = "transparent-inputs")] transparent: Option<legacy::AccountPubKey>,
+        #[cfg(feature = "sapling")] sapling: Option<sapling::DiversifiableFullViewingKey>,
+        #[cfg(feature = "orchard")] orchard: Option<orchard::keys::FullViewingKey>,
+        // TODO: Implement construction of UFVKs with metadata items.
+    ) -> Result<UnifiedFullViewingKey, DerivationError> {
+        Self::from_checked_parts(
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            // We don't currently allow constructing new UFVKs with unknown items, but we store
+            // this to allow parsing such UFVKs.
+            vec![],
+        )
+    }
+
+    #[cfg(feature = "unstable-frost")]
+    pub fn from_orchard_fvk(
+        orchard: orchard::keys::FullViewingKey,
+    ) -> Result<UnifiedFullViewingKey, DerivationError> {
+        Self::from_checked_parts(
+            #[cfg(feature = "transparent-inputs")]
+            None,
+            #[cfg(feature = "sapling")]
+            None,
+            #[cfg(feature = "orchard")]
+            Some(orchard),
+            // We don't currently allow constructing new UFVKs with unknown items, but we store
+            // this to allow parsing such UFVKs.
+            vec![],
+        )
+    }
+
+    #[cfg(all(feature = "sapling", feature = "unstable"))]
+    pub fn from_sapling_extended_full_viewing_key(
+        sapling: ExtendedFullViewingKey,
+    ) -> Result<UnifiedFullViewingKey, DerivationError> {
+        Self::from_checked_parts(
+            #[cfg(feature = "transparent-inputs")]
+            None,
+            #[cfg(feature = "sapling")]
+            Some(sapling.to_diversifiable_full_viewing_key()),
+            #[cfg(feature = "orchard")]
+            None,
+            // We don't currently allow constructing new UFVKs with unknown items, but we store
+            // this to allow parsing such UFVKs.
+            vec![],
+        )
+    }
+
+    /// Construct a UFVK from its constituent parts, after verifying that UIVK derivation can
+    /// succeed.
+    fn from_checked_parts(
+        #[cfg(feature = "transparent-inputs")] transparent: Option<legacy::AccountPubKey>,
+        #[cfg(feature = "sapling")] sapling: Option<sapling::DiversifiableFullViewingKey>,
+        #[cfg(feature = "orchard")] orchard: Option<orchard::keys::FullViewingKey>,
+        unknown: Vec<(u32, Vec<u8>)>,
+    ) -> Result<UnifiedFullViewingKey, DerivationError> {
+        // Verify that IVK derivation succeeds; we don't want to construct a UFVK
+        // that can't derive transparent addresses.
+        #[cfg(feature = "transparent-inputs")]
+        let _ = transparent
+            .as_ref()
+            .map(|t| t.derive_external_ivk())
+            .transpose()?;
+
+        Ok(UnifiedFullViewingKey {
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            unknown,
+        })
+    }
+
+    /// Parses a `UnifiedFullViewingKey` from its [ZIP 316] string encoding.
+    ///
+    /// [ZIP 316]: https://zips.z.cash/zip-0316
+    pub fn decode<P: consensus::Parameters>(params: &P, encoding: &str) -> Result<Self, String> {
+        let (net, ufvk) = unified::Ufvk::decode(encoding).map_err(|e| e.to_string())?;
+        let expected_net = params.network_type();
+        if net != expected_net {
+            return Err(format!(
+                "UFVK is for network {:?} but we expected {:?}",
+                net, expected_net,
+            ));
+        }
+
+        Self::parse(&ufvk).map_err(|e| e.to_string())
+    }
+
+    /// Parses a `UnifiedFullViewingKey` from its [ZIP 316] string encoding.
+    ///
+    /// [ZIP 316]: https://zips.z.cash/zip-0316
+    pub fn parse(ufvk: &Ufvk) -> Result<Self, DecodingError> {
+        #[cfg(feature = "orchard")]
+        let mut orchard = None;
+        #[cfg(feature = "sapling")]
+        let mut sapling = None;
+        #[cfg(feature = "transparent-inputs")]
+        let mut transparent = None;
+
+        // We can use as-parsed order here for efficiency, because we're breaking out the
+        // receivers we support from the unknown receivers.
+        let unknown = ufvk
+            .items_as_parsed()
+            .iter()
+            .filter_map(|receiver| match receiver {
+                #[cfg(feature = "orchard")]
+                unified::Fvk::Orchard(data) => orchard::keys::FullViewingKey::from_bytes(data)
+                    .ok_or(DecodingError::KeyDataInvalid(Typecode::Orchard))
+                    .map(|addr| {
+                        orchard = Some(addr);
+                        None
+                    })
+                    .transpose(),
+                #[cfg(not(feature = "orchard"))]
+                unified::Fvk::Orchard(data) => Some(Ok::<_, DecodingError>((
+                    u32::from(unified::Typecode::Orchard),
+                    data.to_vec(),
+                ))),
+                #[cfg(feature = "sapling")]
+                unified::Fvk::Sapling(data) => {
+                    sapling::DiversifiableFullViewingKey::from_bytes(data)
+                        .ok_or(DecodingError::KeyDataInvalid(Typecode::Sapling))
+                        .map(|pa| {
+                            sapling = Some(pa);
+                            None
+                        })
+                        .transpose()
+                }
+                #[cfg(not(feature = "sapling"))]
+                unified::Fvk::Sapling(data) => Some(Ok::<_, DecodingError>((
+                    u32::from(unified::Typecode::Sapling),
+                    data.to_vec(),
+                ))),
+                #[cfg(feature = "transparent-inputs")]
+                unified::Fvk::P2pkh(data) => legacy::AccountPubKey::deserialize(data)
+                    .map_err(|_| DecodingError::KeyDataInvalid(Typecode::P2pkh))
+                    .map(|tfvk| {
+                        transparent = Some(tfvk);
+                        None
+                    })
+                    .transpose(),
+                #[cfg(not(feature = "transparent-inputs"))]
+                unified::Fvk::P2pkh(data) => Some(Ok::<_, DecodingError>((
+                    u32::from(unified::Typecode::P2pkh),
+                    data.to_vec(),
+                ))),
+                unified::Fvk::Unknown { typecode, data } => Some(Ok((*typecode, data.clone()))),
+            })
+            .collect::<Result<_, _>>()?;
+
+        Self::from_checked_parts(
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            unknown,
+        )
+        .map_err(|_| DecodingError::KeyDataInvalid(Typecode::P2pkh))
+    }
+
+    /// Returns the string encoding of this `UnifiedFullViewingKey` for the given network.
+    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
+        self.to_ufvk().encode(&params.network_type())
+    }
+
+    /// Returns the string encoding of this `UnifiedFullViewingKey` for the given network.
+    fn to_ufvk(&self) -> Ufvk {
+        let items = std::iter::empty().chain(self.unknown.iter().map(|(typecode, data)| {
+            unified::Fvk::Unknown {
+                typecode: *typecode,
+                data: data.clone(),
+            }
+        }));
+        #[cfg(feature = "orchard")]
+        let items = items.chain(
+            self.orchard
+                .as_ref()
+                .map(|fvk| fvk.to_bytes())
+                .map(unified::Fvk::Orchard),
+        );
+        #[cfg(feature = "sapling")]
+        let items = items.chain(
+            self.sapling
+                .as_ref()
+                .map(|dfvk| dfvk.to_bytes())
+                .map(unified::Fvk::Sapling),
+        );
+        #[cfg(feature = "transparent-inputs")]
+        let items = items.chain(
+            self.transparent
+                .as_ref()
+                .map(|tfvk| tfvk.serialize().try_into().unwrap())
+                .map(unified::Fvk::P2pkh),
+        );
+
+        unified::Ufvk::try_from_items(items.collect())
+            .expect("UnifiedFullViewingKey should only be constructed safely")
+    }
+
+    /// Derives a Unified Incoming Viewing Key from this Unified Full Viewing Key.
+    pub fn to_unified_incoming_viewing_key(&self) -> UnifiedIncomingViewingKey {
+        UnifiedIncomingViewingKey {
+            #[cfg(feature = "transparent-inputs")]
+            transparent: self.transparent.as_ref().map(|t| {
+                t.derive_external_ivk()
+                    .expect("Transparent IVK derivation was checked at construction.")
+            }),
+            #[cfg(feature = "sapling")]
+            sapling: self.sapling.as_ref().map(|s| s.to_external_ivk()),
+            #[cfg(feature = "orchard")]
+            orchard: self.orchard.as_ref().map(|o| o.to_ivk(Scope::External)),
+            unknown: Vec::new(),
+        }
+    }
+
+    /// Returns the transparent component of the unified key at the
+    /// BIP44 path `m/44'/<coin_type>'/<account>'`.
+    #[cfg(feature = "transparent-inputs")]
+    pub fn transparent(&self) -> Option<&legacy::AccountPubKey> {
+        self.transparent.as_ref()
+    }
+
+    /// Returns the Sapling diversifiable full viewing key component of this unified key.
+    #[cfg(feature = "sapling")]
+    pub fn sapling(&self) -> Option<&sapling::DiversifiableFullViewingKey> {
+        self.sapling.as_ref()
+    }
+
+    /// Returns the Orchard full viewing key component of this unified key.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> Option<&orchard::keys::FullViewingKey> {
+        self.orchard.as_ref()
+    }
+
+    /// Attempts to derive the Unified Address for the given diversifier index and
+    /// receiver types.
+    ///
+    /// Returns `None` if the specified index does not produce a valid diversifier.
+    pub fn address(
+        &self,
+        j: DiversifierIndex,
+        request: UnifiedAddressRequest,
+    ) -> Result<UnifiedAddress, AddressGenerationError> {
+        self.to_unified_incoming_viewing_key().address(j, request)
+    }
+
+    /// Searches the diversifier space starting at diversifier index `j` for one which will
+    /// produce a valid diversifier, and return the Unified Address constructed using that
+    /// diversifier along with the index at which the valid diversifier was found.
+    ///
+    /// Returns an `Err(AddressGenerationError)` if no valid diversifier exists or if the features
+    /// required to satisfy the unified address request are not properly enabled.
+    #[allow(unused_mut)]
+    pub fn find_address(
+        &self,
+        mut j: DiversifierIndex,
+        request: UnifiedAddressRequest,
+    ) -> Result<(UnifiedAddress, DiversifierIndex), AddressGenerationError> {
+        self.to_unified_incoming_viewing_key()
+            .find_address(j, request)
+    }
+
+    /// Find the Unified Address corresponding to the smallest valid diversifier index, along with
+    /// that index.
+    ///
+    /// Returns an `Err(AddressGenerationError)` if no valid diversifier exists or if the features
+    /// required to satisfy the unified address request are not properly enabled.
+    pub fn default_address(
+        &self,
+        request: UnifiedAddressRequest,
+    ) -> Result<(UnifiedAddress, DiversifierIndex), AddressGenerationError> {
+        self.find_address(DiversifierIndex::new(), request)
+    }
+}
+
+/// A [ZIP 316](https://zips.z.cash/zip-0316) unified incoming viewing key.
+#[derive(Clone, Debug)]
+pub struct UnifiedIncomingViewingKey {
+    #[cfg(feature = "transparent-inputs")]
+    transparent: Option<zcash_primitives::legacy::keys::ExternalIvk>,
+    #[cfg(feature = "sapling")]
+    sapling: Option<::sapling::zip32::IncomingViewingKey>,
+    #[cfg(feature = "orchard")]
+    orchard: Option<orchard::keys::IncomingViewingKey>,
+    /// Stores the unrecognized elements of the unified encoding.
+    unknown: Vec<(u32, Vec<u8>)>,
+}
+
+impl UnifiedIncomingViewingKey {
+    /// Construct a new unified incoming viewing key.
+    ///
+    /// This method is only available when the `test-dependencies` feature is enabled,
+    /// as derivation from the UFVK or deserialization from the serialized form should
+    /// be used instead.
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub fn new(
+        #[cfg(feature = "transparent-inputs")] transparent: Option<
+            zcash_primitives::legacy::keys::ExternalIvk,
+        >,
+        #[cfg(feature = "sapling")] sapling: Option<::sapling::zip32::IncomingViewingKey>,
+        #[cfg(feature = "orchard")] orchard: Option<orchard::keys::IncomingViewingKey>,
+        // TODO: Implement construction of UIVKs with metadata items.
+    ) -> UnifiedIncomingViewingKey {
+        UnifiedIncomingViewingKey {
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            // We don't allow constructing new UFVKs with unknown items, but we store
+            // this to allow parsing such UFVKs.
+            unknown: vec![],
+        }
+    }
+
+    /// Parses a `UnifiedFullViewingKey` from its [ZIP 316] string encoding.
+    ///
+    /// [ZIP 316]: https://zips.z.cash/zip-0316
+    pub fn decode<P: consensus::Parameters>(params: &P, encoding: &str) -> Result<Self, String> {
+        let (net, ufvk) = unified::Uivk::decode(encoding).map_err(|e| e.to_string())?;
+        let expected_net = params.network_type();
+        if net != expected_net {
+            return Err(format!(
+                "UIVK is for network {:?} but we expected {:?}",
+                net, expected_net,
+            ));
+        }
+
+        Self::parse(&ufvk).map_err(|e| e.to_string())
+    }
+
+    /// Constructs a unified incoming viewing key from a parsed unified encoding.
+    fn parse(uivk: &Uivk) -> Result<Self, DecodingError> {
+        #[cfg(feature = "orchard")]
+        let mut orchard = None;
+        #[cfg(feature = "sapling")]
+        let mut sapling = None;
+        #[cfg(feature = "transparent-inputs")]
+        let mut transparent = None;
+
+        let mut unknown = vec![];
+
+        // We can use as-parsed order here for efficiency, because we're breaking out the
+        // receivers we support from the unknown receivers.
+        for receiver in uivk.items_as_parsed() {
+            match receiver {
+                unified::Ivk::Orchard(data) => {
+                    #[cfg(feature = "orchard")]
+                    {
+                        orchard = Some(
+                            Option::from(orchard::keys::IncomingViewingKey::from_bytes(data))
+                                .ok_or(DecodingError::KeyDataInvalid(Typecode::Orchard))?,
+                        );
+                    }
+
+                    #[cfg(not(feature = "orchard"))]
+                    unknown.push((u32::from(unified::Typecode::Orchard), data.to_vec()));
+                }
+                unified::Ivk::Sapling(data) => {
+                    #[cfg(feature = "sapling")]
+                    {
+                        sapling = Some(
+                            Option::from(::sapling::zip32::IncomingViewingKey::from_bytes(data))
+                                .ok_or(DecodingError::KeyDataInvalid(Typecode::Sapling))?,
+                        );
+                    }
+
+                    #[cfg(not(feature = "sapling"))]
+                    unknown.push((u32::from(unified::Typecode::Sapling), data.to_vec()));
+                }
+                unified::Ivk::P2pkh(data) => {
+                    #[cfg(feature = "transparent-inputs")]
+                    {
+                        transparent = Some(
+                            legacy::ExternalIvk::deserialize(data)
+                                .map_err(|_| DecodingError::KeyDataInvalid(Typecode::P2pkh))?,
+                        );
+                    }
+
+                    #[cfg(not(feature = "transparent-inputs"))]
+                    unknown.push((u32::from(unified::Typecode::P2pkh), data.to_vec()));
+                }
+                unified::Ivk::Unknown { typecode, data } => {
+                    unknown.push((*typecode, data.clone()));
+                }
+            }
+        }
+
+        Ok(Self {
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+            unknown,
+        })
+    }
+
+    /// Returns the string encoding of this `UnifiedFullViewingKey` for the given network.
+    pub fn encode<P: consensus::Parameters>(&self, params: &P) -> String {
+        self.render().encode(&params.network_type())
+    }
+
+    /// Converts this unified incoming viewing key to a unified encoding.
+    fn render(&self) -> Uivk {
+        let items = std::iter::empty().chain(self.unknown.iter().map(|(typecode, data)| {
+            unified::Ivk::Unknown {
+                typecode: *typecode,
+                data: data.clone(),
+            }
+        }));
+        #[cfg(feature = "orchard")]
+        let items = items.chain(
+            self.orchard
+                .as_ref()
+                .map(|ivk| ivk.to_bytes())
+                .map(unified::Ivk::Orchard),
+        );
+        #[cfg(feature = "sapling")]
+        let items = items.chain(
+            self.sapling
+                .as_ref()
+                .map(|divk| divk.to_bytes())
+                .map(unified::Ivk::Sapling),
+        );
+        #[cfg(feature = "transparent-inputs")]
+        let items = items.chain(
+            self.transparent
+                .as_ref()
+                .map(|tivk| tivk.serialize().try_into().unwrap())
+                .map(unified::Ivk::P2pkh),
+        );
+
+        unified::Uivk::try_from_items(items.collect())
+            .expect("UnifiedIncomingViewingKey should only be constructed safely.")
+    }
+
+    /// Returns the Transparent external IVK, if present.
+    #[cfg(feature = "transparent-inputs")]
+    pub fn transparent(&self) -> &Option<zcash_primitives::legacy::keys::ExternalIvk> {
+        &self.transparent
+    }
+
+    /// Returns the Sapling IVK, if present.
+    #[cfg(feature = "sapling")]
+    pub fn sapling(&self) -> &Option<::sapling::zip32::IncomingViewingKey> {
+        &self.sapling
+    }
+
+    /// Returns the Orchard IVK, if present.
+    #[cfg(feature = "orchard")]
+    pub fn orchard(&self) -> &Option<orchard::keys::IncomingViewingKey> {
+        &self.orchard
+    }
+
+    /// Attempts to derive the Unified Address for the given diversifier index and
+    /// receiver types.
+    ///
+    /// Returns `None` if the specified index does not produce a valid diversifier.
+    pub fn address(
+        &self,
+        _j: DiversifierIndex,
+        request: UnifiedAddressRequest,
+    ) -> Result<UnifiedAddress, AddressGenerationError> {
+        #[cfg(feature = "orchard")]
+        let mut orchard = None;
+        if request.has_orchard {
+            #[cfg(not(feature = "orchard"))]
+            return Err(AddressGenerationError::ReceiverTypeNotSupported(
+                Typecode::Orchard,
+            ));
+
+            #[cfg(feature = "orchard")]
+            if let Some(oivk) = &self.orchard {
+                let orchard_j = orchard::keys::DiversifierIndex::from(*_j.as_bytes());
+                orchard = Some(oivk.address_at(orchard_j))
+            } else {
+                return Err(AddressGenerationError::KeyNotAvailable(Typecode::Orchard));
+            }
+        }
+
+        #[cfg(feature = "sapling")]
+        let mut sapling = None;
+        if request.has_sapling {
+            #[cfg(not(feature = "sapling"))]
+            return Err(AddressGenerationError::ReceiverTypeNotSupported(
+                Typecode::Sapling,
+            ));
+
+            #[cfg(feature = "sapling")]
+            if let Some(divk) = &self.sapling {
+                // If a Sapling receiver type is requested, we must be able to construct an
+                // address; if we're unable to do so, then no Unified Address exists at this
+                // diversifier and we use `?` to early-return from this method.
+                sapling = Some(
+                    divk.address_at(_j)
+                        .ok_or(AddressGenerationError::InvalidSaplingDiversifierIndex(_j))?,
+                );
+            } else {
+                return Err(AddressGenerationError::KeyNotAvailable(Typecode::Sapling));
+            }
+        }
+
+        #[cfg(feature = "transparent-inputs")]
+        let mut transparent = None;
+        if request.has_p2pkh {
+            #[cfg(not(feature = "transparent-inputs"))]
+            return Err(AddressGenerationError::ReceiverTypeNotSupported(
+                Typecode::P2pkh,
+            ));
+
+            #[cfg(feature = "transparent-inputs")]
+            if let Some(tivk) = self.transparent.as_ref() {
+                // If a transparent receiver type is requested, we must be able to construct an
+                // address; if we're unable to do so, then no Unified Address exists at this
+                // diversifier.
+                let transparent_j = to_transparent_child_index(_j)
+                    .ok_or(AddressGenerationError::InvalidTransparentChildIndex(_j))?;
+
+                transparent = Some(
+                    tivk.derive_address(transparent_j)
+                        .map_err(|_| AddressGenerationError::InvalidTransparentChildIndex(_j))?,
+                );
+            } else {
+                return Err(AddressGenerationError::KeyNotAvailable(Typecode::P2pkh));
+            }
+        }
+        #[cfg(not(feature = "transparent-inputs"))]
+        let transparent = None;
+
+        UnifiedAddress::from_receivers(
+            #[cfg(feature = "orchard")]
+            orchard,
+            #[cfg(feature = "sapling")]
+            sapling,
+            transparent,
+        )
+        .ok_or(AddressGenerationError::ShieldedReceiverRequired)
+    }
+
+    /// Searches the diversifier space starting at diversifier index `j` for one which will
+    /// produce a valid diversifier, and return the Unified Address constructed using that
+    /// diversifier along with the index at which the valid diversifier was found.
+    ///
+    /// Returns an `Err(AddressGenerationError)` if no valid diversifier exists or if the features
+    /// required to satisfy the unified address request are not properly enabled.
+    #[allow(unused_mut)]
+    pub fn find_address(
+        &self,
+        mut j: DiversifierIndex,
+        request: UnifiedAddressRequest,
+    ) -> Result<(UnifiedAddress, DiversifierIndex), AddressGenerationError> {
+        // If we need to generate a transparent receiver, check that the user has not
+        // specified an invalid transparent child index, from which we can never search to
+        // find a valid index.
+        #[cfg(feature = "transparent-inputs")]
+        if request.has_p2pkh
+            && self.transparent.is_some()
+            && to_transparent_child_index(j).is_none()
+        {
+            return Err(AddressGenerationError::InvalidTransparentChildIndex(j));
+        }
+
+        // Find a working diversifier and construct the associated address.
+        loop {
+            let res = self.address(j, request);
+            match res {
+                Ok(ua) => {
+                    return Ok((ua, j));
+                }
+                #[cfg(feature = "sapling")]
+                Err(AddressGenerationError::InvalidSaplingDiversifierIndex(_)) => {
+                    if j.increment().is_err() {
+                        return Err(AddressGenerationError::DiversifierSpaceExhausted);
+                    }
+                }
+                Err(other) => {
+                    return Err(other);
+                }
+            }
+        }
+    }
+
+    /// Find the Unified Address corresponding to the smallest valid diversifier index, along with
+    /// that index.
+    ///
+    /// Returns an `Err(AddressGenerationError)` if no valid diversifier exists or if the features
+    /// required to satisfy the unified address request are not properly enabled.
+    pub fn default_address(
+        &self,
+        request: UnifiedAddressRequest,
+    ) -> Result<(UnifiedAddress, DiversifierIndex), AddressGenerationError> {
+        self.find_address(DiversifierIndex::new(), request)
+    }
+
+    /// Constructs a [`UnifiedAddressRequest`] that includes the components of this UIVK.
+    pub fn to_address_request(&self) -> Option<UnifiedAddressRequest> {
+        #[cfg(feature = "orchard")]
+        let has_orchard = self.orchard.is_some();
+        #[cfg(not(feature = "orchard"))]
+        let has_orchard = false;
+
+        #[cfg(feature = "sapling")]
+        let has_sapling = self.sapling.is_some();
+        #[cfg(not(feature = "sapling"))]
+        let has_sapling = false;
+
+        #[cfg(feature = "transparent-inputs")]
+        let has_p2pkh = self.transparent.is_some();
+        #[cfg(not(feature = "transparent-inputs"))]
+        let has_p2pkh = false;
+
+        UnifiedAddressRequest::new(has_orchard, has_sapling, has_p2pkh)
+    }
+}
+
+#[cfg(any(test, feature = "test-dependencies"))]
+pub mod testing {
+    use proptest::prelude::*;
+
+    use super::UnifiedSpendingKey;
+    use zcash_primitives::{consensus::Network, zip32::AccountId};
+
+    pub fn arb_unified_spending_key(params: Network) -> impl Strategy<Value = UnifiedSpendingKey> {
+        prop::array::uniform32(prop::num::u8::ANY).prop_flat_map(move |seed| {
+            prop::num::u32::ANY
+                .prop_map(move |account| {
+                    UnifiedSpendingKey::from_seed(
+                        &params,
+                        &seed,
+                        AccountId::try_from(account & ((1 << 31) - 1)).unwrap(),
+                    )
+                })
+                .prop_filter("seeds must generate valid USKs", |v| v.is_ok())
+                .prop_map(|v| v.unwrap())
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+
+    use proptest::prelude::proptest;
+
+    use {zcash_primitives::consensus::MAIN_NETWORK, zip32::AccountId};
+
+    #[cfg(any(feature = "sapling", feature = "orchard"))]
+    use {
+        super::{UnifiedFullViewingKey, UnifiedIncomingViewingKey},
+        zcash_address::unified::{Encoding, Uivk},
+    };
+
+    #[cfg(feature = "orchard")]
+    use zip32::Scope;
+
+    #[cfg(feature = "sapling")]
+    use super::sapling;
+
+    #[cfg(feature = "transparent-inputs")]
+    use {
+        crate::{address::Address, encoding::AddressCodec},
+        zcash_address::test_vectors,
+        zcash_primitives::legacy::keys::{AccountPrivKey, IncomingViewingKey},
+        zip32::DiversifierIndex,
+    };
+
+    #[cfg(feature = "unstable")]
+    use super::{testing::arb_unified_spending_key, Era, UnifiedSpendingKey};
+
+    #[cfg(all(feature = "orchard", feature = "unstable"))]
+    use subtle::ConstantTimeEq;
+
+    #[cfg(feature = "transparent-inputs")]
+    fn seed() -> Vec<u8> {
+        let seed_hex = "6ef5f84def6f4b9d38f466586a8380a38593bd47c8cda77f091856176da47f26b5bd1c8d097486e5635df5a66e820d28e1d73346f499801c86228d43f390304f";
+        hex::decode(seed_hex).unwrap()
+    }
+
+    #[test]
+    #[should_panic]
+    #[cfg(feature = "sapling")]
+    fn spending_key_panics_on_short_seed() {
+        let _ = sapling::spending_key(&[0; 31][..], 0, AccountId::ZERO);
+    }
+
+    #[cfg(feature = "transparent-inputs")]
+    #[test]
+    fn pk_to_taddr() {
+        use zcash_primitives::legacy::keys::NonHardenedChildIndex;
+
+        let taddr = AccountPrivKey::from_seed(&MAIN_NETWORK, &seed(), AccountId::ZERO)
+            .unwrap()
+            .to_account_pubkey()
+            .derive_external_ivk()
+            .unwrap()
+            .derive_address(NonHardenedChildIndex::ZERO)
+            .unwrap()
+            .encode(&MAIN_NETWORK);
+        assert_eq!(taddr, "t1PKtYdJJHhc3Pxowmznkg7vdTwnhEsCvR4".to_string());
+    }
+
+    #[test]
+    #[cfg(any(feature = "orchard", feature = "sapling"))]
+    fn ufvk_round_trip() {
+        #[cfg(feature = "orchard")]
+        let orchard = {
+            let sk =
+                orchard::keys::SpendingKey::from_zip32_seed(&[0; 32], 0, AccountId::ZERO).unwrap();
+            Some(orchard::keys::FullViewingKey::from(&sk))
+        };
+
+        #[cfg(feature = "sapling")]
+        let sapling = {
+            let extsk = sapling::spending_key(&[0; 32], 0, AccountId::ZERO);
+            Some(extsk.to_diversifiable_full_viewing_key())
+        };
+
+        #[cfg(feature = "transparent-inputs")]
+        let transparent = {
+            let privkey =
+                AccountPrivKey::from_seed(&MAIN_NETWORK, &[0; 32], AccountId::ZERO).unwrap();
+            Some(privkey.to_account_pubkey())
+        };
+
+        let ufvk = UnifiedFullViewingKey::new(
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        );
+
+        let ufvk = ufvk.expect("Orchard or Sapling fvk is present.");
+        let encoded = ufvk.encode(&MAIN_NETWORK);
+
+        // Test encoded form against known values; these test vectors contain Orchard receivers
+        // that will be treated as unknown if the `orchard` feature is not enabled.
+        let encoded_with_t = "uview1tg6rpjgju2s2j37gkgjq79qrh5lvzr6e0ed3n4sf4hu5qd35vmsh7avl80xa6mx7ryqce9hztwaqwrdthetpy4pc0kce25x453hwcmax02p80pg5savlg865sft9reat07c5vlactr6l2pxtlqtqunt2j9gmvr8spcuzf07af80h5qmut38h0gvcfa9k4rwujacwwca9vu8jev7wq6c725huv8qjmhss3hdj2vh8cfxhpqcm2qzc34msyrfxk5u6dqttt4vv2mr0aajreww5yufpk0gn4xkfm888467k7v6fmw7syqq6cceu078yw8xja502jxr0jgum43lhvpzmf7eu5dmnn6cr6f7p43yw8znzgxg598mllewnx076hljlvynhzwn5es94yrv65tdg3utuz2u3sras0wfcq4adxwdvlk387d22g3q98t5z74quw2fa4wed32escx8dwh4mw35t4jwf35xyfxnu83mk5s4kw2glkgsshmxk";
+        let _encoded_no_t = "uview12z384wdq76ceewlsu0esk7d97qnd23v2qnvhujxtcf2lsq8g4hwzpx44fwxssnm5tg8skyh4tnc8gydwxefnnm0hd0a6c6etmj0pp9jqkdsllkr70u8gpf7ndsfqcjlqn6dec3faumzqlqcmtjf8vp92h7kj38ph2786zx30hq2wru8ae3excdwc8w0z3t9fuw7mt7xy5sn6s4e45kwm0cjp70wytnensgdnev286t3vew3yuwt2hcz865y037k30e428dvgne37xvyeal2vu8yjnznphf9t2rw3gdp0hk5zwq00ws8f3l3j5n3qkqgsyzrwx4qzmgq0xwwk4vz2r6vtsykgz089jncvycmem3535zjwvvtvjw8v98y0d5ydwte575gjm7a7k";
+
+        // We test the full roundtrip only with the `sapling` and `orchard` features enabled,
+        // because we will not generate these parts of the encoding if the UFVK does not have an
+        // these parts.
+        #[cfg(all(feature = "sapling", feature = "orchard"))]
+        {
+            #[cfg(feature = "transparent-inputs")]
+            assert_eq!(encoded, encoded_with_t);
+            #[cfg(not(feature = "transparent-inputs"))]
+            assert_eq!(encoded, _encoded_no_t);
+        }
+
+        let decoded = UnifiedFullViewingKey::decode(&MAIN_NETWORK, &encoded).unwrap();
+        let reencoded = decoded.encode(&MAIN_NETWORK);
+        assert_eq!(encoded, reencoded);
+
+        #[cfg(feature = "transparent-inputs")]
+        assert_eq!(
+            decoded.transparent.map(|t| t.serialize()),
+            ufvk.transparent.as_ref().map(|t| t.serialize()),
+        );
+        #[cfg(feature = "sapling")]
+        assert_eq!(
+            decoded.sapling.map(|s| s.to_bytes()),
+            ufvk.sapling.map(|s| s.to_bytes()),
+        );
+        #[cfg(feature = "orchard")]
+        assert_eq!(
+            decoded.orchard.map(|o| o.to_bytes()),
+            ufvk.orchard.map(|o| o.to_bytes()),
+        );
+
+        let decoded_with_t = UnifiedFullViewingKey::decode(&MAIN_NETWORK, encoded_with_t).unwrap();
+        #[cfg(feature = "transparent-inputs")]
+        assert_eq!(
+            decoded_with_t.transparent.map(|t| t.serialize()),
+            ufvk.transparent.as_ref().map(|t| t.serialize()),
+        );
+
+        // Both Orchard and Sapling enabled
+        #[cfg(all(
+            feature = "orchard",
+            feature = "sapling",
+            feature = "transparent-inputs"
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 0);
+        #[cfg(all(
+            feature = "orchard",
+            feature = "sapling",
+            not(feature = "transparent-inputs")
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 1);
+
+        // Orchard enabled
+        #[cfg(all(
+            feature = "orchard",
+            not(feature = "sapling"),
+            feature = "transparent-inputs"
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 1);
+        #[cfg(all(
+            feature = "orchard",
+            not(feature = "sapling"),
+            not(feature = "transparent-inputs")
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 2);
+
+        // Sapling enabled
+        #[cfg(all(
+            not(feature = "orchard"),
+            feature = "sapling",
+            feature = "transparent-inputs"
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 1);
+        #[cfg(all(
+            not(feature = "orchard"),
+            feature = "sapling",
+            not(feature = "transparent-inputs")
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 2);
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn ufvk_derivation() {
+        use crate::keys::UnifiedAddressRequest;
+
+        use super::UnifiedSpendingKey;
+
+        for tv in test_vectors::UNIFIED {
+            let usk = UnifiedSpendingKey::from_seed(
+                &MAIN_NETWORK,
+                &tv.root_seed,
+                AccountId::try_from(tv.account).unwrap(),
+            )
+            .expect("seed produced a valid unified spending key");
+
+            let d_idx = DiversifierIndex::from(tv.diversifier_index);
+            let ufvk = usk.to_unified_full_viewing_key();
+
+            // The test vectors contain some diversifier indices that do not generate
+            // valid Sapling addresses, so skip those.
+            #[cfg(feature = "sapling")]
+            if ufvk.sapling().unwrap().address(d_idx).is_none() {
+                continue;
+            }
+
+            let ua = ufvk
+                .address(d_idx, UnifiedAddressRequest::unsafe_new(false, true, true))
+                .unwrap_or_else(|err| {
+                    panic!(
+                        "unified address generation failed for account {}: {:?}",
+                        tv.account, err
+                    )
+                });
+
+            match Address::decode(&MAIN_NETWORK, tv.unified_addr) {
+                Some(Address::Unified(tvua)) => {
+                    // We always derive transparent and Sapling receivers, but not
+                    // every value in the test vectors has these present.
+                    if tvua.has_transparent() {
+                        assert_eq!(tvua.transparent(), ua.transparent());
+                    }
+                    #[cfg(feature = "sapling")]
+                    if tvua.has_sapling() {
+                        assert_eq!(tvua.sapling(), ua.sapling());
+                    }
+                }
+                _other => {
+                    panic!(
+                        "{} did not decode to a valid unified address",
+                        tv.unified_addr
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    #[cfg(any(feature = "orchard", feature = "sapling"))]
+    fn uivk_round_trip() {
+        use zcash_primitives::consensus::NetworkType;
+
+        #[cfg(feature = "orchard")]
+        let orchard = {
+            let sk =
+                orchard::keys::SpendingKey::from_zip32_seed(&[0; 32], 0, AccountId::ZERO).unwrap();
+            Some(orchard::keys::FullViewingKey::from(&sk).to_ivk(Scope::External))
+        };
+
+        #[cfg(feature = "sapling")]
+        let sapling = {
+            let extsk = sapling::spending_key(&[0; 32], 0, AccountId::ZERO);
+            Some(extsk.to_diversifiable_full_viewing_key().to_external_ivk())
+        };
+
+        #[cfg(feature = "transparent-inputs")]
+        let transparent = {
+            let privkey =
+                AccountPrivKey::from_seed(&MAIN_NETWORK, &[0; 32], AccountId::ZERO).unwrap();
+            Some(privkey.to_account_pubkey().derive_external_ivk().unwrap())
+        };
+
+        let uivk = UnifiedIncomingViewingKey::new(
+            #[cfg(feature = "transparent-inputs")]
+            transparent,
+            #[cfg(feature = "sapling")]
+            sapling,
+            #[cfg(feature = "orchard")]
+            orchard,
+        );
+
+        let encoded = uivk.render().encode(&NetworkType::Main);
+
+        // Test encoded form against known values; these test vectors contain Orchard receivers
+        // that will be treated as unknown if the `orchard` feature is not enabled.
+        let encoded_with_t = "uivk1z28yg638vjwusmf0zc9ad2j0mpv6s42wc5kqt004aaqfu5xxxgu7mdcydn9qf723fnryt34s6jyxyw0jt7spq04c3v9ze6qe9gjjc5aglz8zv5pqtw58czd0actynww5n85z3052kzgy6cu0fyjafyp4sr4kppyrrwhwev2rr0awq6m8d66esvk6fgacggqnswg5g9gkv6t6fj9ajhyd0gmel4yzscprpzduncc0e2lywufup6fvzf6y8cefez2r99pgge5yyfuus0r60khgu895pln5e7nn77q6s9kh2uwf6lrfu06ma2kd7r05jjvl4hn6nupge8fajh0cazd7mkmz23t79w";
+        let _encoded_no_t = "uivk1020vq9j5zeqxh303sxa0zv2hn9wm9fev8x0p8yqxdwyzde9r4c90fcglc63usj0ycl2scy8zxuhtser0qrq356xfy8x3vyuxu7f6gas75svl9v9m3ctuazsu0ar8e8crtx7x6zgh4kw8xm3q4rlkpm9er2wefxhhf9pn547gpuz9vw27gsdp6c03nwlrxgzhr2g6xek0x8l5avrx9ue9lf032tr7kmhqf3nfdxg7ldfgx6yf09g";
+
+        // We test the full roundtrip only with the `sapling` and `orchard` features enabled,
+        // because we will not generate these parts of the encoding if the UIVK does not have an
+        // these parts.
+        #[cfg(all(feature = "sapling", feature = "orchard"))]
+        {
+            #[cfg(feature = "transparent-inputs")]
+            assert_eq!(encoded, encoded_with_t);
+            #[cfg(not(feature = "transparent-inputs"))]
+            assert_eq!(encoded, _encoded_no_t);
+        }
+
+        let decoded = UnifiedIncomingViewingKey::parse(&Uivk::decode(&encoded).unwrap().1).unwrap();
+        let reencoded = decoded.render().encode(&NetworkType::Main);
+        assert_eq!(encoded, reencoded);
+
+        #[cfg(feature = "transparent-inputs")]
+        assert_eq!(
+            decoded.transparent.map(|t| t.serialize()),
+            uivk.transparent.as_ref().map(|t| t.serialize()),
+        );
+        #[cfg(feature = "sapling")]
+        assert_eq!(
+            decoded.sapling.map(|s| s.to_bytes()),
+            uivk.sapling.map(|s| s.to_bytes()),
+        );
+        #[cfg(feature = "orchard")]
+        assert_eq!(
+            decoded.orchard.map(|o| o.to_bytes()),
+            uivk.orchard.map(|o| o.to_bytes()),
+        );
+
+        let decoded_with_t =
+            UnifiedIncomingViewingKey::parse(&Uivk::decode(encoded_with_t).unwrap().1).unwrap();
+        #[cfg(feature = "transparent-inputs")]
+        assert_eq!(
+            decoded_with_t.transparent.map(|t| t.serialize()),
+            uivk.transparent.as_ref().map(|t| t.serialize()),
+        );
+
+        // Both Orchard and Sapling enabled
+        #[cfg(all(
+            feature = "orchard",
+            feature = "sapling",
+            feature = "transparent-inputs"
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 0);
+        #[cfg(all(
+            feature = "orchard",
+            feature = "sapling",
+            not(feature = "transparent-inputs")
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 1);
+
+        // Orchard enabled
+        #[cfg(all(
+            feature = "orchard",
+            not(feature = "sapling"),
+            feature = "transparent-inputs"
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 1);
+        #[cfg(all(
+            feature = "orchard",
+            not(feature = "sapling"),
+            not(feature = "transparent-inputs")
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 2);
+
+        // Sapling enabled
+        #[cfg(all(
+            not(feature = "orchard"),
+            feature = "sapling",
+            feature = "transparent-inputs"
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 1);
+        #[cfg(all(
+            not(feature = "orchard"),
+            feature = "sapling",
+            not(feature = "transparent-inputs")
+        ))]
+        assert_eq!(decoded_with_t.unknown.len(), 2);
+    }
+
+    #[test]
+    #[cfg(feature = "transparent-inputs")]
+    fn uivk_derivation() {
+        use crate::keys::UnifiedAddressRequest;
+
+        use super::UnifiedSpendingKey;
+
+        for tv in test_vectors::UNIFIED {
+            let usk = UnifiedSpendingKey::from_seed(
+                &MAIN_NETWORK,
+                &tv.root_seed,
+                AccountId::try_from(tv.account).unwrap(),
+            )
+            .expect("seed produced a valid unified spending key");
+
+            let d_idx = DiversifierIndex::from(tv.diversifier_index);
+            let uivk = usk
+                .to_unified_full_viewing_key()
+                .to_unified_incoming_viewing_key();
+
+            // The test vectors contain some diversifier indices that do not generate
+            // valid Sapling addresses, so skip those.
+            #[cfg(feature = "sapling")]
+            if uivk.sapling().as_ref().unwrap().address_at(d_idx).is_none() {
+                continue;
+            }
+
+            let ua = uivk
+                .address(d_idx, UnifiedAddressRequest::unsafe_new(false, true, true))
+                .unwrap_or_else(|err| {
+                    panic!(
+                        "unified address generation failed for account {}: {:?}",
+                        tv.account, err
+                    )
+                });
+
+            match Address::decode(&MAIN_NETWORK, tv.unified_addr) {
+                Some(Address::Unified(tvua)) => {
+                    // We always derive transparent and Sapling receivers, but not
+                    // every value in the test vectors has these present.
+                    if tvua.has_transparent() {
+                        assert_eq!(tvua.transparent(), ua.transparent());
+                    }
+                    #[cfg(feature = "sapling")]
+                    if tvua.has_sapling() {
+                        assert_eq!(tvua.sapling(), ua.sapling());
+                    }
+                }
+                _other => {
+                    panic!(
+                        "{} did not decode to a valid unified address",
+                        tv.unified_addr
+                    );
+                }
+            }
+        }
+    }
+
+    proptest! {
+        #[test]
+        #[cfg(feature = "unstable")]
+        fn prop_usk_roundtrip(usk in arb_unified_spending_key(zcash_protocol::consensus::Network::MainNetwork)) {
+            let encoded = usk.to_bytes(Era::Orchard);
+
+            #[allow(clippy::let_and_return)]
+            let encoded_len = {
+                let len = 4;
+
+                #[cfg(feature = "orchard")]
+                let len = len + 2 + 32;
+
+                let len = len + 2 + 169;
+
+                // Transparent part is an `xprv` transparent extended key deserialized
+                // into bytes from Base58, minus the 4 prefix bytes.
+                #[cfg(feature = "transparent-inputs")]
+                let len = len + 2 + 74;
+
+                #[allow(clippy::let_and_return)]
+                len
+            };
+            assert_eq!(encoded.len(), encoded_len);
+
+            let decoded = UnifiedSpendingKey::from_bytes(Era::Orchard, &encoded);
+            let decoded = decoded.unwrap_or_else(|e| panic!("Error decoding USK: {:?}", e));
+
+            #[cfg(feature = "orchard")]
+            assert!(bool::from(decoded.orchard().ct_eq(usk.orchard())));
+
+            assert_eq!(decoded.sapling(), usk.sapling());
+
+            #[cfg(feature = "transparent-inputs")]
+            assert_eq!(decoded.transparent().to_bytes(), usk.transparent().to_bytes());
+        }
+    }
+}
diff --git a/zcash_keys/src/lib.rs b/zcash_keys/src/lib.rs
new file mode 100644
index 0000000000..eb881a80f8
--- /dev/null
+++ b/zcash_keys/src/lib.rs
@@ -0,0 +1,25 @@
+//! *A crate for Zcash key and address management.*
+//!
+//! `zcash_keys` contains Rust structs, traits and functions for creating Zcash spending
+//! and viewing keys and addresses.
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
+
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+// Catch documentation errors caused by code changes.
+#![deny(rustdoc::broken_intra_doc_links)]
+// Temporary until we have addressed all Result<T, ()> cases.
+#![allow(clippy::result_unit_err)]
+
+pub mod address;
+pub mod encoding;
+
+#[cfg(any(
+    feature = "orchard",
+    feature = "sapling",
+    feature = "transparent-inputs"
+))]
+pub mod keys;
diff --git a/zcash_primitives/CHANGELOG.md b/zcash_primitives/CHANGELOG.md
index 4f3d765178..4b8d6a0e59 100644
--- a/zcash_primitives/CHANGELOG.md
+++ b/zcash_primitives/CHANGELOG.md
@@ -7,6 +7,380 @@ and this library adheres to Rust's notion of
 
 ## [Unreleased]
 
+## [0.20.0] - 2024-11-14
+
+### Added
+- A new feature flag, `non-standard-fees`, has been added. This flag is now
+  required in order to make use of any types or methods that enable non-standard
+  fee calculation.
+
+### Changed
+- MSRV is now 1.77.0.
+- `zcash_primitives::transaction::fees`:
+  - The `fixed` module has been moved behind the `non-standard-fees` feature
+    flag. Using a fixed fee may result in a transaction that cannot be mined on
+    the current Zcash network. To calculate the ZIP 317 fee, use
+    `zip317::FeeRule::standard()`.
+  - `zip317::FeeRule::non_standard` has been moved behind the `non-standard-fees`
+    feature flag. Using a non-standard fee may result in a transaction that cannot
+    be mined on the current `Zcash` network.
+
+### Deprecated
+- `zcash_primitives::transaction::fees`:
+  - `StandardFeeRule` has been deprecated. It was never used within `zcash_primitives`
+    and should have been a member of `zcash_client_backend::fees` instead.
+
+### Removed
+- `zcash_primitives::transaction::fees`:
+  - `StandardFeeRule` itself has been removed; it was not used in this crate.
+    Its use in `zcash_client_backend` has been replaced with
+    `zcash_client_backend::fees::StandardFeeRule`.
+  - `fixed::FeeRule::standard`. This constructor was misleadingly named: using a
+    fixed fee does not conform to any current Zcash standard. To calculate the
+    ZIP 317 fee, use `zip317::FeeRule::standard()`. To preserve the current
+    behaviour, use `fixed::FeeRule::non_standard(zip317::MINIMUM_FEE)`,
+    but note that this is likely to result in transactions that cannot be mined.
+
+## [0.19.0] - 2024-10-02
+
+### Changed
+- Migrated to `zcash_address 0.6`.
+
+### Fixed
+- The previous release did not bump `zcash_address` and ended up depending on
+  multiple versions of `zcash_protocol`, which didn't cause a code conflict but
+  results in two different consensus protocol states being present in the
+  dependency tree.
+
+## [0.18.0] - 2024-10-02
+
+### Changed
+- Update dependencies to `incrementalmerkletree 0.7`, `orchard 0.10`,
+  `sapling-crypto 0.3`, `zcash_protocol 0.4`.
+
+## [0.17.0] - 2024-08-26
+
+### Changed
+- Update dependencies to `zcash_protocol 0.3`, `zcash_address 0.5`.
+
+## [0.16.0] - 2024-08-19
+
+### Added
+- `zcash_primitives::legacy::keys`:
+  - `impl From<TransparentKeyScope> for bip32::ChildNumber`
+  - `impl From<NonHardenedChildIndex> for bip32::ChildNumber`
+  - `impl TryFrom<bip32::ChildNumber> for NonHardenedChildIndex`
+  - `EphemeralIvk`
+  - `AccountPubKey::derive_ephemeral_ivk`
+  - `TransparentKeyScope::custom` is now `const`.
+  - `TransparentKeyScope::{EXTERNAL, INTERNAL, EPHEMERAL}`
+- `zcash_primitives::legacy::Script::serialized_size`
+- `zcash_primitives::transaction::fees::transparent`:
+  - `InputSize`
+  - `InputView::serialized_size`
+  - `OutputView::serialized_size`
+- `zcash_primitives::transaction::component::transparent::OutPoint::txid`
+- `zcash_primitives::transaction::builder::DEFAULT_TX_EXPIRY_DELTA`
+
+### Changed
+- MSRV is now 1.70.0.
+- Bumped dependencies to `secp256k1 0.27`, `incrementalmerkletree 0.6`,
+  `orchard 0.9`, `sapling-crypto 0.2`.
+- `zcash_primitives::legacy::keys`:
+  - `AccountPrivKey::{from_bytes, to_bytes}` now use the byte encoding from the
+    inside of a `xprv` Base58 string encoding from BIP 32, excluding the prefix
+    bytes (i.e. starting with `depth`).
+  - `AccountPrivKey::from_extended_privkey` now takes
+    `bip32::ExtendedPrivateKey<secp256k1::SecretKey>`.
+  - The following methods now return `Result<_, bip32::Error>`:
+    - `AccountPrivKey::from_seed`
+    - `AccountPrivKey::derive_secret_key`
+    - `AccountPrivKey::derive_external_secret_key`
+    - `AccountPrivKey::derive_internal_secret_key`
+    - `AccountPubKey::derive_external_ivk`
+    - `AccountPubKey::derive_internal_ivk`
+    - `AccountPubKey::deserialize`
+    - `IncomingViewingKey::derive_address`
+- `zcash_primitives::transaction::fees::FeeRule::fee_required`: the types
+  of parameters relating to transparent inputs and outputs have changed.
+  This method now requires their `tx_in` and `tx_out` serialized sizes
+  (expressed as iterators of `InputSize` for inputs and `usize` for outputs)
+  rather than a slice of `InputView` or `OutputView`.
+
+### Deprecated
+- `zcash_primitives::transaction::fees::zip317::FeeRule::non_standard` has been
+  deprecated, because in general it can calculate fees that violate ZIP 317, which
+  might cause transactions built with it to fail. Maintaining the generality of the
+  current implementation imposes ongoing maintenance costs, and so it is likely to
+  be removed in the near future. Use `transaction::fees::zip317::FeeRule::standard()`
+  instead to comply with ZIP 317.
+
+### Removed
+- The `zcash_primitives::zip339` module, which reexported parts of the API of
+  the `bip0039` crate, has been removed. Use the `bip0039` crate directly
+  instead.
+- The `hdwallet` dependency and its effect on `zcash_primitives::legacy::keys`:
+  - `impl From<TransparentKeyScope> for hdwallet::KeyIndex`
+  - `impl From<NonHardenedChildIndex> for hdwallet::KeyIndex`
+  - `impl TryFrom<hdwallet::KeyIndex> for NonHardenedChildIndex`
+
+## [0.15.1] - 2024-05-23
+
+- Fixed `sapling-crypto` dependency to not enable its `multicore` feature flag
+  when the default features of `zcash_primitives` are disabled.
+
+## [0.15.0] - 2024-03-25
+
+### Added
+- `zcash_primitives::transaction::components::sapling::zip212_enforcement`
+
+### Changed
+- The following modules are now re-exported from the `zcash_protocol` crate.
+  Additional changes have also been made therein; refer to the `zcash_protocol`
+  changelog for details.
+  - `zcash_primitives::consensus` re-exports `zcash_protocol::consensus`.
+  - `zcash_primitives::constants` re-exports `zcash_protocol::constants`.
+  - `zcash_primitives::transaction::components::amount` re-exports
+    `zcash_protocol::value`. Many of the conversions to and from the
+    `Amount` and `NonNegativeAmount` value types now return
+    `Result<_, BalanceError>` instead of `Result<_, ()>`.
+  - `zcash_primitives::memo` re-exports `zcash_protocol::memo`.
+  - Update to `orchard` version `0.8.0`
+
+### Removed
+- `zcash_primitives::consensus::sapling_zip212_enforcement` instead use
+  `zcash_primitives::transaction::components::sapling::zip212_enforcement`.
+- From `zcash_primitive::components::transaction`:
+  - `impl From<Amount> for u64`
+  - `impl TryFrom<sapling::value::NoteValue> for NonNegativeAmount`
+  - `impl From<NonNegativeAmount> for sapling::value::NoteValue`
+  - `impl TryFrom<orchard::ValueSum> for Amount`
+  - `impl From<NonNegativeAmount> for orchard::NoteValue`
+- The `local_consensus` module and feature flag have been removed; use the module
+  from the `zcash_protocol` crate instead.
+- `unstable-nu6` and `zfuture` feature flags (use `--cfg zcash_unstable=\"nu6\"`
+  or `--cfg zcash_unstable=\"zfuture\"` in `RUSTFLAGS` and `RUSTDOCFLAGS`
+  instead).
+
+## [0.14.0] - 2024-03-01
+### Added
+- Dependency on `bellman 0.14`, `sapling-crypto 0.1`.
+- `zcash_primitives::consensus::sapling_zip212_enforcement`
+- `zcash_primitives::legacy::keys`:
+  - `AccountPrivKey::derive_secret_key`
+  - `NonHardenedChildIndex`
+  - `TransparentKeyScope`
+- `zcash_primitives::local_consensus` module, behind the `local-consensus`
+  feature flag.
+  - The `LocalNetwork` struct provides a type for specifying network upgrade
+    activation heights for a local or specific configuration of a full node.
+    Developers can make use of this type when connecting to a Regtest node by
+    replicating the activation heights used on their node configuration.
+  - `impl zcash_primitives::consensus::Parameters for LocalNetwork` uses the
+    provided activation heights, and `zcash_primitives::constants::regtest::`
+    for everything else.
+- `zcash_primitives::transaction`:
+  - `builder::{BuildConfig, FeeError, get_fee, BuildResult}`
+  - `builder::Error::SaplingBuilderNotAvailable`
+  - `components::sapling`:
+    - Sapling bundle component parsers, behind the `temporary-zcashd` feature
+      flag:
+      - `temporary_zcashd_read_spend_v4`
+      - `temporary_zcashd_read_output_v4`
+      - `temporary_zcashd_write_output_v4`
+      - `temporary_zcashd_read_v4_components`
+      - `temporary_zcashd_write_v4_components`
+  - `components::transparent`:
+    - `builder::TransparentInputInfo`
+  - `fees::StandardFeeRule`
+  - Constants in `fees::zip317`:
+    - `MARGINAL_FEE`
+    - `GRACE_ACTIONS`
+    - `P2PKH_STANDARD_INPUT_SIZE`
+    - `P2PKH_STANDARD_OUTPUT_SIZE`
+  - `impl From<TxId> for [u8; 32]`
+- `zcash_primitives::zip32`:
+  - `ChildIndex::hardened`
+  - `ChildIndex::index`
+  - `ChainCode::new`
+  - `ChainCode::as_bytes`
+  - `impl From<AccountId> for ChildIndex`
+- Additions related to `zcash_primitive::components::amount::Amount`
+  and `zcash_primitive::components::amount::NonNegativeAmount`:
+  - `impl TryFrom<Amount> for u64`
+  - `Amount::const_from_u64`
+  - `NonNegativeAmount::const_from_u64`
+  - `NonNegativeAmount::from_nonnegative_i64_le_bytes`
+  - `NonNegativeAmount::to_i64_le_bytes`
+  - `NonNegativeAmount::is_zero`
+  - `NonNegativeAmount::is_positive`
+  - `impl From<&NonNegativeAmount> for Amount`
+  - `impl From<NonNegativeAmount> for u64`
+  - `impl From<NonNegativeAmount> for zcash_primitives::sapling::value::NoteValue`
+  - `impl From<NonNegativeAmount> for orchard::::NoteValue`
+  - `impl Sum<NonNegativeAmount> for Option<NonNegativeAmount>`
+  - `impl<'a> Sum<&'a NonNegativeAmount> for Option<NonNegativeAmount>`
+  - `impl TryFrom<sapling::value::NoteValue> for NonNegativeAmount`
+  - `impl TryFrom<orchard::NoteValue> for NonNegativeAmount`
+- `impl {Clone, PartialEq, Eq} for zcash_primitives::memo::Error`
+
+### Changed
+- Migrated to `orchard 0.7`.
+- `zcash_primitives::legacy`:
+  - `TransparentAddress` variants have changed:
+    - `TransparentAddress::PublicKey` has been renamed to `PublicKeyHash`
+    - `TransparentAddress::Script` has been renamed to `ScriptHash`
+  - `keys::{derive_external_secret_key, derive_internal_secret_key}` arguments
+    changed from `u32` to `NonHardenedChildIndex`.
+- `zcash_primitives::transaction`:
+  - `builder`:
+    - `Builder` now has a generic parameter for the type of progress notifier,
+      which needs to implement `sapling::builder::ProverProgress` in order to
+      build transactions.
+    - `Builder::new` now takes a `BuildConfig` argument instead of an optional
+      Orchard anchor. Anchors for both Sapling and Orchard are now required at
+      the time of builder construction.
+    - `Builder::{build, build_zfuture}` now take
+      `&impl SpendProver, &impl OutputProver` instead of `&impl TxProver`.
+    - `Builder::add_sapling_spend` no longer takes a `diversifier` argument as
+      the diversifier may be obtained from the note.
+    - `Builder::add_sapling_spend` now takes its `ExtendedSpendingKey` argument
+      by reference.
+    - `Builder::{add_sapling_spend, add_sapling_output}` now return `Error`s
+      instead of the underlying `sapling_crypto::builder::Error`s when returning
+      `Err`.
+    - `Builder::add_orchard_spend` now takes its `SpendingKey` argument by
+      reference.
+    - `Builder::with_progress_notifier` now consumes `self` and returns a
+      `Builder` typed on the provided channel.
+    - `Builder::get_fee` now returns a `builder::FeeError` instead of the bare
+      `FeeRule::Error` when returning `Err`.
+    - `Builder::build` now returns a `Result<BuildResult, ...>` instead of
+      using a tuple to return the constructed transaction and build metadata.
+    - `Error::OrchardAnchorNotAvailable` has been renamed to
+      `OrchardBuilderNotAvailable`.
+    - `build` and `build_zfuture` each now take an additional `rng` argument.
+  - `components`:
+    - `transparent::TxOut.value` now has type `NonNegativeAmount` instead of
+      `Amount`.
+    - `sapling::MapAuth` trait methods now take `&mut self` instead of `&self`.
+    - `transparent::fees` has been moved to
+      `zcash_primitives::transaction::fees::transparent`
+    - `transparent::builder::TransparentBuilder::{inputs, outputs}` have changed
+      to return `&[TransparentInputInfo]` and `&[TxOut]` respectively, in order
+      to avoid coupling to the fee traits.
+  - `Unauthorized::SaplingAuth` now has type `InProgress<Proven, Unsigned>`.
+  - `fees::FeeRule::fee_required` now takes an additional `orchard_action_count`
+    argument.
+  - The following methods now take `NonNegativeAmount` instead of `Amount`:
+    - `builder::Builder::{add_sapling_output, add_transparent_output}`
+    - `components::transparent::builder::TransparentBuilder::add_output`
+    - `fees::fixed::FeeRule::non_standard`
+    - `fees::zip317::FeeRule::non_standard`
+  - The following methods now return `NonNegativeAmount` instead of `Amount`:
+    - `components::amount::testing::arb_nonnegative_amount`
+    - `fees::transparent`:
+      - `InputView::value`
+      - `OutputView::value`
+    - `fees::FeeRule::{fee_required, fee_required_zfuture}`
+    - `fees::fixed::FeeRule::fixed_fee`
+    - `fees::zip317::FeeRule::marginal_fee`
+    - `sighash::TransparentAuthorizingContext::input_amounts`
+- `zcash_primitives::zip32`:
+  - `ChildIndex` has been changed from an enum to an opaque struct, and no
+    longer supports non-hardened indices.
+
+### Removed
+- `zcash_primitives::constants`:
+  - All `const` values (moved to `sapling_crypto::constants`).
+- `zcash_primitives::keys` module, as it was empty after the removal of:
+  - `PRF_EXPAND_PERSONALIZATION`
+  - `OutgoingViewingKey` (use `sapling_crypto::keys::OutgoingViewingKey`
+    instead).
+  - `prf_expand, prf_expand_vec` (use `zcash_spec::PrfExpand` instead).
+- `zcash_primitives::sapling` module (use the `sapling-crypto` crate instead).
+- `zcash_primitives::transaction::components::sapling`:
+  - The following types were removed from this module (moved into
+    `sapling_crypto::bundle`):
+    - `Bundle`
+    - `SpendDescription, SpendDescriptionV5`
+    - `OutputDescription, OutputDescriptionV5`
+    - `Authorization, Authorized`
+    - `GrothProofBytes`
+  - `CompactOutputDescription` (moved to `sapling_crypto::note_encryption`).
+  - `Unproven`
+  - `builder` (moved to `sapling_crypto::builder`).
+  - `builder::Unauthorized` (use `builder::InProgress` instead).
+  - `testing::{arb_bundle, arb_output_description}` (moved into
+    `sapling_crypto::bundle::testing`).
+  - `SpendDescription::<Unauthorized>::apply_signature`
+  - `Bundle::<Unauthorized>::apply_signatures` (use
+    `Bundle::<InProgress<Proven, Unsigned>>::apply_signatures` instead).
+  - The `fees` module was removed. Its contents were unused in this crate,
+    are now instead made available by `zcash_client_backend::fees::sapling`.
+- `impl From<zcash_primitive::components::transaction::Amount> for u64`
+- `zcash_primitives::zip32`:
+  - `sapling` module (moved to `sapling_crypto::zip32`).
+  - `ChildIndex::Hardened` (use `ChildIndex::hardened` instead).
+  - `ChildIndex::NonHardened`
+  - `sapling::ExtendedFullViewingKey::derive_child`
+
+### Fixed
+- `zcash_primitives::keys::ExpandedSpendingKey::from_spending_key` now panics if the
+  spending key expands to `ask = 0`. This has a negligible probability of occurring.
+- `zcash_primitives::zip32::ExtendedSpendingKey::derive_child` now panics if the
+  child key has `ask = 0`. This has a negligible probability of occurring.
+
+## [0.13.0] - 2023-09-25
+### Added
+- `zcash_primitives::consensus::BlockHeight::saturating_sub`
+- `zcash_primitives::transaction::builder`:
+  - `Builder::add_orchard_spend`
+  - `Builder::add_orchard_output`
+- `zcash_primitives::transaction::components::orchard::builder` module
+- `impl HashSer for String` is provided under the `test-dependencies` feature
+  flag. This is a test-only impl; the identity leaf value is `_` and the combining
+  operation is concatenation.
+- `zcash_primitives::transaction::components::amount::NonNegativeAmount::ZERO`
+- Additional trait implementations for `NonNegativeAmount`:
+  - `TryFrom<Amount> for NonNegativeAmount`
+  - `Add<NonNegativeAmount> for NonNegativeAmount`
+  - `Add<NonNegativeAmount> for Option<NonNegativeAmount>`
+  - `Sub<NonNegativeAmount> for NonNegativeAmount`
+  - `Sub<NonNegativeAmount> for Option<NonNegativeAmount>`
+  - `Mul<usize> for NonNegativeAmount`
+- `zcash_primitives::block::BlockHash::try_from_slice`
+
+### Changed
+- Migrated to `incrementalmerkletree 0.5`, `orchard 0.6`.
+- `zcash_primitives::transaction`:
+  - `builder::Builder::{new, new_with_rng}` now take an optional `orchard_anchor`
+    argument which must be provided in order to enable Orchard spends and recipients.
+  - All `builder::Builder` methods now require the bound `R: CryptoRng` on
+    `Builder<'a, P, R>`. A non-`CryptoRng` randomness source is still accepted
+    by `builder::Builder::test_only_new_with_rng`, which **MUST NOT** be used in
+    production.
+  - `builder::Error` has several additional variants for Orchard-related errors.
+  - `fees::FeeRule::fee_required` now takes an additional argument,
+    `orchard_action_count`
+  - `Unauthorized`'s associated type `OrchardAuth` is now
+    `orchard::builder::InProgress<orchard::builder::Unproven, orchard::builder::Unauthorized>`
+    instead of `zcash_primitives::transaction::components::orchard::Unauthorized`
+- `zcash_primitives::consensus::NetworkUpgrade` now implements `PartialEq`, `Eq`
+- `zcash_primitives::legacy::Script` now has a custom `Debug` implementation that
+  renders script details in a much more legible fashion.
+- `zcash_primitives::sapling::redjubjub::Signature` now has a custom `Debug`
+  implementation that renders details in a much more legible fashion.
+- `zcash_primitives::sapling::tree::Node` now has a custom `Debug`
+  implementation that renders details in a much more legible fashion.
+
+### Removed
+- `impl {PartialEq, Eq} for transaction::builder::Error`
+  (use `assert_matches!` where error comparisons are required)
+- `zcash_primitives::transaction::components::orchard::Unauthorized`
+- `zcash_primitives::transaction::components::amount::DEFAULT_FEE` was
+  deprecated in 0.12.0 and has now been removed.
+
 ## [0.12.0] - 2023-06-06
 ### Added
 - `zcash_primitives::transaction`:
@@ -27,7 +401,7 @@ and this library adheres to Rust's notion of
   `incrementalmerkletree::Hashable` and `merkle_tree::HashSer`.
 - The `Hashable` bound on the `Node` parameter to the `IncrementalWitness`
   type has been removed.
-- `sapling::SAPLING_COMMITMENT_TREE_DEPTH_U8` and `sapling::SAPLING_COMMITMENT_TREE_DEPTH` 
+- `sapling::SAPLING_COMMITMENT_TREE_DEPTH_U8` and `sapling::SAPLING_COMMITMENT_TREE_DEPTH`
   have been removed; use `sapling::NOTE_COMMITMENT_TREE_DEPTH` instead.
 - `merkle_tree::{CommitmentTree, IncrementalWitness, MerklePath}` have been removed in
   favor of versions of these types that are now provided by the
@@ -89,7 +463,7 @@ and this library adheres to Rust's notion of
 - The bounds on the `H` parameter to the following methods have changed:
   - `merkle_tree::incremental::read_frontier_v0`
   - `merkle_tree::incremental::read_auth_fragment_v1`
-- The depth of the `merkle_tree::{CommitmentTree, IncrementalWitness, and MerklePath}` 
+- The depth of the `merkle_tree::{CommitmentTree, IncrementalWitness, and MerklePath}`
   data types are now statically constrained using const generic type parameters.
 - `transaction::fees::fixed::FeeRule::standard()` now uses the ZIP 317 minimum fee
   (10000 zatoshis rather than 1000 zatoshis) as the fixed fee. To be compliant with
@@ -539,6 +913,9 @@ and `zcash_encoding`.
   now takes its `MemoBytes` argument as a required field rather than an
   optional one. If the empty memo is desired, use
   `MemoBytes::from(Memo::Empty)` explicitly.
+- `zcash_primitives::zip32`:
+  - `ExtendedSpendingKey::default_address` no longer returns `Option<_>`.
+  - `ExtendedFullViewingKey::default_address` no longer returns `Option<_>`.
 
 ## [0.5.0] - 2021-03-26
 ### Added
diff --git a/zcash_primitives/Cargo.toml b/zcash_primitives/Cargo.toml
index cec7ecc2c8..d6ffd1cbaa 100644
--- a/zcash_primitives/Cargo.toml
+++ b/zcash_primitives/Cargo.toml
@@ -1,109 +1,133 @@
 [package]
 name = "zcash_primitives"
 description = "Rust implementations of the Zcash primitives"
-version = "0.12.0"
+version = "0.20.0"
 authors = [
     "Jack Grigg <jack@z.cash>",
     "Kris Nuttycombe <kris@electriccoin.co>"
 ]
 homepage = "https://github.com/zcash/librustzcash"
-repository = "https://github.com/zcash/librustzcash"
+repository.workspace = true
 readme = "README.md"
-license = "MIT OR Apache-2.0"
-edition = "2021"
-rust-version = "1.65"
-categories = ["cryptography::cryptocurrencies"]
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
 
 [package.metadata.docs.rs]
 all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
 
 [dependencies]
-equihash = { version = "0.2", path = "../components/equihash" }
-zcash_address = { version = "0.3", path = "../components/zcash_address" }
-zcash_encoding = { version = "0.2", path = "../components/zcash_encoding" }
+equihash.workspace = true
+zcash_address.workspace = true
+zcash_encoding.workspace = true
+zcash_protocol.workspace = true
+zip32.workspace = true
 
 # Dependencies exposed in a public API:
 # (Breaking upgrades to these require a breaking upgrade to this crate.)
 # - CSPRNG
-rand = "0.8"
-rand_core = "0.6"
+rand.workspace = true
+rand_core.workspace = true
 
 # - Digests (output types exposed)
-blake2b_simd = "1"
-sha2 = "0.10"
+blake2b_simd.workspace = true
+sha2.workspace = true
 
-# - Metrics
-memuse = "0.2.1"
+# - Logging and metrics
+memuse.workspace = true
+tracing.workspace = true
 
 # - Secret management
-subtle = "2.2.3"
+subtle.workspace = true
 
 # - Shielded protocols
-bls12_381 = "0.8"
-ff = "0.13"
-group = { version = "0.13", features = ["wnaf-memuse"] }
-jubjub = "0.10"
-nonempty = "0.7"
-orchard = { version = "0.5", default-features = false }
+ff.workspace = true
+group = { workspace = true, features = ["wnaf-memuse"] }
+jubjub.workspace = true
+nonempty.workspace = true
+orchard.workspace = true
+sapling.workspace = true
+zcash_spec.workspace = true
 
 # - Note Commitment Trees
-incrementalmerkletree = { version = "0.4", features = ["legacy-api"] }
-
-# - Static constants
-lazy_static = "1"
+incrementalmerkletree = { workspace = true, features = ["legacy-api"] }
 
 # - Test dependencies
-proptest = { version = "1.0.0", optional = true }
+proptest = { workspace = true, optional = true }
 
 # - Transparent inputs
 #   - `Error` type exposed
-hdwallet = { version = "0.4", optional = true }
+bip32 = { workspace = true, optional = true }
 #   - `SecretKey` and `PublicKey` types exposed
-secp256k1 = { version = "0.26", optional = true }
-
-# - ZIP 339
-bip0039 = { version = "0.10", features = ["std", "all-languages"] }
+secp256k1 = { workspace = true, optional = true }
 
 # Dependencies used internally:
 # (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
+# - Documentation
+document-features.workspace = true
+
 # - Encodings
-byteorder = "1"
-hex = "0.4"
+bs58.workspace = true
+byteorder.workspace = true
+hex.workspace = true
 
 # - Shielded protocols
-bitvec = "1"
-blake2s_simd = "1"
+redjubjub = "0.7"
 
 # - Transparent inputs
-ripemd = { version = "0.1", optional = true }
+ripemd = { workspace = true, optional = true }
 
 # - ZIP 32
-aes = "0.8"
-fpe = "0.6"
+aes.workspace = true
+fpe.workspace = true
 
 [dependencies.zcash_note_encryption]
-version = "0.4"
+workspace = true
 features = ["pre-zip-212"]
 
 [dev-dependencies]
 chacha20poly1305 = "0.10"
-criterion = "0.4"
-incrementalmerkletree = { version = "0.4", features = ["legacy-api", "test-dependencies"] }
-proptest = "1.0.0"
-assert_matches = "1.3.0"
-rand_xorshift = "0.3"
-orchard = { version = "0.5", default-features = false, features = ["test-dependencies"] }
+criterion.workspace = true
+incrementalmerkletree = { workspace = true, features = ["legacy-api", "test-dependencies"] }
+proptest.workspace = true
+assert_matches.workspace = true
+rand_xorshift.workspace = true
+sapling = { workspace = true, features = ["test-dependencies"] }
+orchard = { workspace = true, features = ["test-dependencies"] }
+zcash_protocol = { workspace = true, features = ["test-dependencies"] }
 
 [target.'cfg(unix)'.dev-dependencies]
-pprof = { version = "0.11", features = ["criterion", "flamegraph"] } # MSRV 1.56
+pprof = { version = "0.13", features = ["criterion", "flamegraph"] }
 
 [features]
 default = ["multicore"]
-multicore = ["orchard/multicore"]
-transparent-inputs = ["hdwallet", "ripemd", "secp256k1"]
+
+## Enables multithreading support for creating proofs.
+multicore = ["orchard/multicore", "sapling/multicore"]
+
+## Enables spending transparent notes with the transaction builder.
+transparent-inputs = ["dep:bip32", "dep:ripemd", "dep:secp256k1"]
+
+### A temporary feature flag that exposes granular APIs needed by `zcashd`. These APIs
+### should not be relied upon and will be removed in a future release.
 temporary-zcashd = []
-test-dependencies = ["proptest", "orchard/test-dependencies"]
-zfuture = []
+
+## Exposes APIs that are useful for testing, such as `proptest` strategies.
+test-dependencies = [
+    "dep:proptest",
+    "orchard/test-dependencies",
+    "sapling/test-dependencies",
+    "zcash_protocol/test-dependencies",
+]
+
+## A feature used to isolate tests that are expensive to run. Test-only.
+expensive-tests = []
+
+## A feature that provides `FeeRule` implementations and constructors for
+## non-standard fees.
+non-standard-fees = []
 
 [lib]
 bench = false
@@ -112,9 +136,8 @@ bench = false
 name = "note_decryption"
 harness = false
 
-[[bench]]
-name = "pedersen_hash"
-harness = false
-
 [badges]
 maintenance = { status = "actively-developed" }
+
+[lints]
+workspace = true
diff --git a/zcash_primitives/README.md b/zcash_primitives/README.md
index efa356ba3e..02a0c33a10 100644
--- a/zcash_primitives/README.md
+++ b/zcash_primitives/README.md
@@ -12,16 +12,6 @@ Licensed under either of
 
 at your option.
 
-Downstream code forks should note that 'zcash_primitives' depends on the
-'orchard' crate, which is licensed under the
-[Bootstrap Open Source License](https://github.com/zcash/orchard/blob/main/LICENSE-BOSL).
-A license exception is provided allowing some derived works that are linked or
-combined with the 'orchard' crate to be copied or distributed under the original
-licenses (in this case MIT / Apache 2.0), provided that the included portions of
-the 'orchard' code remain subject to BOSL.
-See https://github.com/zcash/orchard/blob/main/COPYING for details of which
-derived works can make use of this exception.
-
 ### Contribution
 
 Unless you explicitly state otherwise, any contribution intentionally
diff --git a/zcash_primitives/benches/note_decryption.rs b/zcash_primitives/benches/note_decryption.rs
index 4827badce7..99048cb843 100644
--- a/zcash_primitives/benches/note_decryption.rs
+++ b/zcash_primitives/benches/note_decryption.rs
@@ -3,22 +3,20 @@ use std::iter;
 use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
 use ff::Field;
 use rand_core::OsRng;
+use sapling::{
+    self,
+    note_encryption::{
+        try_sapling_compact_note_decryption, try_sapling_note_decryption, CompactOutputDescription,
+        PreparedIncomingViewingKey, SaplingDomain,
+    },
+    prover::mock::{MockOutputProver, MockSpendProver},
+    value::NoteValue,
+    Diversifier, SaplingIvk,
+};
 use zcash_note_encryption::batch;
 use zcash_primitives::{
     consensus::{NetworkUpgrade::Canopy, Parameters, TEST_NETWORK},
-    memo::MemoBytes,
-    sapling::{
-        note_encryption::{
-            try_sapling_compact_note_decryption, try_sapling_note_decryption,
-            PreparedIncomingViewingKey, SaplingDomain,
-        },
-        prover::mock::MockTxProver,
-        value::NoteValue,
-        Diversifier, SaplingIvk,
-    },
-    transaction::components::sapling::{
-        builder::SaplingBuilder, CompactOutputDescription, GrothProofBytes, OutputDescription,
-    },
+    transaction::components::{sapling::zip212_enforcement, Amount},
 };
 
 #[cfg(unix)]
@@ -27,27 +25,28 @@ use pprof::criterion::{Output, PProfProfiler};
 fn bench_note_decryption(c: &mut Criterion) {
     let mut rng = OsRng;
     let height = TEST_NETWORK.activation_height(Canopy).unwrap();
+    let zip212_enforcement = zip212_enforcement(&TEST_NETWORK, height);
 
     let valid_ivk = SaplingIvk(jubjub::Fr::random(&mut rng));
     let invalid_ivk = SaplingIvk(jubjub::Fr::random(&mut rng));
 
     // Construct a Sapling output.
-    let output: OutputDescription<GrothProofBytes> = {
+    let output = {
         let diversifier = Diversifier([0; 11]);
         let pa = valid_ivk.to_payment_address(diversifier).unwrap();
 
-        let mut builder = SaplingBuilder::new(TEST_NETWORK, height);
+        let mut builder = sapling::builder::Builder::new(
+            zip212_enforcement,
+            // We use the Coinbase bundle type because we don't need to use
+            // any inputs for this benchmark.
+            sapling::builder::BundleType::Coinbase,
+            sapling::Anchor::empty_tree(),
+        );
         builder
-            .add_output(
-                &mut rng,
-                None,
-                pa,
-                NoteValue::from_raw(100),
-                MemoBytes::empty(),
-            )
+            .add_output(None, pa, NoteValue::from_raw(100), None)
             .unwrap();
-        let bundle = builder
-            .build(&MockTxProver, &mut (), &mut rng, height, None)
+        let (bundle, _) = builder
+            .build::<MockSpendProver, MockOutputProver, _, Amount>(&mut rng)
             .unwrap()
             .unwrap();
         bundle.shielded_outputs()[0].clone()
@@ -61,27 +60,25 @@ fn bench_note_decryption(c: &mut Criterion) {
         group.throughput(Throughput::Elements(1));
 
         group.bench_function("valid", |b| {
-            b.iter(|| {
-                try_sapling_note_decryption(&TEST_NETWORK, height, &valid_ivk, &output).unwrap()
-            })
+            b.iter(|| try_sapling_note_decryption(&valid_ivk, &output, zip212_enforcement).unwrap())
         });
 
         group.bench_function("invalid", |b| {
-            b.iter(|| try_sapling_note_decryption(&TEST_NETWORK, height, &invalid_ivk, &output))
+            b.iter(|| try_sapling_note_decryption(&invalid_ivk, &output, zip212_enforcement))
         });
 
         let compact = CompactOutputDescription::from(output.clone());
 
         group.bench_function("compact-valid", |b| {
             b.iter(|| {
-                try_sapling_compact_note_decryption(&TEST_NETWORK, height, &valid_ivk, &compact)
+                try_sapling_compact_note_decryption(&valid_ivk, &compact, zip212_enforcement)
                     .unwrap()
             })
         });
 
         group.bench_function("compact-invalid", |b| {
             b.iter(|| {
-                try_sapling_compact_note_decryption(&TEST_NETWORK, height, &invalid_ivk, &compact)
+                try_sapling_compact_note_decryption(&invalid_ivk, &compact, zip212_enforcement)
             })
         });
     }
@@ -95,7 +92,7 @@ fn bench_note_decryption(c: &mut Criterion) {
 
             let outputs: Vec<_> = iter::repeat(output.clone())
                 .take(noutputs)
-                .map(|output| (SaplingDomain::for_height(TEST_NETWORK, height), output))
+                .map(|output| (SaplingDomain::new(zip212_enforcement), output))
                 .collect();
 
             group.bench_function(
diff --git a/zcash_primitives/benches/pedersen_hash.rs b/zcash_primitives/benches/pedersen_hash.rs
deleted file mode 100644
index 847e68b751..0000000000
--- a/zcash_primitives/benches/pedersen_hash.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-use criterion::{criterion_group, criterion_main, Criterion};
-use rand_core::{OsRng, RngCore};
-use zcash_primitives::sapling::pedersen_hash::{pedersen_hash, Personalization};
-
-#[cfg(unix)]
-use pprof::criterion::{Output, PProfProfiler};
-
-fn bench_pedersen_hash(c: &mut Criterion) {
-    let rng = &mut OsRng;
-    let bits = (0..510)
-        .map(|_| (rng.next_u32() % 2) != 0)
-        .collect::<Vec<_>>();
-    let personalization = Personalization::MerkleTree(31);
-
-    c.bench_function("pedersen-hash", |b| {
-        b.iter(|| pedersen_hash(personalization, bits.clone()))
-    });
-}
-
-#[cfg(unix)]
-criterion_group! {
-    name = benches;
-    config = Criterion::default().with_profiler(PProfProfiler::new(100, Output::Flamegraph(None)));
-    targets = bench_pedersen_hash
-}
-#[cfg(not(unix))]
-criterion_group!(benches, bench_pedersen_hash);
-criterion_main!(benches);
diff --git a/zcash_primitives/proptest-regressions/transaction/tests.txt b/zcash_primitives/proptest-regressions/transaction/tests.txt
index 341ba3ff3d..dabdfa7a38 100644
--- a/zcash_primitives/proptest-regressions/transaction/tests.txt
+++ b/zcash_primitives/proptest-regressions/transaction/tests.txt
@@ -4,3 +4,4 @@
 #
 # It is recommended to check this file in to source control so that
 # everyone who runs the test benefits from these saved cases.
+cc ef22a227ba4fd42e9006359f9beba93ac97694bcaa6d7b164e1da7408b362b2a # shrinks to tx = Transaction { txid: TxId("8ce37a485f5f1534f1ce037dfe877124a9acc3d7aa8509f5bf4a2b9d40631dd2"), data: TransactionData { version: Zip225, consensus_branch_id: Nu5, lock_time: 0, expiry_height: BlockHeight(11684921), transparent_bundle: Some(Bundle { vin: [TxIn { prevout: OutPoint { hash: TxId("9b9550eda1e95f3ce7e5faa5622a112c7924945f39053a8474dae218d9364c79"), n: 12 }, script_sig: Script("006365ac00ac006a53ac51006363536a5163516a6551525100525352ac656500006a6551635265516a53006aac6a526563ac00525351ac5300636aac52ac636a6a6aacac00536a535300ac6363635165005352ac526a6a51650000636a51ac0065ac656a51530063ac6a65536a6363655365525365ac655253acac51656a516a52515365655352006a6a51510052ac51515200655163525265ac6a0063ac655151655153525265515100ac6a0065535151655300656a63530053ac52535100acac515153ac6a6aac65ac636a536a6aac636a636aac6a0063ac"), sequence: 145371301 }, TxIn { prevout: OutPoint { hash: TxId("4a84935f0d000e3061bca1d2a9bfb9b75ccdce2408410a92c7831ba15b0f8de2"), n: 55 }, script_sig: Script("52006a516a"), sequence: 1240183846 }, TxIn { prevout: OutPoint { hash: TxId("2fc8c09a2baaa35876f20a7d98f98fa7e465e0b02f6045741a4367d7c79ba788"), n: 40 }, script_sig: Script("536363ac536553636a65ac65526551acac52635265ac51525300635200ac53516a006a636500635253acac63536a63ac636500ac53655263636351516353ac006a5263515153ac0052006a6a00516a65636a655351ac005163536aac6a52ac00525352526a53535163510063526552526553ac51ac526565ac5353536a6a526363535252510065ac51635253636353536a6552525263ac00636a51535251ac5251ac00515353536a00656a52ac6a52530063656352656aac6553ac5163006365656300536552ac52535152516a656a6a655300ac65ac52520065006500ac6363525151516365ac005200515152516a52656a5300"), sequence: 629674215 }, TxIn { prevout: OutPoint { hash: TxId("de7f18205ea995195e6b9fda84d1497f2dc980e36c689337025c0c9d42969444"), n: 2 }, script_sig: Script("655253ac53516a5251630065636a6552ac6363655300656aacac655253006a006a6353515152ac65530052635265006a52005253536a65526a526300ac5352535153acac52ac530052ac6351516aac63006a00ac6a"), sequence: 1653740502 }, TxIn { prevout: OutPoint { hash: TxId("6eaddeb1a19ac24efbf619da0734ce179a840a780b740fb05c0d3dfd969278d0"), n: 46 }, script_sig: Script("ac53526a65516a6365ac5152006a535263635151005251656565516351516a63510052ac526a6363520065656500656a535265525153005153656a655153ac656300006365ac530052ac636553006565656a6500516353515152636a63acac51ac63656a6a515263006a65656a635165acac6565525252655253515200536565526500530063ac53630063650053ac526553ac5200ac63006551ac6551006365006a520063ac65525252655353006a51516a"), sequence: 1010999298 }, TxIn { prevout: OutPoint { hash: TxId("9b84cd63dd1abd9ae09a81d158f46bf3d83ca696aead5ed0fc8ce0cfd9505c66"), n: 34 }, script_sig: Script("ac5165656a5365ac6300ac6a6553ac6a6553ac5300ac536a63525252535253635252ac00520051006a6a52510063630053516a53acac6a5300516353650063516a536aac6a526a636a6351655351656351ac510000516a00516a0000516552635300525351006aac63ac515265ac52510053630053ac535165000052515153ac636363ac000053525151ac526500536a6a00635351ac65635100636353656a006352525100acac516a516a515200516365ac516553636a5300"), sequence: 3807958519 }], vout: [TxOut { value: Zatoshis(1660357088736517), script_pubkey: Script("52536a53526a0000655165636365ac65536a0065655265") }, TxOut { value: Zatoshis(1562132766465776), script_pubkey: Script("00acacacac516a63536500635165ac53516351515153656a00") }, TxOut { value: Zatoshis(283749562968041), script_pubkey: Script("6351ac5300006351ac6a00006a5251536363ac6a65635152535153526aac656a635300536a0053636552525263636565516a53006a51516a65acac5365635200acac006aac656a636552acacac516353006365656a656aac515165636a5353656300006351ac526353ac6a6353535351535300ac536a52536a65ac636552") }, TxOut { value: Zatoshis(862453730210246), script_pubkey: Script("63635351ac53536a516a6a526aac6aacac536352ac516553635163ac6a655352525263525252656a53ac53525300516a5263ac516a535365ac516a53ac636a00530052006363ac00ac6a6a6a00536a63ac5200acac0000ac00656351acacac65ac656565650053ac6a51acac53006aac5163acacac53005153535352516aacac630051526552535153516a65535100526a5151005265516a6a526363ac52516a5151") }, TxOut { value: Zatoshis(1371726038473473), script_pubkey: Script("63635163635253636a6551526a536552ac53635353526565ac52656300516aac526a6563ac6553005200515253ac51ac00655165acac5265636553635351ac0053ac51636a65516a00005200515152ac5300535353655200656a6351516a65526552ac536a6352515153535300526a6a6a52ac515363655365656a5253655351ac5300ac006a650051536a536a0053ac65005251ac52536563006a520063ac52536553636a526a6a65526a6552526365535363515300ac535352656a00636563ac515165655265636352656a63636563516363ac63ac536a6a000063525253656a6553526a5363656a536a526a516a0065ac6a52636a0051") }, TxOut { value: Zatoshis(1482870972644116), script_pubkey: Script("6a65ac006a00656500536aac52515265000065515200ac536a005363636553005263525100ac63630052ac52635265ac515265ac535363ac51516aac00ac636565515353ac0065525300ac6365636a6553636a6a53655253636a5100655353515353536365510000630052ac635163ac00") }, TxOut { value: Zatoshis(429998546955287), script_pubkey: Script("65515363ac5152ac00ac00526a63006365ac6a6a525100acac656a530051ac6a51006a636553536363525263656a6a5165536a65536552ac636a5151655363515153ac000053650063656a650052656a51000051ac65526553acac006300ac516a00ac006aac5153ac516563ac5151acac530063536300ac655352ac53655165ac636a516a516aac5353630063516a00516a53635100520053ac51") }, TxOut { value: Zatoshis(428798607533163), script_pubkey: Script("5152536a5352ac63ac526a6a536352525153006a526563656552636a6a6365ac5100ac656300636352ac5365ac6353525353ac536a6a636a53ac520051636552ac526353515253655351acac0063536351ac65") }], authorization: Authorized }), sprout_bundle: None, sapling_bundle: Some(Bundle { shielded_spends: [], shielded_outputs: [OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x2da5f1515ea6c7c51a92056ebc5ac119344bc332b1dbc7b3bffd3eded203f72c, v: 0x706c28c122e4ff41675097e7d9c54a636fdf978434c6a55961746aa7c49874fc, z: 0x1ee71f06e806350742fa3ab264f29ddbc8bbef173182cb00a9a06b88e6c864ab, t1: 0x05ed0d51b26731d0a1111cd51fe4881dd8b274f9bb9e9a00883f6ceac0f69c3f, t2: 0x59c8b87d7e5cf012ba5f3209b71a3e69b0a48ef1d51716e9d1134626760c8343 }), cmu = ExtractedNoteCommitment(0x61c7f66f315686c341a1695fe1e304a3634adcaee66fcff5368be12e060b2abe), ephemeral_key = EphemeralKeyBytes([229, 34, 250, 204, 113, 140, 4, 235, 23, 206, 67, 16, 161, 82, 69, 45, 177, 83, 16, 90, 113, 116, 219, 155, 153, 228, 137, 139, 56, 0, 78, 152])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x6d5380a8ca4150ace8aed38f3b8e3b7b67d9b51ca972de44196afd2b379cbd9e, v: 0x6d7fecef2b7509409fb5de621a3f640b74e8caab0a5a05f34d8b8601d536c3b1, z: 0x559f2328d6c29bd2b294fe17f0c609ffbd26a97de90755787008fe449b8ad29f, t1: 0x161d06e2d1f10fec8b7f7689e95d6b211b4362665316e33439c85629dd22e416, t2: 0x093fa652804c85a69040c6f08659b9b55478765cdca16a170b7daa464ddeecc0 }), cmu = ExtractedNoteCommitment(0x552b46e6bdb521740cf22639d7d88c71eedd3c85d56a2cfbb8ea3ba4fc641469), ephemeral_key = EphemeralKeyBytes([59, 202, 142, 163, 235, 118, 247, 218, 13, 227, 18, 100, 143, 169, 88, 225, 189, 82, 143, 141, 168, 145, 96, 57, 20, 156, 42, 241, 9, 110, 149, 167])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x3eef7be40ddb4f0e3f394f76ae6a13bd1c43481803575ba275570f866c3b4fb1, v: 0x6d846983fd602acd95f739c5d3c7d860ddff7a5c1a59588e15eba399359a020d, z: 0x54b9119bba6ae7526c5e7be13f30f98b0ca503aec038e218836b63ceacc79c3f, t1: 0x1f1f275e047cee7b61b8e3bd230d935212850ec4f8a06d74ea26a7d07367718f, t2: 0x38b1b5e17b4ff97de5f86a1a4340003879b2b1a0156c080b622490620f3e97bf }), cmu = ExtractedNoteCommitment(0x23f950c2f07e8cd8336dc669a9ccfb544a3c818d6a8543e9aa366dfbfb0717ae), ephemeral_key = EphemeralKeyBytes([195, 93, 90, 136, 83, 251, 154, 150, 155, 101, 251, 247, 255, 161, 232, 170, 179, 85, 17, 9, 1, 117, 228, 22, 192, 245, 87, 213, 8, 126, 104, 175])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x6409b1629a3525602106ea6868dfc9975e9c3509471a8314f3854ae4335a9b8e, v: 0x7199e69203a87c5ee9e6cd08879c663f1d41fd05df1613db27a82bf40dbea600, z: 0x11fe924e5e5313d2e340b5a46ad31aef713aefe90b2b84cd4b40847183acc5b5, t1: 0x0198af4c9f4c00d9ed7779f43f8c72e0fb6dba6a4951b361452dc4467bc1546a, t2: 0x62c898c9bac1d8fdd7a81c5227c1cbf6bfa7c17dfb2356d7510b2b8b66d90915 }), cmu = ExtractedNoteCommitment(0x0aa60af7f605fc2a488e13be8972939bf34f03d478398d847c8d233f5c16c118), ephemeral_key = EphemeralKeyBytes([186, 240, 127, 223, 116, 2, 9, 202, 39, 164, 31, 156, 37, 255, 53, 144, 210, 193, 13, 208, 129, 139, 199, 231, 56, 148, 39, 66, 182, 63, 126, 235])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x4799f6683b7278d5434d35484d91efd62d5522a341d3f0e62d404b7f11e043be, v: 0x3fb2af69e58daccc0f8d42a14e30f321fa99fcf232b04aeb760d0104cc356ddf, z: 0x1b4deacdc618220fd71c6159c553922e2f29ed525fa1ceeaa9746163eb9f30af, t1: 0x70559f9a6a4e523c54441e83934a146251b26d7fd33259fa38ea6f1081fa8b39, t2: 0x559a93571fce6462b8e251fe876838b25252180b85a1c6b84c8e2306198468b6 }), cmu = ExtractedNoteCommitment(0x714c9013caaed4ff0f610f616e9d626708b098d1cf351f49781f4a03c6f87dc9), ephemeral_key = EphemeralKeyBytes([72, 78, 245, 247, 130, 189, 58, 209, 5, 85, 33, 199, 56, 153, 136, 117, 7, 152, 195, 130, 234, 202, 253, 229, 184, 208, 158, 194, 237, 63, 241, 184])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x1639ffa06d2bf748cebc4d0709844b72008dfcab4df730856abecd8db7935022, v: 0x4813798bfd3016351a84f7e3bafb12ac31a1a0416b01e809d00e24d0987df5b1, z: 0x4e83e61a8b32f09e4ff0a5f43b72ff6b559f3ab2ba830359bd5846e50cc1745c, t1: 0x62bbd84ae274a5a9afc37f52c7dd3fb3b00d7e958bdad53611ce8e33d734416c, t2: 0x0809f8955dc3c23f935dcc516bd6b0efde0c8082b7efa6fb21f48edd72f93dfb }), cmu = ExtractedNoteCommitment(0x488e912c1a2b61f2d2e68f973ac3347ecd7a9e76a9efeb7a043544c025624214), ephemeral_key = EphemeralKeyBytes([214, 97, 107, 188, 177, 8, 56, 61, 0, 201, 217, 156, 102, 74, 147, 12, 68, 126, 254, 55, 220, 112, 115, 102, 231, 152, 178, 126, 144, 42, 42, 199])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x2ccd9cad74c7aefa4379d86151b26f4a2e76b3eca6a5bfcbcecddd4687ffc658, v: 0x5b519c3acea070cb1e7aa212b0f4e00c2ad0114c6ab0c19f54cc8b274a32d233, z: 0x11b6450485e443d6d1387eab6185a956c56f076eb72c5d174ed3fcc33fb8f6e2, t1: 0x252b2bb3d22c33407c7a7b01ade614d7dbb4a02538e8563bb8221ca171e63c50, t2: 0x20ad8a400621fa31e9fae77c5127687622fd986e5c9f535d6e7cf5137e500435 }), cmu = ExtractedNoteCommitment(0x3c8b50422a52840fdf010a15b699457161ce051fca37d4ee5ad033ef7eee522b), ephemeral_key = EphemeralKeyBytes([66, 86, 13, 3, 221, 51, 162, 68, 73, 62, 135, 247, 249, 180, 160, 38, 81, 60, 138, 213, 80, 127, 66, 143, 45, 168, 240, 107, 0, 54, 150, 17])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x6cb7873fde5e525a0c269235b0b81ce084fb37ee45aa7dcb85872a5d7c35f9d4, v: 0x29ceded03d013f1a9f7659f63f8717dc5b0dbe45211c455bc00ef8bf1760aa71, z: 0x43b612443f8d31139301ba786e839f73af96d5a42528a95261f17ded5af1800f, t1: 0x23bc0b55bec5b80e10dc104cea4b6064d7b981edf009f7b941ddbc53167de41f, t2: 0x284a1f3eb4ad18e92ea84d19ee23f3dff7c556e7f120b071418b6e78be95e290 }), cmu = ExtractedNoteCommitment(0x0cccf7c6cf230e3104c3c9d6a1532debd910452a998b93ec9efff24643b77192), ephemeral_key = EphemeralKeyBytes([200, 19, 38, 244, 253, 161, 33, 66, 46, 31, 17, 45, 25, 73, 194, 107, 38, 252, 86, 235, 54, 172, 101, 139, 58, 184, 184, 128, 121, 54, 137, 5])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x62693c3654b7b58aa386c50d5301c150c511c350ee17acbd6d94b00d77948aa6, v: 0x489778314b9257c7dbcaa63b8b3a8b6916126886940491badff93e167107cfc4, z: 0x2bec220817442fc15ae2db640a59a8f1a21ce3178eda16b434ad586df37241d9, t1: 0x72e3c8a5a05c16b46952eb0143a630c0cb8ab956a0c8b62355a34e133dda5fa6, t2: 0x3c186efacaf7867493f75f11f9cc44125c9414486cc3fc68a34fad8d55c951bc }), cmu = ExtractedNoteCommitment(0x565df925e20f899425c8cb61c3d41a2ca43dd3fd95cc95991e02d9250c9ae28b), ephemeral_key = EphemeralKeyBytes([138, 191, 12, 255, 13, 174, 171, 110, 159, 140, 205, 61, 9, 147, 245, 47, 87, 159, 17, 210, 104, 118, 218, 242, 156, 73, 84, 211, 196, 24, 211, 157])), OutputDescription(cv = ValueCommitment(ExtendedPoint { u: 0x34efb8d62ba8c8529e113f51df5c4be9c75222b4dd59fca7fb63e0353ae4a1eb, v: 0x065895095eea577c308992a79ab5c8b53d6013bc0f0f1b4c9e8af4c20d47c74b, z: 0x2ac95436024a36e2f8e0e33ef3863fdac46975178df7734cc17b24a16c06dcd2, t1: 0x29faea3a84fd8e4ccc8cbba04ce59fc6b2679f3c5b6769c42878687066adaaac, t2: 0x47664ea8fa2e7a457609ba3975ddaff2b9145f6edd6da9bede7cb7af07598831 }), cmu = ExtractedNoteCommitment(0x0508761f1bf175ec281231adfc39daf2a50a451ca931663858a807749f85d595), ephemeral_key = EphemeralKeyBytes([35, 96, 98, 191, 186, 134, 111, 44, 80, 244, 220, 161, 130, 147, 150, 246, 56, 212, 40, 247, 172, 248, 20, 205, 191, 158, 19, 136, 53, 141, 136, 26]))], value_balance: ZatBalance(-1433796326827925), authorization: Authorized { binding_sig: Signature(Signature { r_bytes: "f7f92b662f9a395ea9b2cc7ea416ac6b518f66ac91f808a78a5af9622043b917", s_bytes: "fbfc7d79140c0d91b4b54263fd93dcb2df1ca7412ea270e4c6023d5ca2184e04" }) } }), orchard_bundle: Some(Bundle { actions: [Action { nf: Nullifier(0x3fab4b74ade6d6f1c806bd5f00393e487e8c965ba35b459679cc949dc77b30c2), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2e40a384863628df6c2640e0f6abec16e5a7725e4081a4aa4a71477661bba567, y: 0x0aa3bb2b6079362a33d923b72d2c3acfcc8a41fbafc39b3d71ed738286d6bf0b, z: 0x2ff2729ed9e951204e8095e136e50088c675adde3f4e9c1d887671e5fc06b580 }, bytes: VerificationKeyBytes { bytes: "9d4ce9fea1edb94cf39f9561cb16107fb714c9e9d84f27a75dffd5474ee7b522" } }), cmx: ExtractedNoteCommitment(0x2dbac4a26d619adbed3e3639bbbaf9ee9f692c70db9fa4c1cdba0647bc3320f5), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2ccebb1216ff30528cb99beab8bb2aeef52e470cd640c93d0ee99d3b37b91fd2, y: 0x39ac1e7602a74811bfc0e981bf2c4450636387e17fd89d50dac5e6d8c04f9e1e, z: 0x0826e4b2dae03b64bdde98fb361e42bb8fd45bea00c4a7c15af3a23cc528d502 }), authorization: Signature(Signature { r_bytes: "9a5c2017f474ba1cd694cdd9c19c45601c1bcbd97772d79fabc96abd74da2432", s_bytes: "a8ea063d7b9f8bff3bdb7efbe760f4ada42afe4f516d537c2013111f9410903b" }) }, Action { nf: Nullifier(0x24259240e5ca3cc3f9c38a9a9cf22457d4d9afb998ba788b8e6f5c9a1337d3c2), rk: VerificationKey(VerificationKey { point: Ep { x: 0x16f87a4e073149f839ec6d782a6efe7db8a1906c63bb32b954007dcb0ddb7745, y: 0x1a542aa814634a55214738cb3fd9d825cfb70e9e417a3b5e6f66cf22c136a15e, z: 0x0d04c475d494444b9254f0b57cb2e4bfd4d9a09f29ea050578e7a48a98fea344 }, bytes: VerificationKeyBytes { bytes: "c6a6f7492222a803ff41a48a552b3587d189a5138a356b259312881297b36803" } }), cmx: ExtractedNoteCommitment(0x18310b150a3d63002a8f02787cbfcb80fa3c7f6592e262541900fc5da904ec23), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1d4ac28c1ede57a8f603a55a2d1bc35e0ef2fc5d2baca42122a325a2d0d16d42, y: 0x07e1e83d53f759fe28df363b9649281decab93263ca390fabe10fc06fc9ba502, z: 0x0c1a8e0d50a8685856404373e901dfc2202af742923f60ab1d618b5b252d91c5 }), authorization: Signature(Signature { r_bytes: "49e4f58eaffe4c6eade282ce9f931ef3b6c8393d86af0d67eab30541a40a5594", s_bytes: "f10e468bf364b4855ec509331791f0b4ea7f12b41abfb4de8243187aeceedf0c" }) }, Action { nf: Nullifier(0x0022aca209f8375f6d6028fd29f1d303fb1f3717542614c2fcd160b603106591), rk: VerificationKey(VerificationKey { point: Ep { x: 0x01659ec0b5b9de52b197fb2e57ca15a864c68fc9790e3a5ebd9ee92e67b0acfa, y: 0x349da7adabb860dd9ca61ab6dc46d59545c50a98e24521ff05c0fb00908bbc06, z: 0x09dba3bf0c0928255f500cc90e6cd52598212b69e2463b0912e6e55fe5140416 }, bytes: VerificationKeyBytes { bytes: "f48904f2e05d08bcc4c979905b471c29925e0eb811229c25eb6d238065302122" } }), cmx: ExtractedNoteCommitment(0x0e4400d5e0bc8030b64016de4ecf3a1c302257716ab8c7d079cf6d6d777b733e), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2fad0538290f52ebc85ad46afc25126fc48f0ce217c7f18fabc5d3ed1e0044dd, y: 0x1d3f501c449e7a9320560fcbbcf93f29e89ffd23c4ab67d6e3bbfea05d72fb29, z: 0x06d9a53eef53bedd7778a4015b4b0713bd81e50f4a4f7b50f59f4191310eae45 }), authorization: Signature(Signature { r_bytes: "f7d1d445184835d21e385f5381167c061cfe21f48ed41aada0a28a01f09952b6", s_bytes: "8b3ac2bb401d446d9d88dfd7b1865cd772953912646bff781b51381277464909" }) }, Action { nf: Nullifier(0x1b30c779067ce51530eff953c909f32d30d77808b6e9b9cc908b04d01078dad9), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3328d2aeaa12c6ad60262baa423ab6b16009c814fdd25d1ab9c71c0f05f1cbb0, y: 0x09715441072351e6d65ae7099de022fffeb5f972f040cab319b9f1971af2598f, z: 0x254a68aade186d24edf120fa39f4d8aa5b276ecd54e9cc54959bae709e98943d }, bytes: VerificationKeyBytes { bytes: "46e6b256621935be33de882211e0a22a6fbe9db088a0769679fc47fa4558e19f" } }), cmx: ExtractedNoteCommitment(0x24f9da227ba72f862dc91fb5d52a5997d1b632d3a52971a7c444f6b9defc729c), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1a4179e1f3dfed764df1afff407cf26291bbb89b899f3d2c691244b6f14cb1eb, y: 0x0c97059184ee06679fe175deb8491981054e588a5e188fb9013be5bde02ab6fc, z: 0x395f4a50bbe2666fd8336b6e8100ae006a9f7d0968db03003fb1c65dffe7cf8f }), authorization: Signature(Signature { r_bytes: "47debc67453c6e75dbd51c3df134b6dfdc8a0c1b7772a25a67f1d1dc9d2e8008", s_bytes: "b4eaa90880df348e42af9d1aa80d694df7428ae36e736b733631a8a591800a3c" }) }, Action { nf: Nullifier(0x1c5267f7cdfe6720284dc1adf1a9ceffed3adc179fb5917b34f1a0356cc227f5), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0db2de3fd8f798df4f0da9f2da8d410f4e1c42a425cb4f6baef6ab7cf3bbd133, y: 0x30b1eb3cff27dd85cd5dd89e60437c3b70848cb553ad3d4555f287065a98e954, z: 0x2529d63ca4a39cb6e724c6b9ca8c4d01f21b765d52372b747de9a965db7603b0 }, bytes: VerificationKeyBytes { bytes: "e77121ec71747f72fb2df859231d986465b5c46115275780e725556bf4318538" } }), cmx: ExtractedNoteCommitment(0x30de3d5b2753d99ffab0739cdf934877a8d279021f1a50403f1369a78fad16ab), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x09b1060da5861a3f5d4ecd902b1997b60b6ce337dace3de05a7a1cb14e9fc166, y: 0x19c7ff53142196839dcccc1cd34e8d82d3a494c997d1efd9032f7e497d573e44, z: 0x371f542390e5e3e365216ee10935e47e3c0b4083611db728faa47cb166eeaa15 }), authorization: Signature(Signature { r_bytes: "885b451a573dcf4b77d9dc57559e9a6b3aa1201a0384594473eb04e0e3910410", s_bytes: "2e0ee6bd153cd10db65fcb1aa9bf2729329e54a0d52326ff8bb30b8501b2c226" }) }, Action { nf: Nullifier(0x1a2e65c8dbcf5f3619a3ea4a2dacf3e5ed2ca4e129d30c07430186b3880812e1), rk: VerificationKey(VerificationKey { point: Ep { x: 0x31a87b495844bd2aa2a910c5438008c9b537b93c60159cf05447bf16b6bcf21e, y: 0x18da5ef855eb6070dc400928e3dc9905e14a07b6e3eae84ed11f9586a624f109, z: 0x31d7aed79a972b19477ef8254449c27607bdc7c8e7dc6c84ca84cb7664b71ce6 }, bytes: VerificationKeyBytes { bytes: "3e378ea19b274a642963d54a57917e6b32c0345e1565c2b25a708f5c841cb90f" } }), cmx: ExtractedNoteCommitment(0x18d0e7309be961f3a77dfca917fcda26c004ac5e2acc1222979adcaabebfce53), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x27c7bf6fa29e5f0e6fee7e3711a124fa547ec21cbf3178ce13a8c0a82d0fb531, y: 0x398e9e296900f743231d873796cd844dc9fe4cdccb4c9483e872f8c78d5da3b5, z: 0x1941c00521e6cab38ed055b078110ba7287754c64027feab0a0fc20a282d5e97 }), authorization: Signature(Signature { r_bytes: "2cfdfe8bfced104324596ab6db4e5084ac4dfe48c32165ecd631993bf30c9234", s_bytes: "c8b1a511c7c94a05f5fab962bc619be44e0a424cf7a63405b069c832d359630a" }) }, Action { nf: Nullifier(0x3589dfc242796a3b7dca7e2509efa475e72a40320d055567473e6ec49cd696a4), rk: VerificationKey(VerificationKey { point: Ep { x: 0x36b50185a7a472651a3eb5f5025b5e4daf204558845bba366cdfa0610a2954ac, y: 0x37585f8fdda91fada9d4dab18b4f3de6173d0655462da1fc10923b74333d3343, z: 0x3e52416180f522715beb8b3ff9b43f7f86f2ea27e38e2d2482dd14b987a39d38 }, bytes: VerificationKeyBytes { bytes: "b3ac3d0d9770ed14c1193119da6401dbdd4ef32b229ae9ca23765ad6c5f8dd31" } }), cmx: ExtractedNoteCommitment(0x238a0930958e4fc337293e43017856e9f6e8f91dcda25d8543ba2ac1db791f32), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x07e481c8f73dfd24eaea197b5dd2912eadcadab517ddfb84fd891b878e7cd768, y: 0x1d440156b1f83a479a61a37d0f3bcfef96f5a3dc74060c84d457ab79477fa484, z: 0x27a537da3932a1a55b489cb3df8142fc31cc7221a2d832c8bbc6797243d32e94 }), authorization: Signature(Signature { r_bytes: "f811dbe0efd2d614a131bc486f76c85e442661292ffe434fc9b7d64ffdcc4c3c", s_bytes: "3828e7e6b98fb682927737a7f2d563bf62ed300e7a09e5d1b80818e797defa10" }) }, Action { nf: Nullifier(0x00558bc8b283beed68ebc732b27eb70d6e7c3baf0af2020be716d739cfeb5f03), rk: VerificationKey(VerificationKey { point: Ep { x: 0x1454697425df1972e4894610f037be1c9479f1b6c82e5ed56fb17b99ccf7f23a, y: 0x2d97984e1a6f4254251302f7bd3fb02498403e8b063078a8674aec70c13cf5fe, z: 0x1ec66c8edcacfd898fd63126992d45a32f874837d2708ebf86276f2693f9d8b6 }, bytes: VerificationKeyBytes { bytes: "e30adc0fbddb833fe6947770c76978b3ea4d526bf35a5d37a3e0873c6e0b5991" } }), cmx: ExtractedNoteCommitment(0x2be815c480706661b936c922be84e43bc355edd9fa188d2a4a66d36229b240c1), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1e92b967dde67961a963daa7388f30f26487fb04125835e65dd4711fba0114c5, y: 0x24059e37729a5c02e7838863c402dc9103ac756438996e35add28e7b97a121a8, z: 0x0a0c33035058aca2f28f2023dec9a76fd67f785fccd66a36d2147fb4f5455098 }), authorization: Signature(Signature { r_bytes: "f59ff9229c88292775bd9a9e9226c007366d005c8ff4a8785944f6a7be6b3ba3", s_bytes: "e2fa1f4e89e3bc9225e25dd44e77171b56de499c95bd49768e1135d4b7895f16" }) }, Action { nf: Nullifier(0x1ebab7588102e35f7bef6dc33fda577a5efa834d64a9d1c35d6e4279f816b9ef), rk: VerificationKey(VerificationKey { point: Ep { x: 0x02fd8b1a352996af101fd6119393da5639a52bb4ee912c5846fc74d952a06a36, y: 0x372cfa726bfbc8d9d78c35d777dc6da0e7a5390f33bc3107dccc0e06aa0c411c, z: 0x0e27ccaee1aa9aab78c386a077d09e66cdb5ae4fb2da2289cae2c6708ec588a3 }, bytes: VerificationKeyBytes { bytes: "ff4acd3ebf0bcd9a39f23f05c0c0f2ea3896087b38cfd83fedd56db0e079bd9c" } }), cmx: ExtractedNoteCommitment(0x2d16d1d5ea2bd75c72c6618378e235e9a3b58642fdee29b3bdc1d7d3a2760070), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x130ce8b526ad862854d90b521f63d261b569afe156435afce44dec4918bc84b3, y: 0x1f19a43c5275f71d17ff96a826a2f6d86f911d24e723959f447f768ef1a2998c, z: 0x36e260a2c17562b28daa914998cbb007417c60fee27b97bc6631df417f962cb5 }), authorization: Signature(Signature { r_bytes: "a4ce5fa1898145ac03d0069b720dd6cd8e104e90d926d2d36d46ec01aafd54a5", s_bytes: "576c78c23e9b2381c5d120f503e5b2fbd3f7f94c65ea7650ff7451af018a0238" }) }, Action { nf: Nullifier(0x2541079d7039b931bfb6bf6b73b393482a2e2bcab2552ad29c1afa7a6dc9ae5a), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2394173836e435e27ae7cbafe22e28c132413fec8fc1ff0582c710d53a646303, y: 0x0f5c94003c6d4d7e7853d5858775947f9123092b5737fda68fe290a0a99b08cf, z: 0x321e3d0de65ebd525a4dea5611efd43898e56f33237439bbdbfa0a9dc9f04241 }, bytes: VerificationKeyBytes { bytes: "4935787e99225d1ee6c25187916461eedfc5fe15e0576a09025d6af09b1100af" } }), cmx: ExtractedNoteCommitment(0x045e9bc61952ec2fb137769a441f5b8be28b73de8a5c10d4e2b839bd5e024962), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0c4dc642c9733afbe86470dbc103bc5d640bb02939a1aa7b593ed4e78d6f6ea0, y: 0x252069228457760bb4971fe9040bd727b5714d2d1a08f629710f7840221c1cc4, z: 0x1273f88824c20e77722b60a6704081cb50ca82e79196e44998f71199cf54cd5e }), authorization: Signature(Signature { r_bytes: "7808a7e296f9caa6ca4fc01fb1a45d397d1c4e0184d9a8c631500b3624903734", s_bytes: "b97e5f4111a3bd4940c36709590191272b930f0615e6cb3a71c1fc13469b3603" }) }, Action { nf: Nullifier(0x1343f3bed7dd0cea209f00c1ed272f0b6851ec797f1985fd00c42cb5b232405e), rk: VerificationKey(VerificationKey { point: Ep { x: 0x07d1cecf5655f981f9b38342aad66177b3059e9b411ee90f626797d36310e75b, y: 0x08c96e7778c349f9bf48a579ebd9fe767e67427b53a8bf203512274c5363e040, z: 0x31dec8d43e754e1c7d452eba9bcd663f1ba4ada70140507cf0fb7eaa52733afc }, bytes: VerificationKeyBytes { bytes: "c33c28dede3d81a3b773cdc8892c30b2b21d96e0ca2c03afbc61caf3c299e1ab" } }), cmx: ExtractedNoteCommitment(0x0d107ea854265f2028ac54a9453fb5a966f6db23a2dc3d98f50d5b93bd71a6ef), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x11ceb64a16307f859a171fa95ebaab59622bf8010558da5f40b9606acf8c62db, y: 0x3112f46c1aa3ef1a7c714eae93339ebfc6338139f3ad9a6c7502f3471662f4a7, z: 0x1c3397af18251eded1e437f6743645072bd3a44190017b472bb4c0b6a14eb4bd }), authorization: Signature(Signature { r_bytes: "cc98896b3ea927904114d213e982be34c77c5de75e2df86be4dbac75f8fe0f29", s_bytes: "82cb67096bde43851c9679e50dbe18b3149b39c2ccdb0bf53b64d7dd968a2608" }) }, Action { nf: Nullifier(0x1abbd2e90619f8d3d204d1bd53252cbfa2c3ec0605684ce889b5cf270aefe94d), rk: VerificationKey(VerificationKey { point: Ep { x: 0x25f126936dbc4e2d64a6d35e237223a8fb501efb3c280dced0ba3789671592c4, y: 0x0329946a4dcb758dfefc18b7e6298ce78b6c09211b120157d32732dc0a2889f9, z: 0x04101f060c9d83fc19c7220aa57de9b76a2c213fa9c7e021d465e951dfbf9a6d }, bytes: VerificationKeyBytes { bytes: "753eab0c9986a56f72a10d34a210e1efb6df1e8f1a33c5ab8b04ffe31ccef02e" } }), cmx: ExtractedNoteCommitment(0x285215959ba15bafc280bc948410b77c2394050e628a7fbe0d37c7cb65c50842), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0f26fb8aada0afbbc36dcde7a59e596b1e982ff66cd62ad626acdcbd2508abe3, y: 0x31726b85cb338eb3f57da4e5473fd1bc4683ffdc59b80b1015ecf97236c11767, z: 0x1660b097c0762719a2448672cd80ece6c3b6a54c28a96302e2c96d90584a5d72 }), authorization: Signature(Signature { r_bytes: "c7a1b1f81db08f336d13ad6f2a0e629c36d6835724e0b41e111ba40cc9f6b39c", s_bytes: "655bb2ccbbb1934995772ec1d241a4c141726c38dc252a18e9d88a87904bf811" }) }, Action { nf: Nullifier(0x1b57bd636780aa89fa1e266a6e086c791470d3475882d13819988620861c8bf1), rk: VerificationKey(VerificationKey { point: Ep { x: 0x377964ffe389323a1de11c75b8e4bd3358595c821c5299067c00de2e63dd83db, y: 0x1ef6a8a8a367bfd624ee30cec8d63782fa6bb101d3a2ba983820fd69c902135f, z: 0x3aeeddc289de54649c516655d6d1f005598014ac4ee364874c4ab231f6bf07a9 }, bytes: VerificationKeyBytes { bytes: "61443019b34d7868ff1806ad59dfb003f21ff26ca9e5e3f273c0b178fce6e18d" } }), cmx: ExtractedNoteCommitment(0x3ae35b820aa11ce61a7633b7d82e0f4fa80cb86175a80b12984877903e10b189), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1a3aff8564bf81393deeeab986fe4701f3aa6da6b2eb58c2af2c1a29baa14365, y: 0x20d045423a9f79b7b346bbb8304c272b0afe08c967f855e278e8dfed52a2e918, z: 0x3ba785c384ee85ce18f2423b584e366e6996f292dccc23ee59ed69dce6193d16 }), authorization: Signature(Signature { r_bytes: "566acac9c32435d6a89537a488fea5b57c4dc7b066cf0b47b7dec2c96f828202", s_bytes: "a1ca1e5ad7fdbcc04f52f83427b75886afc1ae0fb0ac3cc90f981c06fb2b4921" }) }, Action { nf: Nullifier(0x1c384d205d21949c3c8538d69b7c5620566a27d5ee5c3c4c029063a40e096411), rk: VerificationKey(VerificationKey { point: Ep { x: 0x16c83e1456858fd22b2b0fa7fb35673e245ba37408acb64d7874b7e85151a5be, y: 0x2a8a511ae237ecc8f5361ff47f603dbc0f0c531da229a393044326edde7fbe8f, z: 0x33f1d82d62c196b63fad6ac59a400ce091af75c238268282c05cebcfc6455d00 }, bytes: VerificationKeyBytes { bytes: "4e57562d51d28db6484d7d03a3ed0a537b69690c5d777593ddbde77db1f34ea4" } }), cmx: ExtractedNoteCommitment(0x04effe4751c4b35ac038cdda8c3e0395a613bd625c3715c7a5e375b57211b323), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2990942c497608a806eed9665ab80caccca3d05ed1faf56a4eae4482e49f40b8, y: 0x377094ed56ee48a1465fb698ee683c90c8fd9610c45ff7e70a0eb483fb19b6cd, z: 0x216ead21cd367e4efe6928a3100f3de0e58d528ab1cdb0640bcf952724cdba79 }), authorization: Signature(Signature { r_bytes: "5a5ccc630e4a35d2801b2a90e04ba9450e8b0f11dc9979131785e6291a3d38b9", s_bytes: "2ccc98f91b16d62f9d51a09c48af1b8b7baf1d4fa5eccb6b94ab130d67dd071d" }) }, Action { nf: Nullifier(0x0dd3d99f87cc6b6b89016b0a80ac0f0e6c347081212b4f490214508ef53af045), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0a4a8f8151fdc8f900040274cbb79c7a1076e4e6c693611575240d43d6b6ca77, y: 0x1f28513a485677c76a21996b36af9e794cfb893a33646768b8b58d2707200fb8, z: 0x3d6472710ac1126a2395d493de61bf5f67192b080aa2e17a0244749af1effc54 }, bytes: VerificationKeyBytes { bytes: "50e0a59649f4c2b19b8e532adad96d28fdae3e45530fd2247fdff83996fdc40d" } }), cmx: ExtractedNoteCommitment(0x2bf86655dff73672f29afc1bcbc16650016f7a6942e23ded141b9a1ec804e30b), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x13b2c7220fabfc1d58d563a97b17e78c0cc2e641a0fd42764d186f0ff1c3f674, y: 0x3503f90b63c69fe823bda0208d0df9f762727601d7d234d353be3a5b3bcb3686, z: 0x298d7204f6c1d2a5513ca94e8374b5485f21fec7aaebc58707cda60acc08b95d }), authorization: Signature(Signature { r_bytes: "b7c252dc4a02207aabb07dbcda8b0ab7454509fcebb9b24441c3cca17aae1a00", s_bytes: "aa507945532bb2e960928a5ba1c67c94d6a486862955d608a4c28d76fc55121f" }) }, Action { nf: Nullifier(0x2fbaa635a1350dd4002f08a9337108e4fac9ccd9e9abd196866b9550c2857c24), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0295394be8d6628be5d792ec54d65d4ee85de7508e8629434cc1824bfff68db6, y: 0x224e19afb5995617d0e2483b53a5a495159d21c4dedef036c120dfa90068c106, z: 0x12aaf4c5f2f68543ae1a433475e1be6f92f08b9d0707b60ac6efe860b9daa4e4 }, bytes: VerificationKeyBytes { bytes: "0a98276cc98892775d63beca0e9c8e3720c44708c1ba544c4b04b0aa08973f38" } }), cmx: ExtractedNoteCommitment(0x2dc777c2a83be9b0995c83f484a3aaea7adcb5cbe9c43bc758e06ae51be7c5b3), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0097cbecbba7f3e072d9c65e9b433f9aebc163c0cc048b12219a57236aa2174f, y: 0x0db3d0ac38c4d3c6ed8480b82bfcead39a2e03c4e1abe2956c67965b9dfa2cd3, z: 0x163933c3fb71e3a0b423705960c3795cfd3e1bdcec88f53add9f4ef00155219b }), authorization: Signature(Signature { r_bytes: "209f003c052308a388ca8fcad59ef11092b0d06a26e869251cc71dc380180b09", s_bytes: "a32c19b96c7f2c613fd5bb9a2bec104702abcb184fc81e033f9ff716af66ff3c" }) }, Action { nf: Nullifier(0x00628372e27d7f763fdd82f60a0e357bc95f38e342b4e7a7428c798392d3c875), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2f317ae5a39823f8c17cdd222986ea354759e6401e1bf0d6c7969486e4236a44, y: 0x0cde3450beb6210324d9e9b91c98bdd6980a59b1cdd6204b125ed08775a84e06, z: 0x3ee462e8a4314318b45a8e207362135903c67667b890766ae7b3a7f536cfaf24 }, bytes: VerificationKeyBytes { bytes: "922abe4f0d21b6dafcd0af4d2a38e19f6730b87a4d5827d16f746b60243de986" } }), cmx: ExtractedNoteCommitment(0x168f9ef220e9c8db83a28132166d23bcb5bda05bf10cab32878be1e841d7a329), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0d12ce474ed00a8cca74f77c4a00242e6767f437b34906303a979739bb15cebf, y: 0x0488176b3b97ff5e5c71006c1e68bc5656c425ec2d49b29fb0b4ad087d86d654, z: 0x32dfbabcf32bf51fe43bf98148757b44d82e41a05c8d4ba13e4bd3af401db639 }), authorization: Signature(Signature { r_bytes: "91fdfcdc0cb1edc92e0e9d29e9b1373f35e63fdce0a61ed7fe99e56a1d39a708", s_bytes: "02412b3cdf3eeb70b76f5d15483b9e084544ebb1f8f436e2e4aab319d4f9cf0d" }) }, Action { nf: Nullifier(0x14b41038c0522d6918d91d55a12a430274640d83f4ecb2ac6602c164f91021b2), rk: VerificationKey(VerificationKey { point: Ep { x: 0x150459d20cbbe26f2252178e1d93cec7b344e799163090f6a9cc4054bfcf20e6, y: 0x01fb0f85838133b741cb529eca6a308f457e1ecb7ad5f1e07c512064285b76e9, z: 0x3347f9d9ff064b88dbcfbbcafbb21412baad0e2e6cb6ad2082e8651733f83360 }, bytes: VerificationKeyBytes { bytes: "c307382a8df9b3f5d550af1f99048890377e4caec023fb884193949d93a7a209" } }), cmx: ExtractedNoteCommitment(0x3a1e3f70b3b412fb6962fbec4ff93d1339564c90306b95b35e30968aa9d90d65), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x279e2d406e871213ca3595c07df3d8f948060a5760729e3401999efee1f0af37, y: 0x1203bc664585c03a09001f445d18bd9540438a6f0fdfdff712e46ed591e51e08, z: 0x0a68321d9067a830b51e504b91f5b70036ac16fb8e19aca92709d888633c5c92 }), authorization: Signature(Signature { r_bytes: "b350833b740f9aeac940eced343617f690fe93ab7e7f59d25bae7399042bb735", s_bytes: "5936664d3ad6795d421675bad9d92628704eb0344b5d68646fc23b668d6f0507" }) }, Action { nf: Nullifier(0x1726cf37c384b1fcc6ff057547a000b41a124915003d3673dc5105bc2621dbde), rk: VerificationKey(VerificationKey { point: Ep { x: 0x09acd873685269c11933ea659469abfc21474569a79710d0202c5834134937aa, y: 0x39181f2a7df7c38cee6a12139a87fb967b93659f00646729bb04e704ba2d8689, z: 0x0c6f465e51f23099d52be2bee855b0b8b1f21ac3190574c5ddc51ef98b9b011d }, bytes: VerificationKeyBytes { bytes: "686bf43c7737f477931cd673999fb7ac3f1f4f7e67174df235e2f16411aab30a" } }), cmx: ExtractedNoteCommitment(0x068dfcecba3281bfe0946243954de2503acf28661f9929a9d15346c671925192), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3362314c4e57515cde466e7fb1f01412ce1e7c1876fd1af0f86069b2205a6b0a, y: 0x0e866d059cd6584718dd26516f8855bb69eaaec306bf5b186a73036daa565ff7, z: 0x0473a15d5be6c3d13979bc665e37e3fc4c94a34197ec72eef598b02b6aa124fa }), authorization: Signature(Signature { r_bytes: "44ff11a3daab20f044cdadf51392604dbf8d1fdaee86e079cab58ed79807d412", s_bytes: "57413f4c7e6e2bf5828179ca58bc7ddcc33d85e6e7bb5f08856e9b3f8aacff01" }) }, Action { nf: Nullifier(0x077c250f1c8861fd40f62ade383d90d118b4a20090eceeb31c0cafbf1f25323d), rk: VerificationKey(VerificationKey { point: Ep { x: 0x152bf812f7ef5313a69514c923d98ebe553ab87d1ed126f929e954e47957a459, y: 0x2970824128bfbedd570e7bcfebc6511292d91a87b36552055886c2c27ace7c42, z: 0x34f063840d6d22d1aaa0930be5c09b84c42aa8984a557cf9f4a24e86f0fdc0cb }, bytes: VerificationKeyBytes { bytes: "398bd38109882b65d2c4ff6ed53d00804bd293a55fd7f455fdc092f65ff8c831" } }), cmx: ExtractedNoteCommitment(0x3ca7d07a8298e138d02a91d3c8d5fee61feabafd29858dba0251b05d2ada9123), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x242e4eb45bbbc81faf8589a01ae2fb330c6459d2e3f499e34a9120a8aca0fdad, y: 0x00e36947926a343490e2e9364383992d51535aef3ed69d38c3852e8bc58c5ccd, z: 0x1928ef9849523b7fd2407c505b6c8433be68e3bb6a784ddd4b1bf1ebb04814cb }), authorization: Signature(Signature { r_bytes: "97f24c2dec21d38ece502509ab8df94d38e70627d8aa5269db17f6f4e47b8a1d", s_bytes: "a4c244ba6883b6d976b6db4705412cd30e2f96e73c77a96d59d23a9792a1383b" }) }, Action { nf: Nullifier(0x0683448cfb8b4da5e81b1809bb5775c6a63ad68b310ddba037532d4fd58614c1), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3eba86b1f5b2256cd0ff5f26f0da595073e1e3f7e5f9cac6ec02d0d55cbfbee6, y: 0x14a9def05c4129616291830571bda0a7afe44c7778737ba2c344c871c5e570d2, z: 0x3234d3cdb8b3e134cdd7fcff1a025b6170cac0345287f4dfee87febb4e6bb550 }, bytes: VerificationKeyBytes { bytes: "853fd4d642e85fdbc1376f592b134b617f0ff54b8b9185856436c8286f6b279c" } }), cmx: ExtractedNoteCommitment(0x397726d7d76482e987dc958f1d6136980c659909f9185eb58acaec9976bc1e69), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x01e113e27024bdcb0f1325b8eb93d927e798bd6faa7734f4e5dd6498de0937b2, y: 0x374db40a3b9f4df93c197f1f1566d7a5cb34bb609fffdff21319ec5731bbbd71, z: 0x11090b12a4809cf5f66ab38c28e6e0ca11fdb6e57cc05db20ab381ecf0b023d7 }), authorization: Signature(Signature { r_bytes: "3018da5ecb33a51953c28b32b088afb9106077ab7cf6a49e0c5baaccc588689b", s_bytes: "73479f92514fc63c0729be422cb5c5d8a3d2f325584a8f059cec717e84ce6b02" }) }, Action { nf: Nullifier(0x2a187ea38e6cd1ced5c6c81a02d991bd300afa10f97b3c0a4f847f9555154500), rk: VerificationKey(VerificationKey { point: Ep { x: 0x265337632d25ed52b963d89f6ed902e4afc23f5e4179266a4a770a685303ee4a, y: 0x2b2c86cfe00d264c3d7cf6c93361800f07747c29afebdbc9e5a16366b5f3adee, z: 0x008cb8c04cb1f5b5133260a93208d9a757a7e0fb6b97720c05f947c7fbebddcf }, bytes: VerificationKeyBytes { bytes: "973c42ac212c927eb3bdfc75e9c7c38796cf45e4a29310a357daa9cb30060314" } }), cmx: ExtractedNoteCommitment(0x39d8ff97a4d2375b141605554bdb4f15b04fe8a71fe1e6bc3ca3b7e14dedbeec), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x29e24b56ede23c3a9f2e07d0f52961e5941dd01b7676773dc935751cf6fb784f, y: 0x3d109c4fad729f399471db670ae438325e226329e68a607339996100f3612a86, z: 0x1bfaf59a3f306cbbca20fe045a088bc7ac3094d5da2aef705e20b50812290663 }), authorization: Signature(Signature { r_bytes: "e6b275632f44726c45574c918992a981deb59bd1c6ce167f75a336b1c886352d", s_bytes: "5a32f1096f11f3175d2d3c03200749210d0677fdcb74bf4acdcab5105ab5fa05" }) }, Action { nf: Nullifier(0x2b37ce39f1e10682e3f85f14aca578c9aa34a420594591dd625e4a0a08afb1c1), rk: VerificationKey(VerificationKey { point: Ep { x: 0x306962a341bd538ece5bdb754e40c53f2037313833711a4ea2252bfcf2501729, y: 0x3221c870d9e59a18dfa4735fc056230154640c8eb506dcb3c4d3ab323c669699, z: 0x3bbac17c086ca0625376c24f3a7379b0f547124d00ce1135304aa45d875cf57d }, bytes: VerificationKeyBytes { bytes: "a59f734525fe23545feef38c4bd93d50b142dca11310ca42028febb69e940037" } }), cmx: ExtractedNoteCommitment(0x32fb4cb682b33b2cf7a2f8df2462bce9860c14bdf8c20199fcee0d659aaa0a87), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0696ff74488fd94c241fe7c0d1ae691c5c25c0d5df0ee7732f7b58b180ef757d, y: 0x110d5a5349a9700e7cff3139af645037bdd738884299e32f625d582b38bb75d5, z: 0x0a961490000de204bfe746080c015b5696f84a1a5eb9f9be16a4085a10739607 }), authorization: Signature(Signature { r_bytes: "cfbeaddb700f5bd369d726c815194571bfb7de751a82092855e7c42df7cfde80", s_bytes: "0f2697ff8f9b835fcd822fc901c7efc792e8eb0c5274e602a2ccdcaa085eea11" }) }, Action { nf: Nullifier(0x2991e03db39d8ce3a944a666ff23c564472953b3ee8f7a0b9a3237f873bae5db), rk: VerificationKey(VerificationKey { point: Ep { x: 0x16cbf94b13d9400bcc29d0daae61b11dc3e766bf3615a99e5d2c70450c1ce210, y: 0x2ddfb306ef1653e8c743fb73123d521cd43d588109be4f6fe1117cf3f8574a45, z: 0x3326af0691621b644f45a66cd1ffc10603db83585f8144b8263472359be80f79 }, bytes: VerificationKeyBytes { bytes: "3269ba33f941f78a9e52002d488b3a89a428233733ee8305349fef56f7e40e9b" } }), cmx: ExtractedNoteCommitment(0x2217265ab220d3243214c44494c438d05a9c504ee906cc35740a312ad5cb961e), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x34a9a2273c26b3ccff6524f7d6109f0c74e45fc8038036e20619f072390e9e3b, y: 0x1a7714799a0aad578ac90e1527e401008f0f39581cb264d5dc760976af02c0ea, z: 0x30f9930cc90bcbaec776918c2bf6076f234855007d7a38966cba7fcb25ce7933 }), authorization: Signature(Signature { r_bytes: "ccd40d08c7e8676706f34b77b9847c207e10cc71e97bd59a2c0bc535198121b7", s_bytes: "4738b1246bdd2b4e798ce921aa9d0ec727dacd0d6be30dce2f1d4adf69c60822" }) }, Action { nf: Nullifier(0x353e090eba9d0497867a35a0fa9844ea14cfb66164f705e038faf50196380d3f), rk: VerificationKey(VerificationKey { point: Ep { x: 0x10e8f753484ef1874515f6cd55537a58f51974408507090e2f6606daaf93659c, y: 0x00a2745c6db9812583ddbbcb8809545586520b30b9f6ae81a3d801f62efe7aab, z: 0x033f2adcb1cb012d9c94cf8f04544ee6d38df337a7f129402e8fb9be26fc9336 }, bytes: VerificationKeyBytes { bytes: "638bd001cc1b488dead77d6a4f40c083a2b612992dfd592f64d73d0dfcca2193" } }), cmx: ExtractedNoteCommitment(0x37384b99e760b5d705f95fd92f902adc744c033e599599070902456c18ba349b), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2101965f5d520922fe5dc97481757e48971f03ac781dd5fb9a75831d00582b1c, y: 0x037f2f56d5f2dfd09e25b8c6213c351087d795381565ad7fdd43996b3d92726d, z: 0x13c554bae673d39c6d5420f7ded544c9d1a3ff83b977e538e657c797e795be4d }), authorization: Signature(Signature { r_bytes: "312f24dcbfad7791adf53b3a35ff0ff536b61e6987028340aae68be5aa0dd114", s_bytes: "7948067a8163f851a525f4ea6135eb619ec00e1d5114312e7f2f9f7b77977835" }) }, Action { nf: Nullifier(0x273ee51aa547e2187e3d595de12b702a8c5628be0c4c2b6837b4cc2dd3bc21fe), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2073e154c230980d482a75a07d986917dba2966f0ead20a798d4f85b90cad489, y: 0x3bbfe3ba776d300e7b6fe79f17902d09d9e266f1dde509cd1658ea4d9ada547a, z: 0x3330b7a54630a67980ebd153afe33bd7250695d57f8dfa6dd0c95179bffad03d }, bytes: VerificationKeyBytes { bytes: "33400c1877c0979b20a0a4a8e5128586b6e0c51159d10da6b04d0576f557b129" } }), cmx: ExtractedNoteCommitment(0x1020929db11082bf8089d5ca27446842a62055b73a59fb21c1b02fca07b6a51b), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x04dfb0dc8b770bfd4eaf55a55440a531ff8b325ebfb376f849bbf6763212af4c, y: 0x220d9ffe5c0d098820679c928dc64d0680208a41785be177c37123fbc8f85108, z: 0x21414ce88b89058444a75bc8145329bbf6f1a875238008045b6ab4f21c85e799 }), authorization: Signature(Signature { r_bytes: "cb77e8586ca2f236e47c512570870c1365650fc6eca2fc089c6d1e4b8427fa9f", s_bytes: "47a14ddb53dd548a43f77b18bde8d0ff41ebe5e061d6f8d6e6fe7416c8a1f50a" }) }, Action { nf: Nullifier(0x1263e3ea99b4462578b9048a7fde900e5e66fbf9c8d6a27308cf42a423d6cc6c), rk: VerificationKey(VerificationKey { point: Ep { x: 0x082ec32857b8ae5f952c41a3ba6dd3a33211c038b14ae6460201ca1d8b3d557a, y: 0x1613d452369f6a8a3097db7057ff85adc315870517f1b4451007cd92bac171c3, z: 0x31458d7ab156e8b182d03e19766a7b47f49711d2bacd263f90428d11e5bab448 }, bytes: VerificationKeyBytes { bytes: "11087495e67a5080c02c3e1bd3f75e00f07605058874db9f8dbdcc9ce9937f9e" } }), cmx: ExtractedNoteCommitment(0x3969a40c14a9e9014476d39d0ccf05f0696a8dceced9555bbb9083ccde1699b9), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x035c18c39c2bdcbc894821e6b6db5712143d23cfa4fdae7f1b2f1d8a011a9915, y: 0x210f483b6d260299e126db08883c04e71ba13be817502881b1300c4e15218d9e, z: 0x39b1e0c5d946e3138970bce58110f3ad5e0e67fdb9ab0be358f06f092c13fa3b }), authorization: Signature(Signature { r_bytes: "c92d67a7a67d4d588a623cedc40ac61bf405035327c34280b228b266fdc39206", s_bytes: "2d049c9c1209e25f2ee80ddff531f1fb6f996eceffb36d2a923cf702a40ecc16" }) }, Action { nf: Nullifier(0x1b2eb5fa6ed12b2aca24d4a0670e305220ed92dcb685c002e92667648b8f7071), rk: VerificationKey(VerificationKey { point: Ep { x: 0x1852e3a9fa4393735a47edf6e86e6f5c3a2334bb224996cbfb93803ebff59364, y: 0x01221b2c13ba57d5f14173275329ff10c3249eadbb5f892a56792df32d33f50a, z: 0x19f1b98c638e1cfd84d92b80d5b88b5f4be407a1ab026a6315a49d275246860e }, bytes: VerificationKeyBytes { bytes: "07cc65a7f950c7f87f8005f823dcc61b0879bf306e0fe4395ac66c594e231f2a" } }), cmx: ExtractedNoteCommitment(0x0315df660dbd667b43f065563bc93dfa839da8bfe89404218330978d2b5b0a34), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x32136f83ece1040738e23e111f8ece520d2e486d056ac60b59d64ad75330432a, y: 0x0d608f1d02574e4af8baf925612034ddf715f3a2e8c5be398b841d760d740801, z: 0x310afd59ef61d3c7238828a1b270b992e1e66f918d72c4bbdd9bd863464df8e9 }), authorization: Signature(Signature { r_bytes: "78ef51210a8f24ef61f11169f3479d21b6d68c67faaa64ecb848d203fb58a116", s_bytes: "3d03e265d12b394aa7a1bd82262dd5c7e6475bfc16b3e8da45125998a937fd1a" }) }, Action { nf: Nullifier(0x24e4d95fe5e4a16d541116dca8cbf6398fce08904e6555d64bbb9d7510b732b7), rk: VerificationKey(VerificationKey { point: Ep { x: 0x30bccea13bda519b3594211ccd24ab3966980e717e094a5ee5167a013fde6559, y: 0x3ddb76dd21a5579e4e7cc144d619fca600ddacf177b805f266e120c266fa597a, z: 0x332a667b0c7990000d25ce2201cfeef9b0e4ad3fe9323b12566e5f1c41732e15 }, bytes: VerificationKeyBytes { bytes: "8ff2907f0879fc329c2fcc2a3a2b284ea248b1af03d2bb7f9018f700a7ee5995" } }), cmx: ExtractedNoteCommitment(0x07594fb16b0a33d00cccd8e9b1a942e52dcf3daa9601601b37f1f9508f6a8060), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3804e6aae4472727fe7a1c69c06c7dd0417fd7ee377994ffa55c2bc4ed3ea22b, y: 0x0bf66376beb575a5a9d41bf0d8e72e59494a7314e06cb132b7bf96fef88d6be4, z: 0x11934f628682301537277b704f413c16ba1467819b82edef29bc34122cc2132d }), authorization: Signature(Signature { r_bytes: "3a3eb0aed9c5bfd344ee52a153a05ddda902ee9b3cf99d6d749ad03f862be49d", s_bytes: "b74b5379ae2370643faddb1a290d73a7ee90365bd8fc525d105230697c8a3307" }) }, Action { nf: Nullifier(0x00d8c19a0e1b602324c0c3f4fca0da7979b9dc6c84bc6118c95d48c282c78c4c), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0e5efacac30beeecfc05fe7ed416ae2a1aa0e7167eb165c0af7719c6071152c7, y: 0x322426439829445a45ab7ae2a0866256de46c768f605217e5c359b546ece1ff1, z: 0x1fe2cc0c816144b8c4408a666a30efee7fb81636142ed3963c88fe801a947908 }, bytes: VerificationKeyBytes { bytes: "9b0aead399bb39f809e5999071584331b559f64ac3338c6b6811e69dde1cde97" } }), cmx: ExtractedNoteCommitment(0x2f177cafd352b408e798305a8810a15cc7aff65098a7a332b0e30ab61562acd1), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1ea93226dd7519fdc1768eafef4cc9d5bc337a11fe5d29c5fd80dfd4dd3dbdeb, y: 0x1bfe314b28cabd8c7d6f73039f3d4b9df52d44cab7d91ead0534205bcc2a2c84, z: 0x124e6414e018ca14bc40de8c7c4e5135235898ad3d904a220430574c986ea428 }), authorization: Signature(Signature { r_bytes: "3733b505adb0e06c819400b7a10ebb165737dc379b26b24c86f2c960217351aa", s_bytes: "012170a3cd0c6c1680e8a188e1094e1f609bbb6a9dd6753e29a576807c110008" }) }, Action { nf: Nullifier(0x0f51b36311ec77a61b3162ed311e7ce6d7b5e61dc93100b52d247d54e2087d32), rk: VerificationKey(VerificationKey { point: Ep { x: 0x21ea5163a60af4c87d20d814dfde23700c05b0306c9d8528d1c4d943eeec0960, y: 0x2cd09e72e8079e2bbb9777eb90d5a864be908b1d4034240d34996a05657b7ecf, z: 0x16c14c97fe7cd6172405e4a24c61429557dec1e36345531706143f0243012eee }, bytes: VerificationKeyBytes { bytes: "9347ef4e3dad8667990a3f82c85b3c8529bec66f0d841b38a1d06cf369b7b009" } }), cmx: ExtractedNoteCommitment(0x36f791d2c80b98facd2790513ec071cc058f9f0ee6d20cb9dc8c1026b37dcb76), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1d1adc39eb4f2de4b414a1acb965f5af6f8896081b4cfbfecd795a04f753ce0f, y: 0x0b9d0baace302544d4ecd9f23704a6cd53d6f4f003ebe6fa2d5c0524e4bf3f39, z: 0x0ced08047040ee7c480ed554108b627ba8492edff54f3bfef7e1ac7a48a55beb }), authorization: Signature(Signature { r_bytes: "99ffbba8aace2200213f1597aed33e5db9397e61f628fe540da62feb611bdc21", s_bytes: "3d7240a6a889f812f940e60e6402833c591a96e363f55f79df1fe586f992572c" }) }, Action { nf: Nullifier(0x0aecceb5e730cba8268f8a28a86404beccc83d0a873f72ab6666dcaa8978f341), rk: VerificationKey(VerificationKey { point: Ep { x: 0x35d5fe318fdea0bb6a7d1e645eec18337cb1ab05497be06c5d9fa61f7da59159, y: 0x327a116df40e923ed9c489898e4f6e3b302e1fa40d050719902064679c1733aa, z: 0x3184890df77ba82a647ff16d4c36b21f1a0f923edbf9b99fdfb3f498541d66b1 }, bytes: VerificationKeyBytes { bytes: "a158cb348bf2b11d2aaa15cd518cf86db3639ef31c405f5bc63b84cdcb2cde38" } }), cmx: ExtractedNoteCommitment(0x054310f8598c739c81e1aaed05840bdaf8b1915407828d1e4f4883db16b4df95), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2af37c0a8621b84dd87bf478f0e40c85ffffc41f15fd1e2da03e99f57775d8d8, y: 0x217a63150a37054f31feb17f3ae4dbbb83539c4cde5f6ff690c6274927e25e3c, z: 0x2815c410aefc35843dc4c2efc7f0acea59e5ed2e585248c086f4c15d9ddfe958 }), authorization: Signature(Signature { r_bytes: "8168b973ed6aaa9af5efd210ba64135bda7b53b5e12e80821a121c1687416539", s_bytes: "0139d5fb8034437c0988c87c16341d741cf1c122c9644e62a8e0003fa5338b3c" }) }, Action { nf: Nullifier(0x3b6f720023386fd2b4bdc92e66626fbf7e7f48c607229a1843c3726f84f4399f), rk: VerificationKey(VerificationKey { point: Ep { x: 0x17350e19646213997590a797fb281e77fa822c7f77bb31688c172fa332baa967, y: 0x14e26dec73ec77592cc74bf1b381cedb0cac7f547cf706bbf6e0135e1b00d48d, z: 0x2cd4812b7a61c17c66827ab96734f00dce537c9e9e3cbe02dc5c45ae89b452e8 }, bytes: VerificationKeyBytes { bytes: "5db6760d0e1389018fc396bcd7b8818fe577d500636f86a04060927dcd1ea02f" } }), cmx: ExtractedNoteCommitment(0x3a51796e6626ad1d2b2d44eafad5930399102541c1d9248d22616a3841b05ce7), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3433b8f1bdd709b4a53b8b58e6a41d558d61d9052a9220882cb06a513ed76e7d, y: 0x0dcbcce3d2b1e308f8950ad2e246764a4baa2581d0569b223f77b1601620c50d, z: 0x11153d3302efac7adaa2e5c3172cc16b817947be538c9c1c29886f34ff3b767b }), authorization: Signature(Signature { r_bytes: "07ec468560cd7c1575399c0fafde50658b2794078d6b2ff61797d2c7189f788c", s_bytes: "ce340b75eba9b0020aea091a98572e7fff48c7ba8408b569ab4ec31265222e14" }) }, Action { nf: Nullifier(0x0cfac78e5f22db406c392cd940aca1df12276b6c05b12650674a994c2e0e5619), rk: VerificationKey(VerificationKey { point: Ep { x: 0x1172ccca9f38ab1b5e9991482fcde942e453733b0edad4e93ab0758559b9ecd7, y: 0x2cc3322a39fa0d3846047e83627c5740a55dd1ba7d41438c5a2bb531c8488491, z: 0x2d8d1626eb71dcf67715ab20db284a3edd22306f1b1bb730ab7c1bdd79d07521 }, bytes: VerificationKeyBytes { bytes: "b087778afee083b7ad81ef2dd44d5b52c818c721a9082e6985e1becbf580513f" } }), cmx: ExtractedNoteCommitment(0x12da344155d1976ada44564a1ebfc9703099f465713a0341e3bb594b54dc10b6), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0a6daccb479b0f75378752e5c2958e1aaf6e3327171f16bf8a67cd0be26129f2, y: 0x13322e3d04fd8fa40f22b271141c876d03f81519badc06528bba7c9225dd11b0, z: 0x0df3b77cc1497bc2114d5143b9250c9dcc2a61de46bb15765fdbeecfc7ba5f98 }), authorization: Signature(Signature { r_bytes: "924a4746676d4feed4e9352ff7473b1f8e99c70c28e964d5568064c3bdc44c91", s_bytes: "3d9f0eafd5db62561c77b2d3af5788cad14ec082c63db8fa49514c41d3485016" }) }, Action { nf: Nullifier(0x2aff644c41791d1a9580bcfa82599d77796905c39c979d60c03bc2d46cf81bba), rk: VerificationKey(VerificationKey { point: Ep { x: 0x339643f1d1819e55a84e53b64915b4794d6238f307b0550a2d689946b99e4110, y: 0x3119e2bda3f8038fd5b0370a9c953ad12b4eb862276d6666a2fc8d06194f96b6, z: 0x3e57091be9b4e59914041c4db5ebe2409418d3a7256a55851911c4e0bbb89dc3 }, bytes: VerificationKeyBytes { bytes: "91dc883e692f8502bf98eda6c024d604b9e47fa7f638d22385de9838c0d6ad1a" } }), cmx: ExtractedNoteCommitment(0x11b31330d46f3144e243fea841518a13b30318896d988adee31772e5b41aade6), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x299551b4cc893169ee2a02b2dd5f593a18530ad81406f3a4f7aeaa81c49c7345, y: 0x2c075335449c105827416f2281d9ccf107c55caa7cb06bb9aedb73b26c48ee70, z: 0x0717793665a78a7297a801546b54e4c885bc07c45254411b27e98f9915271f88 }), authorization: Signature(Signature { r_bytes: "c0679d4109c8a8b722e0566c3941aa15dc849921e7b198f45864d7498f86e608", s_bytes: "6d7e5f400b7c0d399dc0139bbfe1ab69a587ff5e986eebbdbb51cd63e1b78d32" }) }, Action { nf: Nullifier(0x2d4c93f6b3393d2cc3a92fa3e849ae9a03851e05631d396f22df3af44d6733df), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0b9ef6fb1cb576673e1463c7e36238a0ee7b80f49bc5ebae864a7b9d9e77fdab, y: 0x0090d0824b0ba2add46d8f376b2940c9eb9436c3fde1e8d6c02a86cdf828f21f, z: 0x270c68076c4c2923f6a1231fbd823a050cfa97d85e99fd64d0fe9146a50a29e1 }, bytes: VerificationKeyBytes { bytes: "e930891eae3bae8a46b7244dd33f30cb7ce3ef0ea36d02d8a59ae4dff6022e34" } }), cmx: ExtractedNoteCommitment(0x3ee9b651f0d64df121faa9c1f779d9b8e264cd6c5b61966de8bb90846d3ed08f), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1e79b0cd1d6c481bd0821ecbd492dbb94416619f98c298adb6ed74ba1d53d63f, y: 0x2cbae1cb754b6cb707391b73b5a6527d3bb91b69e5118310bb69f192f22239fb, z: 0x285483c943a07fff68f50f28a264166aa89d412ba45db5cff4fbfa0ded6fc675 }), authorization: Signature(Signature { r_bytes: "bf17f18b30f6bbe35f5dea4e5e858fcca40ee6dd53c56d4a9ed631e21787d896", s_bytes: "9d984252bfebdf4e79160b5ad8b40e6965fa200a22cf132739904cd419394f09" }) }, Action { nf: Nullifier(0x063a9a7749bad4158cfd85ba5789e246d5cbfc9d3a041fd6b2cfc26066c810b1), rk: VerificationKey(VerificationKey { point: Ep { x: 0x28528a409d9e44471df01c1336d88040c8f0faff2fa9e4618d4a45e3d00d64b8, y: 0x374f949517135ee1d20d8200f9c07b163598ff4ea0964615642cab6e99bf02e2, z: 0x033aaba71077683fe5d5b92d366acc1ee37be326d651927d6de0dbcbd63b84a0 }, bytes: VerificationKeyBytes { bytes: "7e057f1fb4ca1d584bc488e6af735b3b989103ddefb8eb8fb442903e3e37cab5" } }), cmx: ExtractedNoteCommitment(0x25b7df225fa5013ddcad8e28cc6e032072f80ad3df4048f44dbcadc10305862c), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x19598627f6483bc67b798a2e04b3843b476ca2f4bd52541e2785564b4926f777, y: 0x37ca4f16b4c4b322fe18f28bf07f72b590a26efb84f17f9f451face679bdd7b4, z: 0x2c027a7c34e441936c321202a2f5b0e99f2994ac466ae652aa24ba73d64df671 }), authorization: Signature(Signature { r_bytes: "2ad311616bfbe17096f633fd3b295734394c03c7387813c1d5ed8cadd5c4bf39", s_bytes: "b9fcc766b214af224242bb677d10b91cf2d6a472fcb2dc3e67199c1210514e1c" }) }, Action { nf: Nullifier(0x1cd79bd3ada8815123173293c1c9987ea9b6491272b674353cd0a3d56c99d8ca), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0f5e6ea4db6d9bbd855d94cc54579899a73a701d4fc6846a2520e4f97728b16a, y: 0x01fc377c3cd5329cb09fe08947d5da349b77a237174fcc80bab48b3fca8e2578, z: 0x17c36fbe302a55c454c305343fc965df284e1738527fb1a2f3355ec53fd8a5fd }, bytes: VerificationKeyBytes { bytes: "80e3c342b575ed6f5b8743a8f8643e968cc5101ce5b8270b92b688c9215d512f" } }), cmx: ExtractedNoteCommitment(0x04e5843d89c2dc089fa513a0214829dd7d3eda623e6b3af97cf1a52b8eea7a9a), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1ad1b21b7602bdbb816038bc27426692edcb8a05c0c6adee37236a352f26b57a, y: 0x266f816d03c7ac6e55439563dd7a4ab279a009d6c036e02418f385a39dd4cbb5, z: 0x2306e125724a626fb961e97cf10c83f1713165365dd697c0fd513c086604bf22 }), authorization: Signature(Signature { r_bytes: "611c25378d6042b5f427c4df95764b65833a4553d33ed229d7afa901b54f7c96", s_bytes: "d97523e1563d399ad1003c8fb30b541b237b022cf05ad1089eba4096f74f5005" }) }, Action { nf: Nullifier(0x0549514c7ada206d437c3cb2117d84759212d00b45e2315fd7b08552686f01ae), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0406b5954ea01c5105e5a38b5067bd46b433e0f35c1941a7aac91066be36b608, y: 0x17555d345e324142d4430fec19e6f6849272f451a0c3adf3b643abf053f95717, z: 0x3baced5e82987e1593996a45e6477d5bedf12146d69bcc1cbd4e5e443f5e7585 }, bytes: VerificationKeyBytes { bytes: "7701c4fd1775a552a715c0a5ad7bca4b8acb76e1a642941043de5bfaa656bd11" } }), cmx: ExtractedNoteCommitment(0x0605eaf0b6502fd56c3fec2ccbd5e0a09c639e9c444d40304896c54aba299926), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x083788471aac1f4b68248e071247c171e96f837a7b4a59d8b9cae760eb060a7c, y: 0x2a3ed6c8ef37a630bc101bd1418cb459087f244772acd092b0c3cdc9731c6dc1, z: 0x09c7610558c9461d409a48efb130d9f178ad8bd751e7218126712547928b9fb9 }), authorization: Signature(Signature { r_bytes: "3f848382fd43cab26e4a1e17b0e12920f706ca1bd92489b58aee95c4109d9a1d", s_bytes: "e1aaa15df67a3b517841acde2654a2f8104471d0f30cbac5d330d4e8bddc9021" }) }, Action { nf: Nullifier(0x11798408eb25a84125931f6bc0553ae458ec87fe1b3a94199c1d210e7f2176a0), rk: VerificationKey(VerificationKey { point: Ep { x: 0x214ecd2821574898d980eb6fd9fb408ff14b754a2bfba82d53dc3da6aea38d65, y: 0x296a1251bcba6b137040b24be81df28ffdde35d6eba6774ff526f2d4da1b4bc5, z: 0x058e908803cfc16083a4a54f3af8a34bac40f73988827d3134a112f5835e3099 }, bytes: VerificationKeyBytes { bytes: "2123630cf0a3f9eaa7b5c052f8b83e3b5f77b0cda54fc80cfb99e1ebe05f7121" } }), cmx: ExtractedNoteCommitment(0x2f48d6a2d08cec8fa04c1759cc91727fcfe4804ddee6ecc469e958b2c1567544), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x146d364bc4b9a141e4c6404d71bf0b2eea03460547d19b51385baf48be7b84a4, y: 0x1a4967591823686ee7be38807d9c129c3c577bb74e968e0912a2666833f6b58a, z: 0x136e6629ec6108ad71dc2dbacb34ab1658e5399fce5b67a46530aa59089b78db }), authorization: Signature(Signature { r_bytes: "839719db29c64dfa66d20ceb6b713ba9c9ca092e9b8480255c50d3e7061ce28d", s_bytes: "6a0f0ef09009366898c957e3e3bb510fcf0f96512a037f4d113c488efbb4eb07" }) }, Action { nf: Nullifier(0x03556824918acd449e2ead851a6c6c55f8ccb717addb10c8ef70864ebc425d18), rk: VerificationKey(VerificationKey { point: Ep { x: 0x153a680fd469f22e132bc7a79b6597927a9f164c438bbf38b668c0b0dea5557a, y: 0x3fa7a2be1b08ba6746d477a98a67f12731912c1965c989aa17b2a9f61b921132, z: 0x12292016b395654ddf6e6dc1846f3da750351c3ee9a579b38bad52e28dfc03e3 }, bytes: VerificationKeyBytes { bytes: "0e53a81edd1cf540c6004a56f12e426f7ae9c00fab713b3b44c375edfedda6a8" } }), cmx: ExtractedNoteCommitment(0x27c32027c8bf8d3d77352b434175bd16c713d01e5981a063829a721f9e20e898), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2c6ed0de6888df0f82b9cfc8ac05904cddff1b49976ba42ffde044d9c83d2828, y: 0x21d7093f5ad948fcda02c967375921874d4fa2a8c300a6383803bde7026e1d3b, z: 0x32713872f7e2d4d9e4efedbe514bed8acb94f020ee10fb4fd48dd1d7763140a1 }), authorization: Signature(Signature { r_bytes: "d26704d2369e11f409ce959ae593d318e519f0e039946038180532018a174199", s_bytes: "740096c4f2125581155aa41f44c7a221797f8f6ee5c9aba182ca78ad85a87316" }) }, Action { nf: Nullifier(0x3e4c85b9c018bfebb4fba33e11e96ee2195dc4ab70b107b935121c5b55c58b43), rk: VerificationKey(VerificationKey { point: Ep { x: 0x216ad84293433e11dda4de98ac93c3c06334ff2a886f25cfc8ef6371cbb91dff, y: 0x1d43e6b0e057f7a34f93c77373f8a7e366c646d08f0e8ae24b0aea88cebb2355, z: 0x37f6a1b0335b6f024dd5b12ff7a9b09683794c566a833e9702ec6063aa085588 }, bytes: VerificationKeyBytes { bytes: "2c7affae4486eaa20b359fec65beda750c6a8b9b21452c1442d83a0115f9589c" } }), cmx: ExtractedNoteCommitment(0x06d909518445f1241f1f2b9a2493487aa6fa7bc392087ed2f4b68cb6408e7e81), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x031e729f8960e7dea9ab0acdedb6cc128c6f86a1c1cb36a42b865ec4a4786110, y: 0x3d458715ff14de4d107fc9b8909101ccce617915c8b07e8d3ca7749057aed5b4, z: 0x1901bca483679dfcb57d177cbd1ab9df69cc3f8ab79b19fd4a7a2af6e187c3f8 }), authorization: Signature(Signature { r_bytes: "a8bbeb2b50f6189b1ae789e06c995540a6d9f55cd62d916919463276944bd58f", s_bytes: "4177872ae8cca90fa7d08baa472e19b92a33a71fd2dd0693675b45d2eac4242b" }) }, Action { nf: Nullifier(0x3d11a96034521a08bb4e60424ddd2b2d0ca38665d1e45df4146dd47ad91cafe7), rk: VerificationKey(VerificationKey { point: Ep { x: 0x1cd6977cafeb57c0b9aed843ebbc24355b5267126e8dd5ee10a71adfa2ac0d58, y: 0x0b915a4b9a8531a7e74d1c9456adf865f57b191bd7027517aa7870f315d851c3, z: 0x2bd8b0b8ccf364358da74662394bcb118d4d906ec3fcce609031b08d9935eaca }, bytes: VerificationKeyBytes { bytes: "4e921a7dad42c6b8278334011e8f1e021b90b8cbfb29401dbe4cecb040e54986" } }), cmx: ExtractedNoteCommitment(0x2a0005db09e93f289c3b378b4bda26f51950ceac15c19ad8a2c88abb2aeb0b12), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3160bd6f458d6cc12e0b9d314a46bfd463f274a37ef080da8805cd701b480ff4, y: 0x1cc591a70fb8e164aa7bb1af03b21c1f0c0d04744097a7ac3cf62d71a43fed7f, z: 0x1f48c3f27466c03a444c8ee6ec270df5b4b892d47705d80ac19e720dcda766cf }), authorization: Signature(Signature { r_bytes: "abee5b960d7c36dff24daa4b2afcd87721a865709d111cf4c5b42a7466e7a5bd", s_bytes: "b7183366ba583c1e9e325e9d6668cdabbfb30af2b142faf4c9ae0a61a3d5242e" }) }, Action { nf: Nullifier(0x195e6294867c1ce7d7281bf9252f4701053a3a5312b94db58313a25d3406fbf3), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0cdcdd1eed3c19b9eff9f838308b3e063208cf7237e3798d54631330d2505d1e, y: 0x1b8b1803a0b33f78cd69de744166a893193326f75a9fdb40f4e6cac09c98e5e3, z: 0x0002b5fdd97ce7d8e71957772b9b04ac9dd26d8862b1390295c488583c5b672b }, bytes: VerificationKeyBytes { bytes: "189318dd2c759b64ff8440568abe0557c554a5ffcfd2acd9805bfd8695f89bac" } }), cmx: ExtractedNoteCommitment(0x347d71ca55fa0438caf8184510c80c3ac472b26841f40701c2c3fc34d3de2d12), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x245051c2a16ef1245a72cfaee9adca004c469665728c22f1f4c08b58c2b5fbc2, y: 0x0c932fad7dab6e65d43e5a45ea4a0a92530230bf5acc5bbda3e79335514d34d8, z: 0x2bca0487c48922b14b70d8725545aebd9171ebaaef883939228134721f777986 }), authorization: Signature(Signature { r_bytes: "a16adcc38c1904d938d2ab147cae5dbf3cf38667eff80944b66a6d730ac5018d", s_bytes: "96751aba04031db40846479a7a2495f670cf188e4fd88f18e1253672bdbaf510" }) }, Action { nf: Nullifier(0x289f1f659e52864477f6a3d043bb0098ee15a39f51c9835ccf46a33d761350c4), rk: VerificationKey(VerificationKey { point: Ep { x: 0x1264ac4655a86f1289c93155a07e6dd611c4cda24e7ec5aa7afd843fc54c4360, y: 0x21ca1dba56a3a68534ad7d30711bb67b7ba70b5b2a7c41874ae2316b36d2a6da, z: 0x0b8c362237cfe3a09568abc24c35dbc6e56890dc7490a22a507118982fb5554c }, bytes: VerificationKeyBytes { bytes: "78f849a66a916d37560cbe40b56c2f40fe07d1f63770f79f2c773916eadfa13b" } }), cmx: ExtractedNoteCommitment(0x0c22588d71e187827ed567532b74102ebca06e355f0b2fa697a7b93ace9efa9e), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3feec311a222341bf30ecc29ae3f10c587086f95f8680219f292c9f53d749bec, y: 0x2a36390a25c72c7f572f69595f962688f649a6e238333e9da539a1fa865421e8, z: 0x0585389d89be35d0f7534675fd2629562d4b0822b5025651223906ee3433e982 }), authorization: Signature(Signature { r_bytes: "9bf2667de6d37d35543a25a514e7c8df82df81aea9f4eb57426d0204da39f380", s_bytes: "a5f2a3052cecc4393f084018cfcfd1aebfd711db8517f6e28086566a5e049d16" }) }, Action { nf: Nullifier(0x1a00a87d6593553be6a88715caa5535282cd0ab2e716944e7dd0f85f77653dfa), rk: VerificationKey(VerificationKey { point: Ep { x: 0x135ed098b6b2bebc50a545ddcb10df6d5e9e93426bc5d1d83bcdc5b4898a24af, y: 0x035037de150f7cb72c11af702dc82df10622f949703a6469b2f4b4afb6a87025, z: 0x24cd7fd60310184f71904b1d10a1c372c06f0962f22f1afad6cffc2bee67fc7d }, bytes: VerificationKeyBytes { bytes: "3546ece89b659c9671e0c555b29b472d27d8e61db359e3793f4bc9b7af2ac40e" } }), cmx: ExtractedNoteCommitment(0x086a95f71bc134dc6119b8db9809ff482b37a1abad8ec65c3487853d68026b73), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0f8ec298540680f8b7b13837a085488063eaf911110f6d2febe1c0375ac476db, y: 0x2f7b89dbdad9dda29c1459d4db277e0fbe0b52f2c92f1da34ed6e7196a5b7c88, z: 0x10e8a57b314cf946a30e72141e4311c74a49a7d377aa7850bd9f3e2a2389436e }), authorization: Signature(Signature { r_bytes: "b059f103e0fd7f145b5ab869bc910e387b37021345b18a5d96f3d6e6c4a05e28", s_bytes: "67edd2162d35a8dfa2af39ceace13af3ce46213d7493f880c0b2a5d9050f253b" }) }, Action { nf: Nullifier(0x148337c18b19a29ab9e22db3ee0e7dc38059eae248a5c5cab90f34af7a76a529), rk: VerificationKey(VerificationKey { point: Ep { x: 0x366c3ca8b53dd53e25b7ab27b1cef6bb5cdc83ed495049c9f2affe09895161f4, y: 0x181b2dfecc300a0236f3a00cc77df11d9c7ed5687c65828b2eab52ef1c86a0ef, z: 0x09ff32a183cc4139dbecc4d7522c6b6171d1572ec16c16a9c9907d57e6c0eb2d }, bytes: VerificationKeyBytes { bytes: "d57f5f6a8c2a195192b4393b42ea3a31c61d0b2f99942cc4eaa8c06cb2818137" } }), cmx: ExtractedNoteCommitment(0x039e2d2612165507c7bfff18777c3f1490345f7bf214f004cbb883fbe2d19bf7), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x128874e015f98b2cddd52eea5607644c842b1cdf39b4ccff58ba52f8ac52648a, y: 0x170bd70038701795ec7c6e0af7bc40ddad0a35e8557f4f8e895f641355e84f10, z: 0x376dfb3f309e69b2e37399af00ddbe9b5c13bc0f1c997838c48d73ba65caa850 }), authorization: Signature(Signature { r_bytes: "e4193ffb419cb96a05b2d7ee8a6a8b565d88772f7165766a960578af44b2b039", s_bytes: "e07bf781a5d1afc4cde1177f3da86024026fff68c084092f335e1f973e16c503" }) }, Action { nf: Nullifier(0x24ad4557002a679d5fa7df7d7efe0840464c7f27882bb454ccd7f3e692c28c85), rk: VerificationKey(VerificationKey { point: Ep { x: 0x31e344fa71d57c0a8a2c7804630c92bc102c258891f84097ed45cff7cf622194, y: 0x0145f3346c927cdddd21651e6be814ec0c3967917014f7edf819ccaad55d4f04, z: 0x1f73aa063aa17c5da78babc04e9688616d1288bdce0d7951f345e367e84ba671 }, bytes: VerificationKeyBytes { bytes: "c99034f5a07e4e66d40db1709c2dcce8e4facff4d3b02d6c8e13d600ebe9cc0b" } }), cmx: ExtractedNoteCommitment(0x1a66798ef72fd9abc3f61ce99d57b8b3db4a98d4cac17a1d5f03a51b4d48c0be), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x21b5b50d48b7ef82656beeae928865a8d1f73143db8d4208e0369598e12860c6, y: 0x30afb2e6a62a28030083741c713c633b0bfc09a5858215548fd3eab09ebedc9f, z: 0x0b09e53e834eedcaa3888e504bff81d2897f310686e2918d50e301b1837f8a2e }), authorization: Signature(Signature { r_bytes: "67260bf768a899407733a6431e5ca859d1cf766774b5dedb6afa3d3c2d7e7732", s_bytes: "fd656c2fb9ea627942767f63b1e106f34f548da86122a1a196b67a33fae3001b" }) }, Action { nf: Nullifier(0x01cfcba7b2d141aee8d0b9703d06eb464209bd905c251d096f888b93b927fa8f), rk: VerificationKey(VerificationKey { point: Ep { x: 0x386c6f4e45e7de939e50225ad3d45cc3e1797dafca592df2bf29465f3bc6e8ef, y: 0x13d2b12fd1923f960edaf3192aaa0de4cef78fc903323b03de61e0c7036a1f35, z: 0x3753c6d43074e3e6c98c75e6f6b01c4b03762191f0b712f578d65041b88a94c3 }, bytes: VerificationKeyBytes { bytes: "54e1399bdee58bb5ec96dcda7a380328c47680c9fb9679cd96c120e76dc05293" } }), cmx: ExtractedNoteCommitment(0x240a5b517a8e5f7f3425d304976394bbdba41584c7280301063efed4c9d386dd), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2000f1e09ae26a4cbbc02a13542661d730204cfecc996af9b3834f3f06279719, y: 0x0f973facc40660ea92adcfd43d815185d808834a333ebec612485cdea90739dd, z: 0x38acb213238080b7a4add304f1ea69b0ea0fbfd80c9e67f1471ea5a345ef2ae3 }), authorization: Signature(Signature { r_bytes: "4cf229df67e58adcdad305faf36372b6a3d1e7134e5bddb953391b092cb3ec2a", s_bytes: "74e7acff9a51a295ee4c3166595f5bb7fe0fb3426b518351b81b96487d39251d" }) }, Action { nf: Nullifier(0x232319212fcb166b0f5aaeafad32af01ed58b50655bb970b44b187c6f46c7ff9), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3f78a528bc04fb82d2d5f9c65a4ca9af528dd54f714940e8d86a0a9e5c2afaed, y: 0x1bb4d36917cc714141244b17ea00b19e60749aa31476ce1f369e6ae9c8f575a9, z: 0x1581588f42c5b0e7b5ce1d7a6876dc66c0a480b810750de530a76a8de3455108 }, bytes: VerificationKeyBytes { bytes: "709de35adedfe2c1284bbb823d829bc3c92af058036d3015a5a38a62a7df88b8" } }), cmx: ExtractedNoteCommitment(0x1896d42c7f4703835f052df18ab42fbe40e27fdcf36c29e6ee02fe2e24a2ced8), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x026fd5f01694263516ac8c8336fb18b4654fc1c16175b2019f86b5104f69edfc, y: 0x300b3ceff59fe15a166c3c469f52f5b74e4b87ebe504eaebb4ee1075eef705a2, z: 0x2d8c82f65bebf9444ea7f2d7db76810bc6b3e073b321bff48ad2d6a8cc4065e3 }), authorization: Signature(Signature { r_bytes: "4a94fb68c8274d5b4e56970500e4c8465551d643bc0cc69c2532ccb834402e14", s_bytes: "9d6acdc592aa42767d6be731818779c9ec238f560018282c76c78bed196b400d" }) }, Action { nf: Nullifier(0x3c491738e481391caccff2300eee29610875a8649e4170062db2ff7bdec894bc), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2a540f36606272bab1a5a5e13922ca689087adb913b3a642fd17b352f1a23ad3, y: 0x37d83b3e1075fbca29bffe5e431267c756ab5577fc9d131875babb5360349ac7, z: 0x015f4b955e5b9e6482d6c0b222f3a9a6f2a0b43a441cead490a966ca983dbca8 }, bytes: VerificationKeyBytes { bytes: "dea5081300db11e98ef66599c955a57a934fe4827cb07ce2f0c9a9b1a1121a07" } }), cmx: ExtractedNoteCommitment(0x10287fd3a25d7318aaba98e27720ab78db7ec55d963a41442181d10738686644), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3e3cdbb3ed16fd563d154730d78b7c080b893507cd840342fbd72287264f779f, y: 0x3ab54dd035b72fc50a416736f5a1884697ce6d66427e438a2f9210179f9edea3, z: 0x029454662e3fcfaf5922d5351b59a954df3aa277d92306598fd0db29f01aade7 }), authorization: Signature(Signature { r_bytes: "5366852434b9450ddbf69837f0548b9f043752e40c1271c8b7220f1902ea5f8a", s_bytes: "98ce83ea014692146852291e9d1f719f570a09a0a610ae4cc94f1e24a1d52111" }) }, Action { nf: Nullifier(0x26b74acba8f1b22521b47fb09f92a84b5195e13b6cd19d01630ff94cfd06fd5c), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2e477979ab29a906d1b34e077185c5601a6cf737cfa60525acbb95c4466e4b39, y: 0x3c6bc7142360ec2785eb0b6bbb79cc32a894a7ae7dccaaa802a137e473b28518, z: 0x051b41d564fdf07c2e17c691dfcfff9cba697e5001ec1d6225ba9af0316d1495 }, bytes: VerificationKeyBytes { bytes: "a32380032b33e2eb2d4026901a2668725fec31ea96996491c56729a31733930e" } }), cmx: ExtractedNoteCommitment(0x05b8ab4cc44c9098ce0ae8f06774da63aa6a30da7430f7727ae8fff1524b74bf), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2b76a058b7f533efad5ca072572c2d77060f70aa3b5af4e4a3291c41d646969a, y: 0x3796c7cf3dc585cd0bfb7948960f1fd926eac559985874125d57f49b7add1e08, z: 0x1377bc1d8f33578d23f630343850a9a139be1fa7809b7a75185e3a3492ba361c }), authorization: Signature(Signature { r_bytes: "013b30091be9c49222904cab79b664dbac32acdf9f57a9b02f6572b81774628b", s_bytes: "bf5e30fc1a76a9711c19b85b6f2895e913db92813eba75d2f873b2374aae7811" }) }, Action { nf: Nullifier(0x34a7cbfe449e510c44240690e5fd5ca97620c7fe9bfe6e676e1726d26fa8860f), rk: VerificationKey(VerificationKey { point: Ep { x: 0x098a831519196813874d51f9c106c5df47dfebabdd1c0b40a0cd867ab75a355b, y: 0x0c3b100f73cb1a0a487d8e56c1449a39fc6bb8f0a27413bb52b1f95bd79aacd3, z: 0x20772223f832b87ba9cc89ab04df68d8418b58ad3d815d8a51b347f796da34d5 }, bytes: VerificationKeyBytes { bytes: "14399b2664c2f335bcbec9fc224585f389dc4f2ac7acbfbb929c30dde913ad32" } }), cmx: ExtractedNoteCommitment(0x20f45e89a7523f122278bae8e40767c39c852d90e5a6b30894b94ad0db402e2d), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x18e6090bf072e21abfbade95ae0978e79e3a9f2c63e4a42a3b7acd3544870bf9, y: 0x0ce735bccac70292a5c0f65ae003457b3d25ed48f1ddecf341af45c914720d3b, z: 0x10e3fa9796e8fc6495df529a1d8cf71bba3a5e1d4dedd1cfcc77e68feb3c2b1d }), authorization: Signature(Signature { r_bytes: "fcae641c4e9734d652da18cf1de0d255f616e25db67eac7dc4fe1486dfeb9c95", s_bytes: "fb8bb671d6a4ff8eb75843f0e97c5367f883335c1cce82d5ad5908b2c407a329" }) }, Action { nf: Nullifier(0x2b4f4e182396ad841f0f295637f41dcf498e637f30f23bf08b1c5aaceebf5248), rk: VerificationKey(VerificationKey { point: Ep { x: 0x232ff05760e4155184cbd071e9a73af9dd022bfa4281a83a8854fb6621886431, y: 0x07237152e7cbc9bec3000be4cc230e65c6c6948f17a25cde7bb0834d9645e025, z: 0x3c9c95142dd734e532918c0dbe02bcaee98514a7e615d8bac1c95cddba555948 }, bytes: VerificationKeyBytes { bytes: "7c173815fc64fc4039d45cca2c6cb9c8186c5280808ad675da13816a5d5ff7a7" } }), cmx: ExtractedNoteCommitment(0x10a744c89db0550a97d61b869e383834d7642c957fc52a46f2ae52be7abd6e0a), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1c8e2e02e4432bf9abf1bc11a1aa8a1adfbaba8d8294829b10547dd8f101c7f4, y: 0x3bb66d61dee0f2bbe311924876b57f679f3b1c3630987013e6a4a5a49359a666, z: 0x2763f42446bd23e7bddf9962cb49fc59a9c3200d9cbc618623efb0b3f8d64424 }), authorization: Signature(Signature { r_bytes: "2c450b7006a3b17ceb7ec65e1719fb12fc3881be91cf6debda77292cebe6c109", s_bytes: "92d5ee201f902afe1ce85d09e3b65bb6c16069b2f59d2a6e0044c64737b7c623" }) }, Action { nf: Nullifier(0x351b6b18f1f9074d738baf5725d1699d922ed3ff60bd96c1bfad09ab65c389f7), rk: VerificationKey(VerificationKey { point: Ep { x: 0x37170ed2deb4cd84c82dac152e6d9ced4ae9236e7a2c9edb3574fc5f6eacb3c7, y: 0x20f2c049a5383755c7278a0d4893cdcc32114e17755361ffaaa26cc42d22bbcb, z: 0x34fcfb41e1a6a7c226a52c039b6b855c7228fd0676284e3b961c3882883129eb }, bytes: VerificationKeyBytes { bytes: "25917853b770a9bdaec3b1cf5c52dfc668fd290a528836cdc9773337412f709e" } }), cmx: ExtractedNoteCommitment(0x184b68bf9e68c65efe0d276ae27a8dce531ca671dd8dc998eef26bde591c43f3), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x00895b04f7e4f620141b2fadeebb318c9407b89090cfc818407e6bd4cb05beab, y: 0x3ecc5e3155ef66bb22b030d2b9470f053381518f3d829b8b984c143d350b2415, z: 0x356c5bbdcc9a67b48364a388ed816e28d91e11433ae4f238e82f085c2685475b }), authorization: Signature(Signature { r_bytes: "4d12cbc74ad077184192c4e999f17f2a9d8b1267e1691c4fb559d26184a2810f", s_bytes: "282c7b7883753e64687e57c05659d5360364393a86b83faaf6d18d12221a8702" }) }, Action { nf: Nullifier(0x06a6f45407245cd4db20b4d92d571c612bd4eda11ec277adf0a82d632be1d375), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2f365dc53de99963e1f48822a0e18deb1d027b3bd60e6ac912e3feececcc7877, y: 0x2fe3b483d6875ca3ff3bb051d8d1ad192ea596f1f0241a407f6452adb45e5aef, z: 0x3e19791cb4c28c45ea181ce58e10557ceade9dfb698644bd60798ab69c3f6bf5 }, bytes: VerificationKeyBytes { bytes: "a47a8e96aa23dd483e455e62252b57143fb2a0ab9d8f6e96dfdba250467d9322" } }), cmx: ExtractedNoteCommitment(0x2b29b0d654ca8983f07bfd3aa3ef3318055a6d242a9cfca4a4b54affe1ccee72), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x19722f90d5b7202251e7e956b9b3da162351f1289a9e4f9b5431e78a6803263e, y: 0x1b4c174cb06d8d13c9db8f7143f983dbb8a4307e4e8057974a74508c8fc29d09, z: 0x3ece772b207d14412ea2b7723d6cec89bff5ebf84c0c3f2be49d1ad9705e6e04 }), authorization: Signature(Signature { r_bytes: "1abc465e6b1a9416154dc984b556fe13e67b0a57e8d72ab03ac7090ea1c712b2", s_bytes: "1723455c6a3d7830a127c3148a02de7054687859a9abde116581948fac7fca0b" }) }, Action { nf: Nullifier(0x21b5f3c73b798bd22de348b5c69978356015df8177fcbf2dd9473592f15e4738), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0d6fdd4669161031131bd7ef858db453c9458eb2808aab8bd28eea91d728e803, y: 0x28023a73aeb99b6523fb639c730c4f0876a5c2da31ce379e80f29534e1121f64, z: 0x1d3050007b1a7829810a11eee472686d65eb49a54068f2ea3131a64084197d3d }, bytes: VerificationKeyBytes { bytes: "fbf37b94ad8562e8463225337ba56269792499d12245f92313b841775aa54695" } }), cmx: ExtractedNoteCommitment(0x3de738d26f24b444fbc5a95278b7d432e3444befec6dfe3cf67d18d60edacd19), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x01275a8ad9801f4cde559d0d2b5030956759d495b5855174886ec0dd625525ab, y: 0x0438b48687533c086011bffce106549602d4eb82ed09187d1b09d1f2a63c7169, z: 0x37efd862702cb97a1bf173042d3894b4afa4380d92c22252b218ed9f863a3c0f }), authorization: Signature(Signature { r_bytes: "bb79909677b70d60163c60ab00d058e84543327b3693401e28cb9cc8ea86f63a", s_bytes: "bdd4a3ec9a9c16c280106a3de1fb2cef4e801b24028a13271fb9fae7fab1c92e" }) }, Action { nf: Nullifier(0x090f0ef1c75265fb5a46ee68f5f52ddc440bb1cf392729c9e54dfe4069d2cf11), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3bb18916d9def22d804960343986ecb612a20a74eee7786cb53f73c2f8baab8b, y: 0x1be030609dee2ab6fa0ef15672db5a47940c6fb1d1627f8c358d484460ae8458, z: 0x0a1340258dc626e1db9812eacdc026c89beb74264d376deac2ce0770e2fbe3a6 }, bytes: VerificationKeyBytes { bytes: "00bdf5fc20de350afcd4a23755ba55a9f557b6ce344ea41cc62b140160b04520" } }), cmx: ExtractedNoteCommitment(0x073be3d18850fe3e304d0a39124a9e5e26609b792e23a2b2dc042b065d1ed111), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x29e87e523bba47d955892ad513b0230f3f86a0d639a912a5a7013c397ec1568e, y: 0x138e1425ad14c0a3fe03597a912714baef52615fa41de0357d6c06f4ca7805a2, z: 0x16980183c67d04c3929db0b85a113cc197579e4206463b7321b253f46517db0f }), authorization: Signature(Signature { r_bytes: "79ea95483a9446eb06550f5d515b26122b177e02589c2d2fb58902e935bc7a09", s_bytes: "d72c3f68e6ebc2381c5a3e1ff29fb19e48433ea13c02ec74709bd26908e5140c" }) }, Action { nf: Nullifier(0x1c91b2e64f3d5cbe60de563cbb3fe903a6600b0c0bd80513712a329d52e87d09), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3a9ff921084821ea6ed12d670af74b8b3f5d489275219dcda339aff57003c414, y: 0x2feffc9d5cec350c48e002ad72db70b14eef73c25df74faa123b13e2b938b5cf, z: 0x3eebac897e78780094accd9d2ae6fa1813d01cc1432ad349277c9c568c40e6a2 }, bytes: VerificationKeyBytes { bytes: "a4476d3eb4f16cd1eb5d7705ca41a272311ca40e60b368766bc4358c3fc71f1a" } }), cmx: ExtractedNoteCommitment(0x1ee4e87f029379f2716f443fa5260271ba62a25cecf55a5869d7f06f071610bf), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x123a3887a97f1e05f6f527164e592119483b1680a00a732da756b2dcc264ff40, y: 0x1a1d95e73b87d262d39ccdcfde21ffe8e6c32ad7e10c8b6c71ade6a322cf2383, z: 0x23a61c98569bf7b7a39fdd2401b7ae5cf628e91a25516d48814033fd81ed274f }), authorization: Signature(Signature { r_bytes: "e40eefeb62cd5239a47f38074347c2f2d345c49a70e97c4ecfd8b840a6d51a98", s_bytes: "ce0032b3eb204830b3feae963a60c2f395e864101d088cfd9926a0e44b44193c" }) }, Action { nf: Nullifier(0x32f5b31750be3a1c23d8919e728fc48c0d2663b018571e9dc660f2df717b2920), rk: VerificationKey(VerificationKey { point: Ep { x: 0x12a66952dfea56cec205863464abf67bdeb5d40d7ac9cb8e8c5cc9589c133efa, y: 0x3d0f91b8cc44e11361f4ed67fbd96b8b8887c1bf900e6e3f73698b2a2bece16f, z: 0x10b49dad52ba5569056c5e211b233b97ff6eb9533fc31efafb8e7ae1611463f2 }, bytes: VerificationKeyBytes { bytes: "fbf7722eee08c684ebd1a36fea9f43ae71ed0e447207c8e10715040af332398d" } }), cmx: ExtractedNoteCommitment(0x3dc079d0e8ed1464a817b2f41a4c1a08e19bf2a39e3a39a15c7fb3c8099499f4), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2d7d076f5449544719ac80dca225eb8710e3c78b31980d7a8806a32837fa528d, y: 0x3331a9bd6ba67f14ef1f9578e726341a42b81b71e39658ac2159e2bb2b8f72d4, z: 0x343443c17e7a685a3549dcd147ae57279eed2326b311b87b26b53a14ecf71afc }), authorization: Signature(Signature { r_bytes: "7eaa635d5e70d56559d616a64955422f59763b61fba20631ef08fe7d9505171f", s_bytes: "4b4096fac03477eb0b318469e797cfb3dfd0d822bbcd0cdda902c625338ed307" }) }, Action { nf: Nullifier(0x30cf8377366a59c48efb7cad5868dfe47a04887c4eab78d3d4b10ad4b693494d), rk: VerificationKey(VerificationKey { point: Ep { x: 0x234d3d9a4d875bf1ed643bc4db161dc67f3ada2647a2fa8b619bd701de338cc0, y: 0x2adccdcf7edfe4f5be8f58144e9bc049c78a626795c085ca7a8b9a223fb75a41, z: 0x2af29d156e2b7746c134aef12548c976a94e6f7e87ac092a3b9cc737b74496b7 }, bytes: VerificationKeyBytes { bytes: "701fbc57217c5e2119cc3b8f0fbce668816783acfcc8f727bd076fa2bfb8b031" } }), cmx: ExtractedNoteCommitment(0x0a44b481a19ae9f50c73f902d42ee2445851c456ea4ee2dbcf5bb984298a4349), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3e4de60bf02b5f6456e21b9b76f2dd08663976ca967251d4b1d34d1a5584e67b, y: 0x0729f186bd41ab5843e3c97c37ddae771a15a8041260645c0c94b3f7a62c8a45, z: 0x1ff3d97a71ba7393821d23ee089120de4593210501853e593b916bd23d869012 }), authorization: Signature(Signature { r_bytes: "253c08572aa0eddf1942d1d4185a2a8af7b7cb5dcf9f88ebbad922fd5e8bd2aa", s_bytes: "abb372c1957c90eb99da48013189edc21aa838b000e1583e65b10959ebb55f3d" }) }, Action { nf: Nullifier(0x3b5402b283f8370759755046f354d78b73d5d72c3031999c9ae88212c17d3cba), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0fa74a04a9ccafec00058b790b45969935c47905c6aaad22a3bb769863fc20d2, y: 0x168f40eac561de0369a146dd0f988bed4fcaa8ef440741d5fcf512fa71a9d67a, z: 0x38a16295bec613e9628e0850cebcbb9d8c3bfe67541edf450438c1b126c8411f }, bytes: VerificationKeyBytes { bytes: "aaae56ea7565bfa4fc71f7ff7b8604f0b3ba644501bcb0281b19a4f58fd2ffa0" } }), cmx: ExtractedNoteCommitment(0x36625c619e70326ea3e79c55e64156854189f9da7e219a0eace709ede4bd52e6), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1881f41d0846317d972e7f0a29f2cadd0e54d74436782628d4e28b3167f372f2, y: 0x12fc758c02a3b5033e14add3399dbbea9a912067219ba4c635e046ceea464ab7, z: 0x2ee99f17da43c0456c70f267a88f861509988bdf3e625c42be37797d7591efc1 }), authorization: Signature(Signature { r_bytes: "ce12a9968e6586d9a1aa4d5bcbf78e125458f0467e5b855adbbf0f26e38e23a3", s_bytes: "2540424779c7cc3a82a5f4eb1915bea9fc789eafdfa643c3085f8f9c54157b32" }) }, Action { nf: Nullifier(0x326823e261a5beb343fcee63769c2b400c16d84e9efe62520aacac050fcc1623), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2883a96b8e0250fd1c3c907142dee292755c0b1e39f70be96a7cbf20af89cd96, y: 0x27b2f6959c15ab2b26461612bcbbf7530e0fea6ee3dbc2e3dd4ccb0c572692bf, z: 0x123819e375f729d62e6324f3a404ee3e26a07ed5839313e9b7ddc6c9fe0b1fcf }, bytes: VerificationKeyBytes { bytes: "1a12382216efb0735211e5f9d7e05935a356e08eaea28cdce450dfde47cca18d" } }), cmx: ExtractedNoteCommitment(0x203d9adc98dfe528aeee9b754259927de4233215b08792a85c4d924079d12cef), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1e404b4d1ec8158a3afa7cd74a6c0f023492f5a6926957fe73ec223b4889cbe7, y: 0x3febe2c577278cd56add5b9ea2ebd6f0f5010079fa77df7dcf20ba034267cf3c, z: 0x24ae0cdb4bd7a7be15de1fd3ea36a191ad6fd5e93bc76c37a802bf3fc9615c6f }), authorization: Signature(Signature { r_bytes: "b1c8377f7abec8bfd0a53f6574fd1d9ddfdb7efd6439a7eda64b0acdd0ca9728", s_bytes: "6949d6e59115745be606e7229d9ace187c9cd5513b60b4b3f49d042bc57bb405" }) }, Action { nf: Nullifier(0x225aa2baf8db643ee085e8849bfb223c9b466e99fcb17d4e0511eb8c5d12a831), rk: VerificationKey(VerificationKey { point: Ep { x: 0x37e9c3499478e871e93ed9cc3689191f7306f7fe126eb82419bb448b91ab926f, y: 0x2e11045e1187c65035e2b42a7dc77346cc69fb1e95b35c4da598aae06e34bf72, z: 0x238ccebb937c584f0eb4e0e308cca35e0b69f0aa368bb6d02cffe33957a1bdc4 }, bytes: VerificationKeyBytes { bytes: "7b499b766f2f657fede10a6059ad52991e7dd18919f38371092433606d470e82" } }), cmx: ExtractedNoteCommitment(0x19e415b9b55e8ccf7f66ded3c8bef2808e900e93110387ccf7e7d7e3fd4ce2c5), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1faac717aa6a5cb01d316c9fe121f00875a40ae342829c22d860352b00a54422, y: 0x3fc1c7de7cd7f5935131d295bc91ede1d708af25043d4821913ee081b5413f24, z: 0x2cb0a7e4b3d6aba717c3a4a517e124b86dd01477e1a774fc8a17733ef296624c }), authorization: Signature(Signature { r_bytes: "9d9fe1f76788f790fa2658fbbbb3aaacdd72d59ee40e0102764bee251c5bdb06", s_bytes: "ae141c289e7cf814cfcf0c5fbca7fb5b2148ee91e5c62c538f22a7d41565dc15" }) }, Action { nf: Nullifier(0x1866d64de18eb1f9336cae81b8d460c1cd3e4a11758b3b0eb5f2f27d1dcf250a), rk: VerificationKey(VerificationKey { point: Ep { x: 0x0ec21663fdb34d0c7d56f89c963af880507ff362eb045120bc5d067eaf1c72d7, y: 0x0c1b0af96dd8e6e55a2b42623675a33ec4272749e75243c6c35c98cfa1afe500, z: 0x0ea70f720265ae0d70008463a630f0069581b3e9d8daea57d3cecdcb9d11b9a9 }, bytes: VerificationKeyBytes { bytes: "ed397c688f0953dcdd028c8a5ec19c1679e6697d1cf56505d9ede7ae20246b9e" } }), cmx: ExtractedNoteCommitment(0x2552b877e8e6671eda40bdf2745eb1b5801ace0ec99a82acab840d3d07cdbc83), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x12abc0ea3f13eb90e69fd6aa37ec635b48a091667684c7771e7ec44cd484ec98, y: 0x1e59cb76049e70565e4b8b67e59262223e354dc0e9c98bf4a6d832324faf58e1, z: 0x112ef8d0add21bfc9b3546fcaa55387a6aa7b1e4157c6be05b2f43ddc299906f }), authorization: Signature(Signature { r_bytes: "93cf01f5fc9098c192c8accff23f999df881ee23fc6ce5f52c2bb5338eff5e17", s_bytes: "c59fff27f0e7bf7fb22789b9e7892bc1fead651fbd7821ff099fea6ad9b6bb1f" }) }, Action { nf: Nullifier(0x04e7faf2e0129f39a8dc74197a3cd8297780879a32de77a7b4a65c0849f2a60c), rk: VerificationKey(VerificationKey { point: Ep { x: 0x26fb044bfe00495f885e7921c1240b242b97b4bf0d9a8ea944facd842829bd91, y: 0x1e1c3714835a5022a352165b74430b666012fee1839bb7e12fc528edbb05598e, z: 0x2f95fcb532cbfd30ad3747bc3094b0bb06de7fe0c267f45890a63c8f018e6c6d }, bytes: VerificationKeyBytes { bytes: "f9bb643d67a3c69067c573ebc51b3837121a15cebebca05b584d63ef95d2f03e" } }), cmx: ExtractedNoteCommitment(0x0ff390550d2c147092324f05fca6c58306eac7e0c773243e15420f4aa6d5a265), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x0887928e976451211bcea71dc7b3b94dd5a66314d5fff8dfe9baff7c01830242, y: 0x27c33c0f7221e4498431477eb3192dc6cad7fe24f2ea88bfc06c72aed721bd0b, z: 0x137ea745e0a945386d848e751b5acefad8397b5fc86c7e3dd8b464467e17fa88 }), authorization: Signature(Signature { r_bytes: "e01eb52402b0657ff41ff4acc9d0fc4e98f8927785d40269e0ff28f967f3a1bd", s_bytes: "774bcee690cf4697f46ad3fbea1b42fccd0db79cec3c66a9a118d28fee725c2d" }) }, Action { nf: Nullifier(0x130184ca98daed52fb6df24ed6b6f7363e09326955dd4acbde3922de46cbe342), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2065748b1f20a0c387386f46fb353d8e2e26bb9413e8a124bd07775617eaec9d, y: 0x3dd9afbc113d119646b471bd8699e56b90b31aa54aa75d67be13207cd2a0aad6, z: 0x0da61fe601b53b0090d18202cf270c48f8cefb10d12db4bb8db5be4b198cf67b }, bytes: VerificationKeyBytes { bytes: "df85d091b2f9dc7669e451f3ef03618136b0adc683d949983fbd5f7c0527da8b" } }), cmx: ExtractedNoteCommitment(0x3f587e0a3c3a8de7df085c1ea6ffb4a457eee80f799024460f1956c7a8aa4529), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x12f4998aa391b7c86cccd0e7e378161a5cb6893b5dff21db48b6d98da716ecb0, y: 0x34e90cbc0ef38dede8923d2f5e0dc6a16facaa6b97315bb5e090767dc37a5519, z: 0x05d6b6598aafff18ca5472079c956f385fa0d68a4e14978477fee38106a39298 }), authorization: Signature(Signature { r_bytes: "ead061fec3a9fdf270772d863e28ea2d4643816de138e29bc1fc21aca5e3f486", s_bytes: "b26ad03604e698f6bf83c31ae21b080ef097228dea01b68e46e7655543e1aa0e" }) }, Action { nf: Nullifier(0x20ebcb73197b1d417905b225ae974c748e792b4f9c79e734c1c4c148fb7d8b28), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2cf134cdf9aeebadc761bc6639567cfba6c8df8f7c3a48fd5aecc2f7cd45c4a3, y: 0x2bca61d2a238a55a4c851607d3b406e1a7ff929edf1c6dbb925b11d399a548cb, z: 0x165b9e6dd2cd586baebf1cc81e6a554e837d98de82bf7ebc4a7a3f88204bc57c }, bytes: VerificationKeyBytes { bytes: "30b29ed428e4211f9d33bd081ca0b6b70e993652cc4872d1517e77a1487e49a3" } }), cmx: ExtractedNoteCommitment(0x2462a377136693b3cd930ae060ae65a3e72f8ff879f5d6800490b6eb5c2ce99f), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x32b579712fcb2d8a7c73554dc0426c932205d0ac4ce27904ad6a52b477190986, y: 0x3af5e14b0f918b040ae06d682a817eb945d440fb00cd35c7c15e9bddf12fc96d, z: 0x39c6a6010d71848a34b0a4ef1c092ef5a081947ec7b95541f4d5486baa064c02 }), authorization: Signature(Signature { r_bytes: "3fff28f3b283339789b03789390ecb33952abddd9bf91c39a62b801970f59481", s_bytes: "02ede5f60909145b26b49abc2ce0dc1ff17df29882db608f2102085b4ecdb82f" }) }, Action { nf: Nullifier(0x1becd5ab43910d9d2f74ebb7f2012cb4494c73fc877f67970935510cbcd73543), rk: VerificationKey(VerificationKey { point: Ep { x: 0x002c1c211eafdc11b23d668cc5336e2be42da29f7326cab1783874e3eb6751f4, y: 0x3a8b7e28a0506043d7edfed82a1f7aa4a5546a9de8c0c1f40fea7505260fec3a, z: 0x1f4dab14831e4a2c1fef514f9f7717d96b85d2b7915c08f152aa6161fa41c093 }, bytes: VerificationKeyBytes { bytes: "aeca7bebe3af9b10fd7a70a27008cc1c065d5a8d686b43e0aed8a28f6792ea8a" } }), cmx: ExtractedNoteCommitment(0x37ec05937ec6e3405cc39b4dc883e934c49231ec03fa7ef177a239cf33bfc457), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x113e894d4af0a773e8292645ae54b500cdc6178f535ce6543a7493d955e3967d, y: 0x2cc7667d9107ecdfb66c5a67c6a7ffc4d31e8ad3b5d20aca265fd383c87341f1, z: 0x3459713716e6f8f8a86c46db5261fc3a34d4295aa3ac85f46f042989d4a5e6f8 }), authorization: Signature(Signature { r_bytes: "8314ece2d8564d2a8500ceb3b8537c55b73bc095887b66bcfcf52f231e8cd283", s_bytes: "ac4d0ba65443aedb7211127420df6f291fe7de23c1a10f853b7ed4951908c50e" }) }, Action { nf: Nullifier(0x0f4209c1d6d1f6da8c820285e12d2d4b2d6a8a409e0fe076063199fc28711ad7), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3001d2a737be057316566432baec14e3d66add37b6e79d68e2481f9e4b2085a9, y: 0x2ec1fd63ec6f05abfc9112292479bc86bf1772e10390d4630b3cc42e9318553c, z: 0x0e4893b1f512bb46bab27c1874ebb53d09a98d4de94332dde74717a524236cbc }, bytes: VerificationKeyBytes { bytes: "cae4692cc9975c8d231edc084b25e459749b7aab0d82e1ac00ba50cb1e58f90f" } }), cmx: ExtractedNoteCommitment(0x159d46d88067e2e17214ec7294f4167e1063727928135b089b2f2400102b4158), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x1123209cba50a7a18256ed65583604e48f1b6b5d1c8c6cda3be2d438f44e0a5b, y: 0x2ca8b10247909fa284b6bafeb65d8c1819975a2d3105a0dd71c7e0ddcabdb192, z: 0x0859fd70f5caa2dc982400201a7acd932ac6ce4731d224b548c2c25b23e94595 }), authorization: Signature(Signature { r_bytes: "4c7654195c05e92061f1f9f24ad006a3fba77ad5c8774e323742aa3b9e92b539", s_bytes: "18a236d09fb89d47853b65bee58280f7056435168e983ba5b3aabcddde926126" }) }, Action { nf: Nullifier(0x1f6de9ae2038a53564ac5a0bbbfbcc25deac48d8fd3356d830340f6a0ede6b8a), rk: VerificationKey(VerificationKey { point: Ep { x: 0x3444e036be3d6bc34703d0c927aa824f10e58f97827ac1ce6f1c6edfdb7f7492, y: 0x37c4af8775c3810fa6772038ff006c09adfa58ecebf7f10bb4c4a05ba9405975, z: 0x37a36f0981e69dd9a25d491ac9f8aec999d39b9204e514923f2219909e9ec717 }, bytes: VerificationKeyBytes { bytes: "79681504de21305143acac3002fb49e816f19ff9893dc31775d38ec834a591a9" } }), cmx: ExtractedNoteCommitment(0x22c6b91a8e1f44ecaa1ad25a85a049d3fd9152446a52b5c8d05ff42aac54d148), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x38d652235b0cab459366981f67a2138ef2cec8f53d24b50148bfce3a70cd5209, y: 0x164b4cbffb5e569910948559f2d0648f9d9b11e7532b6dd1eed8725201285af1, z: 0x2f59ab31b34663f2baeb4eca177e90e6f6d260c6e781e8f3c2c5d3c345a422e3 }), authorization: Signature(Signature { r_bytes: "e0275e04f12b7f39a40919db2f487307535413a4906b83756efee0e0eda64503", s_bytes: "484f70c48a1516cc880b9ea4553a157f157fa526a3cc0c5a1e7083bccb956a2c" }) }, Action { nf: Nullifier(0x1a42a1b59f96d60cc581ad8e9636454e894666b891bfd3435515784e50f3930b), rk: VerificationKey(VerificationKey { point: Ep { x: 0x04baf0df242ca93802036a16088e0728a6c19b7e0b8d50201b4196ca884b7dd6, y: 0x0f59af837290a40aecd0a8a0aab1c47064606bef98c9c2ffa95a1f3344ee1b0a, z: 0x1809d8cd32a07f2ab494b7d4e1f749591e1652899d353632aaf7afc9f7ac388a }, bytes: VerificationKeyBytes { bytes: "cb808b30936db00a00464e15c73533fefc0c4ad5077a7ed871cea0995cb30c0e" } }), cmx: ExtractedNoteCommitment(0x158d18c4fb560566444e86cfc98a7187ad9fdc46d4893c020de55d989e04a47c), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2de7c5bc685cf967ec5f73f420924942b03399a8f6363fb1ec52d59cc9c8eedc, y: 0x27cd9ebecf4e96d277783fd1fc2b06fdd84996e92689ee303ee2fc8cefa660e3, z: 0x22016f328acb1160b112db37aa2e685e559c66e155414ca48160d528acd81aac }), authorization: Signature(Signature { r_bytes: "f6606f0128ae2430c8f09e689bc79559e6a70d2ba99b3d35c24000f02a97fb0c", s_bytes: "9b234a6b57e80a4f99577fd91f58c6e42116eb05e1b9044a45998ccbad4ab523" }) }, Action { nf: Nullifier(0x2e1be3999b7c5c49ddde1d97c164977b5f27428753cf820ff5ac9df4d00739ce), rk: VerificationKey(VerificationKey { point: Ep { x: 0x26ef9f06f3549caaca50769ce31e7f77a4741c95ebb7bc87fb143139ed0fde12, y: 0x0ace0f2209219da2b113f34aba85b7072fc9a9cef06ae3c190e92577c6d59bea, z: 0x00a3d4f8d25979622cc6e1de0c36caa6b71fe1be497314077ccaace4fc9ac815 }, bytes: VerificationKeyBytes { bytes: "60e3e931ebabbba1a8073ce913339d7ae6d414d6e7c98863053d71b4bc73e31e" } }), cmx: ExtractedNoteCommitment(0x297d73312d2574a7e8a27a8601f54549d980a2365c6f910ef77fa720ff7bd1f0), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3960ca16e80d8fa3d264e710a47b7bb04d428c3f5d23652b449e91afdb8aa9ec, y: 0x04d93b85b12805a5d98efe56a6dc94d06ef4ec5ac1fb4e21504def587e02dd43, z: 0x2ba451a8440fc44e0751972ae7479205376a154b9d71f81b22bab38a3ccecfa7 }), authorization: Signature(Signature { r_bytes: "3d0393007ada1d4ec71d082845c5b7d98751dd2a57dae2bbcccc245ddff6de8c", s_bytes: "2e59b912096d082b312a692d74f2624e1c479b2fe04ae95b1ad2929280098f1d" }) }, Action { nf: Nullifier(0x35631b5e97a5ad0fb14ef6f98ef64c1bc2d379227273ceb1e9b4883bd98b0cbd), rk: VerificationKey(VerificationKey { point: Ep { x: 0x2e1c2f2630971a4c8d61b204ae6eec2439d5e8d4a2eb2baa2996c440cf9c0688, y: 0x2b4a798d51f7a491a479b79cbc10fd5539f51fa735eb099d03635c9fd2f6cfbc, z: 0x139584200dbef711c45a77e77c8c3a3befb47d0a8d55fbb9d62324f9fb8172d8 }, bytes: VerificationKeyBytes { bytes: "668debae97f453279cb6db31e13e639700440a27d5b6e71de6186e9cf0ba449b" } }), cmx: ExtractedNoteCommitment(0x03c6b1e50d0ed7098858ec72d72c6b1a80320b9137ac9b3ec1a398946d874402), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x3426b76d78ca44baadb9f84ee9a695a611d6104d6b90a448f03367a84780d5f9, y: 0x338172af34cb837f1c2ae5f112d2af9d542e9d5ba2a04ce43cfea2e53a08d1fb, z: 0x3f763bc647c642d4f031363cf2ff3f81422501c7a8a0628533623275c56c9697 }), authorization: Signature(Signature { r_bytes: "bebb69874cd1f26411d841a43e19d7b0f770f5939c51976d15465a153785d6b4", s_bytes: "4040f0468fd3e7ceede8c0bf80984c545cdcc8783c0cddb63621c20e7e1ffe06" }) }, Action { nf: Nullifier(0x08648cbffeeaccdfe710ca0786027389df3d1e0ccd34edeac2c92ab755ad5a02), rk: VerificationKey(VerificationKey { point: Ep { x: 0x22c00460f394166e5546fb23f30814a9adf8d5e31ce4036eb3cf23dc74da5549, y: 0x17e045f8c704bfdd5efd5f1886215c2e3e10f080bdb6d075944706731e6337b8, z: 0x3bb530cb541b3e447745ffe75ed1be877b5f491f5a889957c016345f36ca7d88 }, bytes: VerificationKeyBytes { bytes: "e95c1b2afb83d173ff2a119eba2721944871bfa8a581be4a1c44f4b7d45d598a" } }), cmx: ExtractedNoteCommitment(0x21872c10f169b9d3f89665c5a20f2c92387253806d399b560a143457c4a2acb2), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x2a4ff37511bbc5df2f3cd0a33c29fff2cece1fd82de4ad00cbd692b4fc3b287f, y: 0x0145955772c3b32da41e8465bc4a122fa3a3d5292513ea387754d6ce453bad8f, z: 0x0cd5a22c652e026a834b7461c0922163bcb43c9e6a776d7aad4ff340c0e8cb9f }), authorization: Signature(Signature { r_bytes: "1052b5a2a5a606ac5044c61052465dfff118b02ec5a8d926d4e289125587a008", s_bytes: "174be5283a27de484bbfd54e0fe8063e272d9336bc26a77383cba1ec9122d312" }) }, Action { nf: Nullifier(0x222e767d14589d48ad0f60cbca47f9b85784c099b29cb734805bc71deb309d76), rk: VerificationKey(VerificationKey { point: Ep { x: 0x308c8f122241f7f21a4fa6762c71958fe78326213d55a0793d3f9f80080a7036, y: 0x082b447357fc9e77d0533a4e359efdc8985a7a3a9ecebccef7be3b5cc7e60777, z: 0x127d87c989e94e9e79faf13ad5f13dd158cdc202e20323e45f829988c13c9c26 }, bytes: VerificationKeyBytes { bytes: "fd8fae5952cd4de093e94a6bb3933e6660a2a657962b8bd4df981b006be64fb9" } }), cmx: ExtractedNoteCommitment(0x3826b04b2514f4e818df22d075235fc4200e8287e03cebeae35c526560779f5f), encrypted_note: TransmittedNoteCiphertext { epk_bytes: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], enc_ciphertext: "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", out_ciphertext: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" }, cv_net: ValueCommitment(Ep { x: 0x227eec6392a38af73c3409f3dc2d4f809bc2f290ea06042872fb41f38825dbb6, y: 0x28108055a8acfc71d367dfd020ec0e014b40e7e5e2c1f87ff4b93c2e33fdd14f, z: 0x3f1ba87b500cfd90c136e3f38114b11e7035ec152e0a9334927ef2c9a869b811 }), authorization: Signature(Signature { r_bytes: "77df57422931bc18c74756a027c213515763baa1795b0685884ae990f7a1920e", s_bytes: "b9528752518afdb41d9960982cc28588acc90995f9870cac2201b2766419ca0a" }) }], flags: Flags { spends_enabled: true, outputs_enabled: false }, value_balance: ZatBalance(-1982004641446413), anchor: Anchor(0x167f8f3e9c67e0d3e1c5eab4b5c22bee810e0662639c66bae0a345fb45fd37e2), authorization: Authorized { proof: Proof(1973 bytes), binding_signature: Signature(Signature { r_bytes: "120ef925bceae642ab4ef2b774bf5da8b8064247512a0a08be0c17e8ad79103d", s_bytes: "87e45374e564360f7dd5f2a68d6bc8d337c6dde6e18a959b37920e605a60e01e" }) } }), burn_amount: Some(Zatoshis(1282370927714324)), tze_bundle: None } }
diff --git a/zcash_primitives/src/block.rs b/zcash_primitives/src/block.rs
index 6271e05356..e24dc1d2d3 100644
--- a/zcash_primitives/src/block.rs
+++ b/zcash_primitives/src/block.rs
@@ -10,6 +10,9 @@ use zcash_encoding::Vector;
 
 pub use equihash;
 
+/// The identifier for a Zcash block.
+///
+/// This is the SHA-256d hash of the encoded [`BlockHeader`].
 #[derive(Clone, Copy, PartialEq, Eq, Hash)]
 pub struct BlockHash(pub [u8; 32]);
 
@@ -39,10 +42,20 @@ impl BlockHash {
     ///
     /// This function will panic if the slice is not exactly 32 bytes.
     pub fn from_slice(bytes: &[u8]) -> Self {
-        assert_eq!(bytes.len(), 32);
-        let mut hash = [0; 32];
-        hash.copy_from_slice(bytes);
-        BlockHash(hash)
+        Self::try_from_slice(bytes).unwrap()
+    }
+
+    /// Constructs a [`BlockHash`] from the given slice.
+    ///
+    /// Returns `None` if `bytes` has any length other than 32
+    pub fn try_from_slice(bytes: &[u8]) -> Option<Self> {
+        if bytes.len() == 32 {
+            let mut hash = [0; 32];
+            hash.copy_from_slice(bytes);
+            Some(BlockHash(hash))
+        } else {
+            None
+        }
     }
 }
 
@@ -60,6 +73,7 @@ impl Deref for BlockHeader {
     }
 }
 
+/// The information contained in a Zcash block header.
 pub struct BlockHeaderData {
     pub version: i32,
     pub prev_block: BlockHash,
diff --git a/zcash_primitives/src/constants.rs b/zcash_primitives/src/constants.rs
deleted file mode 100644
index 95bcd53262..0000000000
--- a/zcash_primitives/src/constants.rs
+++ /dev/null
@@ -1,440 +0,0 @@
-//! Various constants used by the Zcash primitives.
-
-use ff::PrimeField;
-use group::Group;
-use jubjub::SubgroupPoint;
-use lazy_static::lazy_static;
-
-pub mod mainnet;
-pub mod regtest;
-pub mod testnet;
-
-/// First 64 bytes of the BLAKE2s input during group hash.
-/// This is chosen to be some random string that we couldn't have anticipated when we designed
-/// the algorithm, for rigidity purposes.
-/// We deliberately use an ASCII hex string of 32 bytes here.
-pub const GH_FIRST_BLOCK: &[u8; 64] =
-    b"096b36a5804bfacef1691e173c366a47ff5ba84a44f26ddd7e8d9f79d5b42df0";
-
-// BLAKE2s invocation personalizations
-/// BLAKE2s Personalization for CRH^ivk = BLAKE2s(ak | nk)
-pub const CRH_IVK_PERSONALIZATION: &[u8; 8] = b"Zcashivk";
-
-/// BLAKE2s Personalization for PRF^nf = BLAKE2s(nk | rho)
-pub const PRF_NF_PERSONALIZATION: &[u8; 8] = b"Zcash_nf";
-
-// Group hash personalizations
-/// BLAKE2s Personalization for Pedersen hash generators.
-pub const PEDERSEN_HASH_GENERATORS_PERSONALIZATION: &[u8; 8] = b"Zcash_PH";
-
-/// BLAKE2s Personalization for the group hash for key diversification
-pub const KEY_DIVERSIFICATION_PERSONALIZATION: &[u8; 8] = b"Zcash_gd";
-
-/// BLAKE2s Personalization for the spending key base point
-pub const SPENDING_KEY_GENERATOR_PERSONALIZATION: &[u8; 8] = b"Zcash_G_";
-
-/// BLAKE2s Personalization for the proof generation key base point
-pub const PROOF_GENERATION_KEY_BASE_GENERATOR_PERSONALIZATION: &[u8; 8] = b"Zcash_H_";
-
-/// BLAKE2s Personalization for the value commitment generator for the value
-pub const VALUE_COMMITMENT_GENERATOR_PERSONALIZATION: &[u8; 8] = b"Zcash_cv";
-
-/// BLAKE2s Personalization for the nullifier position generator (for computing rho)
-pub const NULLIFIER_POSITION_IN_TREE_GENERATOR_PERSONALIZATION: &[u8; 8] = b"Zcash_J_";
-
-/// The prover will demonstrate knowledge of discrete log with respect to this base when
-/// they are constructing a proof, in order to authorize proof construction.
-pub const PROOF_GENERATION_KEY_GENERATOR: SubgroupPoint = SubgroupPoint::from_raw_unchecked(
-    bls12_381::Scalar::from_raw([
-        0x3af2_dbef_b96e_2571,
-        0xadf2_d038_f2fb_b820,
-        0x7043_03f1_e890_6081,
-        0x1457_a502_31cd_e2df,
-    ]),
-    bls12_381::Scalar::from_raw([
-        0x467a_f9f7_e05d_e8e7,
-        0x50df_51ea_f5a1_49d2,
-        0xdec9_0184_0f49_48cc,
-        0x54b6_d107_18df_2a7a,
-    ]),
-);
-
-/// The note commitment is randomized over this generator.
-pub const NOTE_COMMITMENT_RANDOMNESS_GENERATOR: SubgroupPoint = SubgroupPoint::from_raw_unchecked(
-    bls12_381::Scalar::from_raw([
-        0xa514_3b34_a8e3_6462,
-        0xf091_9d06_ffb1_ecda,
-        0xa140_9aa1_f33b_ec2c,
-        0x26eb_9f8a_9ec7_2a8c,
-    ]),
-    bls12_381::Scalar::from_raw([
-        0xd4fc_6365_796c_77ac,
-        0x96b7_8bea_fa9c_c44c,
-        0x949d_7747_6e26_2c95,
-        0x114b_7501_ad10_4c57,
-    ]),
-);
-
-/// The node commitment is randomized again by the position in order to supply the
-/// nullifier computation with a unique input w.r.t. the note being spent, to prevent
-/// Faerie gold attacks.
-pub const NULLIFIER_POSITION_GENERATOR: SubgroupPoint = SubgroupPoint::from_raw_unchecked(
-    bls12_381::Scalar::from_raw([
-        0x2ce3_3921_888d_30db,
-        0xe81c_ee09_a561_229e,
-        0xdb56_b6db_8d80_75ed,
-        0x2400_c2e2_e336_2644,
-    ]),
-    bls12_381::Scalar::from_raw([
-        0xa3f7_fa36_c72b_0065,
-        0xe155_b8e8_ffff_2e42,
-        0xfc9e_8a15_a096_ba8f,
-        0x6136_9d54_40bf_84a5,
-    ]),
-);
-
-/// The value commitment is used to check balance between inputs and outputs. The value is
-/// placed over this generator.
-pub const VALUE_COMMITMENT_VALUE_GENERATOR: SubgroupPoint = SubgroupPoint::from_raw_unchecked(
-    bls12_381::Scalar::from_raw([
-        0x3618_3b2c_b4d7_ef51,
-        0x9472_c89a_c043_042d,
-        0xd861_8ed1_d15f_ef4e,
-        0x273f_910d_9ecc_1615,
-    ]),
-    bls12_381::Scalar::from_raw([
-        0xa77a_81f5_0667_c8d7,
-        0xbc33_32d0_fa1c_cd18,
-        0xd322_94fd_8977_4ad6,
-        0x466a_7e3a_82f6_7ab1,
-    ]),
-);
-
-/// The value commitment is randomized over this generator, for privacy.
-pub const VALUE_COMMITMENT_RANDOMNESS_GENERATOR: SubgroupPoint = SubgroupPoint::from_raw_unchecked(
-    bls12_381::Scalar::from_raw([
-        0x3bce_3b77_9366_4337,
-        0xd1d8_da41_af03_744e,
-        0x7ff6_826a_d580_04b4,
-        0x6800_f4fa_0f00_1cfc,
-    ]),
-    bls12_381::Scalar::from_raw([
-        0x3cae_fab9_380b_6a8b,
-        0xad46_f1b0_473b_803b,
-        0xe6fb_2a6e_1e22_ab50,
-        0x6d81_d3a9_cb45_dedb,
-    ]),
-);
-
-/// The spender proves discrete log with respect to this base at spend time.
-pub const SPENDING_KEY_GENERATOR: SubgroupPoint = SubgroupPoint::from_raw_unchecked(
-    bls12_381::Scalar::from_raw([
-        0x47bf_4692_0a95_a753,
-        0xd5b9_a7d3_ef8e_2827,
-        0xd418_a7ff_2675_3b6a,
-        0x0926_d4f3_2059_c712,
-    ]),
-    bls12_381::Scalar::from_raw([
-        0x3056_32ad_aaf2_b530,
-        0x6d65_674d_cedb_ddbc,
-        0x53bb_37d0_c21c_fd05,
-        0x57a1_019e_6de9_b675,
-    ]),
-);
-
-/// The generators (for each segment) used in all Pedersen commitments.
-pub const PEDERSEN_HASH_GENERATORS: &[SubgroupPoint] = &[
-    SubgroupPoint::from_raw_unchecked(
-        bls12_381::Scalar::from_raw([
-            0x194e_4292_6f66_1b51,
-            0x2f0c_718f_6f0f_badd,
-            0xb5ea_25de_7ec0_e378,
-            0x73c0_16a4_2ded_9578,
-        ]),
-        bls12_381::Scalar::from_raw([
-            0x77bf_abd4_3224_3cca,
-            0xf947_2e8b_c04e_4632,
-            0x79c9_166b_837e_dc5e,
-            0x289e_87a2_d352_1b57,
-        ]),
-    ),
-    SubgroupPoint::from_raw_unchecked(
-        bls12_381::Scalar::from_raw([
-            0xb981_9dc8_2d90_607e,
-            0xa361_ee3f_d48f_df77,
-            0x52a3_5a8c_1908_dd87,
-            0x15a3_6d1f_0f39_0d88,
-        ]),
-        bls12_381::Scalar::from_raw([
-            0x7b0d_c53c_4ebf_1891,
-            0x1f3a_beeb_98fa_d3e8,
-            0xf789_1142_c001_d925,
-            0x015d_8c7f_5b43_fe33,
-        ]),
-    ),
-    SubgroupPoint::from_raw_unchecked(
-        bls12_381::Scalar::from_raw([
-            0x76d6_f7c2_b67f_c475,
-            0xbae8_e5c4_6641_ae5c,
-            0xeb69_ae39_f5c8_4210,
-            0x6643_21a5_8246_e2f6,
-        ]),
-        bls12_381::Scalar::from_raw([
-            0x80ed_502c_9793_d457,
-            0x8bb2_2a7f_1784_b498,
-            0xe000_a46c_8e8c_e853,
-            0x362e_1500_d24e_ee9e,
-        ]),
-    ),
-    SubgroupPoint::from_raw_unchecked(
-        bls12_381::Scalar::from_raw([
-            0x4c76_7804_c1c4_a2cc,
-            0x7d02_d50e_654b_87f2,
-            0xedc5_f4a9_cff2_9fd5,
-            0x323a_6548_ce9d_9876,
-        ]),
-        bls12_381::Scalar::from_raw([
-            0x8471_4bec_a335_70e9,
-            0x5103_afa1_a11f_6a85,
-            0x9107_0acb_d8d9_47b7,
-            0x2f7e_e40c_4b56_cad8,
-        ]),
-    ),
-    SubgroupPoint::from_raw_unchecked(
-        bls12_381::Scalar::from_raw([
-            0x4680_9430_657f_82d1,
-            0xefd5_9313_05f2_f0bf,
-            0x89b6_4b4e_0336_2796,
-            0x3bd2_6660_00b5_4796,
-        ]),
-        bls12_381::Scalar::from_raw([
-            0x9996_8299_c365_8aef,
-            0xb3b9_d809_5859_d14c,
-            0x3978_3238_1406_c9e5,
-            0x494b_c521_03ab_9d0a,
-        ]),
-    ),
-    SubgroupPoint::from_raw_unchecked(
-        bls12_381::Scalar::from_raw([
-            0xcb3c_0232_58d3_2079,
-            0x1d9e_5ca2_1135_ff6f,
-            0xda04_9746_d76d_3ee5,
-            0x6344_7b2b_a31b_b28a,
-        ]),
-        bls12_381::Scalar::from_raw([
-            0x4360_8211_9f8d_629a,
-            0xa802_00d2_c66b_13a7,
-            0x64cd_b107_0a13_6a28,
-            0x64ec_4689_e8bf_b6e5,
-        ]),
-    ),
-];
-
-/// The maximum number of chunks per segment of the Pedersen hash.
-pub const PEDERSEN_HASH_CHUNKS_PER_GENERATOR: usize = 63;
-
-/// The window size for exponentiation of Pedersen hash generators outside the circuit.
-pub const PEDERSEN_HASH_EXP_WINDOW_SIZE: u32 = 8;
-
-lazy_static! {
-    /// The exp table for [`PEDERSEN_HASH_GENERATORS`].
-    pub static ref PEDERSEN_HASH_EXP_TABLE: Vec<Vec<Vec<SubgroupPoint>>> =
-        generate_pedersen_hash_exp_table();
-}
-
-/// Creates the exp table for the Pedersen hash generators.
-fn generate_pedersen_hash_exp_table() -> Vec<Vec<Vec<SubgroupPoint>>> {
-    let window = PEDERSEN_HASH_EXP_WINDOW_SIZE;
-
-    PEDERSEN_HASH_GENERATORS
-        .iter()
-        .cloned()
-        .map(|mut g| {
-            let mut tables = vec![];
-
-            let mut num_bits = 0;
-            while num_bits <= jubjub::Fr::NUM_BITS {
-                let mut table = Vec::with_capacity(1 << window);
-                let mut base = SubgroupPoint::identity();
-
-                for _ in 0..(1 << window) {
-                    table.push(base);
-                    base += g;
-                }
-
-                tables.push(table);
-                num_bits += window;
-
-                for _ in 0..window {
-                    g = g.double();
-                }
-            }
-
-            tables
-        })
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use jubjub::SubgroupPoint;
-
-    use super::*;
-    use crate::sapling::group_hash::group_hash;
-
-    fn find_group_hash(m: &[u8], personalization: &[u8; 8]) -> SubgroupPoint {
-        let mut tag = m.to_vec();
-        let i = tag.len();
-        tag.push(0u8);
-
-        loop {
-            let gh = group_hash(&tag, personalization);
-
-            // We don't want to overflow and start reusing generators
-            assert!(tag[i] != u8::max_value());
-            tag[i] += 1;
-
-            if let Some(gh) = gh {
-                break gh;
-            }
-        }
-    }
-
-    #[test]
-    fn proof_generation_key_base_generator() {
-        assert_eq!(
-            find_group_hash(&[], PROOF_GENERATION_KEY_BASE_GENERATOR_PERSONALIZATION),
-            PROOF_GENERATION_KEY_GENERATOR,
-        );
-    }
-
-    #[test]
-    fn note_commitment_randomness_generator() {
-        assert_eq!(
-            find_group_hash(b"r", PEDERSEN_HASH_GENERATORS_PERSONALIZATION),
-            NOTE_COMMITMENT_RANDOMNESS_GENERATOR,
-        );
-    }
-
-    #[test]
-    fn nullifier_position_generator() {
-        assert_eq!(
-            find_group_hash(&[], NULLIFIER_POSITION_IN_TREE_GENERATOR_PERSONALIZATION),
-            NULLIFIER_POSITION_GENERATOR,
-        );
-    }
-
-    #[test]
-    fn value_commitment_value_generator() {
-        assert_eq!(
-            find_group_hash(b"v", VALUE_COMMITMENT_GENERATOR_PERSONALIZATION),
-            VALUE_COMMITMENT_VALUE_GENERATOR,
-        );
-    }
-
-    #[test]
-    fn value_commitment_randomness_generator() {
-        assert_eq!(
-            find_group_hash(b"r", VALUE_COMMITMENT_GENERATOR_PERSONALIZATION),
-            VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-        );
-    }
-
-    #[test]
-    fn spending_key_generator() {
-        assert_eq!(
-            find_group_hash(&[], SPENDING_KEY_GENERATOR_PERSONALIZATION),
-            SPENDING_KEY_GENERATOR,
-        );
-    }
-
-    #[test]
-    fn pedersen_hash_generators() {
-        for (m, actual) in PEDERSEN_HASH_GENERATORS.iter().enumerate() {
-            assert_eq!(
-                &find_group_hash(
-                    &(m as u32).to_le_bytes(),
-                    PEDERSEN_HASH_GENERATORS_PERSONALIZATION
-                ),
-                actual
-            );
-        }
-    }
-
-    #[test]
-    fn no_duplicate_fixed_base_generators() {
-        let fixed_base_generators = [
-            PROOF_GENERATION_KEY_GENERATOR,
-            NOTE_COMMITMENT_RANDOMNESS_GENERATOR,
-            NULLIFIER_POSITION_GENERATOR,
-            VALUE_COMMITMENT_VALUE_GENERATOR,
-            VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-            SPENDING_KEY_GENERATOR,
-        ];
-
-        // Check for duplicates, far worse than spec inconsistencies!
-        for (i, p1) in fixed_base_generators.iter().enumerate() {
-            if p1.is_identity().into() {
-                panic!("Neutral element!");
-            }
-
-            for p2 in fixed_base_generators.iter().skip(i + 1) {
-                if p1 == p2 {
-                    panic!("Duplicate generator!");
-                }
-            }
-        }
-    }
-
-    /// Check for simple relations between the generators, that make finding collisions easy;
-    /// far worse than spec inconsistencies!
-    fn check_consistency_of_pedersen_hash_generators(
-        pedersen_hash_generators: &[jubjub::SubgroupPoint],
-    ) {
-        for (i, p1) in pedersen_hash_generators.iter().enumerate() {
-            if p1.is_identity().into() {
-                panic!("Neutral element!");
-            }
-            for p2 in pedersen_hash_generators.iter().skip(i + 1) {
-                if p1 == p2 {
-                    panic!("Duplicate generator!");
-                }
-                if *p1 == -p2 {
-                    panic!("Inverse generator!");
-                }
-            }
-
-            // check for a generator being the sum of any other two
-            for (j, p2) in pedersen_hash_generators.iter().enumerate() {
-                if j == i {
-                    continue;
-                }
-                for (k, p3) in pedersen_hash_generators.iter().enumerate() {
-                    if k == j || k == i {
-                        continue;
-                    }
-                    let sum = p2 + p3;
-                    if sum == *p1 {
-                        panic!("Linear relation between generators!");
-                    }
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn pedersen_hash_generators_consistency() {
-        check_consistency_of_pedersen_hash_generators(PEDERSEN_HASH_GENERATORS);
-    }
-
-    #[test]
-    #[should_panic(expected = "Linear relation between generators!")]
-    fn test_jubjub_bls12_pedersen_hash_generators_consistency_check_linear_relation() {
-        let mut pedersen_hash_generators = PEDERSEN_HASH_GENERATORS.to_vec();
-
-        // Test for linear relation
-        pedersen_hash_generators.push(PEDERSEN_HASH_GENERATORS[0] + PEDERSEN_HASH_GENERATORS[1]);
-
-        check_consistency_of_pedersen_hash_generators(&pedersen_hash_generators);
-    }
-}
diff --git a/zcash_primitives/src/constants/mainnet.rs b/zcash_primitives/src/constants/mainnet.rs
deleted file mode 100644
index bd0e473f43..0000000000
--- a/zcash_primitives/src/constants/mainnet.rs
+++ /dev/null
@@ -1,40 +0,0 @@
-//! Constants for the Zcash main network.
-
-/// The mainnet coin type for ZEC, as defined by [SLIP 44].
-///
-/// [SLIP 44]: https://github.com/satoshilabs/slips/blob/master/slip-0044.md
-pub const COIN_TYPE: u32 = 133;
-
-/// The HRP for a Bech32-encoded mainnet [`ExtendedSpendingKey`].
-///
-/// Defined in [ZIP 32].
-///
-/// [`ExtendedSpendingKey`]: crate::zip32::ExtendedSpendingKey
-/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
-pub const HRP_SAPLING_EXTENDED_SPENDING_KEY: &str = "secret-extended-key-main";
-
-/// The HRP for a Bech32-encoded mainnet [`ExtendedFullViewingKey`].
-///
-/// Defined in [ZIP 32].
-///
-/// [`ExtendedFullViewingKey`]: crate::zip32::ExtendedFullViewingKey
-/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
-pub const HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY: &str = "zxviews";
-
-/// The HRP for a Bech32-encoded mainnet [`PaymentAddress`].
-///
-/// Defined in section 5.6.4 of the [Zcash Protocol Specification].
-///
-/// [`PaymentAddress`]: crate::sapling::PaymentAddress
-/// [Zcash Protocol Specification]: https://github.com/zcash/zips/blob/master/protocol/protocol.pdf
-pub const HRP_SAPLING_PAYMENT_ADDRESS: &str = "zs";
-
-/// The prefix for a Base58Check-encoded mainnet [`TransparentAddress::PublicKey`].
-///
-/// [`TransparentAddress::PublicKey`]: crate::legacy::TransparentAddress::PublicKey
-pub const B58_PUBKEY_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xb8];
-
-/// The prefix for a Base58Check-encoded mainnet [`TransparentAddress::Script`].
-///
-/// [`TransparentAddress::Script`]: crate::legacy::TransparentAddress::Script
-pub const B58_SCRIPT_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xbd];
diff --git a/zcash_primitives/src/constants/regtest.rs b/zcash_primitives/src/constants/regtest.rs
deleted file mode 100644
index 86fb95eb91..0000000000
--- a/zcash_primitives/src/constants/regtest.rs
+++ /dev/null
@@ -1,46 +0,0 @@
-//! # Regtest constants
-//!
-//! `regtest` is a `zcashd`-specific environment used for local testing. They mostly reuse
-//! the testnet constants.
-//! These constants are defined in [the `zcashd` codebase].
-//!
-//! [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L482-L496>
-
-/// The regtest cointype reuses the testnet cointype
-pub const COIN_TYPE: u32 = 1;
-
-/// The HRP for a Bech32-encoded regtest [`ExtendedSpendingKey`].
-///
-/// It is defined in [the `zcashd` codebase].
-///
-/// [`ExtendedSpendingKey`]: crate::zip32::ExtendedSpendingKey
-/// [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L496>
-pub const HRP_SAPLING_EXTENDED_SPENDING_KEY: &str = "secret-extended-key-regtest";
-
-/// The HRP for a Bech32-encoded regtest [`ExtendedFullViewingKey`].
-///
-/// It is defined in [the `zcashd` codebase].
-///
-/// [`ExtendedFullViewingKey`]: crate::zip32::ExtendedFullViewingKey
-/// [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L494>
-pub const HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY: &str = "zxviewregtestsapling";
-
-/// The HRP for a Bech32-encoded regtest [`PaymentAddress`].
-///
-/// It is defined in [the `zcashd` codebase].
-///
-/// [`PaymentAddress`]: crate::sapling::PaymentAddress
-/// [the `zcashd` codebase]: <https://github.com/zcash/zcash/blob/128d863fb8be39ee294fda397c1ce3ba3b889cb2/src/chainparams.cpp#L493>
-pub const HRP_SAPLING_PAYMENT_ADDRESS: &str = "zregtestsapling";
-
-/// The prefix for a Base58Check-encoded regtest [`TransparentAddress::PublicKey`].
-/// Same as the testnet prefix.
-///
-/// [`TransparentAddress::PublicKey`]: crate::legacy::TransparentAddress::PublicKey
-pub const B58_PUBKEY_ADDRESS_PREFIX: [u8; 2] = [0x1d, 0x25];
-
-/// The prefix for a Base58Check-encoded regtest [`TransparentAddress::Script`].
-/// Same as the testnet prefix.
-///
-/// [`TransparentAddress::Script`]: crate::legacy::TransparentAddress::Script
-pub const B58_SCRIPT_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xba];
diff --git a/zcash_primitives/src/constants/testnet.rs b/zcash_primitives/src/constants/testnet.rs
deleted file mode 100644
index d11c0e9830..0000000000
--- a/zcash_primitives/src/constants/testnet.rs
+++ /dev/null
@@ -1,40 +0,0 @@
-//! Constants for the Zcash test network.
-
-/// The testnet coin type for ZEC, as defined by [SLIP 44].
-///
-/// [SLIP 44]: https://github.com/satoshilabs/slips/blob/master/slip-0044.md
-pub const COIN_TYPE: u32 = 1;
-
-/// The HRP for a Bech32-encoded testnet [`ExtendedSpendingKey`].
-///
-/// Defined in [ZIP 32].
-///
-/// [`ExtendedSpendingKey`]: crate::zip32::ExtendedSpendingKey
-/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
-pub const HRP_SAPLING_EXTENDED_SPENDING_KEY: &str = "secret-extended-key-test";
-
-/// The HRP for a Bech32-encoded testnet [`ExtendedFullViewingKey`].
-///
-/// Defined in [ZIP 32].
-///
-/// [`ExtendedFullViewingKey`]: crate::zip32::ExtendedFullViewingKey
-/// [ZIP 32]: https://github.com/zcash/zips/blob/master/zip-0032.rst
-pub const HRP_SAPLING_EXTENDED_FULL_VIEWING_KEY: &str = "zxviewtestsapling";
-
-/// The HRP for a Bech32-encoded testnet [`PaymentAddress`].
-///
-/// Defined in section 5.6.4 of the [Zcash Protocol Specification].
-///
-/// [`PaymentAddress`]: crate::sapling::PaymentAddress
-/// [Zcash Protocol Specification]: https://github.com/zcash/zips/blob/master/protocol/protocol.pdf
-pub const HRP_SAPLING_PAYMENT_ADDRESS: &str = "ztestsapling";
-
-/// The prefix for a Base58Check-encoded testnet [`TransparentAddress::PublicKey`].
-///
-/// [`TransparentAddress::PublicKey`]: crate::legacy::TransparentAddress::PublicKey
-pub const B58_PUBKEY_ADDRESS_PREFIX: [u8; 2] = [0x1d, 0x25];
-
-/// The prefix for a Base58Check-encoded testnet [`TransparentAddress::Script`].
-///
-/// [`TransparentAddress::Script`]: crate::legacy::TransparentAddress::Script
-pub const B58_SCRIPT_ADDRESS_PREFIX: [u8; 2] = [0x1c, 0xba];
diff --git a/zcash_primitives/src/extensions/transparent.rs b/zcash_primitives/src/extensions/transparent.rs
index 9f53bd3008..65ed7f78f7 100644
--- a/zcash_primitives/src/extensions/transparent.rs
+++ b/zcash_primitives/src/extensions/transparent.rs
@@ -14,7 +14,7 @@ pub struct AuthData(pub Vec<u8>);
 /// Binary parsing capability for TZE preconditions & witnesses.
 ///
 /// Serialization formats interpreted by implementations of this trait become consensus-critical
-/// upon activation of of the extension that uses them.
+/// upon activation of the extension that uses them.
 pub trait FromPayload: Sized {
     type Error;
 
@@ -25,7 +25,7 @@ pub trait FromPayload: Sized {
 /// Binary serialization capability for TZE preconditions & witnesses.
 ///
 /// Serialization formats used by implementations of this trait become consensus-critical upon
-/// activation of of the extension that uses them.
+/// activation of the extension that uses them.
 pub trait ToPayload {
     /// Returns a serialized payload and its corresponding mode.
     fn to_payload(&self) -> (u32, Vec<u8>);
diff --git a/zcash_primitives/src/keys.rs b/zcash_primitives/src/keys.rs
deleted file mode 100644
index ea085b2a1e..0000000000
--- a/zcash_primitives/src/keys.rs
+++ /dev/null
@@ -1,22 +0,0 @@
-use blake2b_simd::{Hash as Blake2bHash, Params as Blake2bParams};
-
-pub use crate::sapling::keys::OutgoingViewingKey;
-
-pub const PRF_EXPAND_PERSONALIZATION: &[u8; 16] = b"Zcash_ExpandSeed";
-
-/// PRF^expand(sk, t) := BLAKE2b-512("Zcash_ExpandSeed", sk || t)
-pub fn prf_expand(sk: &[u8], t: &[u8]) -> Blake2bHash {
-    prf_expand_vec(sk, &[t])
-}
-
-pub fn prf_expand_vec(sk: &[u8], ts: &[&[u8]]) -> Blake2bHash {
-    let mut h = Blake2bParams::new()
-        .hash_length(64)
-        .personal(PRF_EXPAND_PERSONALIZATION)
-        .to_state();
-    h.update(sk);
-    for t in ts {
-        h.update(t);
-    }
-    h.finalize()
-}
diff --git a/zcash_primitives/src/legacy.rs b/zcash_primitives/src/legacy.rs
index e1d12a766f..b01c6d1471 100644
--- a/zcash_primitives/src/legacy.rs
+++ b/zcash_primitives/src/legacy.rs
@@ -1,6 +1,9 @@
 //! Support for legacy transparent addresses and scripts.
 
 use byteorder::{ReadBytesExt, WriteBytesExt};
+use zcash_address::TryFromRawAddress;
+
+use std::fmt;
 use std::io::{self, Read, Write};
 use std::ops::Shl;
 
@@ -9,29 +12,307 @@ use zcash_encoding::Vector;
 #[cfg(feature = "transparent-inputs")]
 pub mod keys;
 
-/// Minimal subset of script opcodes.
+/// Defined script opcodes.
+///
+/// Most of the opcodes are unused by this crate, but we define them so that the alternate
+/// `Debug` impl for [`Script`] renders correctly for unexpected scripts.
+#[derive(Debug)]
 enum OpCode {
     // push value
+    Op0 = 0x00, // False
     PushData1 = 0x4c,
     PushData2 = 0x4d,
     PushData4 = 0x4e,
+    Negative1 = 0x4f,
+    Reserved = 0x50,
+    Op1 = 0x51, // True
+    Op2 = 0x52,
+    Op3 = 0x53,
+    Op4 = 0x54,
+    Op5 = 0x55,
+    Op6 = 0x56,
+    Op7 = 0x57,
+    Op8 = 0x58,
+    Op9 = 0x59,
+    Op10 = 0x5a,
+    Op11 = 0x5b,
+    Op12 = 0x5c,
+    Op13 = 0x5d,
+    Op14 = 0x5e,
+    Op15 = 0x5f,
+    Op16 = 0x60,
+
+    // control
+    Nop = 0x61,
+    Ver = 0x62,
+    If = 0x63,
+    NotIf = 0x64,
+    VerIf = 0x65,
+    VerNotIf = 0x66,
+    Else = 0x67,
+    EndIf = 0x68,
+    Verify = 0x69,
+    Return = 0x6a,
 
     // stack ops
+    ToAltStack = 0x6b,
+    FromAltStack = 0x6c,
+    Drop2 = 0x6d,
+    Dup2 = 0x6e,
+    Dup3 = 0x6f,
+    Over2 = 0x70,
+    Rot2 = 0x71,
+    Swap2 = 0x72,
+    IfDup = 0x73,
+    Depth = 0x74,
+    Drop = 0x75,
     Dup = 0x76,
+    Nip = 0x77,
+    Over = 0x78,
+    Pick = 0x79,
+    Roll = 0x7a,
+    Rot = 0x7b,
+    Swap = 0x7c,
+    Tuck = 0x7d,
+
+    // splice ops
+    Cat = 0x7e,    // Disabled
+    Substr = 0x7f, // Disabled
+    Left = 0x80,   // Disabled
+    Right = 0x81,  // Disabled
+    Size = 0x82,
 
     // bit logic
+    Invert = 0x83, // Disabled
+    And = 0x84,    // Disabled
+    Or = 0x85,     // Disabled
+    Xor = 0x86,    // Disabled
     Equal = 0x87,
     EqualVerify = 0x88,
+    Reserved1 = 0x89,
+    Reserved2 = 0x8a,
+
+    // numeric
+    Add1 = 0x8b,
+    Sub1 = 0x8c,
+    Mul2 = 0x8d, // Disabled
+    Div2 = 0x8e, // Disabled
+    Negate = 0x8f,
+    Abs = 0x90,
+    Not = 0x91,
+    NotEqual0 = 0x92,
+
+    Add = 0x93,
+    Sub = 0x94,
+    Mul = 0x95,    // Disabled
+    Div = 0x96,    // Disabled
+    Mod = 0x97,    // Disabled
+    LShift = 0x98, // Disabled
+    RShift = 0x99, // Disabled
+
+    BoolAnd = 0x9a,
+    BoolOr = 0x9b,
+    NumEqual = 0x9c,
+    NumEqualVerify = 0x9d,
+    NumNotEqual = 0x9e,
+    LessThan = 0x9f,
+    GreaterThan = 0xa0,
+    LessThanOrEqual = 0xa1,
+    GreaterThanOrEqual = 0xa2,
+    Min = 0xa3,
+    Max = 0xa4,
+
+    Within = 0xa5,
 
     // crypto
+    Ripemd160 = 0xa6,
+    Sha1 = 0xa7,
+    Sha256 = 0xa8,
     Hash160 = 0xa9,
+    Hash256 = 0xaa,
+    CodeSeparator = 0xab, // Disabled
     CheckSig = 0xac,
+    CheckSigVerify = 0xad,
+    CheckMultisig = 0xae,
+    CheckMultisigVerify = 0xaf,
+
+    // expansion
+    Nop1 = 0xb0,
+    CheckLockTimeVerify = 0xb1,
+    Nop3 = 0xb2,
+    Nop4 = 0xb3,
+    Nop5 = 0xb4,
+    Nop6 = 0xb5,
+    Nop7 = 0xb6,
+    Nop8 = 0xb7,
+    Nop9 = 0xb8,
+    Nop10 = 0xb9,
+
+    Invalid = 0xff,
+}
+
+impl OpCode {
+    fn parse(b: u8) -> Option<Self> {
+        match b {
+            0x00 => Some(OpCode::Op0),
+            0x4c => Some(OpCode::PushData1),
+            0x4d => Some(OpCode::PushData2),
+            0x4e => Some(OpCode::PushData4),
+            0x4f => Some(OpCode::Negative1),
+            0x50 => Some(OpCode::Reserved),
+            0x51 => Some(OpCode::Op1),
+            0x52 => Some(OpCode::Op2),
+            0x53 => Some(OpCode::Op3),
+            0x54 => Some(OpCode::Op4),
+            0x55 => Some(OpCode::Op5),
+            0x56 => Some(OpCode::Op6),
+            0x57 => Some(OpCode::Op7),
+            0x58 => Some(OpCode::Op8),
+            0x59 => Some(OpCode::Op9),
+            0x5a => Some(OpCode::Op10),
+            0x5b => Some(OpCode::Op11),
+            0x5c => Some(OpCode::Op12),
+            0x5d => Some(OpCode::Op13),
+            0x5e => Some(OpCode::Op14),
+            0x5f => Some(OpCode::Op15),
+            0x60 => Some(OpCode::Op16),
+            0x61 => Some(OpCode::Nop),
+            0x62 => Some(OpCode::Ver),
+            0x63 => Some(OpCode::If),
+            0x64 => Some(OpCode::NotIf),
+            0x65 => Some(OpCode::VerIf),
+            0x66 => Some(OpCode::VerNotIf),
+            0x67 => Some(OpCode::Else),
+            0x68 => Some(OpCode::EndIf),
+            0x69 => Some(OpCode::Verify),
+            0x6a => Some(OpCode::Return),
+            0x6b => Some(OpCode::ToAltStack),
+            0x6c => Some(OpCode::FromAltStack),
+            0x6d => Some(OpCode::Drop2),
+            0x6e => Some(OpCode::Dup2),
+            0x6f => Some(OpCode::Dup3),
+            0x70 => Some(OpCode::Over2),
+            0x71 => Some(OpCode::Rot2),
+            0x72 => Some(OpCode::Swap2),
+            0x73 => Some(OpCode::IfDup),
+            0x74 => Some(OpCode::Depth),
+            0x75 => Some(OpCode::Drop),
+            0x76 => Some(OpCode::Dup),
+            0x77 => Some(OpCode::Nip),
+            0x78 => Some(OpCode::Over),
+            0x79 => Some(OpCode::Pick),
+            0x7a => Some(OpCode::Roll),
+            0x7b => Some(OpCode::Rot),
+            0x7c => Some(OpCode::Swap),
+            0x7d => Some(OpCode::Tuck),
+            0x7e => Some(OpCode::Cat),
+            0x7f => Some(OpCode::Substr),
+            0x80 => Some(OpCode::Left),
+            0x81 => Some(OpCode::Right),
+            0x82 => Some(OpCode::Size),
+            0x83 => Some(OpCode::Invert),
+            0x84 => Some(OpCode::And),
+            0x85 => Some(OpCode::Or),
+            0x86 => Some(OpCode::Xor),
+            0x87 => Some(OpCode::Equal),
+            0x88 => Some(OpCode::EqualVerify),
+            0x89 => Some(OpCode::Reserved1),
+            0x8a => Some(OpCode::Reserved2),
+            0x8b => Some(OpCode::Add1),
+            0x8c => Some(OpCode::Sub1),
+            0x8d => Some(OpCode::Mul2),
+            0x8e => Some(OpCode::Div2),
+            0x8f => Some(OpCode::Negate),
+            0x90 => Some(OpCode::Abs),
+            0x91 => Some(OpCode::Not),
+            0x92 => Some(OpCode::NotEqual0),
+            0x93 => Some(OpCode::Add),
+            0x94 => Some(OpCode::Sub),
+            0x95 => Some(OpCode::Mul),
+            0x96 => Some(OpCode::Div),
+            0x97 => Some(OpCode::Mod),
+            0x98 => Some(OpCode::LShift),
+            0x99 => Some(OpCode::RShift),
+            0x9a => Some(OpCode::BoolAnd),
+            0x9b => Some(OpCode::BoolOr),
+            0x9c => Some(OpCode::NumEqual),
+            0x9d => Some(OpCode::NumEqualVerify),
+            0x9e => Some(OpCode::NumNotEqual),
+            0x9f => Some(OpCode::LessThan),
+            0xa0 => Some(OpCode::GreaterThan),
+            0xa1 => Some(OpCode::LessThanOrEqual),
+            0xa2 => Some(OpCode::GreaterThanOrEqual),
+            0xa3 => Some(OpCode::Min),
+            0xa4 => Some(OpCode::Max),
+            0xa5 => Some(OpCode::Within),
+            0xa6 => Some(OpCode::Ripemd160),
+            0xa7 => Some(OpCode::Sha1),
+            0xa8 => Some(OpCode::Sha256),
+            0xa9 => Some(OpCode::Hash160),
+            0xaa => Some(OpCode::Hash256),
+            0xab => Some(OpCode::CodeSeparator),
+            0xac => Some(OpCode::CheckSig),
+            0xad => Some(OpCode::CheckSigVerify),
+            0xae => Some(OpCode::CheckMultisig),
+            0xaf => Some(OpCode::CheckMultisigVerify),
+            0xb0 => Some(OpCode::Nop1),
+            0xb1 => Some(OpCode::CheckLockTimeVerify),
+            0xb2 => Some(OpCode::Nop3),
+            0xb3 => Some(OpCode::Nop4),
+            0xb4 => Some(OpCode::Nop5),
+            0xb5 => Some(OpCode::Nop6),
+            0xb6 => Some(OpCode::Nop7),
+            0xb7 => Some(OpCode::Nop8),
+            0xb8 => Some(OpCode::Nop9),
+            0xb9 => Some(OpCode::Nop10),
+            0xff => Some(OpCode::Invalid),
+            _ => None,
+        }
+    }
 }
 
 /// A serialized script, used inside transparent inputs and outputs of a transaction.
-#[derive(Clone, Debug, Default, PartialEq, Eq)]
+#[derive(Clone, Default, PartialEq, Eq)]
 pub struct Script(pub Vec<u8>);
 
+impl fmt::Debug for Script {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        struct ScriptPrinter<'s>(&'s [u8]);
+        impl<'s> fmt::Debug for ScriptPrinter<'s> {
+            fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+                let mut l = f.debug_list();
+                let mut unknown: Option<String> = None;
+                for b in self.0 {
+                    if let Some(opcode) = OpCode::parse(*b) {
+                        if let Some(s) = unknown.take() {
+                            l.entry(&s);
+                        }
+                        l.entry(&opcode);
+                    } else {
+                        let encoded = format!("{:02x}", b);
+                        if let Some(s) = &mut unknown {
+                            s.push_str(&encoded);
+                        } else {
+                            unknown = Some(encoded);
+                        }
+                    }
+                }
+                l.finish()
+            }
+        }
+
+        if f.alternate() {
+            f.debug_tuple("Script")
+                .field(&ScriptPrinter(&self.0))
+                .finish()
+        } else {
+            f.debug_tuple("Script")
+                .field(&hex::encode(&self.0))
+                .finish()
+        }
+    }
+}
+
 impl Script {
     pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
         let script = Vector::read(&mut reader, |r| r.read_u8())?;
@@ -42,6 +323,11 @@ impl Script {
         Vector::write(&mut writer, &self.0, |w, e| w.write_u8(*e))
     }
 
+    /// Returns the length of this script as encoded (including the initial CompactSize).
+    pub fn serialized_size(&self) -> usize {
+        Vector::serialized_size_of_u8_vec(&self.0)
+    }
+
     /// Returns the address that this Script contains, if any.
     pub(crate) fn address(&self) -> Option<TransparentAddress> {
         if self.0.len() == 25
@@ -50,14 +336,14 @@ impl Script {
         {
             let mut hash = [0; 20];
             hash.copy_from_slice(&self.0[3..23]);
-            Some(TransparentAddress::PublicKey(hash))
+            Some(TransparentAddress::PublicKeyHash(hash))
         } else if self.0.len() == 23
             && self.0[0..2] == [OpCode::Hash160 as u8, 0x14]
             && self.0[22] == OpCode::Equal as u8
         {
             let mut hash = [0; 20];
             hash.copy_from_slice(&self.0[2..22]);
-            Some(TransparentAddress::Script(hash))
+            Some(TransparentAddress::ScriptHash(hash))
         } else {
             None
         }
@@ -94,18 +380,18 @@ impl Shl<&[u8]> for Script {
     }
 }
 
-/// A transparent address corresponding to either a public key or a `Script`.
+/// A transparent address corresponding to either a public key hash or a script hash.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum TransparentAddress {
-    PublicKey([u8; 20]), // TODO: Rename to PublicKeyHash
-    Script([u8; 20]),    // TODO: Rename to ScriptHash
+    PublicKeyHash([u8; 20]),
+    ScriptHash([u8; 20]),
 }
 
 impl TransparentAddress {
     /// Generate the `scriptPubKey` corresponding to this address.
     pub fn script(&self) -> Script {
         match self {
-            TransparentAddress::PublicKey(key_id) => {
+            TransparentAddress::PublicKeyHash(key_id) => {
                 // P2PKH script
                 Script::default()
                     << OpCode::Dup
@@ -114,7 +400,7 @@ impl TransparentAddress {
                     << OpCode::EqualVerify
                     << OpCode::CheckSig
             }
-            TransparentAddress::Script(script_id) => {
+            TransparentAddress::ScriptHash(script_id) => {
                 // P2SH script
                 Script::default() << OpCode::Hash160 << &script_id[..] << OpCode::Equal
             }
@@ -122,6 +408,22 @@ impl TransparentAddress {
     }
 }
 
+impl TryFromRawAddress for TransparentAddress {
+    type Error = ();
+
+    fn try_from_raw_transparent_p2pkh(
+        data: [u8; 20],
+    ) -> Result<Self, zcash_address::ConversionError<Self::Error>> {
+        Ok(TransparentAddress::PublicKeyHash(data))
+    }
+
+    fn try_from_raw_transparent_p2sh(
+        data: [u8; 20],
+    ) -> Result<Self, zcash_address::ConversionError<Self::Error>> {
+        Ok(TransparentAddress::ScriptHash(data))
+    }
+}
+
 #[cfg(any(test, feature = "test-dependencies"))]
 pub mod testing {
     use proptest::prelude::{any, prop_compose};
@@ -130,7 +432,7 @@ pub mod testing {
 
     prop_compose! {
         pub fn arb_transparent_addr()(v in proptest::array::uniform20(any::<u8>())) -> TransparentAddress {
-            TransparentAddress::PublicKey(v)
+            TransparentAddress::PublicKeyHash(v)
         }
     }
 }
@@ -155,7 +457,7 @@ mod tests {
         }
 
         {
-            let short_data = vec![2; 100];
+            let short_data = [2; 100];
             let script = Script::default() << &short_data[..];
             assert_eq!(script.0[0], OpCode::PushData1 as u8);
             assert_eq!(script.0[1] as usize, 100);
@@ -181,7 +483,7 @@ mod tests {
 
     #[test]
     fn p2pkh() {
-        let addr = TransparentAddress::PublicKey([4; 20]);
+        let addr = TransparentAddress::PublicKeyHash([4; 20]);
         assert_eq!(
             &addr.script().0,
             &[
@@ -194,7 +496,7 @@ mod tests {
 
     #[test]
     fn p2sh() {
-        let addr = TransparentAddress::Script([7; 20]);
+        let addr = TransparentAddress::ScriptHash([7; 20]);
         assert_eq!(
             &addr.script().0,
             &[
diff --git a/zcash_primitives/src/legacy/keys.rs b/zcash_primitives/src/legacy/keys.rs
index fead35a812..01b40eeb14 100644
--- a/zcash_primitives/src/legacy/keys.rs
+++ b/zcash_primitives/src/legacy/keys.rs
@@ -1,121 +1,259 @@
-use hdwallet::{
-    traits::{Deserialize, Serialize},
-    ExtendedPrivKey, ExtendedPubKey, KeyIndex,
+//! Transparent key components.
+
+use bip32::{
+    ChildNumber, ExtendedKey, ExtendedKeyAttrs, ExtendedPrivateKey, ExtendedPublicKey, Prefix,
 };
 use secp256k1::PublicKey;
 use sha2::{Digest, Sha256};
+use subtle::{Choice, ConstantTimeEq};
 
-use crate::{consensus, keys::prf_expand_vec, zip32::AccountId};
+use zcash_protocol::consensus::{self, NetworkConstants};
+use zcash_spec::PrfExpand;
+use zip32::AccountId;
 
 use super::TransparentAddress;
 
-const MAX_TRANSPARENT_CHILD_INDEX: u32 = 0x7FFFFFFF;
+/// The scope of a transparent key.
+///
+/// This type can represent [`zip32`] internal and external scopes, as well as custom scopes that
+/// may be used in non-hardened derivation at the `change` level of the BIP 44 key path.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct TransparentKeyScope(u32);
+
+impl TransparentKeyScope {
+    /// Returns an arbitrary custom `TransparentKeyScope`.
+    ///
+    /// This should be used with care: funds associated with keys derived under a custom
+    /// scope may not be recoverable if the wallet seed is restored in another wallet. It
+    /// is usually preferable to use standardized key scopes.
+    pub const fn custom(i: u32) -> Option<Self> {
+        if i < (1 << 31) {
+            Some(TransparentKeyScope(i))
+        } else {
+            None
+        }
+    }
+
+    /// The scope used to derive keys for external transparent addresses,
+    /// intended to be used to send funds to this wallet.
+    pub const EXTERNAL: Self = TransparentKeyScope(0);
+
+    /// The scope used to derive keys for internal wallet operations, e.g.
+    /// change or UTXO management.
+    pub const INTERNAL: Self = TransparentKeyScope(1);
+
+    /// The scope used to derive keys for ephemeral transparent addresses.
+    pub const EPHEMERAL: Self = TransparentKeyScope(2);
+}
+
+impl From<zip32::Scope> for TransparentKeyScope {
+    fn from(value: zip32::Scope) -> Self {
+        match value {
+            zip32::Scope::External => TransparentKeyScope::EXTERNAL,
+            zip32::Scope::Internal => TransparentKeyScope::INTERNAL,
+        }
+    }
+}
+
+impl From<TransparentKeyScope> for ChildNumber {
+    fn from(value: TransparentKeyScope) -> Self {
+        ChildNumber::new(value.0, false).expect("TransparentKeyScope is correct by construction")
+    }
+}
+
+/// A child index for a derived transparent address.
+///
+/// Only NON-hardened derivation is supported.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct NonHardenedChildIndex(u32);
+
+impl ConstantTimeEq for NonHardenedChildIndex {
+    fn ct_eq(&self, other: &Self) -> Choice {
+        self.0.ct_eq(&other.0)
+    }
+}
+
+impl NonHardenedChildIndex {
+    pub const ZERO: NonHardenedChildIndex = NonHardenedChildIndex(0);
 
-/// A type representing a BIP-44 private key at the account path level
-/// `m/44'/<coin_type>'/<account>'
+    /// Parses the given ZIP 32 child index.
+    ///
+    /// Returns `None` if the hardened bit is set.
+    pub fn from_index(i: u32) -> Option<Self> {
+        if i < (1 << 31) {
+            Some(NonHardenedChildIndex(i))
+        } else {
+            None
+        }
+    }
+
+    /// Returns the index as a 32-bit integer.
+    pub fn index(&self) -> u32 {
+        self.0
+    }
+
+    pub fn next(&self) -> Option<Self> {
+        // overflow cannot happen because self.0 is 31 bits, and the next index is at most 32 bits
+        // which in that case would lead from_index to return None.
+        Self::from_index(self.0 + 1)
+    }
+}
+
+impl TryFrom<ChildNumber> for NonHardenedChildIndex {
+    type Error = ();
+
+    fn try_from(value: ChildNumber) -> Result<Self, Self::Error> {
+        if value.is_hardened() {
+            Err(())
+        } else {
+            NonHardenedChildIndex::from_index(value.index()).ok_or(())
+        }
+    }
+}
+
+impl From<NonHardenedChildIndex> for ChildNumber {
+    fn from(value: NonHardenedChildIndex) -> Self {
+        Self::new(value.index(), false).expect("NonHardenedChildIndex is correct by construction")
+    }
+}
+
+/// A [BIP44] private key at the account path level `m/44'/<coin_type>'/<account>'`.
+///
+/// [BIP44]: https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
 #[derive(Clone, Debug)]
-pub struct AccountPrivKey(ExtendedPrivKey);
+pub struct AccountPrivKey(ExtendedPrivateKey<secp256k1::SecretKey>);
 
 impl AccountPrivKey {
-    /// Performs derivation of the extended private key for the BIP-44 path:
+    /// Performs derivation of the extended private key for the BIP44 path:
     /// `m/44'/<coin_type>'/<account>'`.
     ///
     /// This produces the root of the derivation tree for transparent
-    /// viewing keys and addresses for the for the provided account.
+    /// viewing keys and addresses for the provided account.
     pub fn from_seed<P: consensus::Parameters>(
         params: &P,
         seed: &[u8],
         account: AccountId,
-    ) -> Result<AccountPrivKey, hdwallet::error::Error> {
-        ExtendedPrivKey::with_seed(seed)?
-            .derive_private_key(KeyIndex::hardened_from_normalize_index(44)?)?
-            .derive_private_key(KeyIndex::hardened_from_normalize_index(params.coin_type())?)?
-            .derive_private_key(KeyIndex::hardened_from_normalize_index(account.into())?)
+    ) -> Result<AccountPrivKey, bip32::Error> {
+        ExtendedPrivateKey::new(seed)?
+            .derive_child(ChildNumber::new(44, true)?)?
+            .derive_child(ChildNumber::new(params.coin_type(), true)?)?
+            .derive_child(ChildNumber::new(account.into(), true)?)
             .map(AccountPrivKey)
     }
 
-    pub fn from_extended_privkey(extprivkey: ExtendedPrivKey) -> Self {
+    pub fn from_extended_privkey(extprivkey: ExtendedPrivateKey<secp256k1::SecretKey>) -> Self {
         AccountPrivKey(extprivkey)
     }
 
     pub fn to_account_pubkey(&self) -> AccountPubKey {
-        AccountPubKey(ExtendedPubKey::from_private_key(&self.0))
+        AccountPubKey(ExtendedPublicKey::from(&self.0))
     }
 
-    /// Derives the BIP-44 private spending key for the external (incoming payment) child path
-    /// `m/44'/<coin_type>'/<account>'/0/<child_index>`.
-    pub fn derive_external_secret_key(
+    /// Derives the BIP44 private spending key for the child path
+    /// `m/44'/<coin_type>'/<account>'/<scope>/<address_index>`.
+    pub fn derive_secret_key(
         &self,
-        child_index: u32,
-    ) -> Result<secp256k1::SecretKey, hdwallet::error::Error> {
+        scope: TransparentKeyScope,
+        address_index: NonHardenedChildIndex,
+    ) -> Result<secp256k1::SecretKey, bip32::Error> {
         self.0
-            .derive_private_key(KeyIndex::Normal(0))?
-            .derive_private_key(KeyIndex::Normal(child_index))
-            .map(|k| k.private_key)
+            .derive_child(scope.into())?
+            .derive_child(address_index.into())
+            .map(|k| *k.private_key())
+    }
+
+    /// Derives the BIP44 private spending key for the external (incoming payment) child path
+    /// `m/44'/<coin_type>'/<account>'/0/<address_index>`.
+    pub fn derive_external_secret_key(
+        &self,
+        address_index: NonHardenedChildIndex,
+    ) -> Result<secp256k1::SecretKey, bip32::Error> {
+        self.derive_secret_key(zip32::Scope::External.into(), address_index)
     }
 
-    /// Derives the BIP-44 private spending key for the internal (change) child path
-    /// `m/44'/<coin_type>'/<account>'/1/<child_index>`.
+    /// Derives the BIP44 private spending key for the internal (change) child path
+    /// `m/44'/<coin_type>'/<account>'/1/<address_index>`.
     pub fn derive_internal_secret_key(
         &self,
-        child_index: u32,
-    ) -> Result<secp256k1::SecretKey, hdwallet::error::Error> {
-        self.0
-            .derive_private_key(KeyIndex::Normal(1))?
-            .derive_private_key(KeyIndex::Normal(child_index))
-            .map(|k| k.private_key)
+        address_index: NonHardenedChildIndex,
+    ) -> Result<secp256k1::SecretKey, bip32::Error> {
+        self.derive_secret_key(zip32::Scope::Internal.into(), address_index)
     }
 
     /// Returns the `AccountPrivKey` serialized using the encoding for a
-    /// [BIP 32](https://en.bitcoin.it/wiki/BIP_0032) ExtendedPrivKey
+    /// [BIP 32](https://en.bitcoin.it/wiki/BIP_0032) ExtendedPrivateKey, excluding the
+    /// 4 prefix bytes.
     pub fn to_bytes(&self) -> Vec<u8> {
-        self.0.serialize()
+        // Convert to `xprv` encoding.
+        let xprv_encoded = self.0.to_extended_key(Prefix::XPRV).to_string();
+
+        // Now decode it and return the bytes we want.
+        bs58::decode(xprv_encoded)
+            .with_check(None)
+            .into_vec()
+            .expect("correct")
+            .split_off(Prefix::LENGTH)
     }
 
     /// Decodes the `AccountPrivKey` from the encoding specified for a
-    /// [BIP 32](https://en.bitcoin.it/wiki/BIP_0032) ExtendedPrivKey
+    /// [BIP 32](https://en.bitcoin.it/wiki/BIP_0032) ExtendedPrivateKey, excluding the
+    /// 4 prefix bytes.
     pub fn from_bytes(b: &[u8]) -> Option<Self> {
-        ExtendedPrivKey::deserialize(b)
-            .map(AccountPrivKey::from_extended_privkey)
+        // Convert to `xprv` encoding.
+        let mut bytes = Prefix::XPRV.to_bytes().to_vec();
+        bytes.extend_from_slice(b);
+        let xprv_encoded = bs58::encode(bytes).with_check().into_string();
+
+        // Now we can parse it.
+        xprv_encoded
+            .parse::<ExtendedKey>()
             .ok()
+            .and_then(|k| ExtendedPrivateKey::try_from(k).ok())
+            .map(AccountPrivKey::from_extended_privkey)
     }
 }
 
-/// A type representing a BIP-44 public key at the account path level
-/// `m/44'/<coin_type>'/<account>'`.
+/// A [BIP44] public key at the account path level `m/44'/<coin_type>'/<account>'`.
 ///
 /// This provides the necessary derivation capability for the transparent component of a unified
 /// full viewing key.
+///
+/// [BIP44]: https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
 #[derive(Clone, Debug)]
-pub struct AccountPubKey(ExtendedPubKey);
+pub struct AccountPubKey(ExtendedPublicKey<PublicKey>);
 
 impl AccountPubKey {
-    /// Derives the BIP-44 public key at the external "change level" path
+    /// Derives the BIP44 public key at the external "change level" path
     /// `m/44'/<coin_type>'/<account>'/0`.
-    pub fn derive_external_ivk(&self) -> Result<ExternalIvk, hdwallet::error::Error> {
+    pub fn derive_external_ivk(&self) -> Result<ExternalIvk, bip32::Error> {
         self.0
-            .derive_public_key(KeyIndex::Normal(0))
+            .derive_child(ChildNumber::new(0, false)?)
             .map(ExternalIvk)
     }
 
-    /// Derives the BIP-44 public key at the internal "change level" path
+    /// Derives the BIP44 public key at the internal "change level" path
     /// `m/44'/<coin_type>'/<account>'/1`.
-    pub fn derive_internal_ivk(&self) -> Result<InternalIvk, hdwallet::error::Error> {
+    pub fn derive_internal_ivk(&self) -> Result<InternalIvk, bip32::Error> {
         self.0
-            .derive_public_key(KeyIndex::Normal(1))
+            .derive_child(ChildNumber::new(1, false)?)
             .map(InternalIvk)
     }
 
+    /// Derives the public key at the "ephemeral" path
+    /// `m/44'/<coin_type>'/<account>'/2`.
+    pub fn derive_ephemeral_ivk(&self) -> Result<EphemeralIvk, bip32::Error> {
+        self.0
+            .derive_child(ChildNumber::new(2, false)?)
+            .map(EphemeralIvk)
+    }
+
     /// Derives the internal ovk and external ovk corresponding to this
     /// transparent fvk. As specified in [ZIP 316][transparent-ovk].
     ///
     /// [transparent-ovk]: https://zips.z.cash/zip-0316#deriving-internal-keys
     pub fn ovks_for_shielding(&self) -> (InternalOvk, ExternalOvk) {
-        let i_ovk = prf_expand_vec(
-            &self.0.chain_code,
-            &[&[0xd0], &self.0.public_key.serialize()],
-        );
-        let i_ovk = i_ovk.as_bytes();
+        let i_ovk = PrfExpand::TRANSPARENT_ZIP316_OVK
+            .with(&self.0.attrs().chain_code, &self.0.public_key().serialize());
         let ovk_external = ExternalOvk(i_ovk[..32].try_into().unwrap());
         let ovk_internal = InternalOvk(i_ovk[32..].try_into().unwrap());
 
@@ -133,123 +271,185 @@ impl AccountPubKey {
     }
 
     pub fn serialize(&self) -> Vec<u8> {
-        let mut buf = self.0.chain_code.clone();
-        buf.extend(self.0.public_key.serialize().to_vec());
+        let mut buf = self.0.attrs().chain_code.to_vec();
+        buf.extend_from_slice(&self.0.public_key().serialize());
         buf
     }
 
-    pub fn deserialize(data: &[u8; 65]) -> Result<Self, hdwallet::error::Error> {
-        let chain_code = data[..32].to_vec();
+    pub fn deserialize(data: &[u8; 65]) -> Result<Self, bip32::Error> {
+        let chain_code = data[..32].try_into().expect("correct length");
         let public_key = PublicKey::from_slice(&data[32..])?;
-        Ok(AccountPubKey(ExtendedPubKey {
+        Ok(AccountPubKey(ExtendedPublicKey::new(
             public_key,
-            chain_code,
-        }))
+            ExtendedKeyAttrs {
+                depth: 3,
+                // We do not expose the inner `ExtendedPublicKey`, so we can use dummy
+                // values for the fields that are not encoded in an `AccountPubKey`.
+                parent_fingerprint: [0xff, 0xff, 0xff, 0xff],
+                child_number: ChildNumber::new(0, true).expect("correct"),
+                chain_code,
+            },
+        )))
     }
 }
 
 /// Derives the P2PKH transparent address corresponding to the given pubkey.
 #[deprecated(note = "This function will be removed from the public API in an upcoming refactor.")]
 pub fn pubkey_to_address(pubkey: &secp256k1::PublicKey) -> TransparentAddress {
-    TransparentAddress::PublicKey(
+    TransparentAddress::PublicKeyHash(
         *ripemd::Ripemd160::digest(Sha256::digest(pubkey.serialize())).as_ref(),
     )
 }
 
 pub(crate) mod private {
-    use hdwallet::ExtendedPubKey;
+    use super::TransparentKeyScope;
+    use bip32::ExtendedPublicKey;
+    use secp256k1::PublicKey;
     pub trait SealedChangeLevelKey {
-        fn extended_pubkey(&self) -> &ExtendedPubKey;
-        fn from_extended_pubkey(key: ExtendedPubKey) -> Self;
+        const SCOPE: TransparentKeyScope;
+        fn extended_pubkey(&self) -> &ExtendedPublicKey<PublicKey>;
+        fn from_extended_pubkey(key: ExtendedPublicKey<PublicKey>) -> Self;
     }
 }
 
+/// Trait representing a transparent "incoming viewing key".
+///
+/// Unlike the Sapling and Orchard shielded protocols (which have viewing keys built into
+/// their key trees and bound to specific spending keys), the transparent protocol has no
+/// "viewing key" concept. Transparent viewing keys are instead emulated by making two
+/// observations:
+///
+/// - [BIP32] hierarchical derivation is structured as a tree.
+/// - The [BIP44] key paths use non-hardened derivation below the account level.
+///
+/// A transparent viewing key for an account is thus defined as the root of a specific
+/// non-hardened subtree underneath the account's path.
+///
+/// [BIP32]: https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki
+/// [BIP44]: https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
 pub trait IncomingViewingKey: private::SealedChangeLevelKey + std::marker::Sized {
     /// Derives a transparent address at the provided child index.
     #[allow(deprecated)]
     fn derive_address(
         &self,
-        child_index: u32,
-    ) -> Result<TransparentAddress, hdwallet::error::Error> {
-        let child_key = self
-            .extended_pubkey()
-            .derive_public_key(KeyIndex::Normal(child_index))?;
-        Ok(pubkey_to_address(&child_key.public_key))
+        address_index: NonHardenedChildIndex,
+    ) -> Result<TransparentAddress, bip32::Error> {
+        let child_key = self.extended_pubkey().derive_child(address_index.into())?;
+        Ok(pubkey_to_address(child_key.public_key()))
     }
 
     /// Searches the space of child indexes for an index that will
     /// generate a valid transparent address, and returns the resulting
     /// address and the index at which it was generated.
-    fn default_address(&self) -> (TransparentAddress, u32) {
-        let mut child_index = 0;
-        while child_index <= MAX_TRANSPARENT_CHILD_INDEX {
-            match self.derive_address(child_index) {
+    fn default_address(&self) -> (TransparentAddress, NonHardenedChildIndex) {
+        let mut address_index = NonHardenedChildIndex::ZERO;
+        loop {
+            match self.derive_address(address_index) {
                 Ok(addr) => {
-                    return (addr, child_index);
+                    return (addr, address_index);
                 }
                 Err(_) => {
-                    child_index += 1;
+                    address_index = address_index.next().unwrap_or_else(|| {
+                        panic!("Exhausted child index space attempting to find a default address.");
+                    });
                 }
             }
         }
-        panic!("Exhausted child index space attempting to find a default address.");
     }
 
     fn serialize(&self) -> Vec<u8> {
         let extpubkey = self.extended_pubkey();
-        let mut buf = extpubkey.chain_code.clone();
-        buf.extend(extpubkey.public_key.serialize().to_vec());
+        let mut buf = extpubkey.attrs().chain_code.to_vec();
+        buf.extend_from_slice(&extpubkey.public_key().serialize());
         buf
     }
 
-    fn deserialize(data: &[u8; 65]) -> Result<Self, hdwallet::error::Error> {
-        let chain_code = data[..32].to_vec();
+    fn deserialize(data: &[u8; 65]) -> Result<Self, bip32::Error> {
+        let chain_code = data[..32].try_into().expect("correct length");
         let public_key = PublicKey::from_slice(&data[32..])?;
-        Ok(Self::from_extended_pubkey(ExtendedPubKey {
+        Ok(Self::from_extended_pubkey(ExtendedPublicKey::new(
             public_key,
-            chain_code,
-        }))
+            ExtendedKeyAttrs {
+                depth: 4,
+                // We do not expose the inner `ExtendedPublicKey`, so we can use a dummy
+                // value for the `parent_fingerprint` that is not encoded in an
+                // `IncomingViewingKey`.
+                parent_fingerprint: [0xff, 0xff, 0xff, 0xff],
+                child_number: Self::SCOPE.into(),
+                chain_code,
+            },
+        )))
     }
 }
 
-/// A type representing an incoming viewing key at the BIP-44 "external"
-/// path `m/44'/<coin_type>'/<account>'/0`. This allows derivation
-/// of child addresses that may be provided to external parties.
+/// An incoming viewing key at the [BIP44] "external" path
+/// `m/44'/<coin_type>'/<account>'/0`.
+///
+/// This allows derivation of child addresses that may be provided to external parties.
+///
+/// [BIP44]: https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
 #[derive(Clone, Debug)]
-pub struct ExternalIvk(ExtendedPubKey);
+pub struct ExternalIvk(ExtendedPublicKey<PublicKey>);
 
 impl private::SealedChangeLevelKey for ExternalIvk {
-    fn extended_pubkey(&self) -> &ExtendedPubKey {
+    const SCOPE: TransparentKeyScope = TransparentKeyScope(0);
+
+    fn extended_pubkey(&self) -> &ExtendedPublicKey<PublicKey> {
         &self.0
     }
 
-    fn from_extended_pubkey(key: ExtendedPubKey) -> Self {
+    fn from_extended_pubkey(key: ExtendedPublicKey<PublicKey>) -> Self {
         ExternalIvk(key)
     }
 }
 
 impl IncomingViewingKey for ExternalIvk {}
 
-/// A type representing an incoming viewing key at the BIP-44 "internal"
-/// path `m/44'/<coin_type>'/<account>'/1`. This allows derivation
-/// of change addresses for use within the wallet, but which should
+/// An incoming viewing key at the [BIP44] "internal" path
+/// `m/44'/<coin_type>'/<account>'/1`.
+///
+/// This allows derivation of change addresses for use within the wallet, but which should
 /// not be shared with external parties.
+///
+/// [BIP44]: https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
 #[derive(Clone, Debug)]
-pub struct InternalIvk(ExtendedPubKey);
+pub struct InternalIvk(ExtendedPublicKey<PublicKey>);
 
 impl private::SealedChangeLevelKey for InternalIvk {
-    fn extended_pubkey(&self) -> &ExtendedPubKey {
+    const SCOPE: TransparentKeyScope = TransparentKeyScope(1);
+
+    fn extended_pubkey(&self) -> &ExtendedPublicKey<PublicKey> {
         &self.0
     }
 
-    fn from_extended_pubkey(key: ExtendedPubKey) -> Self {
+    fn from_extended_pubkey(key: ExtendedPublicKey<PublicKey>) -> Self {
         InternalIvk(key)
     }
 }
 
 impl IncomingViewingKey for InternalIvk {}
 
-/// Internal ovk used for autoshielding.
+/// An incoming viewing key at the "ephemeral" path
+/// `m/44'/<coin_type>'/<account>'/2`.
+///
+/// This allows derivation of ephemeral addresses for use within the wallet.
+#[derive(Clone, Debug)]
+pub struct EphemeralIvk(ExtendedPublicKey<PublicKey>);
+
+#[cfg(feature = "transparent-inputs")]
+impl EphemeralIvk {
+    /// Derives a transparent address at the provided child index.
+    pub fn derive_ephemeral_address(
+        &self,
+        address_index: NonHardenedChildIndex,
+    ) -> Result<TransparentAddress, bip32::Error> {
+        let child_key = self.0.derive_child(address_index.into())?;
+        #[allow(deprecated)]
+        Ok(pubkey_to_address(child_key.public_key()))
+    }
+}
+
+/// Internal outgoing viewing key used for autoshielding.
 pub struct InternalOvk([u8; 32]);
 
 impl InternalOvk {
@@ -258,7 +458,7 @@ impl InternalOvk {
     }
 }
 
-/// External ovk used by zcashd for transparent -> shielded spends to
+/// External outgoing viewing key used by `zcashd` for transparent-to-shielded spends to
 /// external receivers.
 pub struct ExternalOvk([u8; 32]);
 
@@ -270,7 +470,11 @@ impl ExternalOvk {
 
 #[cfg(test)]
 mod tests {
+    use bip32::ChildNumber;
+    use subtle::ConstantTimeEq;
+
     use super::AccountPubKey;
+    use super::NonHardenedChildIndex;
 
     #[test]
     fn check_ovk_test_vectors() {
@@ -517,4 +721,54 @@ mod tests {
             assert_eq!(tv.external_ovk, external.as_bytes());
         }
     }
+
+    #[test]
+    fn nonhardened_indexes_accepted() {
+        assert_eq!(0, NonHardenedChildIndex::from_index(0).unwrap().index());
+        assert_eq!(
+            0x7fffffff,
+            NonHardenedChildIndex::from_index(0x7fffffff)
+                .unwrap()
+                .index()
+        );
+    }
+
+    #[test]
+    fn hardened_indexes_rejected() {
+        assert!(NonHardenedChildIndex::from_index(0x80000000).is_none());
+        assert!(NonHardenedChildIndex::from_index(0xffffffff).is_none());
+    }
+
+    #[test]
+    fn nonhardened_index_next() {
+        assert_eq!(1, NonHardenedChildIndex::ZERO.next().unwrap().index());
+        assert!(NonHardenedChildIndex::from_index(0x7fffffff)
+            .unwrap()
+            .next()
+            .is_none());
+    }
+
+    #[test]
+    fn nonhardened_index_ct_eq() {
+        assert!(check(
+            NonHardenedChildIndex::ZERO,
+            NonHardenedChildIndex::ZERO
+        ));
+        assert!(!check(
+            NonHardenedChildIndex::ZERO,
+            NonHardenedChildIndex::ZERO.next().unwrap()
+        ));
+
+        fn check<T: ConstantTimeEq>(v1: T, v2: T) -> bool {
+            v1.ct_eq(&v2).into()
+        }
+    }
+
+    #[test]
+    fn nonhardened_index_tryfrom_keyindex() {
+        let nh: NonHardenedChildIndex = ChildNumber::new(0, false).unwrap().try_into().unwrap();
+        assert_eq!(nh.index(), 0);
+
+        assert!(NonHardenedChildIndex::try_from(ChildNumber::new(0, true).unwrap()).is_err());
+    }
 }
diff --git a/zcash_primitives/src/lib.rs b/zcash_primitives/src/lib.rs
index 87ea2baaf0..cb163501d4 100644
--- a/zcash_primitives/src/lib.rs
+++ b/zcash_primitives/src/lib.rs
@@ -2,27 +2,29 @@
 //!
 //! `zcash_primitives` is a library that provides the core structs and functions necessary
 //! for working with Zcash.
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
 
 #![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
 // Catch documentation errors caused by code changes.
 #![deny(rustdoc::broken_intra_doc_links)]
 // Temporary until we have addressed all Result<T, ()> cases.
 #![allow(clippy::result_unit_err)]
+// Present to reduce refactoring noise from changing all the imports inside this crate for
+// the `sapling` crate extraction.
+#![allow(clippy::single_component_path_imports)]
 
 pub mod block;
-pub mod consensus;
-pub mod constants;
-pub mod keys;
+pub use zcash_protocol::consensus;
+pub use zcash_protocol::constants;
 pub mod legacy;
-pub mod memo;
+pub use zcash_protocol::memo;
 pub mod merkle_tree;
-pub mod sapling;
+use sapling;
 pub mod transaction;
-pub mod zip32;
-pub mod zip339;
-
-#[cfg(feature = "zfuture")]
+pub use zip32;
+#[cfg(zcash_unstable = "zfuture")]
 pub mod extensions;
-
-#[cfg(test)]
-mod test_vectors;
diff --git a/zcash_primitives/src/merkle_tree.rs b/zcash_primitives/src/merkle_tree.rs
index 176d3b4375..98391c91e2 100644
--- a/zcash_primitives/src/merkle_tree.rs
+++ b/zcash_primitives/src/merkle_tree.rs
@@ -1,4 +1,4 @@
-//! Implementation of a Merkle tree of commitments used to prove the existence of notes.
+//! Parsers and serializers for Zcash Merkle trees.
 
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use incrementalmerkletree::{
@@ -23,6 +23,23 @@ pub trait HashSer {
     fn write<W: Write>(&self, writer: W) -> io::Result<()>;
 }
 
+impl HashSer for sapling::Node {
+    fn read<R: Read>(mut reader: R) -> io::Result<Self> {
+        let mut repr = [0u8; 32];
+        reader.read_exact(&mut repr)?;
+        Option::from(Self::from_bytes(repr)).ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                "Non-canonical encoding of Jubjub base field value.",
+            )
+        })
+    }
+
+    fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
+        writer.write_all(&self.to_bytes())
+    }
+}
+
 impl HashSer for MerkleHashOrchard {
     fn read<R: Read>(mut reader: R) -> io::Result<Self>
     where
@@ -98,12 +115,12 @@ pub fn write_nonempty_frontier_v1<H: HashSer, W: Write>(
     frontier: &NonEmptyFrontier<H>,
 ) -> io::Result<()> {
     write_position(&mut writer, frontier.position())?;
-    if frontier.position().is_odd() {
+    if frontier.position().is_right_child() {
         // The v1 serialization wrote the sibling of a right-hand leaf as an optional value, rather
         // than as part of the ommers vector.
         frontier
             .ommers()
-            .get(0)
+            .first()
             .expect("ommers vector cannot be empty for right-hand nodes")
             .write(&mut writer)?;
         Optional::write(&mut writer, Some(frontier.leaf()), |w, n: &H| n.write(w))?;
@@ -256,14 +273,7 @@ pub fn merkle_path_from_slice<Node: HashSer, const DEPTH: u8>(
     }
 
     // Read the position from the witness
-    let position = witness.read_u64::<LittleEndian>().and_then(|p| {
-        Position::try_from(p).map_err(|_| {
-            io::Error::new(
-                io::ErrorKind::InvalidData,
-                format!("decoded position {} exceeded the range of a `usize`", p),
-            )
-        })
-    })?;
+    let position = witness.read_u64::<LittleEndian>().map(Position::from)?;
 
     // The witness should be empty now; if it wasn't, the caller would
     // have provided more information than they should have, indicating
@@ -292,6 +302,7 @@ pub mod testing {
     use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
     use incrementalmerkletree::frontier::testing::TestNode;
     use std::io::{self, Read, Write};
+    use zcash_encoding::Vector;
 
     use super::HashSer;
 
@@ -304,6 +315,23 @@ pub mod testing {
             writer.write_u64::<LittleEndian>(self.0)
         }
     }
+
+    impl HashSer for String {
+        fn read<R: Read>(reader: R) -> io::Result<String> {
+            Vector::read(reader, |r| r.read_u8()).and_then(|xs| {
+                String::from_utf8(xs).map_err(|e| {
+                    io::Error::new(
+                        io::ErrorKind::InvalidData,
+                        format!("Not a valid utf8 string: {:?}", e),
+                    )
+                })
+            })
+        }
+
+        fn write<W: Write>(&self, writer: W) -> io::Result<()> {
+            Vector::write(writer, self.as_bytes(), |w, b| w.write_u8(*b))
+        }
+    }
 }
 
 #[cfg(test)]
@@ -797,7 +825,7 @@ mod tests {
         for i in 0..16 {
             let cmu = hex::decode(commitments[i]).unwrap();
 
-            let cmu = Node::new(cmu[..].try_into().unwrap());
+            let cmu = Node::from_bytes(cmu[..].try_into().unwrap()).unwrap();
 
             // Witness here
             witnesses.push((IncrementalWitness::from_tree(tree.clone()), last_cmu));
diff --git a/zcash_primitives/src/sapling.rs b/zcash_primitives/src/sapling.rs
deleted file mode 100644
index 31899c72be..0000000000
--- a/zcash_primitives/src/sapling.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-//! Structs and constants specific to the Sapling shielded pool.
-
-mod address;
-pub mod group_hash;
-pub mod keys;
-pub mod note;
-pub mod note_encryption;
-pub mod pedersen_hash;
-pub mod prover;
-pub mod redjubjub;
-mod spec;
-mod tree;
-pub mod util;
-pub mod value;
-
-use group::GroupEncoding;
-use rand_core::{CryptoRng, RngCore};
-
-use crate::constants::SPENDING_KEY_GENERATOR;
-
-use self::redjubjub::{PrivateKey, PublicKey, Signature};
-
-pub use address::PaymentAddress;
-pub use keys::{Diversifier, NullifierDerivingKey, ProofGenerationKey, SaplingIvk, ViewingKey};
-pub use note::{nullifier::Nullifier, Note, Rseed};
-pub use tree::{
-    merkle_hash, CommitmentTree, IncrementalWitness, MerklePath, Node, NOTE_COMMITMENT_TREE_DEPTH,
-};
-
-/// Create the spendAuthSig for a Sapling SpendDescription.
-pub fn spend_sig<R: RngCore + CryptoRng>(
-    ask: PrivateKey,
-    ar: jubjub::Fr,
-    sighash: &[u8; 32],
-    rng: &mut R,
-) -> Signature {
-    spend_sig_internal(ask, ar, sighash, rng)
-}
-
-pub(crate) fn spend_sig_internal<R: RngCore>(
-    ask: PrivateKey,
-    ar: jubjub::Fr,
-    sighash: &[u8; 32],
-    rng: &mut R,
-) -> Signature {
-    // We compute `rsk`...
-    let rsk = ask.randomize(ar);
-
-    // We compute `rk` from there (needed for key prefixing)
-    let rk = PublicKey::from_private(&rsk, SPENDING_KEY_GENERATOR);
-
-    // Compute the signature's message for rk/spend_auth_sig
-    let mut data_to_be_signed = [0u8; 64];
-    data_to_be_signed[0..32].copy_from_slice(&rk.0.to_bytes());
-    data_to_be_signed[32..64].copy_from_slice(&sighash[..]);
-
-    // Do the signing
-    rsk.sign(&data_to_be_signed, rng, SPENDING_KEY_GENERATOR)
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod testing {
-    pub use super::{
-        address::testing::arb_payment_address, keys::testing::arb_incoming_viewing_key,
-        note::testing::arb_note, tree::testing::arb_node,
-    };
-}
diff --git a/zcash_primitives/src/sapling/address.rs b/zcash_primitives/src/sapling/address.rs
deleted file mode 100644
index 4ee547e53e..0000000000
--- a/zcash_primitives/src/sapling/address.rs
+++ /dev/null
@@ -1,118 +0,0 @@
-use super::{
-    keys::{DiversifiedTransmissionKey, Diversifier},
-    note::{Note, Rseed},
-    value::NoteValue,
-};
-
-/// A Sapling payment address.
-///
-/// # Invariants
-///
-/// - `diversifier` is guaranteed to be valid for Sapling (only 50% of diversifiers are).
-/// - `pk_d` is guaranteed to be prime-order (i.e. in the prime-order subgroup of Jubjub,
-///  and not the identity).
-#[derive(Clone, Copy, Debug)]
-pub struct PaymentAddress {
-    pk_d: DiversifiedTransmissionKey,
-    diversifier: Diversifier,
-}
-
-impl PartialEq for PaymentAddress {
-    fn eq(&self, other: &Self) -> bool {
-        self.pk_d == other.pk_d && self.diversifier == other.diversifier
-    }
-}
-
-impl Eq for PaymentAddress {}
-
-impl PaymentAddress {
-    /// Constructs a PaymentAddress from a diversifier and a Jubjub point.
-    ///
-    /// Returns None if `diversifier` is not valid for Sapling, or `pk_d` is the identity.
-    /// Note that we cannot verify in this constructor that `pk_d` is derived from
-    /// `diversifier`, so addresses for which these values have no known relationship
-    /// (and therefore no-one can receive funds at them) can still be constructed.
-    pub fn from_parts(diversifier: Diversifier, pk_d: DiversifiedTransmissionKey) -> Option<Self> {
-        // Check that the diversifier is valid
-        diversifier.g_d()?;
-
-        Self::from_parts_unchecked(diversifier, pk_d)
-    }
-
-    /// Constructs a PaymentAddress from a diversifier and a Jubjub point.
-    ///
-    /// Returns None if `pk_d` is the identity. The caller must check that `diversifier`
-    /// is valid for Sapling.
-    pub(crate) fn from_parts_unchecked(
-        diversifier: Diversifier,
-        pk_d: DiversifiedTransmissionKey,
-    ) -> Option<Self> {
-        if pk_d.is_identity() {
-            None
-        } else {
-            Some(PaymentAddress { pk_d, diversifier })
-        }
-    }
-
-    /// Parses a PaymentAddress from bytes.
-    pub fn from_bytes(bytes: &[u8; 43]) -> Option<Self> {
-        let diversifier = {
-            let mut tmp = [0; 11];
-            tmp.copy_from_slice(&bytes[0..11]);
-            Diversifier(tmp)
-        };
-
-        let pk_d = DiversifiedTransmissionKey::from_bytes(bytes[11..43].try_into().unwrap());
-        if pk_d.is_some().into() {
-            // The remaining invariants are checked here.
-            PaymentAddress::from_parts(diversifier, pk_d.unwrap())
-        } else {
-            None
-        }
-    }
-
-    /// Returns the byte encoding of this `PaymentAddress`.
-    pub fn to_bytes(&self) -> [u8; 43] {
-        let mut bytes = [0; 43];
-        bytes[0..11].copy_from_slice(&self.diversifier.0);
-        bytes[11..].copy_from_slice(&self.pk_d.to_bytes());
-        bytes
-    }
-
-    /// Returns the [`Diversifier`] for this `PaymentAddress`.
-    pub fn diversifier(&self) -> &Diversifier {
-        &self.diversifier
-    }
-
-    /// Returns `pk_d` for this `PaymentAddress`.
-    pub fn pk_d(&self) -> &DiversifiedTransmissionKey {
-        &self.pk_d
-    }
-
-    pub(crate) fn g_d(&self) -> jubjub::SubgroupPoint {
-        self.diversifier.g_d().expect("checked at construction")
-    }
-
-    pub fn create_note(&self, value: u64, rseed: Rseed) -> Note {
-        Note::from_parts(*self, NoteValue::from_raw(value), rseed)
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub(super) mod testing {
-    use proptest::prelude::*;
-
-    use super::{
-        super::keys::{testing::arb_incoming_viewing_key, Diversifier, SaplingIvk},
-        PaymentAddress,
-    };
-
-    pub fn arb_payment_address() -> impl Strategy<Value = PaymentAddress> {
-        arb_incoming_viewing_key().prop_flat_map(|ivk: SaplingIvk| {
-            any::<[u8; 11]>().prop_filter_map(
-                "Sampled diversifier must generate a valid Sapling payment address.",
-                move |d| ivk.to_payment_address(Diversifier(d)),
-            )
-        })
-    }
-}
diff --git a/zcash_primitives/src/sapling/group_hash.rs b/zcash_primitives/src/sapling/group_hash.rs
deleted file mode 100644
index 5a9f06a096..0000000000
--- a/zcash_primitives/src/sapling/group_hash.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-//! Implementation of [group hashing into Jubjub][grouphash].
-//!
-//! [grouphash]: https://zips.z.cash/protocol/protocol.pdf#concretegrouphashjubjub
-
-use ff::PrimeField;
-use group::{cofactor::CofactorGroup, Group, GroupEncoding};
-
-use crate::constants;
-use blake2s_simd::Params;
-
-/// Produces a random point in the Jubjub curve.
-/// The point is guaranteed to be prime order
-/// and not the identity.
-#[allow(clippy::assertions_on_constants)]
-pub fn group_hash(tag: &[u8], personalization: &[u8]) -> Option<jubjub::SubgroupPoint> {
-    assert_eq!(personalization.len(), 8);
-
-    // Check to see that scalar field is 255 bits
-    assert!(bls12_381::Scalar::NUM_BITS == 255);
-
-    let h = Params::new()
-        .hash_length(32)
-        .personal(personalization)
-        .to_state()
-        .update(constants::GH_FIRST_BLOCK)
-        .update(tag)
-        .finalize();
-
-    let p = jubjub::ExtendedPoint::from_bytes(h.as_array());
-    if p.is_some().into() {
-        // <ExtendedPoint as CofactorGroup>::clear_cofactor is implemented using
-        // ExtendedPoint::mul_by_cofactor in the jubjub crate.
-        let p = CofactorGroup::clear_cofactor(&p.unwrap());
-
-        if p.is_identity().into() {
-            None
-        } else {
-            Some(p)
-        }
-    } else {
-        None
-    }
-}
diff --git a/zcash_primitives/src/sapling/keys.rs b/zcash_primitives/src/sapling/keys.rs
deleted file mode 100644
index ad42694927..0000000000
--- a/zcash_primitives/src/sapling/keys.rs
+++ /dev/null
@@ -1,536 +0,0 @@
-//! Sapling key components.
-//!
-//! Implements [section 4.2.2] of the Zcash Protocol Specification.
-//!
-//! [section 4.2.2]: https://zips.z.cash/protocol/protocol.pdf#saplingkeycomponents
-
-use std::io::{self, Read, Write};
-
-use super::{
-    address::PaymentAddress,
-    note_encryption::KDF_SAPLING_PERSONALIZATION,
-    spec::{
-        crh_ivk, diversify_hash, ka_sapling_agree, ka_sapling_agree_prepared,
-        ka_sapling_derive_public, ka_sapling_derive_public_subgroup_prepared, PreparedBase,
-        PreparedBaseSubgroup, PreparedScalar,
-    },
-};
-use crate::{
-    constants::{self, PROOF_GENERATION_KEY_GENERATOR, SPENDING_KEY_GENERATOR},
-    keys::prf_expand,
-};
-
-use blake2b_simd::{Hash as Blake2bHash, Params as Blake2bParams};
-use ff::PrimeField;
-use group::{Curve, Group, GroupEncoding};
-use subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption};
-use zcash_note_encryption::EphemeralKeyBytes;
-
-/// Errors that can occur in the decoding of Sapling spending keys.
-pub enum DecodingError {
-    /// The length of the byte slice provided for decoding was incorrect.
-    LengthInvalid { expected: usize, actual: usize },
-    /// Could not decode the `ask` bytes to a jubjub field element.
-    InvalidAsk,
-    /// Could not decode the `nsk` bytes to a jubjub field element.
-    InvalidNsk,
-}
-
-/// An outgoing viewing key
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct OutgoingViewingKey(pub [u8; 32]);
-
-/// A Sapling expanded spending key
-#[derive(Clone)]
-pub struct ExpandedSpendingKey {
-    pub ask: jubjub::Fr,
-    pub nsk: jubjub::Fr,
-    pub ovk: OutgoingViewingKey,
-}
-
-impl ExpandedSpendingKey {
-    pub fn from_spending_key(sk: &[u8]) -> Self {
-        let ask = jubjub::Fr::from_bytes_wide(prf_expand(sk, &[0x00]).as_array());
-        let nsk = jubjub::Fr::from_bytes_wide(prf_expand(sk, &[0x01]).as_array());
-        let mut ovk = OutgoingViewingKey([0u8; 32]);
-        ovk.0
-            .copy_from_slice(&prf_expand(sk, &[0x02]).as_bytes()[..32]);
-        ExpandedSpendingKey { ask, nsk, ovk }
-    }
-
-    pub fn proof_generation_key(&self) -> ProofGenerationKey {
-        ProofGenerationKey {
-            ak: SPENDING_KEY_GENERATOR * self.ask,
-            nsk: self.nsk,
-        }
-    }
-
-    /// Decodes the expanded spending key from its serialized representation
-    /// as part of the encoding of the extended spending key as defined in
-    /// [ZIP 32](https://zips.z.cash/zip-0032)
-    pub fn from_bytes(b: &[u8]) -> Result<Self, DecodingError> {
-        if b.len() != 96 {
-            return Err(DecodingError::LengthInvalid {
-                expected: 96,
-                actual: b.len(),
-            });
-        }
-
-        let ask = Option::from(jubjub::Fr::from_repr(b[0..32].try_into().unwrap()))
-            .ok_or(DecodingError::InvalidAsk)?;
-        let nsk = Option::from(jubjub::Fr::from_repr(b[32..64].try_into().unwrap()))
-            .ok_or(DecodingError::InvalidNsk)?;
-        let ovk = OutgoingViewingKey(b[64..96].try_into().unwrap());
-
-        Ok(ExpandedSpendingKey { ask, nsk, ovk })
-    }
-
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let mut repr = [0u8; 96];
-        reader.read_exact(repr.as_mut())?;
-        Self::from_bytes(&repr).map_err(|e| match e {
-            DecodingError::InvalidAsk => {
-                io::Error::new(io::ErrorKind::InvalidData, "ask not in field")
-            }
-            DecodingError::InvalidNsk => {
-                io::Error::new(io::ErrorKind::InvalidData, "nsk not in field")
-            }
-            DecodingError::LengthInvalid { .. } => unreachable!(),
-        })
-    }
-
-    pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.to_bytes())
-    }
-
-    /// Encodes the expanded spending key to the its seralized representation
-    /// as part of the encoding of the extended spending key as defined in
-    /// [ZIP 32](https://zips.z.cash/zip-0032)
-    pub fn to_bytes(&self) -> [u8; 96] {
-        let mut result = [0u8; 96];
-        result[0..32].copy_from_slice(&self.ask.to_repr());
-        result[32..64].copy_from_slice(&self.nsk.to_repr());
-        result[64..96].copy_from_slice(&self.ovk.0);
-        result
-    }
-}
-
-#[derive(Clone)]
-pub struct ProofGenerationKey {
-    pub ak: jubjub::SubgroupPoint,
-    pub nsk: jubjub::Fr,
-}
-
-impl ProofGenerationKey {
-    pub fn to_viewing_key(&self) -> ViewingKey {
-        ViewingKey {
-            ak: self.ak,
-            nk: NullifierDerivingKey(constants::PROOF_GENERATION_KEY_GENERATOR * self.nsk),
-        }
-    }
-}
-
-/// A key used to derive the nullifier for a Sapling note.
-#[derive(Debug, Copy, Clone, PartialEq, Eq)]
-pub struct NullifierDerivingKey(pub jubjub::SubgroupPoint);
-
-#[derive(Debug, Clone)]
-pub struct ViewingKey {
-    pub ak: jubjub::SubgroupPoint,
-    pub nk: NullifierDerivingKey,
-}
-
-impl ViewingKey {
-    pub fn rk(&self, ar: jubjub::Fr) -> jubjub::SubgroupPoint {
-        self.ak + constants::SPENDING_KEY_GENERATOR * ar
-    }
-
-    pub fn ivk(&self) -> SaplingIvk {
-        SaplingIvk(crh_ivk(self.ak.to_bytes(), self.nk.0.to_bytes()))
-    }
-
-    pub fn to_payment_address(&self, diversifier: Diversifier) -> Option<PaymentAddress> {
-        self.ivk().to_payment_address(diversifier)
-    }
-}
-
-/// A Sapling key that provides the capability to view incoming and outgoing transactions.
-#[derive(Debug)]
-pub struct FullViewingKey {
-    pub vk: ViewingKey,
-    pub ovk: OutgoingViewingKey,
-}
-
-impl Clone for FullViewingKey {
-    fn clone(&self) -> Self {
-        FullViewingKey {
-            vk: ViewingKey {
-                ak: self.vk.ak,
-                nk: self.vk.nk,
-            },
-            ovk: self.ovk,
-        }
-    }
-}
-
-impl FullViewingKey {
-    pub fn from_expanded_spending_key(expsk: &ExpandedSpendingKey) -> Self {
-        FullViewingKey {
-            vk: ViewingKey {
-                ak: SPENDING_KEY_GENERATOR * expsk.ask,
-                nk: NullifierDerivingKey(PROOF_GENERATION_KEY_GENERATOR * expsk.nsk),
-            },
-            ovk: expsk.ovk,
-        }
-    }
-
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let ak = {
-            let mut buf = [0u8; 32];
-            reader.read_exact(&mut buf)?;
-            jubjub::SubgroupPoint::from_bytes(&buf).and_then(|p| CtOption::new(p, !p.is_identity()))
-        };
-        let nk = {
-            let mut buf = [0u8; 32];
-            reader.read_exact(&mut buf)?;
-            jubjub::SubgroupPoint::from_bytes(&buf)
-        };
-        if ak.is_none().into() {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "ak not of prime order",
-            ));
-        }
-        if nk.is_none().into() {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "nk not in prime-order subgroup",
-            ));
-        }
-        let ak = ak.unwrap();
-        let nk = NullifierDerivingKey(nk.unwrap());
-
-        let mut ovk = [0u8; 32];
-        reader.read_exact(&mut ovk)?;
-
-        Ok(FullViewingKey {
-            vk: ViewingKey { ak, nk },
-            ovk: OutgoingViewingKey(ovk),
-        })
-    }
-
-    pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.vk.ak.to_bytes())?;
-        writer.write_all(&self.vk.nk.0.to_bytes())?;
-        writer.write_all(&self.ovk.0)?;
-
-        Ok(())
-    }
-
-    pub fn to_bytes(&self) -> [u8; 96] {
-        let mut result = [0u8; 96];
-        self.write(&mut result[..])
-            .expect("should be able to serialize a FullViewingKey");
-        result
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct SaplingIvk(pub jubjub::Fr);
-
-impl SaplingIvk {
-    pub fn to_payment_address(&self, diversifier: Diversifier) -> Option<PaymentAddress> {
-        let prepared_ivk = PreparedIncomingViewingKey::new(self);
-        DiversifiedTransmissionKey::derive(&prepared_ivk, &diversifier)
-            .and_then(|pk_d| PaymentAddress::from_parts(diversifier, pk_d))
-    }
-
-    pub fn to_repr(&self) -> [u8; 32] {
-        self.0.to_repr()
-    }
-}
-
-/// A Sapling incoming viewing key that has been precomputed for trial decryption.
-#[derive(Clone, Debug)]
-pub struct PreparedIncomingViewingKey(PreparedScalar);
-
-impl memuse::DynamicUsage for PreparedIncomingViewingKey {
-    fn dynamic_usage(&self) -> usize {
-        self.0.dynamic_usage()
-    }
-
-    fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
-        self.0.dynamic_usage_bounds()
-    }
-}
-
-impl PreparedIncomingViewingKey {
-    /// Performs the necessary precomputations to use a `SaplingIvk` for note decryption.
-    pub fn new(ivk: &SaplingIvk) -> Self {
-        Self(PreparedScalar::new(&ivk.0))
-    }
-}
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
-pub struct Diversifier(pub [u8; 11]);
-
-impl Diversifier {
-    pub fn g_d(&self) -> Option<jubjub::SubgroupPoint> {
-        diversify_hash(&self.0)
-    }
-}
-
-/// The diversified transmission key for a given payment address.
-///
-/// Defined in [Zcash Protocol Spec § 4.2.2: Sapling Key Components][saplingkeycomponents].
-///
-/// Note that this type is allowed to be the identity in the protocol, but we reject this
-/// in [`PaymentAddress::from_parts`].
-///
-/// [saplingkeycomponents]: https://zips.z.cash/protocol/protocol.pdf#saplingkeycomponents
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct DiversifiedTransmissionKey(jubjub::SubgroupPoint);
-
-impl DiversifiedTransmissionKey {
-    /// Defined in [Zcash Protocol Spec § 4.2.2: Sapling Key Components][saplingkeycomponents].
-    ///
-    /// Returns `None` if `d` is an invalid diversifier.
-    ///
-    /// [saplingkeycomponents]: https://zips.z.cash/protocol/protocol.pdf#saplingkeycomponents
-    pub(crate) fn derive(ivk: &PreparedIncomingViewingKey, d: &Diversifier) -> Option<Self> {
-        d.g_d()
-            .map(PreparedBaseSubgroup::new)
-            .map(|g_d| ka_sapling_derive_public_subgroup_prepared(&ivk.0, &g_d))
-            .map(DiversifiedTransmissionKey)
-    }
-
-    /// $abst_J(bytes)$
-    pub(crate) fn from_bytes(bytes: &[u8; 32]) -> CtOption<Self> {
-        jubjub::SubgroupPoint::from_bytes(bytes).map(DiversifiedTransmissionKey)
-    }
-
-    /// $repr_J(self)$
-    pub(crate) fn to_bytes(self) -> [u8; 32] {
-        self.0.to_bytes()
-    }
-
-    /// Returns true if this is the identity.
-    pub(crate) fn is_identity(&self) -> bool {
-        self.0.is_identity().into()
-    }
-
-    /// Exposes the inner Jubjub point.
-    ///
-    /// This API is exposed for `zcash_proof` usage, and will be removed when this type is
-    /// refactored into the `sapling-crypto` crate.
-    pub fn inner(&self) -> jubjub::SubgroupPoint {
-        self.0
-    }
-}
-
-impl ConditionallySelectable for DiversifiedTransmissionKey {
-    fn conditional_select(a: &Self, b: &Self, choice: Choice) -> Self {
-        DiversifiedTransmissionKey(jubjub::SubgroupPoint::conditional_select(
-            &a.0, &b.0, choice,
-        ))
-    }
-}
-
-/// An ephemeral secret key used to encrypt an output note on-chain.
-///
-/// `esk` is "ephemeral" in the sense that each secret key is only used once. In
-/// practice, `esk` is derived deterministically from the note that it is encrypting.
-///
-/// $\mathsf{KA}^\mathsf{Sapling}.\mathsf{Private} := \mathbb{F}_{r_J}$
-///
-/// Defined in [section 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-#[derive(Debug)]
-pub struct EphemeralSecretKey(pub(crate) jubjub::Scalar);
-
-impl ConstantTimeEq for EphemeralSecretKey {
-    fn ct_eq(&self, other: &Self) -> subtle::Choice {
-        self.0.ct_eq(&other.0)
-    }
-}
-
-impl EphemeralSecretKey {
-    pub(crate) fn from_bytes(bytes: &[u8; 32]) -> CtOption<Self> {
-        jubjub::Scalar::from_bytes(bytes).map(EphemeralSecretKey)
-    }
-
-    pub(crate) fn derive_public(&self, g_d: jubjub::ExtendedPoint) -> EphemeralPublicKey {
-        EphemeralPublicKey(ka_sapling_derive_public(&self.0, &g_d))
-    }
-
-    pub(crate) fn agree(&self, pk_d: &DiversifiedTransmissionKey) -> SharedSecret {
-        SharedSecret(ka_sapling_agree(&self.0, &pk_d.0.into()))
-    }
-}
-
-/// An ephemeral public key used to encrypt an output note on-chain.
-///
-/// `epk` is "ephemeral" in the sense that each public key is only used once. In practice,
-/// `epk` is derived deterministically from the note that it is encrypting.
-///
-/// $\mathsf{KA}^\mathsf{Sapling}.\mathsf{Public} := \mathbb{J}$
-///
-/// Defined in [section 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-#[derive(Debug)]
-pub struct EphemeralPublicKey(jubjub::ExtendedPoint);
-
-impl EphemeralPublicKey {
-    pub(crate) fn from_affine(epk: jubjub::AffinePoint) -> Self {
-        EphemeralPublicKey(epk.into())
-    }
-
-    pub(crate) fn from_bytes(bytes: &[u8; 32]) -> CtOption<Self> {
-        jubjub::ExtendedPoint::from_bytes(bytes).map(EphemeralPublicKey)
-    }
-
-    pub(crate) fn to_bytes(&self) -> EphemeralKeyBytes {
-        EphemeralKeyBytes(self.0.to_bytes())
-    }
-}
-
-/// A Sapling ephemeral public key that has been precomputed for trial decryption.
-#[derive(Clone, Debug)]
-pub struct PreparedEphemeralPublicKey(PreparedBase);
-
-impl PreparedEphemeralPublicKey {
-    pub(crate) fn new(epk: EphemeralPublicKey) -> Self {
-        PreparedEphemeralPublicKey(PreparedBase::new(epk.0))
-    }
-
-    pub(crate) fn agree(&self, ivk: &PreparedIncomingViewingKey) -> SharedSecret {
-        SharedSecret(ka_sapling_agree_prepared(&ivk.0, &self.0))
-    }
-}
-
-/// $\mathsf{KA}^\mathsf{Sapling}.\mathsf{SharedSecret} := \mathbb{J}^{(r)}$
-///
-/// Defined in [section 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-#[derive(Debug)]
-pub struct SharedSecret(jubjub::SubgroupPoint);
-
-impl SharedSecret {
-    /// For checking test vectors only.
-    #[cfg(test)]
-    pub(crate) fn to_bytes(&self) -> [u8; 32] {
-        self.0.to_bytes()
-    }
-
-    /// Only for use in batched note encryption.
-    pub(crate) fn batch_to_affine(
-        shared_secrets: Vec<Option<Self>>,
-    ) -> impl Iterator<Item = Option<jubjub::AffinePoint>> {
-        // Filter out the positions for which ephemeral_key was not a valid encoding.
-        let secrets: Vec<_> = shared_secrets
-            .iter()
-            .filter_map(|s| s.as_ref().map(|s| jubjub::ExtendedPoint::from(s.0)))
-            .collect();
-
-        // Batch-normalize the shared secrets.
-        let mut secrets_affine = vec![jubjub::AffinePoint::identity(); secrets.len()];
-        group::Curve::batch_normalize(&secrets, &mut secrets_affine);
-
-        // Re-insert the invalid ephemeral_key positions.
-        let mut secrets_affine = secrets_affine.into_iter();
-        shared_secrets
-            .into_iter()
-            .map(move |s| s.and_then(|_| secrets_affine.next()))
-    }
-
-    /// Defined in [Zcash Protocol Spec § 5.4.5.4: Sapling Key Agreement][concretesaplingkdf].
-    ///
-    /// [concretesaplingkdf]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkdf
-    pub(crate) fn kdf_sapling(self, ephemeral_key: &EphemeralKeyBytes) -> Blake2bHash {
-        Self::kdf_sapling_inner(
-            jubjub::ExtendedPoint::from(self.0).to_affine(),
-            ephemeral_key,
-        )
-    }
-
-    /// Only for direct use in batched note encryption.
-    pub(crate) fn kdf_sapling_inner(
-        secret: jubjub::AffinePoint,
-        ephemeral_key: &EphemeralKeyBytes,
-    ) -> Blake2bHash {
-        Blake2bParams::new()
-            .hash_length(32)
-            .personal(KDF_SAPLING_PERSONALIZATION)
-            .to_state()
-            .update(&secret.to_bytes())
-            .update(ephemeral_key.as_ref())
-            .finalize()
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod testing {
-    use proptest::collection::vec;
-    use proptest::prelude::*;
-    use std::fmt::{self, Debug, Formatter};
-
-    use super::{ExpandedSpendingKey, FullViewingKey, SaplingIvk};
-
-    impl Debug for ExpandedSpendingKey {
-        fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
-            write!(f, "Spending keys cannot be Debug-formatted.")
-        }
-    }
-
-    prop_compose! {
-        pub fn arb_expanded_spending_key()(v in vec(any::<u8>(), 32..252)) -> ExpandedSpendingKey {
-            ExpandedSpendingKey::from_spending_key(&v)
-        }
-    }
-
-    prop_compose! {
-        pub fn arb_full_viewing_key()(sk in arb_expanded_spending_key()) -> FullViewingKey {
-            FullViewingKey::from_expanded_spending_key(&sk)
-        }
-    }
-
-    prop_compose! {
-        pub fn arb_incoming_viewing_key()(fvk in arb_full_viewing_key()) -> SaplingIvk {
-            fvk.vk.ivk()
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use group::{Group, GroupEncoding};
-
-    use super::FullViewingKey;
-    use crate::constants::SPENDING_KEY_GENERATOR;
-
-    #[test]
-    fn ak_must_be_prime_order() {
-        let mut buf = [0; 96];
-        let identity = jubjub::SubgroupPoint::identity();
-
-        // Set both ak and nk to the identity.
-        buf[0..32].copy_from_slice(&identity.to_bytes());
-        buf[32..64].copy_from_slice(&identity.to_bytes());
-
-        // ak is not allowed to be the identity.
-        assert_eq!(
-            FullViewingKey::read(&buf[..]).unwrap_err().to_string(),
-            "ak not of prime order"
-        );
-
-        // Set ak to a basepoint.
-        let basepoint = SPENDING_KEY_GENERATOR;
-        buf[0..32].copy_from_slice(&basepoint.to_bytes());
-
-        // nk is allowed to be the identity.
-        assert!(FullViewingKey::read(&buf[..]).is_ok());
-    }
-}
diff --git a/zcash_primitives/src/sapling/note.rs b/zcash_primitives/src/sapling/note.rs
deleted file mode 100644
index 2e5b21bc6b..0000000000
--- a/zcash_primitives/src/sapling/note.rs
+++ /dev/null
@@ -1,174 +0,0 @@
-use group::{ff::Field, GroupEncoding};
-use rand_core::{CryptoRng, RngCore};
-
-use super::{
-    keys::EphemeralSecretKey, value::NoteValue, Nullifier, NullifierDerivingKey, PaymentAddress,
-};
-use crate::keys::prf_expand;
-
-mod commitment;
-pub use self::commitment::{ExtractedNoteCommitment, NoteCommitment};
-
-pub(super) mod nullifier;
-
-/// Enum for note randomness before and after [ZIP 212](https://zips.z.cash/zip-0212).
-///
-/// Before ZIP 212, the note commitment trapdoor `rcm` must be a scalar value.
-/// After ZIP 212, the note randomness `rseed` is a 32-byte sequence, used to derive
-/// both the note commitment trapdoor `rcm` and the ephemeral private key `esk`.
-#[derive(Copy, Clone, Debug)]
-pub enum Rseed {
-    BeforeZip212(jubjub::Fr),
-    AfterZip212([u8; 32]),
-}
-
-impl Rseed {
-    /// Defined in [Zcash Protocol Spec § 4.7.2: Sending Notes (Sapling)][saplingsend].
-    ///
-    /// [saplingsend]: https://zips.z.cash/protocol/protocol.pdf#saplingsend
-    pub(crate) fn rcm(&self) -> commitment::NoteCommitTrapdoor {
-        commitment::NoteCommitTrapdoor(match self {
-            Rseed::BeforeZip212(rcm) => *rcm,
-            Rseed::AfterZip212(rseed) => {
-                jubjub::Fr::from_bytes_wide(prf_expand(rseed, &[0x04]).as_array())
-            }
-        })
-    }
-}
-
-/// A discrete amount of funds received by an address.
-#[derive(Clone, Debug)]
-pub struct Note {
-    /// The recipient of the funds.
-    recipient: PaymentAddress,
-    /// The value of this note.
-    value: NoteValue,
-    /// The seed randomness for various note components.
-    rseed: Rseed,
-}
-
-impl PartialEq for Note {
-    fn eq(&self, other: &Self) -> bool {
-        // Notes are canonically defined by their commitments.
-        self.cmu().eq(&other.cmu())
-    }
-}
-
-impl Eq for Note {}
-
-impl Note {
-    /// Creates a note from its component parts.
-    ///
-    /// # Caveats
-    ///
-    /// This low-level constructor enforces that the provided arguments produce an
-    /// internally valid `Note`. However, it allows notes to be constructed in a way that
-    /// violates required security checks for note decryption, as specified in
-    /// [Section 4.19] of the Zcash Protocol Specification. Users of this constructor
-    /// should only call it with note components that have been fully validated by
-    /// decrypting a received note according to [Section 4.19].
-    ///
-    /// [Section 4.19]: https://zips.z.cash/protocol/protocol.pdf#saplingandorchardinband
-    pub fn from_parts(recipient: PaymentAddress, value: NoteValue, rseed: Rseed) -> Self {
-        Note {
-            recipient,
-            value,
-            rseed,
-        }
-    }
-
-    /// Returns the recipient of this note.
-    pub fn recipient(&self) -> PaymentAddress {
-        self.recipient
-    }
-
-    /// Returns the value of this note.
-    pub fn value(&self) -> NoteValue {
-        self.value
-    }
-
-    /// Returns the rseed value of this note.
-    pub fn rseed(&self) -> &Rseed {
-        &self.rseed
-    }
-
-    /// Computes the note commitment, returning the full point.
-    fn cm_full_point(&self) -> NoteCommitment {
-        NoteCommitment::derive(
-            self.recipient.g_d().to_bytes(),
-            self.recipient.pk_d().to_bytes(),
-            self.value,
-            self.rseed.rcm(),
-        )
-    }
-
-    /// Computes the nullifier given the nullifier deriving key and
-    /// note position
-    pub fn nf(&self, nk: &NullifierDerivingKey, position: u64) -> Nullifier {
-        Nullifier::derive(nk, self.cm_full_point(), position)
-    }
-
-    /// Computes the note commitment
-    pub fn cmu(&self) -> ExtractedNoteCommitment {
-        self.cm_full_point().into()
-    }
-
-    /// Defined in [Zcash Protocol Spec § 4.7.2: Sending Notes (Sapling)][saplingsend].
-    ///
-    /// [saplingsend]: https://zips.z.cash/protocol/protocol.pdf#saplingsend
-    pub fn rcm(&self) -> jubjub::Fr {
-        self.rseed.rcm().0
-    }
-
-    /// Derives `esk` from the internal `Rseed` value, or generates a random value if this
-    /// note was created with a v1 (i.e. pre-ZIP 212) note plaintext.
-    pub fn generate_or_derive_esk<R: RngCore + CryptoRng>(
-        &self,
-        rng: &mut R,
-    ) -> EphemeralSecretKey {
-        self.generate_or_derive_esk_internal(rng)
-    }
-
-    pub(crate) fn generate_or_derive_esk_internal<R: RngCore>(
-        &self,
-        rng: &mut R,
-    ) -> EphemeralSecretKey {
-        match self.derive_esk() {
-            None => EphemeralSecretKey(jubjub::Fr::random(rng)),
-            Some(esk) => esk,
-        }
-    }
-
-    /// Returns the derived `esk` if this note was created after ZIP 212 activated.
-    pub(crate) fn derive_esk(&self) -> Option<EphemeralSecretKey> {
-        match self.rseed {
-            Rseed::BeforeZip212(_) => None,
-            Rseed::AfterZip212(rseed) => Some(EphemeralSecretKey(jubjub::Fr::from_bytes_wide(
-                prf_expand(&rseed, &[0x05]).as_array(),
-            ))),
-        }
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub(super) mod testing {
-    use proptest::prelude::*;
-
-    use super::{
-        super::{testing::arb_payment_address, value::NoteValue},
-        Note, Rseed,
-    };
-
-    prop_compose! {
-        pub fn arb_note(value: NoteValue)(
-            recipient in arb_payment_address(),
-            rseed in prop::array::uniform32(prop::num::u8::ANY).prop_map(Rseed::AfterZip212)
-        ) -> Note {
-            Note {
-                recipient,
-                value,
-                rseed
-            }
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/note/commitment.rs b/zcash_primitives/src/sapling/note/commitment.rs
deleted file mode 100644
index 613537ec97..0000000000
--- a/zcash_primitives/src/sapling/note/commitment.rs
+++ /dev/null
@@ -1,106 +0,0 @@
-use core::iter;
-
-use bitvec::{array::BitArray, order::Lsb0};
-use group::ff::PrimeField;
-use subtle::{ConstantTimeEq, CtOption};
-
-use crate::sapling::{
-    pedersen_hash::Personalization,
-    spec::{extract_p, windowed_pedersen_commit},
-    value::NoteValue,
-};
-
-/// The trapdoor for a Sapling note commitment.
-#[derive(Clone, Debug)]
-pub(crate) struct NoteCommitTrapdoor(pub(super) jubjub::Fr);
-
-/// A commitment to a note.
-#[derive(Clone, Debug)]
-pub struct NoteCommitment(jubjub::SubgroupPoint);
-
-impl NoteCommitment {
-    pub(crate) fn inner(&self) -> jubjub::SubgroupPoint {
-        self.0
-    }
-}
-
-impl NoteCommitment {
-    /// Derives a Sapling note commitment.
-    #[cfg(feature = "temporary-zcashd")]
-    pub fn temporary_zcashd_derive(
-        g_d: [u8; 32],
-        pk_d: [u8; 32],
-        v: NoteValue,
-        rcm: jubjub::Fr,
-    ) -> Self {
-        Self::derive(g_d, pk_d, v, NoteCommitTrapdoor(rcm))
-    }
-
-    /// $NoteCommit^Sapling$.
-    ///
-    /// Defined in [Zcash Protocol Spec § 5.4.8.2: Windowed Pedersen commitments][concretewindowedcommit].
-    ///
-    /// [concretewindowedcommit]: https://zips.z.cash/protocol/protocol.pdf#concretewindowedcommit
-    pub(super) fn derive(
-        g_d: [u8; 32],
-        pk_d: [u8; 32],
-        v: NoteValue,
-        rcm: NoteCommitTrapdoor,
-    ) -> Self {
-        NoteCommitment(windowed_pedersen_commit(
-            Personalization::NoteCommitment,
-            iter::empty()
-                .chain(v.to_le_bits().iter().by_vals())
-                .chain(BitArray::<_, Lsb0>::new(g_d).iter().by_vals())
-                .chain(BitArray::<_, Lsb0>::new(pk_d).iter().by_vals()),
-            rcm.0,
-        ))
-    }
-}
-
-/// The u-coordinate of the commitment to a note.
-#[derive(Copy, Clone, Debug)]
-pub struct ExtractedNoteCommitment(pub(super) bls12_381::Scalar);
-
-impl ExtractedNoteCommitment {
-    /// Deserialize the extracted note commitment from a byte array.
-    ///
-    /// This method enforces the [consensus rule][cmucanon] that the byte representation
-    /// of cmu MUST be canonical.
-    ///
-    /// [cmucanon]: https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus
-    pub fn from_bytes(bytes: &[u8; 32]) -> CtOption<Self> {
-        bls12_381::Scalar::from_repr(*bytes).map(ExtractedNoteCommitment)
-    }
-
-    /// Serialize the value commitment to its canonical byte representation.
-    pub fn to_bytes(self) -> [u8; 32] {
-        self.0.to_repr()
-    }
-}
-
-impl From<NoteCommitment> for ExtractedNoteCommitment {
-    fn from(cm: NoteCommitment) -> Self {
-        ExtractedNoteCommitment(extract_p(&cm.0))
-    }
-}
-
-impl From<&ExtractedNoteCommitment> for [u8; 32] {
-    fn from(cmu: &ExtractedNoteCommitment) -> Self {
-        cmu.to_bytes()
-    }
-}
-
-impl ConstantTimeEq for ExtractedNoteCommitment {
-    fn ct_eq(&self, other: &Self) -> subtle::Choice {
-        self.0.ct_eq(&other.0)
-    }
-}
-
-impl PartialEq for ExtractedNoteCommitment {
-    fn eq(&self, other: &Self) -> bool {
-        self.ct_eq(other).into()
-    }
-}
-
-impl Eq for ExtractedNoteCommitment {}
diff --git a/zcash_primitives/src/sapling/note/nullifier.rs b/zcash_primitives/src/sapling/note/nullifier.rs
deleted file mode 100644
index 86f7bf946d..0000000000
--- a/zcash_primitives/src/sapling/note/nullifier.rs
+++ /dev/null
@@ -1,45 +0,0 @@
-use std::array::TryFromSliceError;
-
-use subtle::{Choice, ConstantTimeEq};
-
-use super::NoteCommitment;
-use crate::sapling::{
-    keys::NullifierDerivingKey,
-    spec::{mixing_pedersen_hash, prf_nf},
-};
-
-/// Typesafe wrapper for nullifier values.
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
-pub struct Nullifier(pub [u8; 32]);
-
-impl Nullifier {
-    pub fn from_slice(bytes: &[u8]) -> Result<Nullifier, TryFromSliceError> {
-        bytes.try_into().map(Nullifier)
-    }
-
-    pub fn to_vec(&self) -> Vec<u8> {
-        self.0.to_vec()
-    }
-
-    /// $DeriveNullifier$.
-    ///
-    /// Defined in [Zcash Protocol Spec § 4.16: Note Commitments and Nullifiers][commitmentsandnullifiers].
-    ///
-    /// [commitmentsandnullifiers]: https://zips.z.cash/protocol/protocol.pdf#commitmentsandnullifiers
-    pub(super) fn derive(nk: &NullifierDerivingKey, cm: NoteCommitment, position: u64) -> Self {
-        let rho = mixing_pedersen_hash(cm.inner(), position);
-        Nullifier(prf_nf(&nk.0, &rho))
-    }
-}
-
-impl AsRef<[u8]> for Nullifier {
-    fn as_ref(&self) -> &[u8] {
-        &self.0
-    }
-}
-
-impl ConstantTimeEq for Nullifier {
-    fn ct_eq(&self, other: &Self) -> Choice {
-        self.0.ct_eq(&other.0)
-    }
-}
diff --git a/zcash_primitives/src/sapling/note_encryption.rs b/zcash_primitives/src/sapling/note_encryption.rs
deleted file mode 100644
index a12dd4404f..0000000000
--- a/zcash_primitives/src/sapling/note_encryption.rs
+++ /dev/null
@@ -1,1550 +0,0 @@
-//! Implementation of in-band secret distribution for Zcash transactions.
-//!
-//! NB: the example code is only covering the post-Canopy case.
-
-use blake2b_simd::{Hash as Blake2bHash, Params as Blake2bParams};
-use byteorder::{LittleEndian, WriteBytesExt};
-use ff::PrimeField;
-use memuse::DynamicUsage;
-use rand_core::RngCore;
-
-use zcash_note_encryption::{
-    try_compact_note_decryption, try_note_decryption, try_output_recovery_with_ock,
-    try_output_recovery_with_ovk, BatchDomain, Domain, EphemeralKeyBytes, NoteEncryption,
-    NotePlaintextBytes, OutPlaintextBytes, OutgoingCipherKey, ShieldedOutput, COMPACT_NOTE_SIZE,
-    ENC_CIPHERTEXT_SIZE, NOTE_PLAINTEXT_SIZE, OUT_PLAINTEXT_SIZE,
-};
-
-use crate::{
-    consensus::{self, BlockHeight, NetworkUpgrade::Canopy, ZIP212_GRACE_PERIOD},
-    memo::MemoBytes,
-    sapling::{
-        keys::{
-            DiversifiedTransmissionKey, EphemeralPublicKey, EphemeralSecretKey, OutgoingViewingKey,
-            SharedSecret,
-        },
-        value::ValueCommitment,
-        Diversifier, Note, PaymentAddress, Rseed,
-    },
-    transaction::components::{
-        amount::Amount,
-        sapling::{self, OutputDescription},
-    },
-};
-
-use super::note::ExtractedNoteCommitment;
-
-pub use crate::sapling::keys::{PreparedEphemeralPublicKey, PreparedIncomingViewingKey};
-
-pub const KDF_SAPLING_PERSONALIZATION: &[u8; 16] = b"Zcash_SaplingKDF";
-pub const PRF_OCK_PERSONALIZATION: &[u8; 16] = b"Zcash_Derive_ock";
-
-/// Sapling PRF^ock.
-///
-/// Implemented per section 5.4.2 of the Zcash Protocol Specification.
-pub fn prf_ock(
-    ovk: &OutgoingViewingKey,
-    cv: &ValueCommitment,
-    cmu_bytes: &[u8; 32],
-    ephemeral_key: &EphemeralKeyBytes,
-) -> OutgoingCipherKey {
-    OutgoingCipherKey(
-        Blake2bParams::new()
-            .hash_length(32)
-            .personal(PRF_OCK_PERSONALIZATION)
-            .to_state()
-            .update(&ovk.0)
-            .update(&cv.to_bytes())
-            .update(cmu_bytes)
-            .update(ephemeral_key.as_ref())
-            .finalize()
-            .as_bytes()
-            .try_into()
-            .unwrap(),
-    )
-}
-
-/// `get_pk_d` must check that the diversifier contained within the note plaintext is a
-/// valid Sapling diversifier.
-fn sapling_parse_note_plaintext_without_memo<F, P: consensus::Parameters>(
-    domain: &SaplingDomain<P>,
-    plaintext: &[u8],
-    get_pk_d: F,
-) -> Option<(Note, PaymentAddress)>
-where
-    F: FnOnce(&Diversifier) -> Option<DiversifiedTransmissionKey>,
-{
-    assert!(plaintext.len() >= COMPACT_NOTE_SIZE);
-
-    // Check note plaintext version
-    if !plaintext_version_is_valid(&domain.params, domain.height, plaintext[0]) {
-        return None;
-    }
-
-    // The unwraps below are guaranteed to succeed by the assertion above
-    let diversifier = Diversifier(plaintext[1..12].try_into().unwrap());
-    let value = Amount::from_u64_le_bytes(plaintext[12..20].try_into().unwrap()).ok()?;
-    let r: [u8; 32] = plaintext[20..COMPACT_NOTE_SIZE].try_into().unwrap();
-
-    let rseed = if plaintext[0] == 0x01 {
-        let rcm = Option::from(jubjub::Fr::from_repr(r))?;
-        Rseed::BeforeZip212(rcm)
-    } else {
-        Rseed::AfterZip212(r)
-    };
-
-    let pk_d = get_pk_d(&diversifier)?;
-
-    // `diversifier` was checked by `get_pk_d`.
-    let to = PaymentAddress::from_parts_unchecked(diversifier, pk_d)?;
-    let note = to.create_note(value.into(), rseed);
-    Some((note, to))
-}
-
-pub struct SaplingDomain<P: consensus::Parameters> {
-    params: P,
-    height: BlockHeight,
-}
-
-impl<P: consensus::Parameters + DynamicUsage> DynamicUsage for SaplingDomain<P> {
-    fn dynamic_usage(&self) -> usize {
-        self.params.dynamic_usage() + self.height.dynamic_usage()
-    }
-
-    fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
-        let (params_lower, params_upper) = self.params.dynamic_usage_bounds();
-        let (height_lower, height_upper) = self.height.dynamic_usage_bounds();
-        (
-            params_lower + height_lower,
-            params_upper.zip(height_upper).map(|(a, b)| a + b),
-        )
-    }
-}
-
-impl<P: consensus::Parameters> SaplingDomain<P> {
-    pub fn for_height(params: P, height: BlockHeight) -> Self {
-        Self { params, height }
-    }
-}
-
-impl<P: consensus::Parameters> Domain for SaplingDomain<P> {
-    type EphemeralSecretKey = EphemeralSecretKey;
-    // It is acceptable for this to be a point rather than a byte array, because we
-    // enforce by consensus that points must not be small-order, and all points with
-    // non-canonical serialization are small-order.
-    type EphemeralPublicKey = EphemeralPublicKey;
-    type PreparedEphemeralPublicKey = PreparedEphemeralPublicKey;
-    type SharedSecret = SharedSecret;
-    type SymmetricKey = Blake2bHash;
-    type Note = Note;
-    type Recipient = PaymentAddress;
-    type DiversifiedTransmissionKey = DiversifiedTransmissionKey;
-    type IncomingViewingKey = PreparedIncomingViewingKey;
-    type OutgoingViewingKey = OutgoingViewingKey;
-    type ValueCommitment = ValueCommitment;
-    type ExtractedCommitment = ExtractedNoteCommitment;
-    type ExtractedCommitmentBytes = [u8; 32];
-    type Memo = MemoBytes;
-
-    fn derive_esk(note: &Self::Note) -> Option<Self::EphemeralSecretKey> {
-        note.derive_esk()
-    }
-
-    fn get_pk_d(note: &Self::Note) -> Self::DiversifiedTransmissionKey {
-        *note.recipient().pk_d()
-    }
-
-    fn prepare_epk(epk: Self::EphemeralPublicKey) -> Self::PreparedEphemeralPublicKey {
-        PreparedEphemeralPublicKey::new(epk)
-    }
-
-    fn ka_derive_public(
-        note: &Self::Note,
-        esk: &Self::EphemeralSecretKey,
-    ) -> Self::EphemeralPublicKey {
-        esk.derive_public(note.recipient().g_d().into())
-    }
-
-    fn ka_agree_enc(
-        esk: &Self::EphemeralSecretKey,
-        pk_d: &Self::DiversifiedTransmissionKey,
-    ) -> Self::SharedSecret {
-        esk.agree(pk_d)
-    }
-
-    fn ka_agree_dec(
-        ivk: &Self::IncomingViewingKey,
-        epk: &Self::PreparedEphemeralPublicKey,
-    ) -> Self::SharedSecret {
-        epk.agree(ivk)
-    }
-
-    /// Sapling KDF for note encryption.
-    ///
-    /// Implements section 5.4.4.4 of the Zcash Protocol Specification.
-    fn kdf(dhsecret: SharedSecret, epk: &EphemeralKeyBytes) -> Blake2bHash {
-        dhsecret.kdf_sapling(epk)
-    }
-
-    fn note_plaintext_bytes(note: &Self::Note, memo: &Self::Memo) -> NotePlaintextBytes {
-        // Note plaintext encoding is defined in section 5.5 of the Zcash Protocol
-        // Specification.
-        let mut input = [0; NOTE_PLAINTEXT_SIZE];
-        input[0] = match note.rseed() {
-            Rseed::BeforeZip212(_) => 1,
-            Rseed::AfterZip212(_) => 2,
-        };
-        input[1..12].copy_from_slice(&note.recipient().diversifier().0);
-        (&mut input[12..20])
-            .write_u64::<LittleEndian>(note.value().inner())
-            .unwrap();
-
-        match note.rseed() {
-            Rseed::BeforeZip212(rcm) => {
-                input[20..COMPACT_NOTE_SIZE].copy_from_slice(rcm.to_repr().as_ref());
-            }
-            Rseed::AfterZip212(rseed) => {
-                input[20..COMPACT_NOTE_SIZE].copy_from_slice(rseed);
-            }
-        }
-
-        input[COMPACT_NOTE_SIZE..NOTE_PLAINTEXT_SIZE].copy_from_slice(&memo.as_array()[..]);
-
-        NotePlaintextBytes(input)
-    }
-
-    fn derive_ock(
-        ovk: &Self::OutgoingViewingKey,
-        cv: &Self::ValueCommitment,
-        cmu_bytes: &Self::ExtractedCommitmentBytes,
-        epk: &EphemeralKeyBytes,
-    ) -> OutgoingCipherKey {
-        prf_ock(ovk, cv, cmu_bytes, epk)
-    }
-
-    fn outgoing_plaintext_bytes(
-        note: &Self::Note,
-        esk: &Self::EphemeralSecretKey,
-    ) -> OutPlaintextBytes {
-        let mut input = [0u8; OUT_PLAINTEXT_SIZE];
-        input[0..32].copy_from_slice(&note.recipient().pk_d().to_bytes());
-        input[32..OUT_PLAINTEXT_SIZE].copy_from_slice(esk.0.to_repr().as_ref());
-
-        OutPlaintextBytes(input)
-    }
-
-    fn epk_bytes(epk: &Self::EphemeralPublicKey) -> EphemeralKeyBytes {
-        epk.to_bytes()
-    }
-
-    fn epk(ephemeral_key: &EphemeralKeyBytes) -> Option<Self::EphemeralPublicKey> {
-        // ZIP 216: We unconditionally reject non-canonical encodings, because these have
-        // always been rejected by consensus (due to small-order checks).
-        // https://zips.z.cash/zip-0216#specification
-        EphemeralPublicKey::from_bytes(&ephemeral_key.0).into()
-    }
-
-    fn parse_note_plaintext_without_memo_ivk(
-        &self,
-        ivk: &Self::IncomingViewingKey,
-        plaintext: &[u8],
-    ) -> Option<(Self::Note, Self::Recipient)> {
-        sapling_parse_note_plaintext_without_memo(self, plaintext, |diversifier| {
-            DiversifiedTransmissionKey::derive(ivk, diversifier)
-        })
-    }
-
-    fn parse_note_plaintext_without_memo_ovk(
-        &self,
-        pk_d: &Self::DiversifiedTransmissionKey,
-        plaintext: &NotePlaintextBytes,
-    ) -> Option<(Self::Note, Self::Recipient)> {
-        sapling_parse_note_plaintext_without_memo(self, &plaintext.0, |diversifier| {
-            diversifier.g_d().map(|_| *pk_d)
-        })
-    }
-
-    fn cmstar(note: &Self::Note) -> Self::ExtractedCommitment {
-        note.cmu()
-    }
-
-    fn extract_pk_d(op: &OutPlaintextBytes) -> Option<Self::DiversifiedTransmissionKey> {
-        DiversifiedTransmissionKey::from_bytes(
-            op.0[0..32].try_into().expect("slice is the correct length"),
-        )
-        .into()
-    }
-
-    fn extract_esk(op: &OutPlaintextBytes) -> Option<Self::EphemeralSecretKey> {
-        EphemeralSecretKey::from_bytes(
-            op.0[32..OUT_PLAINTEXT_SIZE]
-                .try_into()
-                .expect("slice is the correct length"),
-        )
-        .into()
-    }
-
-    fn extract_memo(&self, plaintext: &NotePlaintextBytes) -> Self::Memo {
-        MemoBytes::from_bytes(&plaintext.0[COMPACT_NOTE_SIZE..NOTE_PLAINTEXT_SIZE]).unwrap()
-    }
-}
-
-impl<P: consensus::Parameters> BatchDomain for SaplingDomain<P> {
-    fn batch_kdf<'a>(
-        items: impl Iterator<Item = (Option<Self::SharedSecret>, &'a EphemeralKeyBytes)>,
-    ) -> Vec<Option<Self::SymmetricKey>> {
-        let (shared_secrets, ephemeral_keys): (Vec<_>, Vec<_>) = items.unzip();
-
-        SharedSecret::batch_to_affine(shared_secrets)
-            .zip(ephemeral_keys.into_iter())
-            .map(|(secret, ephemeral_key)| {
-                secret.map(|dhsecret| SharedSecret::kdf_sapling_inner(dhsecret, ephemeral_key))
-            })
-            .collect()
-    }
-
-    fn batch_epk(
-        ephemeral_keys: impl Iterator<Item = EphemeralKeyBytes>,
-    ) -> Vec<(Option<Self::PreparedEphemeralPublicKey>, EphemeralKeyBytes)> {
-        let ephemeral_keys: Vec<_> = ephemeral_keys.collect();
-        let epks = jubjub::AffinePoint::batch_from_bytes(ephemeral_keys.iter().map(|b| b.0));
-        epks.into_iter()
-            .zip(ephemeral_keys.into_iter())
-            .map(|(epk, ephemeral_key)| {
-                (
-                    Option::from(epk)
-                        .map(EphemeralPublicKey::from_affine)
-                        .map(Self::prepare_epk),
-                    ephemeral_key,
-                )
-            })
-            .collect()
-    }
-}
-
-/// Creates a new encryption context for the given note.
-///
-/// Setting `ovk` to `None` represents the `ovk = ⊥` case, where the note cannot be
-/// recovered by the sender.
-///
-/// NB: the example code here only covers the post-Canopy case.
-///
-/// # Examples
-///
-/// ```
-/// use ff::Field;
-/// use rand_core::OsRng;
-/// use zcash_primitives::{
-///     keys::{OutgoingViewingKey, prf_expand},
-///     consensus::{TEST_NETWORK, TestNetwork, NetworkUpgrade, Parameters},
-///     memo::MemoBytes,
-///     sapling::{
-///         note_encryption::sapling_note_encryption,
-///         util::generate_random_rseed,
-///         value::{NoteValue, ValueCommitTrapdoor, ValueCommitment},
-///         Diversifier, PaymentAddress, Rseed, SaplingIvk,
-///     },
-/// };
-///
-/// let mut rng = OsRng;
-///
-/// let ivk = SaplingIvk(jubjub::Scalar::random(&mut rng));
-/// let diversifier = Diversifier([0; 11]);
-/// let to = ivk.to_payment_address(diversifier).unwrap();
-/// let ovk = Some(OutgoingViewingKey([0; 32]));
-///
-/// let value = NoteValue::from_raw(1000);
-/// let rcv = ValueCommitTrapdoor::random(&mut rng);
-/// let cv = ValueCommitment::derive(value, rcv);
-/// let height = TEST_NETWORK.activation_height(NetworkUpgrade::Canopy).unwrap();
-/// let rseed = generate_random_rseed(&TEST_NETWORK, height, &mut rng);
-/// let note = to.create_note(value.inner(), rseed);
-/// let cmu = note.cmu();
-///
-/// let mut enc = sapling_note_encryption::<_, TestNetwork>(ovk, note, MemoBytes::empty(), &mut rng);
-/// let encCiphertext = enc.encrypt_note_plaintext();
-/// let outCiphertext = enc.encrypt_outgoing_plaintext(&cv, &cmu, &mut rng);
-/// ```
-pub fn sapling_note_encryption<R: RngCore, P: consensus::Parameters>(
-    ovk: Option<OutgoingViewingKey>,
-    note: Note,
-    memo: MemoBytes,
-    rng: &mut R,
-) -> NoteEncryption<SaplingDomain<P>> {
-    let esk = note.generate_or_derive_esk_internal(rng);
-    NoteEncryption::new_with_esk(esk, ovk, note, memo)
-}
-
-#[allow(clippy::if_same_then_else)]
-#[allow(clippy::needless_bool)]
-pub fn plaintext_version_is_valid<P: consensus::Parameters>(
-    params: &P,
-    height: BlockHeight,
-    leadbyte: u8,
-) -> bool {
-    if params.is_nu_active(Canopy, height) {
-        let grace_period_end_height =
-            params.activation_height(Canopy).unwrap() + ZIP212_GRACE_PERIOD;
-
-        if height < grace_period_end_height && leadbyte != 0x01 && leadbyte != 0x02 {
-            // non-{0x01,0x02} received after Canopy activation and before grace period has elapsed
-            false
-        } else if height >= grace_period_end_height && leadbyte != 0x02 {
-            // non-0x02 received past (Canopy activation height + grace period)
-            false
-        } else {
-            true
-        }
-    } else {
-        // return false if non-0x01 received when Canopy is not active
-        leadbyte == 0x01
-    }
-}
-
-pub fn try_sapling_note_decryption<
-    P: consensus::Parameters,
-    Output: ShieldedOutput<SaplingDomain<P>, ENC_CIPHERTEXT_SIZE>,
->(
-    params: &P,
-    height: BlockHeight,
-    ivk: &PreparedIncomingViewingKey,
-    output: &Output,
-) -> Option<(Note, PaymentAddress, MemoBytes)> {
-    let domain = SaplingDomain {
-        params: params.clone(),
-        height,
-    };
-    try_note_decryption(&domain, ivk, output)
-}
-
-pub fn try_sapling_compact_note_decryption<
-    P: consensus::Parameters,
-    Output: ShieldedOutput<SaplingDomain<P>, COMPACT_NOTE_SIZE>,
->(
-    params: &P,
-    height: BlockHeight,
-    ivk: &PreparedIncomingViewingKey,
-    output: &Output,
-) -> Option<(Note, PaymentAddress)> {
-    let domain = SaplingDomain {
-        params: params.clone(),
-        height,
-    };
-
-    try_compact_note_decryption(&domain, ivk, output)
-}
-
-/// Recovery of the full note plaintext by the sender.
-///
-/// Attempts to decrypt and validate the given `enc_ciphertext` using the given `ock`.
-/// If successful, the corresponding Sapling note and memo are returned, along with the
-/// `PaymentAddress` to which the note was sent.
-///
-/// Implements part of section 4.19.3 of the Zcash Protocol Specification.
-/// For decryption using a Full Viewing Key see [`try_sapling_output_recovery`].
-pub fn try_sapling_output_recovery_with_ock<P: consensus::Parameters>(
-    params: &P,
-    height: BlockHeight,
-    ock: &OutgoingCipherKey,
-    output: &OutputDescription<sapling::GrothProofBytes>,
-) -> Option<(Note, PaymentAddress, MemoBytes)> {
-    let domain = SaplingDomain {
-        params: params.clone(),
-        height,
-    };
-
-    try_output_recovery_with_ock(&domain, ock, output, output.out_ciphertext())
-}
-
-/// Recovery of the full note plaintext by the sender.
-///
-/// Attempts to decrypt and validate the given `enc_ciphertext` using the given `ovk`.
-/// If successful, the corresponding Sapling note and memo are returned, along with the
-/// `PaymentAddress` to which the note was sent.
-///
-/// Implements section 4.19.3 of the Zcash Protocol Specification.
-#[allow(clippy::too_many_arguments)]
-pub fn try_sapling_output_recovery<P: consensus::Parameters>(
-    params: &P,
-    height: BlockHeight,
-    ovk: &OutgoingViewingKey,
-    output: &OutputDescription<sapling::GrothProofBytes>,
-) -> Option<(Note, PaymentAddress, MemoBytes)> {
-    let domain = SaplingDomain {
-        params: params.clone(),
-        height,
-    };
-
-    try_output_recovery_with_ovk(&domain, ovk, output, output.cv(), output.out_ciphertext())
-}
-
-#[cfg(test)]
-mod tests {
-    use chacha20poly1305::{
-        aead::{AeadInPlace, KeyInit},
-        ChaCha20Poly1305,
-    };
-    use ff::{Field, PrimeField};
-    use group::Group;
-    use group::GroupEncoding;
-    use rand_core::OsRng;
-    use rand_core::{CryptoRng, RngCore};
-
-    use zcash_note_encryption::{
-        batch, EphemeralKeyBytes, NoteEncryption, OutgoingCipherKey, ENC_CIPHERTEXT_SIZE,
-        NOTE_PLAINTEXT_SIZE, OUT_CIPHERTEXT_SIZE, OUT_PLAINTEXT_SIZE,
-    };
-
-    use super::{
-        prf_ock, sapling_note_encryption, try_sapling_compact_note_decryption,
-        try_sapling_note_decryption, try_sapling_output_recovery,
-        try_sapling_output_recovery_with_ock, SaplingDomain,
-    };
-
-    use crate::{
-        consensus::{
-            BlockHeight,
-            NetworkUpgrade::{Canopy, Sapling},
-            Parameters, TestNetwork, TEST_NETWORK, ZIP212_GRACE_PERIOD,
-        },
-        keys::OutgoingViewingKey,
-        memo::MemoBytes,
-        sapling::{
-            keys::{DiversifiedTransmissionKey, EphemeralSecretKey},
-            note::ExtractedNoteCommitment,
-            note_encryption::PreparedIncomingViewingKey,
-            util::generate_random_rseed,
-            value::{NoteValue, ValueCommitTrapdoor, ValueCommitment},
-            Diversifier, PaymentAddress, Rseed, SaplingIvk,
-        },
-        transaction::components::{
-            sapling::{self, CompactOutputDescription, OutputDescription},
-            GROTH_PROOF_SIZE,
-        },
-    };
-
-    fn random_enc_ciphertext<R: RngCore + CryptoRng>(
-        height: BlockHeight,
-        mut rng: &mut R,
-    ) -> (
-        OutgoingViewingKey,
-        OutgoingCipherKey,
-        PreparedIncomingViewingKey,
-        OutputDescription<sapling::GrothProofBytes>,
-    ) {
-        let ivk = SaplingIvk(jubjub::Fr::random(&mut rng));
-        let prepared_ivk = PreparedIncomingViewingKey::new(&ivk);
-
-        let (ovk, ock, output) = random_enc_ciphertext_with(height, &ivk, rng);
-
-        assert!(
-            try_sapling_note_decryption(&TEST_NETWORK, height, &prepared_ivk, &output).is_some()
-        );
-        assert!(try_sapling_compact_note_decryption(
-            &TEST_NETWORK,
-            height,
-            &prepared_ivk,
-            &CompactOutputDescription::from(output.clone()),
-        )
-        .is_some());
-
-        let ovk_output_recovery = try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output);
-
-        let ock_output_recovery =
-            try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output);
-        assert!(ovk_output_recovery.is_some());
-        assert!(ock_output_recovery.is_some());
-        assert_eq!(ovk_output_recovery, ock_output_recovery);
-
-        (ovk, ock, prepared_ivk, output)
-    }
-
-    fn random_enc_ciphertext_with<R: RngCore + CryptoRng>(
-        height: BlockHeight,
-        ivk: &SaplingIvk,
-        mut rng: &mut R,
-    ) -> (
-        OutgoingViewingKey,
-        OutgoingCipherKey,
-        OutputDescription<sapling::GrothProofBytes>,
-    ) {
-        let diversifier = Diversifier([0; 11]);
-        let pa = ivk.to_payment_address(diversifier).unwrap();
-
-        // Construct the value commitment for the proof instance
-        let value = NoteValue::from_raw(100);
-        let rcv = ValueCommitTrapdoor::random(&mut rng);
-        let cv = ValueCommitment::derive(value, rcv);
-
-        let rseed = generate_random_rseed(&TEST_NETWORK, height, &mut rng);
-
-        let note = pa.create_note(value.inner(), rseed);
-        let cmu = note.cmu();
-
-        let ovk = OutgoingViewingKey([0; 32]);
-        let ne = sapling_note_encryption::<_, TestNetwork>(
-            Some(ovk),
-            note,
-            MemoBytes::empty(),
-            &mut rng,
-        );
-        let epk = ne.epk();
-        let ock = prf_ock(&ovk, &cv, &cmu.to_bytes(), &epk.to_bytes());
-
-        let out_ciphertext = ne.encrypt_outgoing_plaintext(&cv, &cmu, &mut rng);
-        let output = OutputDescription::from_parts(
-            cv,
-            cmu,
-            epk.to_bytes(),
-            ne.encrypt_note_plaintext(),
-            out_ciphertext,
-            [0u8; GROTH_PROOF_SIZE],
-        );
-
-        (ovk, ock, output)
-    }
-
-    fn reencrypt_out_ciphertext(
-        ovk: &OutgoingViewingKey,
-        cv: &ValueCommitment,
-        cmu: &ExtractedNoteCommitment,
-        ephemeral_key: &EphemeralKeyBytes,
-        out_ciphertext: &[u8; OUT_CIPHERTEXT_SIZE],
-        modify_plaintext: impl Fn(&mut [u8; OUT_PLAINTEXT_SIZE]),
-    ) -> [u8; OUT_CIPHERTEXT_SIZE] {
-        let ock = prf_ock(ovk, cv, &cmu.to_bytes(), ephemeral_key);
-
-        let mut op = [0; OUT_PLAINTEXT_SIZE];
-        op.copy_from_slice(&out_ciphertext[..OUT_PLAINTEXT_SIZE]);
-
-        ChaCha20Poly1305::new(ock.as_ref().into())
-            .decrypt_in_place_detached(
-                [0u8; 12][..].into(),
-                &[],
-                &mut op,
-                out_ciphertext[OUT_PLAINTEXT_SIZE..].into(),
-            )
-            .unwrap();
-
-        modify_plaintext(&mut op);
-
-        let tag = ChaCha20Poly1305::new(ock.as_ref().into())
-            .encrypt_in_place_detached([0u8; 12][..].into(), &[], &mut op)
-            .unwrap();
-
-        let mut out_ciphertext = [0u8; OUT_CIPHERTEXT_SIZE];
-        out_ciphertext[..OUT_PLAINTEXT_SIZE].copy_from_slice(&op);
-        out_ciphertext[OUT_PLAINTEXT_SIZE..].copy_from_slice(&tag);
-        out_ciphertext
-    }
-
-    fn reencrypt_enc_ciphertext(
-        ovk: &OutgoingViewingKey,
-        cv: &ValueCommitment,
-        cmu: &ExtractedNoteCommitment,
-        ephemeral_key: &EphemeralKeyBytes,
-        enc_ciphertext: &[u8; ENC_CIPHERTEXT_SIZE],
-        out_ciphertext: &[u8; OUT_CIPHERTEXT_SIZE],
-        modify_plaintext: impl Fn(&mut [u8; NOTE_PLAINTEXT_SIZE]),
-    ) -> [u8; ENC_CIPHERTEXT_SIZE] {
-        let ock = prf_ock(ovk, cv, &cmu.to_bytes(), ephemeral_key);
-
-        let mut op = [0; OUT_PLAINTEXT_SIZE];
-        op.copy_from_slice(&out_ciphertext[..OUT_PLAINTEXT_SIZE]);
-
-        ChaCha20Poly1305::new(ock.as_ref().into())
-            .decrypt_in_place_detached(
-                [0u8; 12][..].into(),
-                &[],
-                &mut op,
-                out_ciphertext[OUT_PLAINTEXT_SIZE..].into(),
-            )
-            .unwrap();
-
-        let pk_d = DiversifiedTransmissionKey::from_bytes(&op[0..32].try_into().unwrap()).unwrap();
-
-        let esk = jubjub::Fr::from_repr(op[32..OUT_PLAINTEXT_SIZE].try_into().unwrap()).unwrap();
-
-        let shared_secret = EphemeralSecretKey(esk).agree(&pk_d);
-        let key = shared_secret.kdf_sapling(ephemeral_key);
-
-        let mut plaintext = [0; NOTE_PLAINTEXT_SIZE];
-        plaintext.copy_from_slice(&enc_ciphertext[..NOTE_PLAINTEXT_SIZE]);
-
-        ChaCha20Poly1305::new(key.as_bytes().into())
-            .decrypt_in_place_detached(
-                [0u8; 12][..].into(),
-                &[],
-                &mut plaintext,
-                enc_ciphertext[NOTE_PLAINTEXT_SIZE..].into(),
-            )
-            .unwrap();
-
-        modify_plaintext(&mut plaintext);
-
-        let tag = ChaCha20Poly1305::new(key.as_ref().into())
-            .encrypt_in_place_detached([0u8; 12][..].into(), &[], &mut plaintext)
-            .unwrap();
-
-        let mut enc_ciphertext = [0u8; ENC_CIPHERTEXT_SIZE];
-        enc_ciphertext[..NOTE_PLAINTEXT_SIZE].copy_from_slice(&plaintext);
-        enc_ciphertext[NOTE_PLAINTEXT_SIZE..].copy_from_slice(&tag);
-        enc_ciphertext
-    }
-
-    fn find_invalid_diversifier() -> Diversifier {
-        // Find an invalid diversifier
-        let mut d = Diversifier([0; 11]);
-        loop {
-            for k in 0..11 {
-                d.0[k] = d.0[k].wrapping_add(1);
-                if d.0[k] != 0 {
-                    break;
-                }
-            }
-            if d.g_d().is_none() {
-                break;
-            }
-        }
-        d
-    }
-
-    fn find_valid_diversifier() -> Diversifier {
-        // Find a different valid diversifier
-        let mut d = Diversifier([0; 11]);
-        loop {
-            for k in 0..11 {
-                d.0[k] = d.0[k].wrapping_add(1);
-                if d.0[k] != 0 {
-                    break;
-                }
-            }
-            if d.g_d().is_some() {
-                break;
-            }
-        }
-        d
-    }
-
-    #[test]
-    fn decryption_with_invalid_ivk() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, _, output) = random_enc_ciphertext(height, &mut rng);
-
-            assert_eq!(
-                try_sapling_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &PreparedIncomingViewingKey::new(&SaplingIvk(jubjub::Fr::random(&mut rng))),
-                    &output
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn decryption_with_invalid_epk() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.ephemeral_key_mut() = jubjub::ExtendedPoint::random(&mut rng).to_bytes().into();
-
-            assert_eq!(
-                try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn decryption_with_invalid_cmu() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-            *output.cmu_mut() =
-                ExtractedNoteCommitment::from_bytes(&bls12_381::Scalar::random(&mut rng).to_repr())
-                    .unwrap();
-
-            assert_eq!(
-                try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn decryption_with_invalid_tag() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-            output.enc_ciphertext_mut()[ENC_CIPHERTEXT_SIZE - 1] ^= 0xff;
-
-            assert_eq!(
-                try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn decryption_with_invalid_version_byte() {
-        let mut rng = OsRng;
-        let canopy_activation_height = TEST_NETWORK.activation_height(Canopy).unwrap();
-        let heights = [
-            canopy_activation_height - 1,
-            canopy_activation_height,
-            canopy_activation_height + ZIP212_GRACE_PERIOD,
-        ];
-        let leadbytes = [0x02, 0x03, 0x01];
-
-        for (&height, &leadbyte) in heights.iter().zip(leadbytes.iter()) {
-            let (ovk, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[0] = leadbyte,
-            );
-            assert_eq!(
-                try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn decryption_with_invalid_diversifier() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[1..12].copy_from_slice(&find_invalid_diversifier().0),
-            );
-            assert_eq!(
-                try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn decryption_with_incorrect_diversifier() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[1..12].copy_from_slice(&find_valid_diversifier().0),
-            );
-
-            assert_eq!(
-                try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn compact_decryption_with_invalid_ivk() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, _, output) = random_enc_ciphertext(height, &mut rng);
-
-            assert_eq!(
-                try_sapling_compact_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &PreparedIncomingViewingKey::new(&SaplingIvk(jubjub::Fr::random(&mut rng))),
-                    &CompactOutputDescription::from(output)
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn compact_decryption_with_invalid_epk() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-            *output.ephemeral_key_mut() = jubjub::ExtendedPoint::random(&mut rng).to_bytes().into();
-
-            assert_eq!(
-                try_sapling_compact_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &ivk,
-                    &CompactOutputDescription::from(output)
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn compact_decryption_with_invalid_cmu() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-            *output.cmu_mut() =
-                ExtractedNoteCommitment::from_bytes(&bls12_381::Scalar::random(&mut rng).to_repr())
-                    .unwrap();
-
-            assert_eq!(
-                try_sapling_compact_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &ivk,
-                    &CompactOutputDescription::from(output)
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn compact_decryption_with_invalid_version_byte() {
-        let mut rng = OsRng;
-        let canopy_activation_height = TEST_NETWORK.activation_height(Canopy).unwrap();
-        let heights = [
-            canopy_activation_height - 1,
-            canopy_activation_height,
-            canopy_activation_height + ZIP212_GRACE_PERIOD,
-        ];
-        let leadbytes = [0x02, 0x03, 0x01];
-
-        for (&height, &leadbyte) in heights.iter().zip(leadbytes.iter()) {
-            let (ovk, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[0] = leadbyte,
-            );
-            assert_eq!(
-                try_sapling_compact_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &ivk,
-                    &CompactOutputDescription::from(output)
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn compact_decryption_with_invalid_diversifier() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[1..12].copy_from_slice(&find_invalid_diversifier().0),
-            );
-            assert_eq!(
-                try_sapling_compact_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &ivk,
-                    &CompactOutputDescription::from(output)
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn compact_decryption_with_incorrect_diversifier() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, _, ivk, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[1..12].copy_from_slice(&find_valid_diversifier().0),
-            );
-            assert_eq!(
-                try_sapling_compact_note_decryption(
-                    &TEST_NETWORK,
-                    height,
-                    &ivk,
-                    &CompactOutputDescription::from(output)
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_ovk() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (mut ovk, _, _, output) = random_enc_ciphertext(height, &mut rng);
-
-            ovk.0[0] ^= 0xff;
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_ock() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (_, _, _, output) = random_enc_ciphertext(height, &mut rng);
-
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(
-                    &TEST_NETWORK,
-                    height,
-                    &OutgoingCipherKey([0u8; 32]),
-                    &output,
-                ),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_cv() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, _, _, mut output) = random_enc_ciphertext(height, &mut rng);
-            *output.cv_mut() = ValueCommitment::derive(
-                NoteValue::from_raw(7),
-                ValueCommitTrapdoor::random(&mut rng),
-            );
-
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_cmu() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-            *output.cmu_mut() =
-                ExtractedNoteCommitment::from_bytes(&bls12_381::Scalar::random(&mut rng).to_repr())
-                    .unwrap();
-
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_epk() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-            *output.ephemeral_key_mut() = jubjub::ExtendedPoint::random(&mut rng).to_bytes().into();
-
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_enc_tag() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            output.enc_ciphertext_mut()[ENC_CIPHERTEXT_SIZE - 1] ^= 0xff;
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_out_tag() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            output.out_ciphertext_mut()[OUT_CIPHERTEXT_SIZE - 1] ^= 0xff;
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_version_byte() {
-        let mut rng = OsRng;
-        let canopy_activation_height = TEST_NETWORK.activation_height(Canopy).unwrap();
-        let heights = [
-            canopy_activation_height - 1,
-            canopy_activation_height,
-            canopy_activation_height + ZIP212_GRACE_PERIOD,
-        ];
-        let leadbytes = [0x02, 0x03, 0x01];
-
-        for (&height, &leadbyte) in heights.iter().zip(leadbytes.iter()) {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[0] = leadbyte,
-            );
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_diversifier() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[1..12].copy_from_slice(&find_invalid_diversifier().0),
-            );
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_incorrect_diversifier() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.enc_ciphertext_mut() = reencrypt_enc_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.enc_ciphertext(),
-                output.out_ciphertext(),
-                |pt| pt[1..12].copy_from_slice(&find_valid_diversifier().0),
-            );
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn recovery_with_invalid_pk_d() {
-        let mut rng = OsRng;
-        let heights = [
-            TEST_NETWORK.activation_height(Sapling).unwrap(),
-            TEST_NETWORK.activation_height(Canopy).unwrap(),
-        ];
-
-        for &height in heights.iter() {
-            let (ovk, ock, _, mut output) = random_enc_ciphertext(height, &mut rng);
-
-            *output.out_ciphertext_mut() = reencrypt_out_ciphertext(
-                &ovk,
-                output.cv(),
-                output.cmu(),
-                output.ephemeral_key(),
-                output.out_ciphertext(),
-                |pt| pt[0..32].copy_from_slice(&jubjub::ExtendedPoint::random(rng).to_bytes()),
-            );
-            assert_eq!(
-                try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output,),
-                None
-            );
-            assert_eq!(
-                try_sapling_output_recovery_with_ock(&TEST_NETWORK, height, &ock, &output,),
-                None
-            );
-        }
-    }
-
-    #[test]
-    fn test_vectors() {
-        let test_vectors = crate::test_vectors::note_encryption::make_test_vectors();
-
-        macro_rules! read_cmu {
-            ($field:expr) => {{
-                ExtractedNoteCommitment::from_bytes($field[..].try_into().unwrap()).unwrap()
-            }};
-        }
-
-        macro_rules! read_jubjub_scalar {
-            ($field:expr) => {{
-                jubjub::Fr::from_repr($field[..].try_into().unwrap()).unwrap()
-            }};
-        }
-
-        macro_rules! read_pk_d {
-            ($field:expr) => {
-                DiversifiedTransmissionKey::from_bytes(&$field).unwrap()
-            };
-        }
-
-        macro_rules! read_cv {
-            ($field:expr) => {
-                ValueCommitment::from_bytes_not_small_order(&$field).unwrap()
-            };
-        }
-
-        let height = TEST_NETWORK.activation_height(Sapling).unwrap();
-
-        for tv in test_vectors {
-            //
-            // Load the test vector components
-            //
-
-            let ivk = PreparedIncomingViewingKey::new(&SaplingIvk(read_jubjub_scalar!(tv.ivk)));
-            let pk_d = read_pk_d!(tv.default_pk_d);
-            let rcm = read_jubjub_scalar!(tv.rcm);
-            let cv = read_cv!(tv.cv);
-            let cmu = read_cmu!(tv.cmu);
-            let esk = EphemeralSecretKey(read_jubjub_scalar!(tv.esk));
-            let ephemeral_key = EphemeralKeyBytes(tv.epk);
-
-            //
-            // Test the individual components
-            //
-
-            let shared_secret = esk.agree(&pk_d);
-            assert_eq!(shared_secret.to_bytes(), tv.shared_secret);
-
-            let k_enc = shared_secret.kdf_sapling(&ephemeral_key);
-            assert_eq!(k_enc.as_bytes(), tv.k_enc);
-
-            let ovk = OutgoingViewingKey(tv.ovk);
-            let ock = prf_ock(&ovk, &cv, &cmu.to_bytes(), &ephemeral_key);
-            assert_eq!(ock.as_ref(), tv.ock);
-
-            let to = PaymentAddress::from_parts(Diversifier(tv.default_d), pk_d).unwrap();
-            let note = to.create_note(tv.v, Rseed::BeforeZip212(rcm));
-            assert_eq!(note.cmu(), cmu);
-
-            let output = OutputDescription::from_parts(
-                cv.clone(),
-                cmu,
-                ephemeral_key,
-                tv.c_enc,
-                tv.c_out,
-                [0u8; GROTH_PROOF_SIZE],
-            );
-
-            //
-            // Test decryption
-            // (Tested first because it only requires immutable references.)
-            //
-
-            match try_sapling_note_decryption(&TEST_NETWORK, height, &ivk, &output) {
-                Some((decrypted_note, decrypted_to, decrypted_memo)) => {
-                    assert_eq!(decrypted_note, note);
-                    assert_eq!(decrypted_to, to);
-                    assert_eq!(&decrypted_memo.as_array()[..], &tv.memo[..]);
-                }
-                None => panic!("Note decryption failed"),
-            }
-
-            match try_sapling_compact_note_decryption(
-                &TEST_NETWORK,
-                height,
-                &ivk,
-                &CompactOutputDescription::from(output.clone()),
-            ) {
-                Some((decrypted_note, decrypted_to)) => {
-                    assert_eq!(decrypted_note, note);
-                    assert_eq!(decrypted_to, to);
-                }
-                None => panic!("Compact note decryption failed"),
-            }
-
-            match try_sapling_output_recovery(&TEST_NETWORK, height, &ovk, &output) {
-                Some((decrypted_note, decrypted_to, decrypted_memo)) => {
-                    assert_eq!(decrypted_note, note);
-                    assert_eq!(decrypted_to, to);
-                    assert_eq!(&decrypted_memo.as_array()[..], &tv.memo[..]);
-                }
-                None => panic!("Output recovery failed"),
-            }
-
-            match &batch::try_note_decryption(
-                &[ivk.clone()],
-                &[(
-                    SaplingDomain::for_height(TEST_NETWORK, height),
-                    output.clone(),
-                )],
-            )[..]
-            {
-                [Some(((decrypted_note, decrypted_to, decrypted_memo), i))] => {
-                    assert_eq!(decrypted_note, &note);
-                    assert_eq!(decrypted_to, &to);
-                    assert_eq!(&decrypted_memo.as_array()[..], &tv.memo[..]);
-                    assert_eq!(*i, 0);
-                }
-                _ => panic!("Note decryption failed"),
-            }
-
-            match &batch::try_compact_note_decryption(
-                &[ivk.clone()],
-                &[(
-                    SaplingDomain::for_height(TEST_NETWORK, height),
-                    CompactOutputDescription::from(output.clone()),
-                )],
-            )[..]
-            {
-                [Some(((decrypted_note, decrypted_to), i))] => {
-                    assert_eq!(decrypted_note, &note);
-                    assert_eq!(decrypted_to, &to);
-                    assert_eq!(*i, 0);
-                }
-                _ => panic!("Note decryption failed"),
-            }
-
-            //
-            // Test encryption
-            //
-
-            let ne = NoteEncryption::<SaplingDomain<TestNetwork>>::new_with_esk(
-                esk,
-                Some(ovk),
-                note,
-                MemoBytes::from_bytes(&tv.memo).unwrap(),
-            );
-
-            assert_eq!(ne.encrypt_note_plaintext().as_ref(), &tv.c_enc[..]);
-            assert_eq!(
-                &ne.encrypt_outgoing_plaintext(&cv, &cmu, &mut OsRng)[..],
-                &tv.c_out[..]
-            );
-        }
-    }
-
-    #[test]
-    fn batching() {
-        let mut rng = OsRng;
-        let height = TEST_NETWORK.activation_height(Canopy).unwrap();
-
-        // Test batch trial-decryption with multiple IVKs and outputs.
-        let invalid_ivk = PreparedIncomingViewingKey::new(&SaplingIvk(jubjub::Fr::random(rng)));
-        let valid_ivk = SaplingIvk(jubjub::Fr::random(rng));
-        let outputs: Vec<_> = (0..10)
-            .map(|_| {
-                (
-                    SaplingDomain::for_height(TEST_NETWORK, height),
-                    random_enc_ciphertext_with(height, &valid_ivk, &mut rng).2,
-                )
-            })
-            .collect();
-        let valid_ivk = PreparedIncomingViewingKey::new(&valid_ivk);
-
-        // Check that batched trial decryptions with invalid_ivk fails.
-        let res = batch::try_note_decryption(&[invalid_ivk.clone()], &outputs);
-        assert_eq!(res.len(), 10);
-        assert_eq!(&res[..], &vec![None; 10][..]);
-
-        // Check that batched trial decryptions with valid_ivk succeeds.
-        let res = batch::try_note_decryption(&[invalid_ivk, valid_ivk.clone()], &outputs);
-        assert_eq!(res.len(), 10);
-        for (result, (_, output)) in res.iter().zip(outputs.iter()) {
-            // Confirm the successful batched trial decryptions gave the same result.
-            // In all cases, the index of the valid ivk is returned.
-            assert!(result.is_some());
-            assert_eq!(
-                result,
-                &try_sapling_note_decryption(&TEST_NETWORK, height, &valid_ivk, output)
-                    .map(|r| (r, 1))
-            );
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/pedersen_hash.rs b/zcash_primitives/src/sapling/pedersen_hash.rs
deleted file mode 100644
index 0e5ed26c53..0000000000
--- a/zcash_primitives/src/sapling/pedersen_hash.rs
+++ /dev/null
@@ -1,160 +0,0 @@
-//! Implementation of the Pedersen hash function used in Sapling.
-
-#[cfg(test)]
-pub(crate) mod test_vectors;
-
-use byteorder::{ByteOrder, LittleEndian};
-use ff::PrimeField;
-use group::Group;
-use std::ops::{AddAssign, Neg};
-
-use crate::constants::{
-    PEDERSEN_HASH_CHUNKS_PER_GENERATOR, PEDERSEN_HASH_EXP_TABLE, PEDERSEN_HASH_EXP_WINDOW_SIZE,
-};
-
-#[derive(Copy, Clone)]
-pub enum Personalization {
-    NoteCommitment,
-    MerkleTree(usize),
-}
-
-impl Personalization {
-    pub fn get_bits(&self) -> Vec<bool> {
-        match *self {
-            Personalization::NoteCommitment => vec![true, true, true, true, true, true],
-            Personalization::MerkleTree(num) => {
-                assert!(num < 63);
-
-                (0..6).map(|i| (num >> i) & 1 == 1).collect()
-            }
-        }
-    }
-}
-
-pub fn pedersen_hash<I>(personalization: Personalization, bits: I) -> jubjub::SubgroupPoint
-where
-    I: IntoIterator<Item = bool>,
-{
-    let mut bits = personalization
-        .get_bits()
-        .into_iter()
-        .chain(bits.into_iter());
-
-    let mut result = jubjub::SubgroupPoint::identity();
-    let mut generators = PEDERSEN_HASH_EXP_TABLE.iter();
-
-    loop {
-        let mut acc = jubjub::Fr::zero();
-        let mut cur = jubjub::Fr::one();
-        let mut chunks_remaining = PEDERSEN_HASH_CHUNKS_PER_GENERATOR;
-        let mut encountered_bits = false;
-
-        // Grab three bits from the input
-        while let Some(a) = bits.next() {
-            encountered_bits = true;
-
-            let b = bits.next().unwrap_or(false);
-            let c = bits.next().unwrap_or(false);
-
-            // Start computing this portion of the scalar
-            let mut tmp = cur;
-            if a {
-                tmp.add_assign(&cur);
-            }
-            cur = cur.double(); // 2^1 * cur
-            if b {
-                tmp.add_assign(&cur);
-            }
-
-            // conditionally negate
-            if c {
-                tmp = tmp.neg();
-            }
-
-            acc.add_assign(&tmp);
-
-            chunks_remaining -= 1;
-
-            if chunks_remaining == 0 {
-                break;
-            } else {
-                cur = cur.double().double().double(); // 2^4 * cur
-            }
-        }
-
-        if !encountered_bits {
-            break;
-        }
-
-        let mut table: &[Vec<jubjub::SubgroupPoint>] =
-            generators.next().expect("we don't have enough generators");
-        let window = PEDERSEN_HASH_EXP_WINDOW_SIZE as usize;
-        let window_mask = (1u64 << window) - 1;
-
-        let acc = acc.to_repr();
-        let num_limbs: usize = acc.as_ref().len() / 8;
-        let mut limbs = vec![0u64; num_limbs + 1];
-        LittleEndian::read_u64_into(acc.as_ref(), &mut limbs[..num_limbs]);
-
-        let mut tmp = jubjub::SubgroupPoint::identity();
-
-        let mut pos = 0;
-        while pos < jubjub::Fr::NUM_BITS as usize {
-            let u64_idx = pos / 64;
-            let bit_idx = pos % 64;
-            let i = (if bit_idx + window < 64 {
-                // This window's bits are contained in a single u64.
-                limbs[u64_idx] >> bit_idx
-            } else {
-                // Combine the current u64's bits with the bits from the next u64.
-                (limbs[u64_idx] >> bit_idx) | (limbs[u64_idx + 1] << (64 - bit_idx))
-            } & window_mask) as usize;
-
-            tmp += table[0][i];
-
-            pos += window;
-            table = &table[1..];
-        }
-
-        result += tmp;
-    }
-
-    result
-}
-
-#[cfg(test)]
-pub mod test {
-    use group::Curve;
-
-    use super::*;
-
-    pub struct TestVector<'a> {
-        pub personalization: Personalization,
-        pub input_bits: Vec<u8>,
-        pub hash_u: &'a str,
-        pub hash_v: &'a str,
-    }
-
-    #[test]
-    fn test_pedersen_hash_points() {
-        let test_vectors = test_vectors::get_vectors();
-
-        assert!(!test_vectors.is_empty());
-
-        for v in test_vectors.iter() {
-            let input_bools: Vec<bool> = v.input_bits.iter().map(|&i| i == 1).collect();
-
-            // The 6 bits prefix is handled separately
-            assert_eq!(v.personalization.get_bits(), &input_bools[..6]);
-
-            let p = jubjub::ExtendedPoint::from(pedersen_hash(
-                v.personalization,
-                input_bools.into_iter().skip(6),
-            ))
-            .to_affine();
-
-            assert_eq!(p.get_u().to_string(), v.hash_u);
-            assert_eq!(p.get_v().to_string(), v.hash_v);
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/pedersen_hash/test_vectors.rs b/zcash_primitives/src/sapling/pedersen_hash/test_vectors.rs
deleted file mode 100644
index 4d051afcad..0000000000
--- a/zcash_primitives/src/sapling/pedersen_hash/test_vectors.rs
+++ /dev/null
@@ -1,715 +0,0 @@
-//! Test vectors from https://github.com/zcash-hackworks/zcash-test-vectors/blob/master/sapling_pedersen.py
-
-use super::{test::TestVector, Personalization};
-
-pub fn get_vectors<'a>() -> Vec<TestVector<'a>> {
-    vec![
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![1, 1, 1, 1, 1, 1],
-            hash_u: "0x06b1187c11ca4fb4383b2e0d0dbbde3ad3617338b5029187ec65a5eaed5e4d0b",
-            hash_v: "0x3ce70f536652f0dea496393a1e55c4e08b9d55508e16d11e5db40d4810cbc982",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![1, 1, 1, 1, 1, 1, 0],
-            hash_u: "0x2fc3bc454c337f71d4f04f86304262fcbfc9ecd808716b92fc42cbe6827f7f1a",
-            hash_v: "0x46d0d25bf1a654eedc6a9b1e5af398925113959feac31b7a2c036ff9b9ec0638",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![1, 1, 1, 1, 1, 1, 1],
-            hash_u: "0x4f8ce0e0a9e674b3ab9606a7d7aefba386e81583d81918127814cde41d209d97",
-            hash_v: "0x312b5ab93b14c9b9af334fe1fe3c50fffb53fbd074fa40ca600febde7c97e346",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![1, 1, 1, 1, 1, 1, 1, 0, 0],
-            hash_u: "0x4f8ce0e0a9e674b3ab9606a7d7aefba386e81583d81918127814cde41d209d97",
-            hash_v: "0x312b5ab93b14c9b9af334fe1fe3c50fffb53fbd074fa40ca600febde7c97e346",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0,
-                0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1,
-                0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1,
-                0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1,
-                1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0,
-                1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1,
-                0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0,
-            ],
-            hash_u: "0x599ab788360ae8c6d5bb7618aec37056d6227408d857fdc394078a3d7afdfe0f",
-            hash_v: "0x4320c373da670e28d168f4ffd72b43208e8c815f40841682c57a3ee1d005a527",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0,
-                0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0,
-                0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0,
-                1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1,
-                1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0,
-                0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0,
-                1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0,
-            ],
-            hash_u: "0x2da510317620f5dfdce1f31db6019f947eedcf02ff2972cff597a5c3ad21f5dd",
-            hash_v: "0x198789969c0c33e6c359b9da4a51771f4d50863f36beef90436944fe568399f2",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0,
-                0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0,
-                1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0,
-                0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0,
-                0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0,
-                0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0,
-                0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1,
-            ],
-            hash_u: "0x601247c7e640992d193dfb51df6ed93446687a7f2bcd0e4a598e6feb1ef20c40",
-            hash_v: "0x371931733b73e7b95c2cad55a6cebd15c83619f697c64283e54e5ef61442a743",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0,
-                0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0,
-                1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1,
-                0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0,
-                1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1,
-                1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1,
-                0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1,
-                1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0,
-                1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0,
-                0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0,
-                1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0,
-                1, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0,
-                0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0,
-                1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0,
-                0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1,
-                1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0,
-                0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1,
-                0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0,
-                1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1,
-                0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1,
-                0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1,
-                1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1,
-                1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1,
-                0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0,
-                0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0,
-                1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1,
-                1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1,
-            ],
-            hash_u: "0x314192ecb1f2d8806a8108704c875a25d9fb7e444f9f373919adedebe8f2ae27",
-            hash_v: "0x6b12b32f1372ad574799dee9eb591d961b704bf611f55fcc71f7e82cd3330b74",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0,
-                0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0,
-                1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1,
-                1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1,
-                0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1,
-                0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0,
-                0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0,
-                0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0,
-                1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1,
-                1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0,
-                1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0,
-                1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0,
-                1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1,
-                1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0,
-                1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 1,
-                1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0,
-                1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1,
-                0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0,
-                1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0,
-                0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0,
-                0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1,
-                0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 1,
-                0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1,
-                0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1,
-                0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0,
-                1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1,
-                1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1,
-                0,
-            ],
-            hash_u: "0x0666c2bce7f362a2b807d212e9a577f116891a932affd7addec39fbf372c494e",
-            hash_v: "0x6758bccfaf2e47c07756b96edea23aa8d10c33b38220bd1c411af612eeec18ab",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1,
-                1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0,
-                0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1,
-                1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1,
-                0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1,
-                0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0,
-                1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1,
-                1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0,
-                1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0,
-                1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0,
-                0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1,
-                0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1,
-                0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0,
-                1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1,
-                1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1,
-                0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1,
-                0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0,
-                0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0,
-                0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 0,
-                1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0,
-                0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0,
-                0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1,
-                0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1,
-                0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1,
-                1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1,
-                0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0,
-                1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1,
-                1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1,
-                1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0,
-                1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0,
-                1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0,
-                1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0,
-                0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0,
-                1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1,
-            ],
-            hash_u: "0x130afe02b99375484efb0998f5331d2178e1d00e803049bb0769099420624f5f",
-            hash_v: "0x5e2fc6970554ffe358652aa7968ac4fcf3de0c830e6ea492e01a38fafb68cd71",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0,
-                1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1,
-                0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0,
-                1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0,
-                0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0,
-                1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1,
-                0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1,
-                0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0,
-                1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0,
-                0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1,
-                1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0,
-                1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1,
-                1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0,
-                0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1,
-                1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1,
-                1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0,
-                1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1,
-                0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1,
-                0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1,
-                1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0,
-                1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1,
-                1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0,
-                1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0,
-                1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0,
-                1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0,
-                0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0,
-                1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1,
-                0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1,
-                0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0,
-                1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1,
-                1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0,
-                1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0,
-                0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1,
-                1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1,
-            ],
-            hash_u: "0x67914ebd539961b70f468fa23d4cb42133693a8ac57cd35a1e6369fe34fbedf7",
-            hash_v: "0x44770870c0f0cfe59a10df95d6c21e6f1514a2f464b66377599438c126052d9f",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![0, 0, 0, 0, 0, 0],
-            hash_u: "0x62454a957289b3930d10f3def0d512cfe0ef3de06421321221af3558de9d481d",
-            hash_v: "0x0279f0aebfb66e53ff69fba16b6608dbf4319b944432f45c6e69a3dbd1f7b330",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![0, 0, 0, 0, 0, 0, 0],
-            hash_u: "0x283c7880f35179e201161402d9c4556b255917dbbf0142ae60519787d36d4dea",
-            hash_v: "0x648224408b4b83297cd0feb4cdc4eeb224237734931145432793bcd414228dc4",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![0, 0, 0, 0, 0, 0, 1],
-            hash_u: "0x1f1086b287636a20063c9614db2de66bb7d49242e88060956a5e5845057f6f5d",
-            hash_v: "0x6b1b395421dde74d53341caa9e01f39d7a3138efb9b57fc0381f98f4868df622",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![0, 0, 0, 0, 0, 0, 1, 0, 0],
-            hash_u: "0x1f1086b287636a20063c9614db2de66bb7d49242e88060956a5e5845057f6f5d",
-            hash_v: "0x6b1b395421dde74d53341caa9e01f39d7a3138efb9b57fc0381f98f4868df622",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1,
-                0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0,
-                0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1,
-                1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1,
-                0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0,
-                1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1,
-                1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0,
-            ],
-            hash_u: "0x20d2b1b0551efe511755d564f8da4f5bf285fd6051331fa5f129ad95b318f6cd",
-            hash_v: "0x2834d96950de67ae80e85545f8333c6e14b5cf5be7325dac768f401e6edd9544",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1,
-                1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1,
-                1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0,
-                0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1,
-                1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0,
-                0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0,
-                0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0,
-            ],
-            hash_u: "0x01f4850a0f40e07186fee1f0a276f52fb12cffe05c18eb2aa18170330a93c555",
-            hash_v: "0x19b0807358e7c8cba9168815ec54c4cd76997c34c592607d172151c48d5377cb",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0,
-                0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1,
-                0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0,
-                0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1,
-                0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1,
-                1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1,
-                0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0,
-            ],
-            hash_u: "0x26dd81a3ffa37452c6a932d41eb4f2e0fedd531e9af8c2a7935b91dff653879d",
-            hash_v: "0x2fc7aebb729ef5cabf0fb3f883bc2eb2603093850b0ec19c1a3c08b653e7f27f",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1,
-                0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0,
-                1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1,
-                1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1,
-                0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0,
-                0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1,
-                1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0,
-                0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0,
-                1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0,
-                0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1,
-                0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0,
-                0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1,
-                0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1,
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0,
-                0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0,
-                1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0,
-                0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 1,
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1,
-                0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0,
-                0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1,
-                0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0,
-                0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0,
-                1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0,
-                1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1,
-                0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1,
-                0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1,
-                1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1,
-            ],
-            hash_u: "0x1111740552773b00aa6a2334575aa94102cfbd084290a430c90eb56d6db65b85",
-            hash_v: "0x6560c44b11683c20030626f89456f78a53ae8a89f565956a98ffc554b48fbb1a",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0,
-                1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0,
-                0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1,
-                0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1,
-                1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0,
-                0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1,
-                0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0,
-                0, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1,
-                1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1,
-                1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1,
-                0, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0,
-                0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0,
-                1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1,
-                0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0,
-                0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1,
-                1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1,
-                0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0,
-                0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1,
-                1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0,
-                1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1,
-                1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0,
-                1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0,
-                1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0,
-                1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 1,
-                1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1,
-                1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0,
-                0,
-            ],
-            hash_u: "0x429349ea9b5f8163bcda3014b3e15554df5173353fd73f315a49360c97265f68",
-            hash_v: "0x188774bb6de41eba669be5d368942783f937acf2f418385fc5c78479b0a405ee",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1,
-                0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 0,
-                0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1,
-                0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1,
-                0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1,
-                1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1,
-                1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0,
-                0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 1,
-                0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0,
-                1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1,
-                1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0,
-                1, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0,
-                1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1,
-                0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0,
-                0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1,
-                0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1,
-                0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0,
-                0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1,
-                0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 1,
-                1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1,
-                1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1,
-                1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 1,
-                0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1,
-                0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1,
-                0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1,
-                0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1,
-                0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0,
-                0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1,
-                0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1,
-                0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1,
-                0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0,
-                0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0,
-                0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0,
-            ],
-            hash_u: "0x00e827f3ed136f3c91c61c97ab9b7cca0ea53c20e47abb5e226ede297bdd5f37",
-            hash_v: "0x315cc00a54972df6a19f650d3fab5f2ad0fb07397bacb6944568618f2aa76bf6",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 1,
-                0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1,
-                1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0,
-                0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1,
-                1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0,
-                0, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1,
-                0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0,
-                1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0,
-                0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1,
-                0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0,
-                0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0,
-                1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0,
-                1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1,
-                0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0,
-                0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1,
-                1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1,
-                1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1,
-                0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0,
-                1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1,
-                1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1,
-                0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0,
-                0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0,
-                1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0,
-                1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1,
-                1, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 0,
-                0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0,
-                0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1,
-                0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1,
-                0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1,
-                0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0,
-                1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0,
-                1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1,
-                1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0,
-            ],
-            hash_u: "0x3ee50557c4aa9158c4bb9d5961208e6c62f55c73ad7c7695a0eba0bcb6d83d05",
-            hash_v: "0x1b1a2be6e47688828aeadf2d37db298eac0c2736c2722b227871fdeeee29de33",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![0, 1, 0, 0, 0, 1],
-            hash_u: "0x61f8e2cb8e945631677b450d5e5669bc6b5f2ec69b321ac550dbe74525d7ac9a",
-            hash_v: "0x4e11951ab9c9400ee38a18bd98cdb9453f1f67141ee9d9bf0c1c157d4fb34f9a",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![0, 1, 0, 0, 0, 1, 0],
-            hash_u: "0x27fa1e296c37dde8448483ce5485c2604d1d830e53812246299773a02ecd519c",
-            hash_v: "0x08e499113675202cb42b4b681a31430814edebd72c5bb3bc3bfedf91fb0605df",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![0, 1, 0, 0, 0, 1, 1],
-            hash_u: "0x52112dd7a4293d049bb011683244a0f957e6ba95e1d1cf2fb6654d449a6d3fbc",
-            hash_v: "0x2ae14ecd81bb5b4489d2d64b5d2eb92a684087b28dd9a4950ecdb78c014e178c",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![0, 1, 0, 0, 0, 1, 1, 0, 0],
-            hash_u: "0x52112dd7a4293d049bb011683244a0f957e6ba95e1d1cf2fb6654d449a6d3fbc",
-            hash_v: "0x2ae14ecd81bb5b4489d2d64b5d2eb92a684087b28dd9a4950ecdb78c014e178c",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0,
-                0, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1,
-                1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0,
-                1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0,
-                0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0,
-                1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0,
-                0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0,
-            ],
-            hash_u: "0x544a0b44c35dca64ee806d1af70b7c44134e5d86efed413947657ffd71adf9b2",
-            hash_v: "0x5ddc5dbf12abbbc5561defd3782a32f450b3c398f52ff4629677e59e86e3ab31",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1,
-                0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1,
-                0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1,
-                0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0,
-                0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 1, 0,
-                1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1,
-                1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1,
-            ],
-            hash_u: "0x6cb6490ccb0ca9ccd657146f58a7b800bc4fb2556ee37861227ee8fda724acfb",
-            hash_v: "0x05c6fe100926f5cc441e54e72f024b6b12c907f2ec5680335057896411984c9f",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1,
-                0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 1,
-                0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1,
-                1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0,
-                0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1,
-                0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1,
-                0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0,
-            ],
-            hash_u: "0x40901e2175cb7f06a00c676d54d90e59fd448f11cbbc5eb517f9fea74b795ce2",
-            hash_v: "0x42d512891f91087310c9bc630c8d0ecc014596f884fd6df55dada8195ed726de",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0,
-                0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1,
-                1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0,
-                1, 0, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1,
-                1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0,
-                1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1,
-                1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0,
-                0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1,
-                1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0,
-                0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0,
-                0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1,
-                1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1,
-                1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0,
-                1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1,
-                0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0,
-                1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0,
-                1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0,
-                1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0,
-                0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1,
-                1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0,
-                1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0,
-                1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0,
-                1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0,
-                1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1,
-                1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0,
-                0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1,
-                0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1,
-            ],
-            hash_u: "0x66a433542419f1a086ed0663b0e8df2ece9a04065f147896976baba1a916b6dc",
-            hash_v: "0x203bd3672522e1d3c86fa6b9f3b58f20199a4216adfd40982add13a856f6f3de",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1,
-                1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1,
-                1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1,
-                1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0,
-                1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1,
-                0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1,
-                0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0,
-                1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1,
-                1, 1, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0, 0, 1,
-                1, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1,
-                0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0,
-                0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0,
-                0, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0,
-                1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1,
-                1, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1,
-                1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1,
-                0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0,
-                1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1,
-                0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0,
-                0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1,
-                0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0,
-                0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1,
-                1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1,
-                1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0,
-                1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 0,
-                1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0,
-                1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0,
-                1,
-            ],
-            hash_u: "0x119db3b38086c1a3c6c6f53c529ee62d9311d69c2d8aeeafa6e172e650d3afda",
-            hash_v: "0x72287540be7d2b0f58f5c73eaa53c55bea6b79dd79873b4e47cc11787bb9a15d",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, 0, 1, 1, 1,
-                1, 1, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 0, 1,
-                1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0,
-                0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0,
-                1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0,
-                0, 1, 0, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0,
-                0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1,
-                1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0,
-                1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0,
-                1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1,
-                0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1,
-                0, 1, 0, 1, 0, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0,
-                1, 0, 1, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 0,
-                1, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 0,
-                1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 1,
-                1, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0,
-                0, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1,
-                0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, 1,
-                0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0,
-                1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0, 0, 0,
-                1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 0,
-                1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1,
-                0, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1,
-                1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0,
-                0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0,
-                1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 0,
-                1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 1, 1, 0,
-                0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0,
-                0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1,
-                1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1,
-                0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 0,
-                1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0,
-                0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 1, 1,
-                1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0,
-            ],
-            hash_u: "0x446efdcf89b70ba2b03427a0893008181d0fc4e76b84b1a500d7ee523c8e3666",
-            hash_v: "0x125ee0048efb0372b92c3c15d51a7c5c77a712054cc4fdd0774563da46ec7289",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(34),
-            input_bits: vec![
-                0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1,
-                1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 0, 1, 1, 1,
-                0, 0, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0,
-                1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 0, 1, 0, 0,
-                1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 0, 1, 0,
-                0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1,
-                0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0,
-                0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0,
-                0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0,
-                1, 1, 1, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0,
-                0, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 1, 1, 0, 0,
-                0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1,
-                1, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1,
-                0, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 0,
-                0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0,
-                0, 0, 1, 0, 1, 1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1,
-                1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 1, 1,
-                1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 1,
-                1, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0,
-                0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 0, 1, 0,
-                1, 1, 1, 1, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 1, 1,
-                1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1,
-                1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1,
-                1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0,
-                0, 1, 1, 0, 1, 0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1,
-                0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1,
-                0, 0, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0,
-                1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 1, 0,
-                0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1,
-                0, 0, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0,
-                0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1,
-                1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 1, 1, 0,
-                1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 1, 0, 1,
-            ],
-            hash_u: "0x72723bf0573bcb4b72d4184cfeb707d9556b7f705f56a4652707a36f2edf10f7",
-            hash_v: "0x3a7f0999a6a1393bd49fc82302e7352e01176fbebb0192bf5e6ef39eb8c585ad",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(27),
-            input_bits: vec![
-                1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1,
-                1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1,
-                0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0,
-                1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1,
-                1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1,
-                0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0,
-                1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0, 1, 1, 0,
-            ],
-            hash_u: "0x414f6ba05f6b92da1f9051950769e1083d05615def32b016ae424309828a11f4",
-            hash_v: "0x471d2109656afcb96d0609b371b132b97efcf72c6051064dd19fdc004799bfa9",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(36),
-            input_bits: vec![
-                0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0,
-                0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0,
-                1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1,
-                0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0,
-                0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0,
-                1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1,
-                0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 1,
-            ],
-            hash_u: "0x62d6fe1e373225a5695f3115aed8265c59e2d6275ceef6bbc53fde3fc6594024",
-            hash_v: "0x407275be7d5a4c48204c8d83f5b211d09a2f285d4f0f87a928d4de9a6338e1d1",
-        },
-        TestVector {
-            personalization: Personalization::MerkleTree(0),
-            input_bits: vec![
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-            ],
-            hash_u: "0x1116a934f26b57a2c9daa6f25ac9b1a8f9dacddba30f65433ac021bf39a6bfdd",
-            hash_v: "0x407275be7d5a4c48204c8d83f5b211d09a2f285d4f0f87a928d4de9a6338e1d1",
-        },
-        TestVector {
-            personalization: Personalization::NoteCommitment,
-            input_bits: vec![
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-            ],
-            hash_u: "0x329e3bb2ca31ea6e13a986730237f6fd16b842a510cbabe851bdbcf57d75ee0d",
-            hash_v: "0x471d2109656afcb96d0609b371b132b97efcf72c6051064dd19fdc004799bfa9",
-        },
-    ]
-}
diff --git a/zcash_primitives/src/sapling/prover.rs b/zcash_primitives/src/sapling/prover.rs
deleted file mode 100644
index 0dc8c86816..0000000000
--- a/zcash_primitives/src/sapling/prover.rs
+++ /dev/null
@@ -1,137 +0,0 @@
-//! Abstractions over the proving system and parameters.
-
-use crate::{
-    sapling::{
-        self,
-        redjubjub::{PublicKey, Signature},
-        value::ValueCommitment,
-    },
-    transaction::components::{Amount, GROTH_PROOF_SIZE},
-};
-
-use super::{Diversifier, PaymentAddress, ProofGenerationKey, Rseed};
-
-/// Interface for creating zero-knowledge proofs for shielded transactions.
-pub trait TxProver {
-    /// Type for persisting any necessary context across multiple Sapling proofs.
-    type SaplingProvingContext;
-
-    /// Instantiate a new Sapling proving context.
-    fn new_sapling_proving_context(&self) -> Self::SaplingProvingContext;
-
-    /// Create the value commitment, re-randomized key, and proof for a Sapling
-    /// [`SpendDescription`], while accumulating its value commitment randomness inside
-    /// the context for later use.
-    ///
-    /// [`SpendDescription`]: crate::transaction::components::SpendDescription
-    #[allow(clippy::too_many_arguments)]
-    fn spend_proof(
-        &self,
-        ctx: &mut Self::SaplingProvingContext,
-        proof_generation_key: ProofGenerationKey,
-        diversifier: Diversifier,
-        rseed: Rseed,
-        ar: jubjub::Fr,
-        value: u64,
-        anchor: bls12_381::Scalar,
-        merkle_path: sapling::MerklePath,
-    ) -> Result<([u8; GROTH_PROOF_SIZE], ValueCommitment, PublicKey), ()>;
-
-    /// Create the value commitment and proof for a Sapling [`OutputDescription`],
-    /// while accumulating its value commitment randomness inside the context for later
-    /// use.
-    ///
-    /// [`OutputDescription`]: crate::transaction::components::OutputDescription
-    fn output_proof(
-        &self,
-        ctx: &mut Self::SaplingProvingContext,
-        esk: jubjub::Fr,
-        payment_address: PaymentAddress,
-        rcm: jubjub::Fr,
-        value: u64,
-    ) -> ([u8; GROTH_PROOF_SIZE], ValueCommitment);
-
-    /// Create the `bindingSig` for a Sapling transaction. All calls to
-    /// [`TxProver::spend_proof`] and [`TxProver::output_proof`] must be completed before
-    /// calling this function.
-    fn binding_sig(
-        &self,
-        ctx: &mut Self::SaplingProvingContext,
-        value_balance: Amount,
-        sighash: &[u8; 32],
-    ) -> Result<Signature, ()>;
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod mock {
-    use rand_core::OsRng;
-
-    use super::TxProver;
-    use crate::{
-        constants::SPENDING_KEY_GENERATOR,
-        sapling::{
-            self,
-            redjubjub::{PublicKey, Signature},
-            value::{NoteValue, ValueCommitTrapdoor, ValueCommitment},
-            Diversifier, PaymentAddress, ProofGenerationKey, Rseed,
-        },
-        transaction::components::{Amount, GROTH_PROOF_SIZE},
-    };
-
-    pub struct MockTxProver;
-
-    impl TxProver for MockTxProver {
-        type SaplingProvingContext = ();
-
-        fn new_sapling_proving_context(&self) -> Self::SaplingProvingContext {}
-
-        fn spend_proof(
-            &self,
-            _ctx: &mut Self::SaplingProvingContext,
-            proof_generation_key: ProofGenerationKey,
-            _diversifier: Diversifier,
-            _rcm: Rseed,
-            ar: jubjub::Fr,
-            value: u64,
-            _anchor: bls12_381::Scalar,
-            _merkle_path: sapling::MerklePath,
-        ) -> Result<([u8; GROTH_PROOF_SIZE], ValueCommitment, PublicKey), ()> {
-            let mut rng = OsRng;
-
-            let value = NoteValue::from_raw(value);
-            let rcv = ValueCommitTrapdoor::random(&mut rng);
-            let cv = ValueCommitment::derive(value, rcv);
-
-            let rk =
-                PublicKey(proof_generation_key.ak.into()).randomize(ar, SPENDING_KEY_GENERATOR);
-
-            Ok(([0u8; GROTH_PROOF_SIZE], cv, rk))
-        }
-
-        fn output_proof(
-            &self,
-            _ctx: &mut Self::SaplingProvingContext,
-            _esk: jubjub::Fr,
-            _payment_address: PaymentAddress,
-            _rcm: jubjub::Fr,
-            value: u64,
-        ) -> ([u8; GROTH_PROOF_SIZE], ValueCommitment) {
-            let mut rng = OsRng;
-
-            let value = NoteValue::from_raw(value);
-            let rcv = ValueCommitTrapdoor::random(&mut rng);
-            let cv = ValueCommitment::derive(value, rcv);
-
-            ([0u8; GROTH_PROOF_SIZE], cv)
-        }
-
-        fn binding_sig(
-            &self,
-            _ctx: &mut Self::SaplingProvingContext,
-            _value_balance: Amount,
-            _sighash: &[u8; 32],
-        ) -> Result<Signature, ()> {
-            Err(())
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/redjubjub.rs b/zcash_primitives/src/sapling/redjubjub.rs
deleted file mode 100644
index 74b7b6e0d5..0000000000
--- a/zcash_primitives/src/sapling/redjubjub.rs
+++ /dev/null
@@ -1,375 +0,0 @@
-//! Implementation of [RedJubjub], a specialization of RedDSA to the Jubjub
-//! curve.
-//!
-//! [RedJubjub]: https://zips.z.cash/protocol/protocol.pdf#concretereddsa
-
-use ff::{Field, PrimeField};
-use group::GroupEncoding;
-use jubjub::{AffinePoint, ExtendedPoint, SubgroupPoint};
-use rand_core::RngCore;
-use std::io::{self, Read, Write};
-use std::ops::{AddAssign, MulAssign, Neg};
-
-use super::util::hash_to_scalar;
-
-fn read_scalar<R: Read>(mut reader: R) -> io::Result<jubjub::Fr> {
-    let mut s_repr = [0u8; 32];
-    reader.read_exact(s_repr.as_mut())?;
-
-    Option::from(jubjub::Fr::from_repr(s_repr))
-        .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "scalar is not in field"))
-}
-
-fn write_scalar<W: Write>(s: &jubjub::Fr, mut writer: W) -> io::Result<()> {
-    writer.write_all(s.to_repr().as_ref())
-}
-
-fn h_star(a: &[u8], b: &[u8]) -> jubjub::Fr {
-    hash_to_scalar(b"Zcash_RedJubjubH", a, b)
-}
-
-#[derive(Copy, Clone, Debug)]
-pub struct Signature {
-    rbar: [u8; 32],
-    sbar: [u8; 32],
-}
-
-pub struct PrivateKey(pub jubjub::Fr);
-
-#[derive(Debug, Clone)]
-pub struct PublicKey(pub ExtendedPoint);
-
-impl Signature {
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let mut rbar = [0u8; 32];
-        let mut sbar = [0u8; 32];
-        reader.read_exact(&mut rbar)?;
-        reader.read_exact(&mut sbar)?;
-        Ok(Signature { rbar, sbar })
-    }
-
-    pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.rbar)?;
-        writer.write_all(&self.sbar)
-    }
-}
-
-impl PrivateKey {
-    #[must_use]
-    pub fn randomize(&self, alpha: jubjub::Fr) -> Self {
-        let mut tmp = self.0;
-        tmp.add_assign(&alpha);
-        PrivateKey(tmp)
-    }
-
-    pub fn read<R: Read>(reader: R) -> io::Result<Self> {
-        let pk = read_scalar::<R>(reader)?;
-        Ok(PrivateKey(pk))
-    }
-
-    pub fn write<W: Write>(&self, writer: W) -> io::Result<()> {
-        write_scalar::<W>(&self.0, writer)
-    }
-
-    pub fn sign<R: RngCore>(&self, msg: &[u8], rng: &mut R, p_g: SubgroupPoint) -> Signature {
-        // T = (l_H + 128) bits of randomness
-        // For H*, l_H = 512 bits
-        let mut t = [0u8; 80];
-        rng.fill_bytes(&mut t[..]);
-
-        // r = H*(T || M)
-        let r = h_star(&t[..], msg);
-
-        // R = r . P_G
-        let r_g = p_g * r;
-        let rbar = r_g.to_bytes();
-
-        // S = r + H*(Rbar || M) . sk
-        let mut s = h_star(&rbar[..], msg);
-        s.mul_assign(&self.0);
-        s.add_assign(&r);
-        let mut sbar = [0u8; 32];
-        write_scalar::<&mut [u8]>(&s, &mut sbar[..])
-            .expect("Jubjub scalars should serialize to 32 bytes");
-
-        Signature { rbar, sbar }
-    }
-}
-
-impl PublicKey {
-    pub fn from_private(privkey: &PrivateKey, p_g: SubgroupPoint) -> Self {
-        PublicKey((p_g * privkey.0).into())
-    }
-
-    #[must_use]
-    pub fn randomize(&self, alpha: jubjub::Fr, p_g: SubgroupPoint) -> Self {
-        PublicKey(ExtendedPoint::from(p_g * alpha) + self.0)
-    }
-
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let mut bytes = [0u8; 32];
-        reader.read_exact(&mut bytes)?;
-        let p = ExtendedPoint::from_bytes(&bytes).map(PublicKey);
-        if p.is_some().into() {
-            Ok(p.unwrap())
-        } else {
-            Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "invalid RedJubjub public key",
-            ))
-        }
-    }
-
-    pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.0.to_bytes())
-    }
-
-    pub fn verify(&self, msg: &[u8], sig: &Signature, p_g: SubgroupPoint) -> bool {
-        self.verify_with_zip216(msg, sig, p_g, true)
-    }
-
-    pub fn verify_with_zip216(
-        &self,
-        msg: &[u8],
-        sig: &Signature,
-        p_g: SubgroupPoint,
-        zip216_enabled: bool,
-    ) -> bool {
-        // c = H*(Rbar || M)
-        let c = h_star(&sig.rbar[..], msg);
-
-        // Signature checks:
-        // R != invalid
-        let r = {
-            let r = if zip216_enabled {
-                ExtendedPoint::from_bytes(&sig.rbar)
-            } else {
-                AffinePoint::from_bytes_pre_zip216_compatibility(sig.rbar).map(|p| p.to_extended())
-            };
-            if r.is_none().into() {
-                return false;
-            }
-            r.unwrap()
-        };
-        // S < order(G)
-        // (jubjub::Scalar guarantees its representation is in the field)
-        let s = match read_scalar::<&[u8]>(&sig.sbar[..]) {
-            Ok(s) => s,
-            Err(_) => return false,
-        };
-        // 0 = h_G(-S . P_G + R + c . vk)
-        ((self.0 * c) + r - (p_g * s))
-            .mul_by_cofactor()
-            .is_identity()
-            .into()
-    }
-}
-
-pub struct BatchEntry<'a> {
-    vk: PublicKey,
-    msg: &'a [u8],
-    sig: Signature,
-}
-
-// TODO: #82: This is a naive implementation currently,
-// and doesn't use multiexp.
-pub fn batch_verify<'a, R: RngCore>(
-    mut rng: &mut R,
-    batch: &[BatchEntry<'a>],
-    p_g: SubgroupPoint,
-) -> bool {
-    let mut acc = ExtendedPoint::identity();
-
-    for entry in batch {
-        let mut r = {
-            let r = ExtendedPoint::from_bytes(&entry.sig.rbar);
-            if r.is_none().into() {
-                return false;
-            }
-            r.unwrap()
-        };
-        let mut s = match read_scalar::<&[u8]>(&entry.sig.sbar[..]) {
-            Ok(s) => s,
-            Err(_) => return false,
-        };
-
-        let mut c = h_star(&entry.sig.rbar[..], entry.msg);
-
-        let z = jubjub::Fr::random(&mut rng);
-
-        s.mul_assign(&z);
-        s = s.neg();
-
-        r *= z;
-
-        c.mul_assign(&z);
-
-        acc = acc + r + (entry.vk.0 * c) + (p_g * s);
-    }
-
-    acc.mul_by_cofactor().is_identity().into()
-}
-
-#[cfg(test)]
-mod tests {
-    use group::Group;
-    use rand_core::SeedableRng;
-    use rand_xorshift::XorShiftRng;
-
-    use super::*;
-    use crate::constants::SPENDING_KEY_GENERATOR;
-
-    #[test]
-    fn test_batch_verify() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-        let p_g = SPENDING_KEY_GENERATOR;
-
-        let sk1 = PrivateKey(jubjub::Fr::random(&mut rng));
-        let vk1 = PublicKey::from_private(&sk1, p_g);
-        let msg1 = b"Foo bar";
-        let sig1 = sk1.sign(msg1, &mut rng, p_g);
-        assert!(vk1.verify(msg1, &sig1, p_g));
-
-        let sk2 = PrivateKey(jubjub::Fr::random(&mut rng));
-        let vk2 = PublicKey::from_private(&sk2, p_g);
-        let msg2 = b"Foo bar";
-        let sig2 = sk2.sign(msg2, &mut rng, p_g);
-        assert!(vk2.verify(msg2, &sig2, p_g));
-
-        let mut batch = vec![
-            BatchEntry {
-                vk: vk1,
-                msg: msg1,
-                sig: sig1,
-            },
-            BatchEntry {
-                vk: vk2,
-                msg: msg2,
-                sig: sig2,
-            },
-        ];
-
-        assert!(batch_verify(&mut rng, &batch, p_g));
-
-        batch[0].sig = sig2;
-
-        assert!(!batch_verify(&mut rng, &batch, p_g));
-    }
-
-    #[test]
-    fn cofactor_check() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-        let zero = jubjub::ExtendedPoint::identity();
-        let p_g = SPENDING_KEY_GENERATOR;
-
-        let jubjub_modulus_bytes = [
-            0xb7, 0x2c, 0xf7, 0xd6, 0x5e, 0x0e, 0x97, 0xd0, 0x82, 0x10, 0xc8, 0xcc, 0x93, 0x20,
-            0x68, 0xa6, 0x00, 0x3b, 0x34, 0x01, 0x01, 0x3b, 0x67, 0x06, 0xa9, 0xaf, 0x33, 0x65,
-            0xea, 0xb4, 0x7d, 0x0e,
-        ];
-
-        // Get a point of order 8
-        let p8 = loop {
-            let r = jubjub::ExtendedPoint::random(&mut rng)
-                .to_niels()
-                .multiply_bits(&jubjub_modulus_bytes);
-
-            let r2 = r.double();
-            let r4 = r2.double();
-            let r8 = r4.double();
-
-            if r2 != zero && r4 != zero && r8 == zero {
-                break r;
-            }
-        };
-
-        let sk = PrivateKey(jubjub::Fr::random(&mut rng));
-        let vk = PublicKey::from_private(&sk, p_g);
-
-        // TODO: This test will need to change when #77 is fixed
-        let msg = b"Foo bar";
-        let sig = sk.sign(msg, &mut rng, p_g);
-        assert!(vk.verify(msg, &sig, p_g));
-
-        let vktorsion = PublicKey(vk.0 + p8);
-        assert!(vktorsion.verify(msg, &sig, p_g));
-    }
-
-    #[test]
-    fn round_trip_serialization() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-        let p_g = SPENDING_KEY_GENERATOR;
-
-        for _ in 0..1000 {
-            let sk = PrivateKey(jubjub::Fr::random(&mut rng));
-            let vk = PublicKey::from_private(&sk, p_g);
-            let msg = b"Foo bar";
-            let sig = sk.sign(msg, &mut rng, p_g);
-
-            let mut sk_bytes = [0u8; 32];
-            let mut vk_bytes = [0u8; 32];
-            let mut sig_bytes = [0u8; 64];
-            sk.write(&mut sk_bytes[..]).unwrap();
-            vk.write(&mut vk_bytes[..]).unwrap();
-            sig.write(&mut sig_bytes[..]).unwrap();
-
-            let sk_2 = PrivateKey::read(&sk_bytes[..]).unwrap();
-            let vk_2 = PublicKey::from_private(&sk_2, p_g);
-            let mut vk_2_bytes = [0u8; 32];
-            vk_2.write(&mut vk_2_bytes[..]).unwrap();
-            assert!(vk_bytes == vk_2_bytes);
-
-            let vk_2 = PublicKey::read(&vk_bytes[..]).unwrap();
-            let sig_2 = Signature::read(&sig_bytes[..]).unwrap();
-            assert!(vk.verify(msg, &sig_2, p_g));
-            assert!(vk_2.verify(msg, &sig, p_g));
-            assert!(vk_2.verify(msg, &sig_2, p_g));
-        }
-    }
-
-    #[test]
-    fn random_signatures() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-        let p_g = SPENDING_KEY_GENERATOR;
-
-        for _ in 0..1000 {
-            let sk = PrivateKey(jubjub::Fr::random(&mut rng));
-            let vk = PublicKey::from_private(&sk, p_g);
-
-            let msg1 = b"Foo bar";
-            let msg2 = b"Spam eggs";
-
-            let sig1 = sk.sign(msg1, &mut rng, p_g);
-            let sig2 = sk.sign(msg2, &mut rng, p_g);
-
-            assert!(vk.verify(msg1, &sig1, p_g));
-            assert!(vk.verify(msg2, &sig2, p_g));
-            assert!(!vk.verify(msg1, &sig2, p_g));
-            assert!(!vk.verify(msg2, &sig1, p_g));
-
-            let alpha = jubjub::Fr::random(&mut rng);
-            let rsk = sk.randomize(alpha);
-            let rvk = vk.randomize(alpha, p_g);
-
-            let sig1 = rsk.sign(msg1, &mut rng, p_g);
-            let sig2 = rsk.sign(msg2, &mut rng, p_g);
-
-            assert!(rvk.verify(msg1, &sig1, p_g));
-            assert!(rvk.verify(msg2, &sig2, p_g));
-            assert!(!rvk.verify(msg1, &sig2, p_g));
-            assert!(!rvk.verify(msg2, &sig1, p_g));
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/spec.rs b/zcash_primitives/src/sapling/spec.rs
deleted file mode 100644
index 0e78073265..0000000000
--- a/zcash_primitives/src/sapling/spec.rs
+++ /dev/null
@@ -1,165 +0,0 @@
-//! Helper functions defined in the Zcash Protocol Specification.
-
-use blake2s_simd::Params as Blake2sParams;
-use group::{cofactor::CofactorGroup, ff::PrimeField, Curve, GroupEncoding, WnafBase, WnafScalar};
-
-use super::{
-    group_hash::group_hash,
-    pedersen_hash::{pedersen_hash, Personalization},
-};
-use crate::constants::{
-    CRH_IVK_PERSONALIZATION, KEY_DIVERSIFICATION_PERSONALIZATION,
-    NOTE_COMMITMENT_RANDOMNESS_GENERATOR, NULLIFIER_POSITION_GENERATOR, PRF_NF_PERSONALIZATION,
-};
-
-const PREPARED_WINDOW_SIZE: usize = 4;
-pub(crate) type PreparedBase = WnafBase<jubjub::ExtendedPoint, PREPARED_WINDOW_SIZE>;
-pub(crate) type PreparedBaseSubgroup = WnafBase<jubjub::SubgroupPoint, PREPARED_WINDOW_SIZE>;
-pub(crate) type PreparedScalar = WnafScalar<jubjub::Scalar, PREPARED_WINDOW_SIZE>;
-
-/// $CRH^\mathsf{ivk}(ak, nk)$
-///
-/// Defined in [Zcash Protocol Spec § 5.4.1.5: CRH^ivk Hash Function][concretecrhivk].
-///
-/// [concretecrhivk]: https://zips.z.cash/protocol/protocol.pdf#concretecrhivk
-pub(crate) fn crh_ivk(ak: [u8; 32], nk: [u8; 32]) -> jubjub::Scalar {
-    let mut h: [u8; 32] = Blake2sParams::new()
-        .hash_length(32)
-        .personal(CRH_IVK_PERSONALIZATION)
-        .to_state()
-        .update(&ak)
-        .update(&nk)
-        .finalize()
-        .as_bytes()
-        .try_into()
-        .expect("output length is correct");
-
-    // Drop the most significant five bits, so it can be interpreted as a scalar.
-    h[31] &= 0b0000_0111;
-
-    jubjub::Fr::from_repr(h).unwrap()
-}
-
-/// Defined in [Zcash Protocol Spec § 5.4.1.6: DiversifyHash^Sapling and DiversifyHash^Orchard Hash Functions][concretediversifyhash].
-///
-/// [concretediversifyhash]: https://zips.z.cash/protocol/protocol.pdf#concretediversifyhash
-pub(crate) fn diversify_hash(d: &[u8; 11]) -> Option<jubjub::SubgroupPoint> {
-    group_hash(d, KEY_DIVERSIFICATION_PERSONALIZATION)
-}
-
-/// $MixingPedersenHash$.
-///
-/// Defined in [Zcash Protocol Spec § 5.4.1.8: Mixing Pedersen Hash Function][concretemixinghash].
-///
-/// [concretemixinghash]: https://zips.z.cash/protocol/protocol.pdf#concretemixinghash
-pub(crate) fn mixing_pedersen_hash(
-    cm: jubjub::SubgroupPoint,
-    position: u64,
-) -> jubjub::SubgroupPoint {
-    cm + (NULLIFIER_POSITION_GENERATOR * jubjub::Fr::from(position))
-}
-
-/// $PRF^\mathsf{nfSapling}_{nk}(\rho)$
-///
-/// Defined in [Zcash Protocol Spec § 5.4.2: Pseudo Random Functions][concreteprfs].
-///
-/// [concreteprfs]: https://zips.z.cash/protocol/protocol.pdf#concreteprfs
-pub(crate) fn prf_nf(nk: &jubjub::SubgroupPoint, rho: &jubjub::SubgroupPoint) -> [u8; 32] {
-    Blake2sParams::new()
-        .hash_length(32)
-        .personal(PRF_NF_PERSONALIZATION)
-        .to_state()
-        .update(&nk.to_bytes())
-        .update(&rho.to_bytes())
-        .finalize()
-        .as_bytes()
-        .try_into()
-        .expect("output length is correct")
-}
-
-/// Defined in [Zcash Protocol Spec § 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-pub(crate) fn ka_sapling_derive_public(
-    sk: &jubjub::Scalar,
-    b: &jubjub::ExtendedPoint,
-) -> jubjub::ExtendedPoint {
-    ka_sapling_derive_public_prepared(&PreparedScalar::new(sk), &PreparedBase::new(*b))
-}
-
-/// Defined in [Zcash Protocol Spec § 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-pub(crate) fn ka_sapling_derive_public_prepared(
-    sk: &PreparedScalar,
-    b: &PreparedBase,
-) -> jubjub::ExtendedPoint {
-    // [sk] b
-    b * sk
-}
-
-/// This is defined implicitly by [Zcash Protocol Spec § 4.2.2: Sapling Key Components][saplingkeycomponents]
-/// which uses $KA^\mathsf{Sapling}.\mathsf{DerivePublic}$ to produce a diversified
-/// transmission key with type $KA^\mathsf{Sapling}.\mathsf{PublicPrimeSubgroup}$.
-///
-/// [saplingkeycomponents]: https://zips.z.cash/protocol/protocol.pdf#saplingkeycomponents
-pub(crate) fn ka_sapling_derive_public_subgroup_prepared(
-    sk: &PreparedScalar,
-    b: &PreparedBaseSubgroup,
-) -> jubjub::SubgroupPoint {
-    // [sk] b
-    b * sk
-}
-
-/// Defined in [Zcash Protocol Spec § 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-pub(crate) fn ka_sapling_agree(
-    sk: &jubjub::Scalar,
-    b: &jubjub::ExtendedPoint,
-) -> jubjub::SubgroupPoint {
-    ka_sapling_agree_prepared(&PreparedScalar::new(sk), &PreparedBase::new(*b))
-}
-
-/// Defined in [Zcash Protocol Spec § 5.4.5.3: Sapling Key Agreement][concretesaplingkeyagreement].
-///
-/// [concretesaplingkeyagreement]: https://zips.z.cash/protocol/protocol.pdf#concretesaplingkeyagreement
-pub(crate) fn ka_sapling_agree_prepared(
-    sk: &PreparedScalar,
-    b: &PreparedBase,
-) -> jubjub::SubgroupPoint {
-    // [8 sk] b
-    // <ExtendedPoint as CofactorGroup>::clear_cofactor is implemented using
-    // ExtendedPoint::mul_by_cofactor in the jubjub crate.
-
-    (b * sk).clear_cofactor()
-}
-
-/// $WindowedPedersenCommit_r(s)$
-///
-/// Defined in [Zcash Protocol Spec § 5.4.8.2: Windowed Pedersen commitments][concretewindowedcommit].
-///
-/// [concretewindowedcommit]: https://zips.z.cash/protocol/protocol.pdf#concretewindowedcommit
-pub(crate) fn windowed_pedersen_commit<I>(
-    personalization: Personalization,
-    s: I,
-    r: jubjub::Scalar,
-) -> jubjub::SubgroupPoint
-where
-    I: IntoIterator<Item = bool>,
-{
-    pedersen_hash(personalization, s) + (NOTE_COMMITMENT_RANDOMNESS_GENERATOR * r)
-}
-
-/// Coordinate extractor for Jubjub.
-///
-/// Defined in [Zcash Protocol Spec § 5.4.9.4: Coordinate Extractor for Jubjub][concreteextractorjubjub].
-///
-/// [concreteextractorjubjub]: https://zips.z.cash/protocol/protocol.pdf#concreteextractorjubjub
-pub(crate) fn extract_p(point: &jubjub::SubgroupPoint) -> bls12_381::Scalar {
-    // The commitment is in the prime order subgroup, so mapping the
-    // commitment to the u-coordinate is an injective encoding.
-    Into::<&jubjub::ExtendedPoint>::into(point)
-        .to_affine()
-        .get_u()
-}
diff --git a/zcash_primitives/src/sapling/tree.rs b/zcash_primitives/src/sapling/tree.rs
deleted file mode 100644
index 5bacb51e23..0000000000
--- a/zcash_primitives/src/sapling/tree.rs
+++ /dev/null
@@ -1,143 +0,0 @@
-use bitvec::{order::Lsb0, view::AsBits};
-use group::{ff::PrimeField, Curve};
-use incrementalmerkletree::{Hashable, Level};
-use lazy_static::lazy_static;
-use std::io::{self, Read, Write};
-
-use super::{
-    note::ExtractedNoteCommitment,
-    pedersen_hash::{pedersen_hash, Personalization},
-};
-use crate::merkle_tree::HashSer;
-
-pub const NOTE_COMMITMENT_TREE_DEPTH: u8 = 32;
-pub type CommitmentTree =
-    incrementalmerkletree::frontier::CommitmentTree<Node, NOTE_COMMITMENT_TREE_DEPTH>;
-pub type IncrementalWitness =
-    incrementalmerkletree::witness::IncrementalWitness<Node, NOTE_COMMITMENT_TREE_DEPTH>;
-pub type MerklePath = incrementalmerkletree::MerklePath<Node, NOTE_COMMITMENT_TREE_DEPTH>;
-
-lazy_static! {
-    static ref UNCOMMITTED_SAPLING: bls12_381::Scalar = bls12_381::Scalar::one();
-    static ref EMPTY_ROOTS: Vec<Node> = {
-        let mut v = vec![Node::empty_leaf()];
-        for d in 0..NOTE_COMMITMENT_TREE_DEPTH {
-            let next = Node::combine(d.into(), &v[usize::from(d)], &v[usize::from(d)]);
-            v.push(next);
-        }
-        v
-    };
-}
-
-/// Compute a parent node in the Sapling commitment tree given its two children.
-pub fn merkle_hash(depth: usize, lhs: &[u8; 32], rhs: &[u8; 32]) -> [u8; 32] {
-    let lhs = {
-        let mut tmp = [false; 256];
-        for (a, b) in tmp.iter_mut().zip(lhs.as_bits::<Lsb0>()) {
-            *a = *b;
-        }
-        tmp
-    };
-
-    let rhs = {
-        let mut tmp = [false; 256];
-        for (a, b) in tmp.iter_mut().zip(rhs.as_bits::<Lsb0>()) {
-            *a = *b;
-        }
-        tmp
-    };
-
-    jubjub::ExtendedPoint::from(pedersen_hash(
-        Personalization::MerkleTree(depth),
-        lhs.iter()
-            .copied()
-            .take(bls12_381::Scalar::NUM_BITS as usize)
-            .chain(
-                rhs.iter()
-                    .copied()
-                    .take(bls12_381::Scalar::NUM_BITS as usize),
-            ),
-    ))
-    .to_affine()
-    .get_u()
-    .to_repr()
-}
-
-/// A node within the Sapling commitment tree.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct Node {
-    pub(super) repr: [u8; 32],
-}
-
-impl Node {
-    #[cfg(test)]
-    pub(crate) fn new(repr: [u8; 32]) -> Self {
-        Node { repr }
-    }
-
-    /// Creates a tree leaf from the given Sapling note commitment.
-    pub fn from_cmu(value: &ExtractedNoteCommitment) -> Self {
-        Node {
-            repr: value.to_bytes(),
-        }
-    }
-
-    /// Constructs a new note commitment tree node from a [`bls12_381::Scalar`]
-    pub fn from_scalar(cmu: bls12_381::Scalar) -> Self {
-        Self {
-            repr: cmu.to_repr(),
-        }
-    }
-}
-
-impl Hashable for Node {
-    fn empty_leaf() -> Self {
-        Node {
-            repr: UNCOMMITTED_SAPLING.to_repr(),
-        }
-    }
-
-    fn combine(level: Level, lhs: &Self, rhs: &Self) -> Self {
-        Node {
-            repr: merkle_hash(level.into(), &lhs.repr, &rhs.repr),
-        }
-    }
-
-    fn empty_root(level: Level) -> Self {
-        EMPTY_ROOTS[<usize>::from(level)]
-    }
-}
-
-impl HashSer for Node {
-    fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let mut repr = [0u8; 32];
-        reader.read_exact(&mut repr)?;
-        Ok(Node { repr })
-    }
-
-    fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(self.repr.as_ref())
-    }
-}
-
-impl From<Node> for bls12_381::Scalar {
-    fn from(node: Node) -> Self {
-        // Tree nodes should be in the prime field.
-        bls12_381::Scalar::from_repr(node.repr).unwrap()
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub(super) mod testing {
-    use proptest::prelude::*;
-
-    use super::Node;
-
-    prop_compose! {
-        pub fn arb_node()(value in prop::array::uniform32(prop::num::u8::ANY)) -> Node {
-            Node {
-                repr: value
-            }
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/util.rs b/zcash_primitives/src/sapling/util.rs
deleted file mode 100644
index 294ebdf16f..0000000000
--- a/zcash_primitives/src/sapling/util.rs
+++ /dev/null
@@ -1,37 +0,0 @@
-use blake2b_simd::Params;
-use ff::Field;
-use rand_core::{CryptoRng, RngCore};
-
-use crate::consensus::{self, BlockHeight, NetworkUpgrade};
-
-use super::Rseed;
-
-pub fn hash_to_scalar(persona: &[u8], a: &[u8], b: &[u8]) -> jubjub::Fr {
-    let mut hasher = Params::new().hash_length(64).personal(persona).to_state();
-    hasher.update(a);
-    hasher.update(b);
-    let ret = hasher.finalize();
-    jubjub::Fr::from_bytes_wide(ret.as_array())
-}
-
-pub fn generate_random_rseed<P: consensus::Parameters, R: RngCore + CryptoRng>(
-    params: &P,
-    height: BlockHeight,
-    rng: &mut R,
-) -> Rseed {
-    generate_random_rseed_internal(params, height, rng)
-}
-
-pub(crate) fn generate_random_rseed_internal<P: consensus::Parameters, R: RngCore>(
-    params: &P,
-    height: BlockHeight,
-    rng: &mut R,
-) -> Rseed {
-    if params.is_nu_active(NetworkUpgrade::Canopy, height) {
-        let mut buffer = [0u8; 32];
-        rng.fill_bytes(&mut buffer);
-        Rseed::AfterZip212(buffer)
-    } else {
-        Rseed::BeforeZip212(jubjub::Fr::random(rng))
-    }
-}
diff --git a/zcash_primitives/src/sapling/value.rs b/zcash_primitives/src/sapling/value.rs
deleted file mode 100644
index b504fb0b72..0000000000
--- a/zcash_primitives/src/sapling/value.rs
+++ /dev/null
@@ -1,248 +0,0 @@
-//! Monetary values within the Sapling shielded pool.
-//!
-//! Values are represented in three places within the Sapling protocol:
-//! - [`NoteValue`], the value of an individual note. It is an unsigned 64-bit integer
-//!   (with maximum value [`MAX_NOTE_VALUE`]), and is serialized in a note plaintext.
-//! - [`ValueSum`], the sum of note values within a Sapling [`Bundle`]. It is represented
-//!   as an `i128` and places an upper bound on the maximum number of notes within a
-//!   single [`Bundle`].
-//! - `valueBalanceSapling`, which is a signed 63-bit integer. This is represented
-//!   by a user-defined type parameter on [`Bundle`], returned by
-//!   [`Bundle::value_balance`] and [`SaplingBuilder::value_balance`].
-//!
-//! If your specific instantiation of the Sapling protocol requires a smaller bound on
-//! valid note values (for example, Zcash's `MAX_MONEY` fits into a 51-bit integer), you
-//! should enforce this in two ways:
-//!
-//! - Define your `valueBalanceSapling` type to enforce your valid value range. This can
-//!   be checked in its `TryFrom<i64>` implementation.
-//! - Define your own "amount" type for note values, and convert it to `NoteValue` prior
-//!   to calling [`SaplingBuilder::add_output`].
-//!
-//! Inside the circuit, note values are constrained to be unsigned 64-bit integers.
-//!
-//! # Caution!
-//!
-//! An `i64` is _not_ a signed 64-bit integer! The [Rust documentation] calls `i64` the
-//! 64-bit signed integer type, which is true in the sense that its encoding in memory
-//! takes up 64 bits. Numerically, however, `i64` is a signed 63-bit integer.
-//!
-//! Fortunately, users of this crate should never need to construct [`ValueSum`] directly;
-//! you should only need to interact with [`NoteValue`] (which can be safely constructed
-//! from a `u64`) and `valueBalanceSapling` (which can be represented as an `i64`).
-//!
-//! [`Bundle`]: crate::transaction::components::sapling::Bundle
-//! [`Bundle::value_balance`]: crate::transaction::components::sapling::Bundle::value_balance
-//! [`SaplingBuilder::value_balance`]: crate::transaction::components::sapling::builder::SaplingBuilder::value_balance
-//! [`SaplingBuilder::add_output`]: crate::transaction::components::sapling::builder::SaplingBuilder::add_output
-//! [Rust documentation]: https://doc.rust-lang.org/stable/std/primitive.i64.html
-
-use bitvec::{array::BitArray, order::Lsb0};
-use ff::Field;
-use group::GroupEncoding;
-use rand::RngCore;
-use subtle::CtOption;
-
-use crate::constants::{VALUE_COMMITMENT_RANDOMNESS_GENERATOR, VALUE_COMMITMENT_VALUE_GENERATOR};
-
-mod sums;
-pub use sums::{CommitmentSum, OverflowError, TrapdoorSum, ValueSum};
-
-/// Maximum note value.
-pub const MAX_NOTE_VALUE: u64 = u64::MAX;
-
-/// The non-negative value of an individual Sapling note.
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct NoteValue(u64);
-
-impl NoteValue {
-    /// Returns the raw underlying value.
-    pub fn inner(&self) -> u64 {
-        self.0
-    }
-
-    /// Creates a note value from its raw numeric value.
-    ///
-    /// This only enforces that the value is an unsigned 64-bit integer. Callers should
-    /// enforce any additional constraints on the value's valid range themselves.
-    pub fn from_raw(value: u64) -> Self {
-        NoteValue(value)
-    }
-
-    pub(crate) fn to_le_bits(self) -> BitArray<[u8; 8], Lsb0> {
-        BitArray::<_, Lsb0>::new(self.0.to_le_bytes())
-    }
-}
-
-/// The blinding factor for a [`ValueCommitment`].
-#[derive(Clone, Debug)]
-pub struct ValueCommitTrapdoor(jubjub::Scalar);
-
-impl ValueCommitTrapdoor {
-    /// Generates a new value commitment trapdoor.
-    ///
-    /// This is public for access by `zcash_proofs`.
-    pub fn random(rng: impl RngCore) -> Self {
-        ValueCommitTrapdoor(jubjub::Scalar::random(rng))
-    }
-
-    /// Returns the inner Jubjub scalar representing this trapdoor.
-    ///
-    /// This is public for access by `zcash_proofs`.
-    pub fn inner(&self) -> jubjub::Scalar {
-        self.0
-    }
-}
-
-/// A commitment to a [`ValueSum`].
-///
-/// # Consensus rules
-///
-/// The Zcash Protocol Spec requires Sapling Spend Descriptions and Output Descriptions to
-/// not contain a small order `ValueCommitment`. However, the `ValueCommitment` type as
-/// specified (and implemented here) may contain a small order point. In practice, it will
-/// not occur:
-/// - [`ValueCommitment::derive`] will only produce a small order point if both the given
-///   [`NoteValue`] and [`ValueCommitTrapdoor`] are zero. However, the only constructor
-///   available for `ValueCommitTrapdoor` is [`ValueCommitTrapdoor::random`], which will
-///   produce zero with negligible probability (assuming a non-broken PRNG).
-/// - [`ValueCommitment::from_bytes_not_small_order`] enforces this by definition, and is
-///   the only constructor that can be used with data received over the network.
-#[derive(Clone, Debug)]
-pub struct ValueCommitment(jubjub::ExtendedPoint);
-
-impl ValueCommitment {
-    /// Derives a `ValueCommitment` by $\mathsf{ValueCommit^{Sapling}}$.
-    ///
-    /// Defined in [Zcash Protocol Spec § 5.4.8.3: Homomorphic Pedersen commitments (Sapling and Orchard)][concretehomomorphiccommit].
-    ///
-    /// [concretehomomorphiccommit]: https://zips.z.cash/protocol/protocol.pdf#concretehomomorphiccommit
-    pub fn derive(value: NoteValue, rcv: ValueCommitTrapdoor) -> Self {
-        let cv = (VALUE_COMMITMENT_VALUE_GENERATOR * jubjub::Scalar::from(value.0))
-            + (VALUE_COMMITMENT_RANDOMNESS_GENERATOR * rcv.0);
-
-        ValueCommitment(cv.into())
-    }
-
-    /// Returns the inner Jubjub point representing this value commitment.
-    ///
-    /// This is public for access by `zcash_proofs`.
-    pub fn as_inner(&self) -> &jubjub::ExtendedPoint {
-        &self.0
-    }
-
-    /// Deserializes a value commitment from its byte representation.
-    ///
-    /// Returns `None` if `bytes` is an invalid representation of a Jubjub point, or the
-    /// resulting point is of small order.
-    ///
-    /// This method can be used to enforce the "not small order" consensus rules defined
-    /// in [Zcash Protocol Spec § 4.4: Spend Descriptions][spenddesc] and
-    /// [§ 4.5: Output Descriptions][outputdesc].
-    ///
-    /// [spenddesc]: https://zips.z.cash/protocol/protocol.pdf#spenddesc
-    /// [outputdesc]: https://zips.z.cash/protocol/protocol.pdf#outputdesc
-    pub fn from_bytes_not_small_order(bytes: &[u8; 32]) -> CtOption<ValueCommitment> {
-        jubjub::ExtendedPoint::from_bytes(bytes)
-            .and_then(|cv| CtOption::new(ValueCommitment(cv), !cv.is_small_order()))
-    }
-
-    /// Serializes this value commitment to its canonical byte representation.
-    pub fn to_bytes(&self) -> [u8; 32] {
-        self.0.to_bytes()
-    }
-}
-
-/// Generators for property testing.
-#[cfg(any(test, feature = "test-dependencies"))]
-#[cfg_attr(docsrs, doc(cfg(feature = "test-dependencies")))]
-pub mod testing {
-    use proptest::prelude::*;
-
-    use super::{NoteValue, ValueCommitTrapdoor, MAX_NOTE_VALUE};
-
-    prop_compose! {
-        /// Generate an arbitrary value in the range of valid nonnegative amounts.
-        pub fn arb_note_value()(value in 0u64..MAX_NOTE_VALUE) -> NoteValue {
-            NoteValue(value)
-        }
-    }
-
-    prop_compose! {
-        /// Generate an arbitrary value in the range of valid positive amounts less than a
-        /// specified value.
-        pub fn arb_note_value_bounded(max: u64)(value in 0u64..max) -> NoteValue {
-            NoteValue(value)
-        }
-    }
-
-    prop_compose! {
-        /// Generate an arbitrary value in the range of valid positive amounts less than a
-        /// specified value.
-        pub fn arb_positive_note_value(max: u64)(value in 1u64..max) -> NoteValue {
-            NoteValue(value)
-        }
-    }
-
-    prop_compose! {
-        /// Generate an arbitrary Jubjub scalar.
-        fn arb_scalar()(bytes in prop::array::uniform32(0u8..)) -> jubjub::Scalar {
-            // Instead of rejecting out-of-range bytes, let's reduce them.
-            let mut buf = [0; 64];
-            buf[..32].copy_from_slice(&bytes);
-            jubjub::Scalar::from_bytes_wide(&buf)
-        }
-    }
-
-    prop_compose! {
-        /// Generate an arbitrary ValueCommitTrapdoor
-        pub fn arb_trapdoor()(rcv in arb_scalar()) -> ValueCommitTrapdoor {
-            ValueCommitTrapdoor(rcv)
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use proptest::prelude::*;
-
-    use super::{
-        testing::{arb_note_value_bounded, arb_trapdoor},
-        CommitmentSum, OverflowError, TrapdoorSum, ValueCommitment, ValueSum,
-        VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-    };
-    use crate::sapling::redjubjub;
-
-    proptest! {
-        #[test]
-        fn bsk_consistent_with_bvk(
-            values in (1usize..10).prop_flat_map(|n_values| prop::collection::vec(
-                (arb_note_value_bounded((i64::MAX as u64) / (n_values as u64)), arb_trapdoor()),
-                n_values,
-            ))
-        ) {
-            let value_balance: i64 = values
-                .iter()
-                .map(|(value, _)| value)
-                .sum::<Result<ValueSum, OverflowError>>()
-                .expect("we generate values that won't overflow")
-                .try_into()
-                .unwrap();
-
-            let bsk = values
-                .iter()
-                .map(|(_, rcv)| rcv)
-                .sum::<TrapdoorSum>()
-                .into_bsk();
-
-            let bvk = values
-                .into_iter()
-                .map(|(value, rcv)| ValueCommitment::derive(value, rcv))
-                .sum::<CommitmentSum>()
-                .into_bvk(value_balance);
-
-            assert_eq!(redjubjub::PublicKey::from_private(
-                &bsk, VALUE_COMMITMENT_RANDOMNESS_GENERATOR).0, bvk.0);
-        }
-    }
-}
diff --git a/zcash_primitives/src/sapling/value/sums.rs b/zcash_primitives/src/sapling/value/sums.rs
deleted file mode 100644
index 7a5420df25..0000000000
--- a/zcash_primitives/src/sapling/value/sums.rs
+++ /dev/null
@@ -1,221 +0,0 @@
-use core::fmt::{self, Debug};
-use core::iter::Sum;
-use core::ops::{Add, AddAssign, Sub, SubAssign};
-
-use super::{NoteValue, ValueCommitTrapdoor, ValueCommitment};
-use crate::constants::VALUE_COMMITMENT_VALUE_GENERATOR;
-use crate::sapling::redjubjub;
-
-/// A value operation overflowed.
-#[derive(Debug)]
-pub struct OverflowError;
-
-impl fmt::Display for OverflowError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "Sapling value operation overflowed")
-    }
-}
-
-impl std::error::Error for OverflowError {}
-
-/// A sum of Sapling note values.
-///
-/// [Zcash Protocol Spec § 4.13: Balance and Binding Signature (Sapling)][saplingbalance]
-/// constrains the range of this type to between `[-(r_J - 1)/2..(r_J - 1)/2]` in the
-/// abstract protocol, and `[−38913406623490299131842..104805176454780817500623]` in the
-/// concrete Zcash protocol. We represent it as an `i128`, which has a range large enough
-/// to handle Zcash transactions while small enough to ensure the abstract protocol bounds
-/// are not breached.
-///
-/// [saplingbalance]: https://zips.z.cash/protocol/protocol.pdf#saplingbalance
-#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
-pub struct ValueSum(i128);
-
-impl ValueSum {
-    /// Initializes a sum of `NoteValue`s to zero.
-    pub fn zero() -> Self {
-        ValueSum(0)
-    }
-}
-
-impl Add<NoteValue> for ValueSum {
-    type Output = Option<ValueSum>;
-
-    #[allow(clippy::suspicious_arithmetic_impl)]
-    fn add(self, rhs: NoteValue) -> Self::Output {
-        self.0.checked_add(rhs.0.into()).map(ValueSum)
-    }
-}
-
-impl Sub<NoteValue> for ValueSum {
-    type Output = Option<ValueSum>;
-
-    #[allow(clippy::suspicious_arithmetic_impl)]
-    fn sub(self, rhs: NoteValue) -> Self::Output {
-        self.0.checked_sub(rhs.0.into()).map(ValueSum)
-    }
-}
-
-impl<'a> Sum<&'a NoteValue> for Result<ValueSum, OverflowError> {
-    fn sum<I: Iterator<Item = &'a NoteValue>>(iter: I) -> Self {
-        iter.fold(Ok(ValueSum(0)), |acc, v| (acc? + *v).ok_or(OverflowError))
-    }
-}
-
-impl Sum<NoteValue> for Result<ValueSum, OverflowError> {
-    fn sum<I: Iterator<Item = NoteValue>>(iter: I) -> Self {
-        iter.fold(Ok(ValueSum(0)), |acc, v| (acc? + v).ok_or(OverflowError))
-    }
-}
-
-impl TryFrom<ValueSum> for i64 {
-    type Error = OverflowError;
-
-    fn try_from(v: ValueSum) -> Result<i64, Self::Error> {
-        i64::try_from(v.0).map_err(|_| OverflowError)
-    }
-}
-
-/// A sum of Sapling value commitment blinding factors.
-#[derive(Clone, Copy, Debug)]
-pub struct TrapdoorSum(jubjub::Scalar);
-
-impl TrapdoorSum {
-    /// Initializes a sum of `ValueCommitTrapdoor`s to zero.
-    pub fn zero() -> Self {
-        TrapdoorSum(jubjub::Scalar::zero())
-    }
-
-    /// Transform this trapdoor sum into the corresponding RedJubjub private key.
-    ///
-    /// This is public for access by `zcash_proofs`.
-    pub fn into_bsk(self) -> redjubjub::PrivateKey {
-        redjubjub::PrivateKey(self.0)
-    }
-}
-
-impl Add<&ValueCommitTrapdoor> for ValueCommitTrapdoor {
-    type Output = TrapdoorSum;
-
-    fn add(self, rhs: &Self) -> Self::Output {
-        TrapdoorSum(self.0 + rhs.0)
-    }
-}
-
-impl Add<&ValueCommitTrapdoor> for TrapdoorSum {
-    type Output = TrapdoorSum;
-
-    fn add(self, rhs: &ValueCommitTrapdoor) -> Self::Output {
-        TrapdoorSum(self.0 + rhs.0)
-    }
-}
-
-impl AddAssign<&ValueCommitTrapdoor> for TrapdoorSum {
-    fn add_assign(&mut self, rhs: &ValueCommitTrapdoor) {
-        self.0 += rhs.0;
-    }
-}
-
-impl Sub<&ValueCommitTrapdoor> for ValueCommitTrapdoor {
-    type Output = TrapdoorSum;
-
-    fn sub(self, rhs: &Self) -> Self::Output {
-        TrapdoorSum(self.0 - rhs.0)
-    }
-}
-
-impl SubAssign<&ValueCommitTrapdoor> for TrapdoorSum {
-    fn sub_assign(&mut self, rhs: &ValueCommitTrapdoor) {
-        self.0 -= rhs.0;
-    }
-}
-
-impl<'a> Sum<&'a ValueCommitTrapdoor> for TrapdoorSum {
-    fn sum<I: Iterator<Item = &'a ValueCommitTrapdoor>>(iter: I) -> Self {
-        iter.fold(TrapdoorSum::zero(), |acc, cv| acc + cv)
-    }
-}
-
-/// A sum of Sapling value commitments.
-#[derive(Clone, Copy, Debug)]
-pub struct CommitmentSum(jubjub::ExtendedPoint);
-
-impl CommitmentSum {
-    /// Initializes a sum of `ValueCommitment`s to zero.
-    pub fn zero() -> Self {
-        CommitmentSum(jubjub::ExtendedPoint::identity())
-    }
-
-    /// Transform this value commitment sum into the corresponding RedJubjub public key.
-    ///
-    /// This is public for access by `zcash_proofs`.
-    pub fn into_bvk<V: Into<i64>>(self, value_balance: V) -> redjubjub::PublicKey {
-        let value: i64 = value_balance.into();
-
-        // Compute the absolute value.
-        let abs_value = match value.checked_abs() {
-            Some(v) => u64::try_from(v).expect("v is non-negative"),
-            None => 1u64 << 63,
-        };
-
-        // Construct the field representation of the signed value.
-        let value_balance = if value.is_negative() {
-            -jubjub::Scalar::from(abs_value)
-        } else {
-            jubjub::Scalar::from(abs_value)
-        };
-
-        // Subtract `value_balance` from the sum to get the final bvk.
-        let bvk = self.0 - VALUE_COMMITMENT_VALUE_GENERATOR * value_balance;
-
-        redjubjub::PublicKey(bvk)
-    }
-}
-
-impl Add<&ValueCommitment> for ValueCommitment {
-    type Output = CommitmentSum;
-
-    fn add(self, rhs: &Self) -> Self::Output {
-        CommitmentSum(self.0 + rhs.0)
-    }
-}
-
-impl Add<&ValueCommitment> for CommitmentSum {
-    type Output = CommitmentSum;
-
-    fn add(self, rhs: &ValueCommitment) -> Self::Output {
-        CommitmentSum(self.0 + rhs.0)
-    }
-}
-
-impl AddAssign<&ValueCommitment> for CommitmentSum {
-    fn add_assign(&mut self, rhs: &ValueCommitment) {
-        self.0 += rhs.0;
-    }
-}
-
-impl Sub<&ValueCommitment> for ValueCommitment {
-    type Output = CommitmentSum;
-
-    fn sub(self, rhs: &Self) -> Self::Output {
-        CommitmentSum(self.0 - rhs.0)
-    }
-}
-
-impl SubAssign<&ValueCommitment> for CommitmentSum {
-    fn sub_assign(&mut self, rhs: &ValueCommitment) {
-        self.0 -= rhs.0;
-    }
-}
-
-impl Sum<ValueCommitment> for CommitmentSum {
-    fn sum<I: Iterator<Item = ValueCommitment>>(iter: I) -> Self {
-        iter.fold(CommitmentSum::zero(), |acc, cv| acc + &cv)
-    }
-}
-
-impl<'a> Sum<&'a ValueCommitment> for CommitmentSum {
-    fn sum<I: Iterator<Item = &'a ValueCommitment>>(iter: I) -> Self {
-        iter.fold(CommitmentSum::zero(), |acc, cv| acc + cv)
-    }
-}
diff --git a/zcash_primitives/src/test_vectors.rs b/zcash_primitives/src/test_vectors.rs
deleted file mode 100644
index 403fbc962f..0000000000
--- a/zcash_primitives/src/test_vectors.rs
+++ /dev/null
@@ -1 +0,0 @@
-pub(crate) mod note_encryption;
diff --git a/zcash_primitives/src/test_vectors/note_encryption.rs b/zcash_primitives/src/test_vectors/note_encryption.rs
deleted file mode 100644
index 09209f29a9..0000000000
--- a/zcash_primitives/src/test_vectors/note_encryption.rs
+++ /dev/null
@@ -1,2046 +0,0 @@
-pub(crate) struct TestVector {
-    pub ovk: [u8; 32],
-    pub ivk: [u8; 32],
-    pub default_d: [u8; 11],
-    pub default_pk_d: [u8; 32],
-    pub v: u64,
-    pub rcm: [u8; 32],
-    pub memo: [u8; 512],
-    pub cv: [u8; 32],
-    pub cmu: [u8; 32],
-    pub esk: [u8; 32],
-    pub epk: [u8; 32],
-    pub shared_secret: [u8; 32],
-    pub k_enc: [u8; 32],
-    pub _p_enc: [u8; 564],
-    pub c_enc: [u8; 580],
-    pub ock: [u8; 32],
-    pub _op: [u8; 64],
-    pub c_out: [u8; 80],
-}
-
-pub(crate) fn make_test_vectors() -> Vec<TestVector> {
-    // From https://github.com/zcash-hackworks/zcash-test-vectors/blob/master/sapling_note_encryption.py
-    vec![
-        TestVector {
-            ovk: [
-                0x98, 0xd1, 0x69, 0x13, 0xd9, 0x9b, 0x04, 0x17, 0x7c, 0xab, 0xa4, 0x4f, 0x6e, 0x4d,
-                0x22, 0x4e, 0x03, 0xb5, 0xac, 0x03, 0x1d, 0x7c, 0xe4, 0x5e, 0x86, 0x51, 0x38, 0xe1,
-                0xb9, 0x96, 0xd6, 0x3b,
-            ],
-            ivk: [
-                0xb7, 0x0b, 0x7c, 0xd0, 0xed, 0x03, 0xcb, 0xdf, 0xd7, 0xad, 0xa9, 0x50, 0x2e, 0xe2,
-                0x45, 0xb1, 0x3e, 0x56, 0x9d, 0x54, 0xa5, 0x71, 0x9d, 0x2d, 0xaa, 0x0f, 0x5f, 0x14,
-                0x51, 0x47, 0x92, 0x04,
-            ],
-            default_d: [
-                0xf1, 0x9d, 0x9b, 0x79, 0x7e, 0x39, 0xf3, 0x37, 0x44, 0x58, 0x39,
-            ],
-            default_pk_d: [
-                0xdb, 0x4c, 0xd2, 0xb0, 0xaa, 0xc4, 0xf7, 0xeb, 0x8c, 0xa1, 0x31, 0xf1, 0x65, 0x67,
-                0xc4, 0x45, 0xa9, 0x55, 0x51, 0x26, 0xd3, 0xc2, 0x9f, 0x14, 0xe3, 0xd7, 0x76, 0xe8,
-                0x41, 0xae, 0x74, 0x15,
-            ],
-            v: 100000000,
-            rcm: [
-                0x39, 0x17, 0x6d, 0xac, 0x39, 0xac, 0xe4, 0x98, 0x0e, 0xcc, 0x8d, 0x77, 0x8e, 0x89,
-                0x86, 0x02, 0x55, 0xec, 0x36, 0x15, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0xa9, 0xcb, 0x0d, 0x13, 0x72, 0x32, 0xff, 0x84, 0x48, 0xd0, 0xf0, 0x78, 0xb6, 0x81,
-                0x4c, 0x66, 0xcb, 0x33, 0x1b, 0x0f, 0x2d, 0x3d, 0x8a, 0x08, 0x5b, 0xed, 0xba, 0x81,
-                0x5f, 0x00, 0xa8, 0xdb,
-            ],
-            cmu: [
-                0x63, 0x55, 0x72, 0xf5, 0x72, 0xa8, 0xa1, 0xa0, 0xb7, 0xac, 0xbc, 0x0a, 0xfc, 0x6d,
-                0x66, 0xf1, 0x4a, 0x02, 0xef, 0xac, 0xde, 0x7b, 0xdf, 0x03, 0x44, 0x3e, 0xd4, 0xc3,
-                0xe5, 0x51, 0xd4, 0x70,
-            ],
-            esk: [
-                0x81, 0xc7, 0xb2, 0x17, 0x1f, 0xf4, 0x41, 0x52, 0x50, 0xca, 0xc0, 0x1f, 0x59, 0x82,
-                0xfd, 0x8f, 0x49, 0x61, 0x9d, 0x61, 0xad, 0x78, 0xf6, 0x83, 0x0b, 0x3c, 0x60, 0x61,
-                0x45, 0x96, 0x2a, 0x0e,
-            ],
-            epk: [
-                0xde, 0xd6, 0x8f, 0x05, 0xc6, 0x58, 0xfc, 0xae, 0x5a, 0xe2, 0x18, 0x64, 0x6f, 0xf8,
-                0x44, 0x40, 0x6f, 0x84, 0x42, 0x67, 0x84, 0x04, 0x0d, 0x0b, 0xef, 0x2b, 0x09, 0xcb,
-                0x38, 0x48, 0xc4, 0xdc,
-            ],
-            shared_secret: [
-                0x67, 0xf9, 0x61, 0x34, 0x04, 0xd9, 0xe9, 0x27, 0x1f, 0x16, 0x74, 0x01, 0x1b, 0x03,
-                0x9b, 0x3d, 0x43, 0x81, 0xa4, 0xd7, 0x0c, 0x58, 0x6c, 0x8a, 0x13, 0x42, 0x28, 0x3f,
-                0xd5, 0xfc, 0x3a, 0xde,
-            ],
-            k_enc: [
-                0xe5, 0xbf, 0x8a, 0xb2, 0xf9, 0x41, 0xe9, 0xb9, 0xd2, 0xc7, 0x4a, 0xce, 0x2d, 0xf6,
-                0xb3, 0x3c, 0x3c, 0x32, 0x29, 0xfa, 0x0b, 0x91, 0x26, 0xf9, 0xdd, 0xdb, 0x43, 0x29,
-                0x66, 0x10, 0x00, 0x69,
-            ],
-            _p_enc: [
-                0x01, 0xf1, 0x9d, 0x9b, 0x79, 0x7e, 0x39, 0xf3, 0x37, 0x44, 0x58, 0x39, 0x00, 0xe1,
-                0xf5, 0x05, 0x00, 0x00, 0x00, 0x00, 0x39, 0x17, 0x6d, 0xac, 0x39, 0xac, 0xe4, 0x98,
-                0x0e, 0xcc, 0x8d, 0x77, 0x8e, 0x89, 0x86, 0x02, 0x55, 0xec, 0x36, 0x15, 0x06, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x8d, 0x6b, 0x27, 0xe7, 0xef, 0xf5, 0x9b, 0xfb, 0xa0, 0x1d, 0x65, 0x88, 0xba, 0xdd,
-                0x36, 0x6c, 0xe5, 0x9b, 0x4d, 0x5b, 0x0e, 0xf9, 0x3b, 0xeb, 0xcb, 0xf2, 0x11, 0x41,
-                0x7c, 0x56, 0xae, 0x70, 0x0a, 0xe1, 0x82, 0x44, 0xba, 0xc2, 0xfb, 0x64, 0x37, 0xdb,
-                0x01, 0xf8, 0x3d, 0xc1, 0x49, 0xe2, 0x78, 0x6e, 0xc4, 0xec, 0x32, 0xc1, 0x1b, 0x05,
-                0x4a, 0x4c, 0x0e, 0x2b, 0xdb, 0xe3, 0x43, 0x78, 0x8b, 0xb9, 0xc3, 0x3f, 0xf4, 0x2f,
-                0xae, 0x99, 0x32, 0x32, 0x13, 0xe0, 0x96, 0x3e, 0x6f, 0x97, 0x6d, 0x6f, 0xff, 0xb8,
-                0xc9, 0xfc, 0xf5, 0x21, 0x95, 0x74, 0xc7, 0xa9, 0x4c, 0x0e, 0x72, 0xf6, 0x09, 0x3a,
-                0xed, 0xaf, 0xe3, 0x80, 0x62, 0x1b, 0x3b, 0xa8, 0x15, 0xd2, 0xb9, 0x72, 0x40, 0xf6,
-                0x77, 0xd3, 0x90, 0xf5, 0xfc, 0x5d, 0x45, 0xee, 0xff, 0x16, 0x68, 0x8e, 0x40, 0xb9,
-                0xee, 0xe8, 0xee, 0x1d, 0x39, 0x3b, 0x00, 0x97, 0x50, 0xcb, 0x73, 0xdf, 0x7a, 0x47,
-                0xfd, 0x07, 0xa2, 0x81, 0x41, 0xdb, 0x49, 0xbd, 0x9c, 0xca, 0xb1, 0xf1, 0x8d, 0x0b,
-                0x6a, 0x55, 0xed, 0x10, 0x1c, 0xa1, 0x6f, 0x73, 0x45, 0xbc, 0xb0, 0xbe, 0xaf, 0x7c,
-                0xd7, 0x9a, 0x3d, 0x2b, 0xf2, 0x88, 0xf1, 0xd8, 0x8e, 0xbb, 0x1e, 0x4b, 0x74, 0x21,
-                0x99, 0xd3, 0x30, 0xc3, 0x0a, 0x9f, 0xee, 0x1b, 0x44, 0xc6, 0x86, 0xa1, 0xff, 0x5c,
-                0xc3, 0x3d, 0x46, 0x27, 0xf8, 0x3d, 0x61, 0xce, 0x34, 0xd6, 0xf1, 0x34, 0x4e, 0x2b,
-                0x11, 0xa5, 0xf7, 0x17, 0x24, 0x42, 0x29, 0x60, 0x75, 0x91, 0x90, 0x05, 0x43, 0x4a,
-                0x57, 0x4e, 0xd4, 0xe4, 0xc9, 0x8e, 0x23, 0x8e, 0xdd, 0x53, 0x67, 0xe8, 0xf5, 0x75,
-                0x24, 0xb6, 0x38, 0xdd, 0x2d, 0x58, 0x30, 0xe8, 0x3f, 0x7f, 0x32, 0x08, 0x0d, 0x2d,
-                0x51, 0xa0, 0x8a, 0xe8, 0x4e, 0x37, 0x42, 0x9c, 0x84, 0x38, 0xfa, 0xae, 0x15, 0x40,
-                0x86, 0x7b, 0x12, 0xac, 0x2c, 0xf6, 0xa7, 0x7d, 0xa7, 0x80, 0xd9, 0x2c, 0xfa, 0x50,
-                0x0c, 0x19, 0x5a, 0x07, 0x1c, 0xe8, 0xae, 0x3f, 0x10, 0x2c, 0xe0, 0x95, 0x01, 0xec,
-                0xda, 0xc0, 0x8a, 0x79, 0x52, 0xa0, 0x8d, 0x53, 0xf3, 0x62, 0xd3, 0x7b, 0x64, 0x94,
-                0x8c, 0x99, 0x15, 0xcb, 0xfc, 0x9f, 0x2d, 0x3c, 0x4e, 0x82, 0x22, 0xd3, 0x9a, 0x34,
-                0x84, 0x21, 0x44, 0x7f, 0xab, 0xe4, 0xd5, 0xf0, 0x87, 0x80, 0x9a, 0x79, 0xe8, 0x49,
-                0xb2, 0x8d, 0xff, 0xbc, 0x97, 0xfb, 0xbf, 0x64, 0x7f, 0xf3, 0x4f, 0x79, 0xff, 0x64,
-                0xe7, 0x37, 0xeb, 0xf0, 0x3d, 0x8a, 0xdd, 0x44, 0xc1, 0x54, 0x32, 0x5f, 0x2b, 0xff,
-                0x14, 0xc6, 0xe9, 0xe9, 0x0b, 0x0f, 0x98, 0x89, 0xf3, 0x25, 0xa9, 0x26, 0xa3, 0x68,
-                0x56, 0x41, 0xa7, 0xa2, 0x19, 0xec, 0xe6, 0xfb, 0x2b, 0x4d, 0xee, 0xbf, 0x31, 0x09,
-                0xd7, 0xee, 0x0f, 0x03, 0x9d, 0xac, 0x42, 0x74, 0x44, 0x99, 0x34, 0x85, 0x84, 0x84,
-                0x44, 0xcc, 0xaf, 0xda, 0x5e, 0xa3, 0x28, 0x74, 0x06, 0x66, 0xdd, 0x75, 0xc3, 0x23,
-                0xce, 0x7b, 0x92, 0x0e, 0xe0, 0xf3, 0xdc, 0x3a, 0xbc, 0xe6, 0xbd, 0x09, 0xc1, 0x3c,
-                0x95, 0x7c, 0x5e, 0xa8, 0x95, 0x28, 0x27, 0x11, 0x6b, 0xb5, 0xbd, 0x0e, 0x5c, 0x27,
-                0xf8, 0x20, 0xf2, 0xcf, 0x72, 0xa5, 0x10, 0x5d, 0x95, 0x55, 0xbe, 0x1e, 0x1e, 0x5e,
-                0x68, 0xff, 0xfb, 0x71, 0x33, 0xdc, 0x39, 0x00, 0x19, 0x4e, 0x3b, 0x73, 0x1c, 0x7d,
-                0x39, 0x11, 0x70, 0xad, 0x6d, 0x4a, 0xf1, 0x3a, 0x78, 0xa0, 0x6c, 0x25, 0xcf, 0xbb,
-                0x0d, 0x09, 0x91, 0xd5, 0xa8, 0x83, 0xcf, 0xf5, 0x1c, 0xb6, 0xf5, 0x91, 0xc7, 0x92,
-                0xd9, 0x9d, 0xcc, 0x55, 0x9c, 0xde, 0x9b, 0x7b, 0x39, 0xc4, 0xf5, 0x4a, 0x6b, 0xfb,
-                0x29, 0xf1, 0xf8, 0x5e, 0x13, 0x5d, 0x17, 0x33, 0xb4, 0x9d, 0x5d, 0xd6, 0x70, 0x18,
-                0xe6, 0x2e, 0x8c, 0x1a, 0xb0, 0xc1, 0x9a, 0x25, 0x41, 0x87, 0x26, 0xcc, 0xf2, 0xf5,
-                0xe8, 0x8b, 0x97, 0x69, 0x21, 0x12, 0x92, 0x4b, 0xda, 0x2f, 0xde, 0x73, 0x48, 0xba,
-                0xd7, 0x29, 0x52, 0x41, 0x72, 0x9d, 0xb4, 0xf3, 0x87, 0x11, 0xc7, 0xea, 0x98, 0xc5,
-                0xd4, 0x19, 0x7c, 0x66, 0xfd, 0x23,
-            ],
-            ock: [
-                0x6c, 0xe6, 0x1e, 0xad, 0x78, 0x49, 0x20, 0x42, 0x93, 0x34, 0x9e, 0x83, 0x2e, 0x95,
-                0xca, 0x3a, 0xc6, 0x42, 0x2e, 0xc4, 0xfe, 0x21, 0xe5, 0xd1, 0x53, 0x86, 0x55, 0x8e,
-                0x4d, 0x37, 0x79, 0x6d,
-            ],
-            _op: [
-                0xdb, 0x4c, 0xd2, 0xb0, 0xaa, 0xc4, 0xf7, 0xeb, 0x8c, 0xa1, 0x31, 0xf1, 0x65, 0x67,
-                0xc4, 0x45, 0xa9, 0x55, 0x51, 0x26, 0xd3, 0xc2, 0x9f, 0x14, 0xe3, 0xd7, 0x76, 0xe8,
-                0x41, 0xae, 0x74, 0x15, 0x81, 0xc7, 0xb2, 0x17, 0x1f, 0xf4, 0x41, 0x52, 0x50, 0xca,
-                0xc0, 0x1f, 0x59, 0x82, 0xfd, 0x8f, 0x49, 0x61, 0x9d, 0x61, 0xad, 0x78, 0xf6, 0x83,
-                0x0b, 0x3c, 0x60, 0x61, 0x45, 0x96, 0x2a, 0x0e,
-            ],
-            c_out: [
-                0x0e, 0xb2, 0xb0, 0x1b, 0xe8, 0x88, 0x0f, 0xc0, 0x46, 0x98, 0x42, 0x27, 0x14, 0x18,
-                0xb5, 0x2b, 0xad, 0x40, 0x19, 0x89, 0x2c, 0xde, 0x53, 0xee, 0xca, 0xcd, 0xb2, 0xe4,
-                0x5f, 0x5f, 0x33, 0x75, 0x85, 0xf7, 0xf6, 0x17, 0x5d, 0x88, 0x8f, 0x6e, 0x2c, 0x4e,
-                0xd1, 0x35, 0x71, 0xcd, 0x96, 0xfd, 0x17, 0x7a, 0x01, 0xab, 0x10, 0x19, 0x08, 0xd7,
-                0xca, 0x4a, 0x6d, 0x81, 0xd9, 0x16, 0x62, 0x2f, 0x5f, 0xf0, 0x77, 0xb1, 0x3f, 0x34,
-                0x55, 0x90, 0xe2, 0x27, 0xc1, 0x0e, 0x08, 0x95, 0xe2, 0x04,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0x3b, 0x94, 0x62, 0x10, 0xce, 0x6d, 0x1b, 0x16, 0x92, 0xd7, 0x39, 0x2a, 0xc8, 0x4a,
-                0x8b, 0xc8, 0xf0, 0x3b, 0x72, 0x72, 0x3c, 0x7d, 0x36, 0x72, 0x1b, 0x80, 0x9a, 0x79,
-                0xc9, 0xd6, 0xe4, 0x5b,
-            ],
-            ivk: [
-                0xc5, 0x18, 0x38, 0x44, 0x66, 0xb2, 0x69, 0x88, 0xb5, 0x10, 0x90, 0x67, 0x41, 0x8d,
-                0x19, 0x2d, 0x9d, 0x6b, 0xd0, 0xd9, 0x23, 0x22, 0x05, 0xd7, 0x74, 0x18, 0xc2, 0x40,
-                0xfc, 0x68, 0xa4, 0x06,
-            ],
-            default_d: [
-                0xae, 0xf1, 0x80, 0xf6, 0xe3, 0x4e, 0x35, 0x4b, 0x88, 0x8f, 0x81,
-            ],
-            default_pk_d: [
-                0xa6, 0xb1, 0x3e, 0xa3, 0x36, 0xdd, 0xb7, 0xa6, 0x7b, 0xb0, 0x9a, 0x0e, 0x68, 0xe9,
-                0xd3, 0xcf, 0xb3, 0x92, 0x10, 0x83, 0x1e, 0xa3, 0xa2, 0x96, 0xba, 0x09, 0xa9, 0x22,
-                0x06, 0x0f, 0xd3, 0x8b,
-            ],
-            v: 200000000,
-            rcm: [
-                0x47, 0x8b, 0xa0, 0xee, 0x6e, 0x1a, 0x75, 0xb6, 0x00, 0x03, 0x6f, 0x26, 0xf1, 0x8b,
-                0x70, 0x15, 0xab, 0x55, 0x6b, 0xed, 0xdf, 0x8b, 0x96, 0x02, 0x38, 0x86, 0x9f, 0x89,
-                0xdd, 0x80, 0x4e, 0x06,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0xfc, 0x54, 0x31, 0x9a, 0x39, 0xbe, 0x49, 0xc0, 0x48, 0x0c, 0x4d, 0xf3, 0x3b, 0x8f,
-                0x77, 0xca, 0x67, 0x3a, 0x42, 0xbf, 0xde, 0xdf, 0xb8, 0x0e, 0xe4, 0x6b, 0x8f, 0x70,
-                0xfc, 0x0d, 0xcd, 0x3d,
-            ],
-            cmu: [
-                0x0c, 0x87, 0x41, 0x75, 0x77, 0x48, 0x0b, 0x69, 0x77, 0xba, 0x92, 0xc5, 0x54, 0x25,
-                0xd6, 0x2b, 0x03, 0xb1, 0xe5, 0xf3, 0xc3, 0x82, 0x9c, 0xac, 0x49, 0xbf, 0xe5, 0x15,
-                0xae, 0x72, 0x29, 0x45,
-            ],
-            esk: [
-                0xad, 0x4a, 0xd6, 0x24, 0x77, 0xc2, 0xc8, 0x83, 0xc8, 0xba, 0xbf, 0xed, 0x5d, 0x38,
-                0x5b, 0x51, 0xab, 0xdc, 0xc6, 0x98, 0xe9, 0x36, 0xe7, 0x8d, 0xc2, 0x26, 0x71, 0x72,
-                0x91, 0x55, 0x62, 0x0b,
-            ],
-            epk: [
-                0xf0, 0x6c, 0xba, 0xf8, 0xcb, 0x5c, 0x84, 0x82, 0x38, 0x47, 0xa1, 0x20, 0x10, 0x4c,
-                0x85, 0xad, 0x70, 0x72, 0x28, 0xad, 0xba, 0x87, 0x6c, 0x6d, 0x83, 0x7e, 0xfd, 0x41,
-                0x4e, 0x1c, 0x1d, 0xb4,
-            ],
-            shared_secret: [
-                0xb9, 0x8a, 0x2c, 0x3b, 0xf0, 0xdc, 0x56, 0xb2, 0xbf, 0x65, 0xf5, 0xbd, 0x15, 0x25,
-                0x05, 0x5e, 0xed, 0x22, 0xac, 0x0d, 0xcc, 0x2c, 0x11, 0xe3, 0x00, 0xc4, 0x67, 0x80,
-                0x2b, 0x85, 0x88, 0x97,
-            ],
-            k_enc: [
-                0xb2, 0xef, 0x45, 0xb0, 0xf7, 0x25, 0x36, 0xa6, 0xc0, 0x22, 0xdd, 0xce, 0xe6, 0x2e,
-                0xa7, 0x02, 0x7a, 0x49, 0x36, 0x2a, 0xa2, 0xdd, 0x3b, 0x54, 0x36, 0xd8, 0x89, 0x75,
-                0xe0, 0x2a, 0xd0, 0xca,
-            ],
-            _p_enc: [
-                0x01, 0xae, 0xf1, 0x80, 0xf6, 0xe3, 0x4e, 0x35, 0x4b, 0x88, 0x8f, 0x81, 0x00, 0xc2,
-                0xeb, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x47, 0x8b, 0xa0, 0xee, 0x6e, 0x1a, 0x75, 0xb6,
-                0x00, 0x03, 0x6f, 0x26, 0xf1, 0x8b, 0x70, 0x15, 0xab, 0x55, 0x6b, 0xed, 0xdf, 0x8b,
-                0x96, 0x02, 0x38, 0x86, 0x9f, 0x89, 0xdd, 0x80, 0x4e, 0x06, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x8a, 0x3f, 0x60, 0x25, 0x2f, 0x4d, 0xf9, 0x96, 0x39, 0x2e, 0x55, 0xaf, 0xee, 0x07,
-                0x22, 0xf1, 0x24, 0xb1, 0xa1, 0x34, 0xe8, 0xa1, 0xfb, 0x1e, 0xaa, 0x88, 0x88, 0x9e,
-                0x6a, 0xd4, 0x89, 0xcf, 0x1b, 0xa9, 0x12, 0x55, 0xee, 0x56, 0xfa, 0x1a, 0x09, 0xdb,
-                0x71, 0x56, 0xc3, 0x55, 0x1a, 0xed, 0x29, 0x69, 0xa6, 0xff, 0x37, 0xf2, 0xa7, 0x7a,
-                0x60, 0xb3, 0xea, 0x43, 0x75, 0xfa, 0xff, 0x04, 0x9e, 0x85, 0xc2, 0x72, 0x21, 0xcc,
-                0x2b, 0xa9, 0x89, 0xbd, 0x18, 0xff, 0x96, 0x98, 0x00, 0x0a, 0xf1, 0xa7, 0x64, 0x3f,
-                0x87, 0x85, 0xd6, 0x5e, 0xbb, 0x04, 0xc8, 0x5b, 0x24, 0x75, 0xdf, 0x62, 0x5b, 0x47,
-                0xe3, 0xe9, 0xc7, 0xac, 0xa8, 0x4c, 0x13, 0x17, 0x23, 0x77, 0x6b, 0xd8, 0xc2, 0x9f,
-                0x9d, 0x1f, 0x5f, 0xd2, 0x57, 0xe5, 0x8f, 0x72, 0xb6, 0x04, 0xf9, 0xb5, 0x7b, 0x1c,
-                0x2d, 0x05, 0x31, 0xeb, 0xbb, 0x19, 0xcf, 0xc2, 0x73, 0x68, 0x89, 0x0d, 0x25, 0x6e,
-                0x9a, 0xba, 0x30, 0x8d, 0xb9, 0xd8, 0x85, 0x6f, 0x49, 0xd4, 0x66, 0x3a, 0xfe, 0x55,
-                0x50, 0x72, 0xed, 0x64, 0xc8, 0x19, 0x8e, 0x6a, 0xd1, 0x5c, 0x0c, 0x43, 0xbb, 0x16,
-                0x85, 0x49, 0xa5, 0xbe, 0x38, 0xc5, 0xb4, 0x6d, 0xc1, 0x2f, 0x0c, 0x2a, 0x96, 0x1f,
-                0xf3, 0xcf, 0xe3, 0x2a, 0x1c, 0x3e, 0xfe, 0x80, 0xb1, 0x5e, 0x37, 0xe4, 0xce, 0xbe,
-                0x2a, 0x7a, 0xbe, 0x03, 0xeb, 0x17, 0xf4, 0xbb, 0xad, 0x22, 0x31, 0xcb, 0x52, 0x55,
-                0xe2, 0x9c, 0xd0, 0x3c, 0xb9, 0x61, 0x33, 0x2c, 0xf5, 0xe5, 0x5e, 0x60, 0x53, 0xcd,
-                0x40, 0x65, 0xc3, 0x78, 0x56, 0x06, 0xb2, 0x18, 0x5f, 0x18, 0xc4, 0xa3, 0xa2, 0x26,
-                0x23, 0xd2, 0x59, 0xcd, 0x20, 0xdb, 0xe1, 0x54, 0xc4, 0xaf, 0x6b, 0x2b, 0xdc, 0xf3,
-                0xb9, 0xc0, 0xff, 0x13, 0xce, 0x27, 0xe3, 0x95, 0x05, 0xa9, 0xf1, 0xb8, 0x2f, 0x6f,
-                0xce, 0xea, 0xc0, 0x95, 0x38, 0x47, 0x17, 0xe8, 0x97, 0x0e, 0xe0, 0x29, 0xde, 0x96,
-                0x4e, 0x80, 0x4a, 0xbd, 0x32, 0xd4, 0xda, 0x93, 0xbb, 0x8d, 0xc2, 0xb6, 0xbd, 0x60,
-                0x44, 0xd8, 0xdf, 0xd7, 0x9d, 0xf7, 0x20, 0x7e, 0xa0, 0x3b, 0xdf, 0x03, 0x6f, 0xa6,
-                0x26, 0x3f, 0x21, 0xbc, 0x1b, 0xfd, 0x4a, 0x6d, 0x9c, 0xb5, 0xf2, 0xd8, 0xbb, 0x6e,
-                0x74, 0xb6, 0xdd, 0x04, 0x7a, 0xe1, 0xaa, 0xb8, 0xc1, 0xa7, 0x23, 0xb4, 0x78, 0x7c,
-                0x54, 0xe2, 0x53, 0x96, 0x7f, 0xa9, 0x44, 0x0b, 0x73, 0x61, 0x83, 0x50, 0x65, 0x74,
-                0x35, 0x03, 0x55, 0x26, 0x9b, 0x2b, 0x66, 0xb7, 0x48, 0xe8, 0x8f, 0xe9, 0xb8, 0xd1,
-                0x23, 0xe9, 0x4b, 0x5f, 0xa5, 0xd0, 0x72, 0xb8, 0xc3, 0x96, 0x52, 0xe9, 0x20, 0x2b,
-                0x16, 0xf1, 0x65, 0x46, 0x0e, 0x4b, 0x97, 0x0f, 0x63, 0xee, 0x7d, 0x63, 0x8f, 0x48,
-                0xe4, 0x90, 0x17, 0xea, 0x64, 0x1c, 0xd3, 0x70, 0x09, 0xd4, 0x4b, 0x77, 0x24, 0x18,
-                0x25, 0x44, 0xdb, 0x92, 0xbd, 0x0c, 0x4a, 0x7e, 0x9d, 0x93, 0x93, 0xd4, 0x6f, 0xcb,
-                0x7b, 0xdd, 0xf9, 0x6f, 0x02, 0xcb, 0xf4, 0x7f, 0xa0, 0xf5, 0x28, 0x04, 0x09, 0x8e,
-                0xcb, 0xbb, 0x7a, 0x13, 0xf3, 0xa2, 0xa5, 0xf1, 0x63, 0x8e, 0x77, 0xf8, 0xa8, 0x2f,
-                0x6c, 0x3d, 0xec, 0xb7, 0x60, 0x7f, 0x09, 0x51, 0xc5, 0x7c, 0x7f, 0x27, 0x76, 0x04,
-                0x22, 0x14, 0xf9, 0x0a, 0x3b, 0x6e, 0x00, 0xed, 0x16, 0x05, 0x9d, 0xff, 0x45, 0x55,
-                0xbd, 0x47, 0x1d, 0x78, 0xaf, 0xe7, 0xaa, 0x3d, 0xc7, 0x91, 0x41, 0xa0, 0x87, 0x2d,
-                0x19, 0xc8, 0x1c, 0x35, 0x1c, 0xaf, 0x54, 0xa2, 0xfc, 0x6d, 0xe8, 0xfd, 0x76, 0x86,
-                0xc4, 0xf2, 0xc5, 0x34, 0xef, 0xac, 0x77, 0x51, 0x5e, 0x30, 0xf2, 0x50, 0x7b, 0xa0,
-                0xb2, 0x3b, 0x1e, 0xe3, 0x7c, 0xa9, 0x08, 0x94, 0x3d, 0xfe, 0xf3, 0x80, 0x9a, 0x7e,
-                0x9b, 0xec, 0xf1, 0xb9, 0x69, 0x10, 0x49, 0xf7, 0x87, 0x6a, 0x59, 0x2e, 0xe7, 0xed,
-                0x64, 0x74, 0x0f, 0x1b, 0xe7, 0xe3, 0x06, 0x6e, 0xf7, 0x6f, 0x81, 0x47, 0x0f, 0x43,
-                0x54, 0x33, 0x1a, 0xa1, 0xbc, 0x49, 0x57, 0x96, 0x99, 0x69, 0x77, 0x82, 0xbb, 0x07,
-                0x5c, 0xbf, 0x82, 0xd3, 0xa8, 0xc0,
-            ],
-            ock: [
-                0x6f, 0xce, 0x27, 0xbf, 0x1a, 0x62, 0xf0, 0x78, 0xe7, 0xe3, 0xcb, 0x5d, 0x8b, 0xf2,
-                0x4c, 0xa7, 0xe4, 0xa5, 0x82, 0x1d, 0x45, 0x5f, 0x0f, 0xa8, 0x2c, 0xd5, 0x44, 0xec,
-                0xb4, 0x20, 0x91, 0xfa,
-            ],
-            _op: [
-                0xa6, 0xb1, 0x3e, 0xa3, 0x36, 0xdd, 0xb7, 0xa6, 0x7b, 0xb0, 0x9a, 0x0e, 0x68, 0xe9,
-                0xd3, 0xcf, 0xb3, 0x92, 0x10, 0x83, 0x1e, 0xa3, 0xa2, 0x96, 0xba, 0x09, 0xa9, 0x22,
-                0x06, 0x0f, 0xd3, 0x8b, 0xad, 0x4a, 0xd6, 0x24, 0x77, 0xc2, 0xc8, 0x83, 0xc8, 0xba,
-                0xbf, 0xed, 0x5d, 0x38, 0x5b, 0x51, 0xab, 0xdc, 0xc6, 0x98, 0xe9, 0x36, 0xe7, 0x8d,
-                0xc2, 0x26, 0x71, 0x72, 0x91, 0x55, 0x62, 0x0b,
-            ],
-            c_out: [
-                0x88, 0x24, 0x58, 0x30, 0x2c, 0x0a, 0xba, 0x55, 0xed, 0x8d, 0x67, 0x18, 0xca, 0x26,
-                0xd8, 0xc2, 0x8a, 0x12, 0x7a, 0x01, 0xe7, 0x7c, 0x2a, 0xe5, 0xbf, 0x15, 0xc6, 0x96,
-                0x73, 0x91, 0x81, 0x77, 0xf9, 0x24, 0x77, 0xa2, 0x18, 0xa7, 0xf6, 0xcf, 0x12, 0x17,
-                0x80, 0x22, 0xc9, 0xdd, 0xc7, 0x18, 0x5c, 0x18, 0xd0, 0x87, 0x6c, 0x3c, 0x29, 0x65,
-                0x83, 0xe0, 0xbc, 0x54, 0x79, 0x3b, 0xf1, 0xe2, 0x6a, 0x85, 0x4a, 0x41, 0xab, 0x61,
-                0x7f, 0x20, 0x52, 0x71, 0xba, 0x6c, 0x14, 0x29, 0xbd, 0xf4,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0x8b, 0xf4, 0x39, 0x0e, 0x28, 0xdd, 0xc9, 0x5b, 0x83, 0x02, 0xc3, 0x81, 0xd5, 0x81,
-                0x0b, 0x84, 0xba, 0x8e, 0x60, 0x96, 0xe5, 0xa7, 0x68, 0x22, 0x77, 0x4f, 0xd4, 0x9f,
-                0x49, 0x1e, 0x8f, 0x49,
-            ],
-            ivk: [
-                0x47, 0x1c, 0x24, 0xa3, 0xdc, 0x87, 0x30, 0xe7, 0x50, 0x36, 0xc0, 0xa9, 0x5f, 0x3e,
-                0x2f, 0x7d, 0xd1, 0xbe, 0x6f, 0xb9, 0x3a, 0xd2, 0x95, 0x92, 0x20, 0x3d, 0xef, 0x30,
-                0x41, 0x95, 0x45, 0x05,
-            ],
-            default_d: [
-                0x75, 0x99, 0xf0, 0xbf, 0x9b, 0x57, 0xcd, 0x2d, 0xc2, 0x99, 0xb6,
-            ],
-            default_pk_d: [
-                0x66, 0x14, 0x17, 0x39, 0x51, 0x4b, 0x28, 0xf0, 0x5d, 0xef, 0x8a, 0x18, 0xee, 0xee,
-                0x5e, 0xed, 0x4d, 0x44, 0xc6, 0x22, 0x5c, 0x3c, 0x65, 0xd8, 0x8d, 0xd9, 0x90, 0x77,
-                0x08, 0x01, 0x2f, 0x5a,
-            ],
-            v: 300000000,
-            rcm: [
-                0x14, 0x7c, 0xf2, 0xb5, 0x1b, 0x4c, 0x7c, 0x63, 0xcb, 0x77, 0xb9, 0x9e, 0x8b, 0x78,
-                0x3e, 0x5b, 0x51, 0x11, 0xdb, 0x0a, 0x7c, 0xa0, 0x4d, 0x6c, 0x01, 0x4a, 0x1d, 0x7d,
-                0xa8, 0x3b, 0xae, 0x0a,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x5c, 0xc9, 0xea, 0x16, 0x8e, 0x79, 0xff, 0x0d, 0x08, 0x3a, 0xf4, 0x21, 0xd3, 0x2d,
-                0x27, 0xfb, 0xa1, 0xc8, 0xa6, 0x38, 0xc0, 0xc3, 0x52, 0xcf, 0x59, 0xdc, 0xb1, 0xca,
-                0x84, 0xc3, 0xfb, 0x1b,
-            ],
-            cmu: [
-                0xb3, 0xb4, 0xe7, 0xab, 0x08, 0x0b, 0x9b, 0x0f, 0xe4, 0x73, 0xcf, 0xc5, 0xa3, 0x10,
-                0x5e, 0x9a, 0x06, 0x2a, 0x4e, 0xe4, 0x9e, 0xdd, 0x70, 0x95, 0xa6, 0x71, 0x63, 0x7e,
-                0x00, 0x57, 0x24, 0x2b,
-            ],
-            esk: [
-                0x99, 0xaa, 0x10, 0xc0, 0x57, 0x88, 0x08, 0x1c, 0x0d, 0xa7, 0xd8, 0x79, 0xcd, 0x95,
-                0x43, 0xec, 0x18, 0x92, 0x15, 0x72, 0x92, 0x40, 0x2e, 0x96, 0x0b, 0x06, 0x99, 0x5a,
-                0x08, 0x96, 0x4c, 0x03,
-            ],
-            epk: [
-                0x6a, 0x92, 0x02, 0x60, 0x43, 0xfa, 0x93, 0x0e, 0xeb, 0x2b, 0x28, 0xfd, 0x7b, 0xbd,
-                0xc5, 0xa7, 0x05, 0x00, 0xbe, 0xb8, 0x4c, 0x67, 0x11, 0x36, 0x23, 0x8e, 0x5e, 0xfd,
-                0xb0, 0x17, 0xd9, 0x9c,
-            ],
-            shared_secret: [
-                0x50, 0x78, 0x28, 0x7f, 0xf1, 0x7b, 0x1d, 0x92, 0x9b, 0x6a, 0x99, 0xb5, 0xe2, 0x82,
-                0x68, 0xa1, 0x92, 0x93, 0x95, 0x73, 0xda, 0xc4, 0xe8, 0x4d, 0x51, 0x1b, 0x53, 0x93,
-                0xd7, 0x2a, 0x6d, 0x68,
-            ],
-            k_enc: [
-                0xa4, 0x3c, 0xaa, 0xd6, 0x25, 0x30, 0xde, 0x86, 0xdf, 0x57, 0xe9, 0xde, 0x03, 0x47,
-                0xa2, 0xd8, 0x06, 0x40, 0x53, 0x0a, 0x4c, 0xa9, 0x7b, 0x82, 0x92, 0xa5, 0xa5, 0x25,
-                0x0f, 0x1b, 0xf2, 0x40,
-            ],
-            _p_enc: [
-                0x01, 0x75, 0x99, 0xf0, 0xbf, 0x9b, 0x57, 0xcd, 0x2d, 0xc2, 0x99, 0xb6, 0x00, 0xa3,
-                0xe1, 0x11, 0x00, 0x00, 0x00, 0x00, 0x14, 0x7c, 0xf2, 0xb5, 0x1b, 0x4c, 0x7c, 0x63,
-                0xcb, 0x77, 0xb9, 0x9e, 0x8b, 0x78, 0x3e, 0x5b, 0x51, 0x11, 0xdb, 0x0a, 0x7c, 0xa0,
-                0x4d, 0x6c, 0x01, 0x4a, 0x1d, 0x7d, 0xa8, 0x3b, 0xae, 0x0a, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x4c, 0xac, 0xe5, 0x2f, 0x2d, 0xa8, 0x2a, 0x34, 0xe3, 0x0d, 0xe8, 0xfb, 0x2e, 0x25,
-                0x6b, 0xef, 0xd9, 0x2d, 0xd3, 0x0e, 0xf7, 0x86, 0x85, 0xa5, 0x08, 0xe4, 0x41, 0x0c,
-                0x79, 0x33, 0x6f, 0x0a, 0xf1, 0xb2, 0x64, 0x84, 0x82, 0x33, 0x59, 0x24, 0x78, 0xd2,
-                0x2d, 0xf7, 0x91, 0xab, 0x8d, 0x4c, 0x7d, 0x32, 0x3c, 0xd8, 0x4d, 0x6b, 0x2e, 0x4d,
-                0xcf, 0x66, 0x49, 0x5b, 0x46, 0xc5, 0x31, 0xa3, 0x21, 0x67, 0x66, 0xfc, 0x8b, 0x6f,
-                0x65, 0xfe, 0x57, 0x6c, 0x44, 0xef, 0x88, 0xc4, 0x44, 0xfa, 0x95, 0x7f, 0xbd, 0x87,
-                0xaf, 0x7a, 0x30, 0xf5, 0x2b, 0xd3, 0xf2, 0x33, 0x8c, 0xbb, 0x0b, 0x7e, 0xe6, 0x68,
-                0x5c, 0x51, 0xec, 0xef, 0xb5, 0xfd, 0x17, 0xd7, 0x53, 0x0b, 0xb6, 0x14, 0x52, 0x28,
-                0xbb, 0x97, 0x6a, 0x56, 0xa1, 0xc9, 0xb2, 0xc8, 0xd2, 0x86, 0x4c, 0x43, 0xd3, 0xcd,
-                0x64, 0x0b, 0xd7, 0xe0, 0x1f, 0x08, 0xaa, 0xc4, 0x16, 0xd2, 0x25, 0x0d, 0xf7, 0xf4,
-                0xb1, 0xb9, 0xeb, 0xd9, 0xbd, 0x10, 0x3f, 0xd4, 0x17, 0xfd, 0xbe, 0x57, 0x13, 0x2e,
-                0xab, 0xfc, 0x52, 0xc3, 0x79, 0x8e, 0x98, 0xc3, 0x7c, 0x1a, 0xf3, 0x4d, 0x28, 0x91,
-                0x2c, 0x1d, 0x11, 0x64, 0xb5, 0x27, 0x71, 0x07, 0xc4, 0x7d, 0x6b, 0xd5, 0xf3, 0xc0,
-                0xb3, 0x0f, 0x4e, 0xfa, 0xb7, 0xef, 0x04, 0x15, 0x8e, 0x11, 0x9d, 0x7c, 0x40, 0x79,
-                0x4a, 0xb0, 0xd4, 0x23, 0x19, 0x49, 0xe7, 0xf8, 0x0f, 0x43, 0xd7, 0x63, 0x64, 0x56,
-                0xfe, 0xe2, 0xe1, 0x27, 0x2e, 0xa1, 0xe2, 0xec, 0x3e, 0x8f, 0xf3, 0x06, 0x98, 0xb8,
-                0x32, 0x64, 0x71, 0xeb, 0xa9, 0x40, 0x95, 0x0d, 0x55, 0x83, 0x62, 0x4d, 0xfd, 0xab,
-                0xe8, 0x7d, 0x7c, 0x52, 0xa4, 0xd0, 0x0e, 0xf2, 0x00, 0x42, 0x38, 0x1c, 0x9e, 0x6f,
-                0x03, 0xd3, 0x29, 0xbb, 0xf4, 0x20, 0x43, 0xf2, 0xf3, 0xb4, 0xfd, 0x77, 0x54, 0x16,
-                0x32, 0x40, 0x2e, 0x06, 0x11, 0xb2, 0x44, 0xb0, 0xc2, 0x80, 0x3c, 0xd5, 0x12, 0x50,
-                0x81, 0x4c, 0xff, 0xdd, 0x7e, 0xeb, 0x17, 0x35, 0xbe, 0xba, 0x8e, 0xa8, 0xa5, 0x8e,
-                0xbc, 0xc3, 0x23, 0xf4, 0x24, 0xfc, 0xd5, 0xa7, 0x3d, 0xcc, 0xa2, 0xf5, 0x06, 0xfc,
-                0xa4, 0x03, 0x19, 0x9f, 0x0c, 0xc7, 0xb1, 0xe9, 0x7b, 0x92, 0x0b, 0xa2, 0x72, 0x35,
-                0xcd, 0x39, 0xe5, 0x27, 0x38, 0x2b, 0xad, 0x3a, 0x48, 0x3b, 0x9f, 0x1e, 0xbb, 0xf2,
-                0x91, 0x77, 0xae, 0x94, 0xd8, 0xfa, 0x63, 0xbe, 0xeb, 0x45, 0x6d, 0x12, 0x78, 0xb9,
-                0xd2, 0x28, 0x59, 0x44, 0x31, 0x99, 0x04, 0xdd, 0xe4, 0x2a, 0xdc, 0x70, 0x62, 0xb5,
-                0x50, 0xb1, 0xff, 0x47, 0xb7, 0x0d, 0x3c, 0x78, 0xc2, 0x4c, 0x55, 0x06, 0x9f, 0x72,
-                0x0f, 0xea, 0x60, 0x23, 0xf2, 0x19, 0x4a, 0x72, 0x91, 0xff, 0xb8, 0x11, 0xf6, 0x8a,
-                0x16, 0xd6, 0xc1, 0x15, 0xf4, 0xd8, 0xc6, 0x85, 0xe0, 0x9a, 0x44, 0xda, 0x84, 0x11,
-                0xe1, 0xb9, 0xb5, 0x3f, 0x39, 0xd5, 0x18, 0x46, 0x14, 0x7d, 0xdb, 0x62, 0x08, 0x98,
-                0xe0, 0x80, 0xb7, 0xa6, 0x5f, 0xe8, 0xe2, 0xe1, 0x31, 0x2b, 0x0b, 0x81, 0x52, 0x13,
-                0x8a, 0x8b, 0xa9, 0xe0, 0x86, 0x67, 0x90, 0x57, 0x17, 0x9f, 0xf0, 0x9f, 0x7b, 0x3c,
-                0xbf, 0x58, 0xbf, 0x59, 0xe3, 0x3f, 0x83, 0xde, 0x2c, 0x70, 0x35, 0x0a, 0xb5, 0x7c,
-                0x82, 0xbe, 0x9e, 0xc9, 0x5c, 0xcc, 0x95, 0xe2, 0xbe, 0x29, 0x4e, 0xc5, 0x38, 0x3f,
-                0xa3, 0xbb, 0xd7, 0xa7, 0x59, 0x31, 0x5c, 0xc2, 0x5d, 0xea, 0x38, 0x53, 0xe7, 0xb5,
-                0x36, 0x6b, 0xaa, 0xe0, 0x5a, 0xca, 0x8b, 0xc9, 0x56, 0xf1, 0xd5, 0xbd, 0xdc, 0xbd,
-                0xa2, 0x95, 0xa5, 0xca, 0x7c, 0x2e, 0x26, 0xfb, 0x4e, 0x26, 0xf7, 0xeb, 0xdf, 0x62,
-                0x44, 0xb7, 0x8a, 0x59, 0x1e, 0xfa, 0xa3, 0xa6, 0xf4, 0x8c, 0xc4, 0x10, 0x59, 0x78,
-                0xc9, 0x68, 0xdd, 0x85, 0x88, 0x79, 0x5a, 0x9a, 0x65, 0x71, 0x17, 0x93, 0xf1, 0x98,
-                0x04, 0xf8, 0x81, 0x4b, 0x4a, 0x9d, 0xb0, 0xbf, 0xa1, 0x57, 0x76, 0x9a, 0xaf, 0xda,
-                0x2d, 0xb0, 0xee, 0xf0, 0x2b, 0x9a, 0x81, 0x16, 0x3b, 0x7c, 0x23, 0x56, 0x97, 0x62,
-                0x0c, 0x72, 0xd8, 0x24, 0xe3, 0x2b,
-            ],
-            ock: [
-                0x24, 0x11, 0xa0, 0xf9, 0x31, 0xa8, 0xd3, 0x51, 0x6c, 0xdb, 0x71, 0x93, 0xc9, 0x41,
-                0xcf, 0x0e, 0x49, 0xc3, 0x66, 0xae, 0x72, 0xc9, 0x79, 0xc4, 0x90, 0x49, 0xc9, 0x4b,
-                0xd3, 0xc7, 0x5c, 0xf4,
-            ],
-            _op: [
-                0x66, 0x14, 0x17, 0x39, 0x51, 0x4b, 0x28, 0xf0, 0x5d, 0xef, 0x8a, 0x18, 0xee, 0xee,
-                0x5e, 0xed, 0x4d, 0x44, 0xc6, 0x22, 0x5c, 0x3c, 0x65, 0xd8, 0x8d, 0xd9, 0x90, 0x77,
-                0x08, 0x01, 0x2f, 0x5a, 0x99, 0xaa, 0x10, 0xc0, 0x57, 0x88, 0x08, 0x1c, 0x0d, 0xa7,
-                0xd8, 0x79, 0xcd, 0x95, 0x43, 0xec, 0x18, 0x92, 0x15, 0x72, 0x92, 0x40, 0x2e, 0x96,
-                0x0b, 0x06, 0x99, 0x5a, 0x08, 0x96, 0x4c, 0x03,
-            ],
-            c_out: [
-                0x9d, 0xcf, 0xab, 0x0d, 0x20, 0x54, 0xd2, 0xbd, 0xf4, 0x06, 0xc3, 0x1b, 0x41, 0x78,
-                0x46, 0x5d, 0xe6, 0x50, 0x5d, 0xb3, 0xbe, 0x9b, 0x69, 0x36, 0xf7, 0x8d, 0x2e, 0x29,
-                0x37, 0x57, 0x9b, 0x58, 0x2e, 0x83, 0x28, 0x61, 0x92, 0x9a, 0x75, 0x17, 0x88, 0x04,
-                0xb6, 0x57, 0x12, 0x6a, 0xdd, 0x74, 0x2e, 0x06, 0xcb, 0x84, 0x36, 0x86, 0x42, 0xdb,
-                0x9b, 0xf4, 0x7a, 0xc6, 0xe4, 0xdc, 0x1a, 0xf1, 0x78, 0x19, 0x8b, 0x22, 0xd6, 0x26,
-                0x23, 0x45, 0x37, 0x3b, 0x0f, 0x56, 0x2e, 0xf2, 0x7b, 0xb0,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0x14, 0x76, 0x78, 0xe0, 0x55, 0x3b, 0x97, 0x82, 0x93, 0x47, 0x64, 0x7c, 0x5b, 0xc7,
-                0xda, 0xb4, 0xcc, 0x22, 0x02, 0xb5, 0x4e, 0xc2, 0x9f, 0xd3, 0x1a, 0x3d, 0xe6, 0xbe,
-                0x08, 0x25, 0xfc, 0x5e,
-            ],
-            ivk: [
-                0x63, 0x6a, 0xa9, 0x64, 0xbf, 0xc2, 0x3c, 0xe4, 0xb1, 0xfc, 0xf7, 0xdf, 0xc9, 0x91,
-                0x79, 0xdd, 0xc4, 0x06, 0xff, 0x55, 0x40, 0x0c, 0x92, 0x95, 0xac, 0xfc, 0x14, 0xf0,
-                0x31, 0xc7, 0x26, 0x00,
-            ],
-            default_d: [
-                0x1b, 0x81, 0x61, 0x4f, 0x1d, 0xad, 0xea, 0x0f, 0x8d, 0x0a, 0x58,
-            ],
-            default_pk_d: [
-                0x25, 0xeb, 0x55, 0xfc, 0xcf, 0x76, 0x1f, 0xc6, 0x4e, 0x85, 0xa5, 0x88, 0xef, 0xe6,
-                0xea, 0xd7, 0x83, 0x2f, 0xb1, 0xf0, 0xf7, 0xa8, 0x31, 0x65, 0x89, 0x5b, 0xdf, 0xf9,
-                0x42, 0x92, 0x5f, 0x5c,
-            ],
-            v: 400000000,
-            rcm: [
-                0x34, 0xa4, 0xb2, 0xa9, 0x14, 0x4f, 0xf5, 0xea, 0x54, 0xef, 0xee, 0x87, 0xcf, 0x90,
-                0x1b, 0x5b, 0xed, 0x5e, 0x35, 0xd2, 0x1f, 0xbb, 0xd7, 0x88, 0xd5, 0xbd, 0x9d, 0x83,
-                0x3e, 0x11, 0x28, 0x04,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x6d, 0x6e, 0xf8, 0xce, 0x97, 0x92, 0x74, 0x09, 0x4f, 0x19, 0x1a, 0xef, 0x64, 0x3f,
-                0x3f, 0xcb, 0xd1, 0xac, 0x9d, 0x98, 0xd6, 0x07, 0xe2, 0xbc, 0xfe, 0xf6, 0xfd, 0x51,
-                0xba, 0x4b, 0xb4, 0xb9,
-            ],
-            cmu: [
-                0x51, 0xfd, 0xdd, 0x70, 0x8c, 0xd1, 0x51, 0xd3, 0xca, 0x47, 0x17, 0xe3, 0xc9, 0x9e,
-                0xeb, 0x8f, 0x64, 0xf1, 0x04, 0x49, 0x5f, 0x26, 0xde, 0x05, 0x7b, 0x68, 0x10, 0x63,
-                0xb9, 0xc9, 0x78, 0x2d,
-            ],
-            esk: [
-                0xbd, 0xde, 0x13, 0x81, 0xec, 0x9f, 0xf4, 0x21, 0xca, 0xfd, 0x1e, 0x31, 0xcc, 0x5d,
-                0xe2, 0x55, 0x59, 0x88, 0x1f, 0x6b, 0x21, 0xb2, 0x17, 0x5d, 0x0d, 0xce, 0x94, 0x08,
-                0x59, 0x7e, 0xa1, 0x03,
-            ],
-            epk: [
-                0x04, 0xa1, 0x0a, 0x3e, 0xa0, 0xe4, 0xb1, 0xa1, 0xd1, 0x3a, 0x67, 0xbc, 0xb2, 0x7d,
-                0xe6, 0x34, 0xe1, 0x94, 0xb2, 0x08, 0x01, 0x62, 0x61, 0x9f, 0xbc, 0xa7, 0x66, 0x2d,
-                0x42, 0xb8, 0xa5, 0x5f,
-            ],
-            shared_secret: [
-                0xdd, 0x88, 0x05, 0x9f, 0xd9, 0x05, 0x90, 0x13, 0xf2, 0xb9, 0xfa, 0xa2, 0x3a, 0x6b,
-                0xa1, 0x49, 0xb2, 0xff, 0x0e, 0x37, 0x79, 0x3a, 0x3e, 0x8d, 0x92, 0x70, 0xff, 0x71,
-                0x67, 0xfd, 0x7a, 0x8d,
-            ],
-            k_enc: [
-                0xab, 0xa4, 0xd4, 0xa5, 0xb5, 0x1a, 0x8b, 0xf5, 0x2e, 0x29, 0xd6, 0x80, 0x3a, 0xb9,
-                0x33, 0x0c, 0xf9, 0xc8, 0x2b, 0x1e, 0xb1, 0xfe, 0xe6, 0xa1, 0xa5, 0x54, 0x4a, 0x82,
-                0xc7, 0xb3, 0x16, 0x82,
-            ],
-            _p_enc: [
-                0x01, 0x1b, 0x81, 0x61, 0x4f, 0x1d, 0xad, 0xea, 0x0f, 0x8d, 0x0a, 0x58, 0x00, 0x84,
-                0xd7, 0x17, 0x00, 0x00, 0x00, 0x00, 0x34, 0xa4, 0xb2, 0xa9, 0x14, 0x4f, 0xf5, 0xea,
-                0x54, 0xef, 0xee, 0x87, 0xcf, 0x90, 0x1b, 0x5b, 0xed, 0x5e, 0x35, 0xd2, 0x1f, 0xbb,
-                0xd7, 0x88, 0xd5, 0xbd, 0x9d, 0x83, 0x3e, 0x11, 0x28, 0x04, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x9d, 0xb8, 0xb2, 0x4a, 0x05, 0x6f, 0x99, 0x6d, 0x39, 0x2d, 0x4d, 0x96, 0x3e, 0xa3,
-                0x89, 0x76, 0xd0, 0xf3, 0x5e, 0x85, 0xd8, 0xaa, 0x84, 0x7a, 0x08, 0x96, 0x16, 0x4e,
-                0x39, 0xd8, 0x69, 0x7a, 0xe1, 0x80, 0xc4, 0xdc, 0xc1, 0x70, 0x61, 0xd5, 0xf3, 0x99,
-                0xe0, 0xac, 0x4e, 0xcb, 0x5f, 0x02, 0xd4, 0xd9, 0xa3, 0xca, 0x5b, 0x33, 0x51, 0x8c,
-                0x58, 0xb1, 0xa0, 0x73, 0xbc, 0xa7, 0xee, 0x67, 0x41, 0x01, 0x03, 0x05, 0xdb, 0xb8,
-                0xc7, 0x38, 0x38, 0x35, 0xb9, 0xc7, 0x80, 0xa9, 0x42, 0x78, 0x5c, 0x57, 0xa3, 0x09,
-                0x8a, 0x81, 0xae, 0xf5, 0xd7, 0x06, 0x1f, 0xda, 0xba, 0xcf, 0x52, 0x72, 0x15, 0x30,
-                0xef, 0x32, 0xdf, 0xfc, 0x01, 0x10, 0x19, 0xeb, 0xd3, 0x60, 0x97, 0xe8, 0x4d, 0xf2,
-                0x03, 0x63, 0xcf, 0x18, 0x22, 0xb1, 0x15, 0x0c, 0x24, 0x73, 0x58, 0x2b, 0x01, 0xf8,
-                0xd8, 0x67, 0x99, 0xc1, 0x73, 0xf7, 0xfe, 0xf8, 0xca, 0x93, 0x8e, 0x4c, 0xde, 0x71,
-                0x85, 0xa1, 0x9d, 0x70, 0xad, 0x38, 0x61, 0x47, 0x9e, 0x7d, 0x43, 0x81, 0x0d, 0xc5,
-                0x64, 0x24, 0x71, 0x03, 0x33, 0x49, 0x28, 0x6b, 0xaf, 0x71, 0x4f, 0x7f, 0xdc, 0x22,
-                0xb3, 0x81, 0xd9, 0xe3, 0xad, 0xf3, 0xbc, 0x10, 0x49, 0x87, 0x8e, 0x18, 0x6d, 0x53,
-                0x2d, 0x8c, 0x98, 0x70, 0xf6, 0x01, 0x80, 0xd6, 0x54, 0x72, 0x45, 0x5d, 0x22, 0xd2,
-                0x59, 0x24, 0xb9, 0x92, 0xc0, 0x2f, 0x94, 0xea, 0x6e, 0xaf, 0x75, 0xb9, 0xdc, 0x88,
-                0x3d, 0xe7, 0x37, 0x6d, 0xa6, 0x01, 0x8e, 0x55, 0x45, 0x1e, 0x23, 0xf2, 0x38, 0xe1,
-                0x09, 0xa6, 0x40, 0x07, 0x89, 0xf9, 0x30, 0x52, 0x57, 0x9b, 0xbb, 0x18, 0x40, 0x19,
-                0xf3, 0x09, 0xb3, 0xd0, 0x6d, 0x07, 0x67, 0xa1, 0x07, 0xe4, 0xb7, 0x9a, 0x2b, 0xfc,
-                0x84, 0x25, 0xd8, 0xb0, 0x70, 0x62, 0x7f, 0x2d, 0x55, 0xc9, 0xa2, 0x6b, 0x22, 0x82,
-                0x3a, 0x21, 0xe1, 0xca, 0xf6, 0xfb, 0xc2, 0xa5, 0x7d, 0xce, 0x78, 0x4b, 0x25, 0x30,
-                0x34, 0x5a, 0x5f, 0x8b, 0x0c, 0xea, 0x3f, 0xce, 0x3b, 0x7f, 0xf4, 0xf5, 0xbb, 0x88,
-                0x4f, 0x68, 0xb7, 0xd1, 0x36, 0x06, 0x92, 0x33, 0xad, 0xe4, 0xd6, 0xbd, 0xda, 0xf3,
-                0x40, 0xde, 0xe1, 0x43, 0x72, 0x33, 0x2e, 0xc3, 0x76, 0xf5, 0x93, 0x5d, 0x62, 0x79,
-                0xc3, 0x74, 0x91, 0x1d, 0x95, 0x40, 0xfa, 0xcc, 0x75, 0x11, 0x5b, 0x20, 0xc5, 0x53,
-                0x32, 0x9b, 0x43, 0xee, 0x57, 0xa8, 0xbb, 0x58, 0xa3, 0xf7, 0x46, 0x06, 0xa7, 0xf3,
-                0xfa, 0x87, 0xe4, 0x6a, 0xaf, 0x72, 0xad, 0xae, 0x90, 0x48, 0xb9, 0x43, 0xe4, 0x64,
-                0x89, 0x85, 0xad, 0xaa, 0x99, 0x0d, 0x78, 0x20, 0xfb, 0xb2, 0xb1, 0x24, 0x65, 0xa1,
-                0x61, 0x7d, 0x01, 0xca, 0xf4, 0x14, 0x36, 0xa4, 0x94, 0x6e, 0xa0, 0x95, 0x96, 0x23,
-                0x96, 0x40, 0xdc, 0x95, 0xe5, 0x86, 0x81, 0x9e, 0x6c, 0x00, 0x69, 0xee, 0xe0, 0x7a,
-                0x72, 0x42, 0xb9, 0x4a, 0xfd, 0x69, 0xce, 0x35, 0x43, 0xb8, 0x87, 0x7b, 0x31, 0x94,
-                0xcd, 0xb9, 0xe7, 0x07, 0xc0, 0x83, 0x8b, 0x15, 0x43, 0x46, 0x03, 0x57, 0x50, 0x46,
-                0x35, 0x2c, 0x1b, 0xf4, 0xcf, 0xc2, 0x7f, 0x4e, 0xdf, 0x61, 0x91, 0xd8, 0xec, 0xf5,
-                0x52, 0xb8, 0xf6, 0x98, 0x70, 0x2d, 0x3a, 0x8f, 0x6f, 0xda, 0x58, 0xb5, 0xcf, 0x16,
-                0x1f, 0xed, 0x6e, 0x6f, 0xdb, 0x14, 0x9a, 0x79, 0xdb, 0x0a, 0x6b, 0x02, 0xc3, 0x27,
-                0xe9, 0x62, 0x9c, 0x94, 0x8f, 0x66, 0x5d, 0x13, 0x28, 0x3f, 0x65, 0xe5, 0x4b, 0xe5,
-                0x5a, 0xc1, 0xae, 0x82, 0x75, 0x35, 0xff, 0x7a, 0xc1, 0x43, 0xcc, 0x72, 0xd9, 0x2b,
-                0xc4, 0xf4, 0x6e, 0xf4, 0xad, 0x88, 0xc7, 0x66, 0xab, 0x4b, 0xff, 0x1e, 0x1d, 0x11,
-                0x5c, 0x85, 0x1e, 0x59, 0x85, 0x41, 0x10, 0x5d, 0x6e, 0xbb, 0x36, 0x7c, 0xe0, 0x54,
-                0x93, 0x20, 0xa2, 0x30, 0x83, 0x53, 0x11, 0x47, 0x8b, 0xdd, 0x9f, 0x6c, 0x53, 0x85,
-                0x03, 0xf3, 0x62, 0xe5, 0xf6, 0xc2, 0x7d, 0x15, 0xb5, 0x6c, 0x41, 0x43, 0xd4, 0x57,
-                0x69, 0xc2, 0x54, 0x6e, 0x53, 0xfb, 0x45, 0x01, 0xf9, 0xba, 0x5e, 0xd4, 0x55, 0xd2,
-                0x49, 0x86, 0xb4, 0xdf, 0xf7, 0xcd,
-            ],
-            ock: [
-                0xf6, 0xbd, 0x5d, 0x10, 0x80, 0xfc, 0xa6, 0x46, 0x00, 0xee, 0x92, 0x17, 0xb0, 0x9e,
-                0xf1, 0x98, 0x4c, 0x9a, 0x8b, 0x98, 0xe0, 0x6e, 0xe5, 0xd8, 0x36, 0xce, 0x0e, 0x6c,
-                0x89, 0xab, 0x56, 0xfd,
-            ],
-            _op: [
-                0x25, 0xeb, 0x55, 0xfc, 0xcf, 0x76, 0x1f, 0xc6, 0x4e, 0x85, 0xa5, 0x88, 0xef, 0xe6,
-                0xea, 0xd7, 0x83, 0x2f, 0xb1, 0xf0, 0xf7, 0xa8, 0x31, 0x65, 0x89, 0x5b, 0xdf, 0xf9,
-                0x42, 0x92, 0x5f, 0x5c, 0xbd, 0xde, 0x13, 0x81, 0xec, 0x9f, 0xf4, 0x21, 0xca, 0xfd,
-                0x1e, 0x31, 0xcc, 0x5d, 0xe2, 0x55, 0x59, 0x88, 0x1f, 0x6b, 0x21, 0xb2, 0x17, 0x5d,
-                0x0d, 0xce, 0x94, 0x08, 0x59, 0x7e, 0xa1, 0x03,
-            ],
-            c_out: [
-                0x25, 0x4f, 0x12, 0x2c, 0xfe, 0x94, 0x98, 0xad, 0xd7, 0x57, 0xcf, 0x0b, 0x61, 0x0d,
-                0xa8, 0xcb, 0xae, 0xda, 0x05, 0x3e, 0x26, 0xcb, 0x72, 0x30, 0x6f, 0x36, 0x23, 0x08,
-                0x55, 0x28, 0x53, 0xff, 0x02, 0x3c, 0x23, 0xc2, 0x6f, 0x3a, 0xb4, 0x41, 0xb8, 0x1e,
-                0xa2, 0x5c, 0xe0, 0xae, 0x57, 0xd1, 0xa9, 0x49, 0x83, 0xbb, 0x45, 0xab, 0x8a, 0x86,
-                0xda, 0x68, 0xef, 0x63, 0xf1, 0x58, 0x16, 0xc1, 0x43, 0x32, 0x7a, 0x1e, 0x46, 0x0c,
-                0x51, 0x0c, 0x63, 0x1c, 0xc6, 0x9f, 0x39, 0x60, 0xfb, 0x5a,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0x1b, 0x6e, 0x75, 0xec, 0xe3, 0xac, 0xe8, 0xdb, 0xa6, 0xa5, 0x41, 0x0d, 0x9a, 0xd4,
-                0x75, 0x56, 0x68, 0xe4, 0xb3, 0x95, 0x85, 0xd6, 0x35, 0xec, 0x1d, 0xa7, 0xc8, 0xdc,
-                0xfd, 0x5f, 0xc4, 0xed,
-            ],
-            ivk: [
-                0x67, 0xfa, 0x2b, 0xf7, 0xc6, 0x7d, 0x46, 0x58, 0x24, 0x3c, 0x31, 0x7c, 0x0c, 0xb4,
-                0x1f, 0xd3, 0x20, 0x64, 0xdf, 0xd3, 0x70, 0x9f, 0xe0, 0xdc, 0xb7, 0x24, 0xf1, 0x4b,
-                0xb0, 0x1a, 0x1d, 0x04,
-            ],
-            default_d: [
-                0xfc, 0xfb, 0x68, 0xa4, 0x0d, 0x4b, 0xc6, 0xa0, 0x4b, 0x09, 0xc4,
-            ],
-            default_pk_d: [
-                0x8b, 0x2a, 0x33, 0x7f, 0x03, 0x62, 0x2c, 0x24, 0xff, 0x38, 0x1d, 0x4c, 0x54, 0x6f,
-                0x69, 0x77, 0xf9, 0x05, 0x22, 0xe9, 0x2f, 0xde, 0x44, 0xc9, 0xd1, 0xbb, 0x09, 0x97,
-                0x14, 0xb9, 0xdb, 0x2b,
-            ],
-            v: 500000000,
-            rcm: [
-                0xe5, 0x57, 0x85, 0x13, 0x55, 0x74, 0x7c, 0x09, 0xac, 0x59, 0x01, 0x3c, 0xbd, 0xe8,
-                0x59, 0x80, 0x96, 0x4e, 0xc1, 0x84, 0x4d, 0x9c, 0x69, 0x67, 0xca, 0x0c, 0x02, 0x9c,
-                0x84, 0x57, 0xbb, 0x04,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0xce, 0x42, 0xf9, 0xd0, 0x89, 0xba, 0x9d, 0x9e, 0x62, 0xe3, 0xf6, 0x56, 0x33, 0x62,
-                0xf0, 0xfd, 0xc7, 0xce, 0xde, 0x8a, 0xb3, 0x59, 0x43, 0x9e, 0x21, 0x4e, 0x26, 0x52,
-                0xdb, 0xf0, 0x5a, 0x0c,
-            ],
-            cmu: [
-                0xc2, 0xb5, 0xf3, 0x57, 0x11, 0x7a, 0x40, 0x03, 0x62, 0x9e, 0x05, 0xca, 0x6f, 0x56,
-                0xa6, 0x23, 0xa3, 0xc4, 0x8a, 0xa5, 0xeb, 0x79, 0x7c, 0xdd, 0x32, 0x2d, 0x48, 0x57,
-                0xa0, 0xfb, 0xa4, 0x4e,
-            ],
-            esk: [
-                0x3d, 0xc1, 0x66, 0xd5, 0x6a, 0x1d, 0x62, 0xf5, 0xa8, 0xd7, 0x55, 0x1d, 0xb5, 0xfd,
-                0x93, 0x13, 0xe8, 0xc7, 0x20, 0x3d, 0x99, 0x6a, 0xf7, 0xd4, 0x77, 0x08, 0x37, 0x56,
-                0xd5, 0x9a, 0xf8, 0x0d,
-            ],
-            epk: [
-                0x5b, 0x54, 0xe5, 0xd4, 0x13, 0xa8, 0x07, 0xdf, 0x36, 0x42, 0x6d, 0x5c, 0x8c, 0x09,
-                0x81, 0x0a, 0xc2, 0x45, 0x95, 0xb1, 0x52, 0xcd, 0x89, 0x41, 0xa2, 0x34, 0x3c, 0x96,
-                0x30, 0x3d, 0x24, 0x6b,
-            ],
-            shared_secret: [
-                0x40, 0x64, 0xc2, 0xb7, 0xc1, 0x82, 0xd1, 0x80, 0x52, 0x50, 0xd3, 0x59, 0xfb, 0xa1,
-                0xa5, 0x32, 0x54, 0x56, 0xb0, 0x12, 0x94, 0x4d, 0x7d, 0x92, 0x9f, 0x40, 0x9c, 0x6d,
-                0xe5, 0x70, 0x5d, 0xc5,
-            ],
-            k_enc: [
-                0xc5, 0xfc, 0xf8, 0x13, 0xb1, 0xbb, 0xef, 0x20, 0xa6, 0x2a, 0xce, 0x7a, 0x47, 0xf3,
-                0x7f, 0x26, 0x1f, 0xbb, 0x2d, 0xfa, 0xd8, 0x88, 0x66, 0xb4, 0x32, 0xff, 0x0d, 0xfa,
-                0xee, 0xc5, 0xb2, 0xcf,
-            ],
-            _p_enc: [
-                0x01, 0xfc, 0xfb, 0x68, 0xa4, 0x0d, 0x4b, 0xc6, 0xa0, 0x4b, 0x09, 0xc4, 0x00, 0x65,
-                0xcd, 0x1d, 0x00, 0x00, 0x00, 0x00, 0xe5, 0x57, 0x85, 0x13, 0x55, 0x74, 0x7c, 0x09,
-                0xac, 0x59, 0x01, 0x3c, 0xbd, 0xe8, 0x59, 0x80, 0x96, 0x4e, 0xc1, 0x84, 0x4d, 0x9c,
-                0x69, 0x67, 0xca, 0x0c, 0x02, 0x9c, 0x84, 0x57, 0xbb, 0x04, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0xd7, 0xe7, 0x06, 0x31, 0x7c, 0x78, 0x95, 0x06, 0x2d, 0x89, 0xab, 0x5f, 0x10, 0x52,
-                0x15, 0x5a, 0xc3, 0xd2, 0xa1, 0xe3, 0x43, 0x97, 0x3e, 0x5a, 0xab, 0x1c, 0xce, 0x53,
-                0x59, 0xc6, 0xbc, 0x11, 0x1b, 0x9a, 0x7b, 0xb6, 0x68, 0xb6, 0xc7, 0xd0, 0x21, 0xb1,
-                0x23, 0x35, 0x77, 0xe8, 0x2b, 0xaf, 0x33, 0x00, 0x5c, 0xd0, 0x34, 0xa9, 0x75, 0x4b,
-                0x1e, 0x12, 0xdf, 0x03, 0x6b, 0x7b, 0xc7, 0x82, 0x98, 0x79, 0xca, 0x8c, 0x6b, 0x54,
-                0x37, 0x8f, 0xcd, 0x5f, 0x18, 0x2f, 0x65, 0x16, 0x0e, 0xa7, 0x24, 0x3b, 0x7d, 0xfc,
-                0xac, 0xfb, 0x6d, 0xac, 0xee, 0x02, 0x26, 0x34, 0x14, 0x9d, 0x8f, 0xb2, 0xf0, 0xca,
-                0x51, 0xa8, 0x26, 0x72, 0xa5, 0x63, 0xd5, 0x36, 0xba, 0xf1, 0xaf, 0x88, 0x1a, 0x7a,
-                0x8d, 0x25, 0xc5, 0xcf, 0x78, 0x61, 0x89, 0x53, 0x03, 0x2e, 0xf5, 0x65, 0xb0, 0xf3,
-                0x98, 0xe3, 0x4b, 0xee, 0x2c, 0x30, 0x95, 0xa7, 0xbd, 0x0b, 0x7d, 0x09, 0x7a, 0x3d,
-                0x26, 0x4d, 0x65, 0x46, 0xd0, 0x0c, 0x85, 0x83, 0x04, 0x43, 0x78, 0xd1, 0x48, 0x94,
-                0x04, 0xa3, 0x1e, 0xec, 0xa8, 0x8f, 0x8f, 0x42, 0xeb, 0xfb, 0x82, 0x18, 0xd4, 0x9f,
-                0xde, 0xd8, 0x2a, 0x9b, 0xa6, 0x23, 0x2c, 0xcc, 0x47, 0x94, 0x5d, 0x6f, 0x7d, 0x6e,
-                0x39, 0xe0, 0xe8, 0x39, 0x29, 0x34, 0x1a, 0xcf, 0x88, 0xdb, 0x5a, 0x27, 0x73, 0xdc,
-                0x55, 0x8a, 0x9d, 0xc1, 0x1d, 0xcd, 0xa1, 0xba, 0xb3, 0xcb, 0x21, 0xbf, 0x5c, 0x29,
-                0x51, 0x83, 0xbf, 0x9a, 0x93, 0xee, 0x02, 0x5e, 0xb4, 0x60, 0xf7, 0xd7, 0x41, 0x20,
-                0x42, 0xce, 0x5a, 0x84, 0x3a, 0x79, 0x0c, 0x3a, 0x94, 0xda, 0x2d, 0xb7, 0xf6, 0x12,
-                0x03, 0x2f, 0xbf, 0x56, 0x4e, 0xfc, 0xf2, 0x04, 0xaf, 0xed, 0x0f, 0xf2, 0xab, 0x2b,
-                0xc1, 0xb3, 0x77, 0xca, 0x41, 0x0f, 0x12, 0x7f, 0xaf, 0x98, 0x76, 0x62, 0x7f, 0xbd,
-                0xb2, 0x26, 0x2a, 0xe6, 0x56, 0x23, 0x08, 0x84, 0x48, 0x00, 0xb5, 0xcd, 0x52, 0x74,
-                0x3e, 0x7f, 0x7b, 0xca, 0xe3, 0xc7, 0xb2, 0x70, 0x34, 0xc5, 0xf2, 0x1d, 0x4f, 0xef,
-                0xb5, 0x9b, 0xd2, 0x3b, 0xc6, 0xea, 0x0c, 0x39, 0x39, 0x87, 0x1a, 0xb4, 0x34, 0xb3,
-                0xa5, 0xcb, 0x71, 0x03, 0x85, 0x1a, 0x24, 0x78, 0xc5, 0xf6, 0x13, 0x8f, 0x8f, 0xd9,
-                0x91, 0x3f, 0xa7, 0xaf, 0x5a, 0x4a, 0xa2, 0x0e, 0xf9, 0x59, 0x40, 0x84, 0x0b, 0xcd,
-                0x17, 0x4c, 0xa3, 0xe1, 0x06, 0x5a, 0xea, 0xee, 0x5f, 0x6c, 0x7d, 0x94, 0x34, 0x2c,
-                0x68, 0x5f, 0x13, 0xa8, 0x1e, 0x7b, 0x53, 0xad, 0x42, 0x89, 0x0b, 0xa8, 0x10, 0x3a,
-                0xc8, 0x34, 0xa4, 0xeb, 0x1f, 0x10, 0xb0, 0xa7, 0x0e, 0x76, 0x89, 0x1d, 0xbe, 0x18,
-                0xf5, 0x80, 0x47, 0x2f, 0x5b, 0xdc, 0x3f, 0xc9, 0x55, 0x0f, 0x15, 0x6b, 0x31, 0x21,
-                0xa8, 0x44, 0xd6, 0xc7, 0x7b, 0x22, 0x4b, 0x8d, 0x04, 0xf1, 0xfe, 0x8e, 0xa7, 0xb9,
-                0x88, 0xd8, 0x78, 0xbf, 0xc0, 0x6d, 0xac, 0x33, 0x2a, 0x10, 0x6a, 0x6e, 0xad, 0x47,
-                0xf8, 0x2b, 0xd8, 0xcb, 0x7c, 0x25, 0xae, 0x9e, 0x1d, 0x75, 0xbb, 0x76, 0x2a, 0xfe,
-                0xe3, 0x49, 0x30, 0xf4, 0xa9, 0x98, 0xf2, 0x68, 0xd8, 0x76, 0x3c, 0xae, 0x7b, 0x32,
-                0x15, 0x20, 0x5e, 0x58, 0x9c, 0x48, 0x11, 0x13, 0xb5, 0xa4, 0xcd, 0xb2, 0x09, 0xbe,
-                0xce, 0x2f, 0x09, 0x4f, 0x33, 0x9f, 0x03, 0xfb, 0x39, 0xa1, 0x6e, 0xf1, 0x67, 0x2e,
-                0x00, 0x89, 0x27, 0xfd, 0x97, 0x09, 0x8e, 0x00, 0x12, 0xbe, 0xca, 0xa0, 0x0f, 0x62,
-                0xc6, 0xbf, 0xd9, 0x45, 0xa0, 0x16, 0xbe, 0x8b, 0x18, 0x66, 0xd9, 0x2b, 0x1d, 0x85,
-                0x88, 0xae, 0x26, 0xc6, 0x35, 0x70, 0xd7, 0xe2, 0xa6, 0xb2, 0xee, 0x6e, 0xc2, 0xe6,
-                0xb0, 0xbe, 0x22, 0x19, 0x38, 0x0e, 0x4e, 0xea, 0x6a, 0xf0, 0x9b, 0xf5, 0x85, 0xf2,
-                0x85, 0x38, 0xd8, 0xb7, 0x89, 0x32, 0x6e, 0x6a, 0x3d, 0xe3, 0xbf, 0x45, 0x06, 0x80,
-                0x28, 0xac, 0x80, 0xb1, 0x92, 0x25, 0x5f, 0x27, 0x33, 0x64, 0xda, 0x88, 0xdc, 0x1a,
-                0x6f, 0x00, 0xe0, 0xcc, 0x32, 0xbb, 0x47, 0x5e, 0xcc, 0xbe, 0x09, 0x7a, 0x69, 0xf6,
-                0x49, 0x2b, 0xdb, 0xa2, 0xad, 0xf0,
-            ],
-            ock: [
-                0xf9, 0x8d, 0x6e, 0x55, 0xff, 0x78, 0x3a, 0x13, 0x13, 0x14, 0x0f, 0xb8, 0x8b, 0x7f,
-                0x3a, 0x4d, 0xb2, 0x81, 0x86, 0x37, 0x86, 0x88, 0xbe, 0xc6, 0x19, 0x56, 0x23, 0x2e,
-                0x42, 0xb7, 0x0a, 0xba,
-            ],
-            _op: [
-                0x8b, 0x2a, 0x33, 0x7f, 0x03, 0x62, 0x2c, 0x24, 0xff, 0x38, 0x1d, 0x4c, 0x54, 0x6f,
-                0x69, 0x77, 0xf9, 0x05, 0x22, 0xe9, 0x2f, 0xde, 0x44, 0xc9, 0xd1, 0xbb, 0x09, 0x97,
-                0x14, 0xb9, 0xdb, 0x2b, 0x3d, 0xc1, 0x66, 0xd5, 0x6a, 0x1d, 0x62, 0xf5, 0xa8, 0xd7,
-                0x55, 0x1d, 0xb5, 0xfd, 0x93, 0x13, 0xe8, 0xc7, 0x20, 0x3d, 0x99, 0x6a, 0xf7, 0xd4,
-                0x77, 0x08, 0x37, 0x56, 0xd5, 0x9a, 0xf8, 0x0d,
-            ],
-            c_out: [
-                0x3b, 0xfc, 0x13, 0x67, 0x3c, 0x24, 0xac, 0x5e, 0xaf, 0x0b, 0xc2, 0x44, 0x6c, 0x38,
-                0xa7, 0x92, 0xae, 0x42, 0xd9, 0x6b, 0xaf, 0x05, 0x53, 0xce, 0xe4, 0x36, 0xb6, 0x34,
-                0xb5, 0x73, 0x89, 0xb3, 0x62, 0x1d, 0xdb, 0xba, 0x22, 0xe6, 0x84, 0x89, 0x0a, 0x7b,
-                0x64, 0x5d, 0x63, 0xc4, 0xbc, 0x8c, 0x26, 0xdb, 0x54, 0x62, 0x8c, 0xef, 0x4d, 0xed,
-                0x98, 0x0f, 0x60, 0x8f, 0x00, 0x20, 0xbb, 0xb5, 0xa2, 0xf6, 0x55, 0x22, 0xa6, 0x1f,
-                0x89, 0xdf, 0x82, 0x18, 0x18, 0x67, 0x04, 0x01, 0x1e, 0x91,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0xc6, 0xbc, 0x1f, 0x39, 0xf0, 0xd7, 0x86, 0x31, 0x4c, 0xb2, 0x0b, 0xf9, 0xab, 0x22,
-                0x85, 0x40, 0x91, 0x35, 0x55, 0xf9, 0x70, 0x69, 0x6b, 0x6d, 0x7c, 0x77, 0xbb, 0x33,
-                0x23, 0x28, 0x37, 0x2a,
-            ],
-            ivk: [
-                0xea, 0x3f, 0x1d, 0x80, 0xe4, 0x30, 0x7c, 0xa7, 0x3b, 0x9f, 0x37, 0x80, 0x1f, 0x91,
-                0xfb, 0xa8, 0x10, 0xcc, 0x41, 0xd2, 0x79, 0xfc, 0x29, 0xf5, 0x64, 0x23, 0x56, 0x54,
-                0xa2, 0x17, 0x8e, 0x03,
-            ],
-            default_d: [
-                0xeb, 0x51, 0x98, 0x82, 0xad, 0x1e, 0x5c, 0xc6, 0x54, 0xcd, 0x59,
-            ],
-            default_pk_d: [
-                0x6b, 0x27, 0xda, 0xcc, 0xb5, 0xa8, 0x20, 0x7f, 0x53, 0x2d, 0x10, 0xca, 0x23, 0x8f,
-                0x97, 0x86, 0x64, 0x8a, 0x11, 0xb5, 0x96, 0x6e, 0x51, 0xa2, 0xf7, 0xd8, 0x9e, 0x15,
-                0xd2, 0x9b, 0x8f, 0xdf,
-            ],
-            v: 600000000,
-            rcm: [
-                0x68, 0xf0, 0x61, 0x04, 0x60, 0x6b, 0x0c, 0x54, 0x49, 0x84, 0x5f, 0xf4, 0xc6, 0x5f,
-                0x73, 0xe9, 0x0f, 0x45, 0xef, 0x5a, 0x43, 0xc9, 0xd7, 0x4c, 0xb2, 0xc8, 0x5c, 0xf5,
-                0x6c, 0x94, 0xc0, 0x02,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x30, 0x27, 0xd7, 0xb7, 0x47, 0x64, 0xca, 0xf7, 0x2b, 0x73, 0x87, 0x28, 0x9b, 0x12,
-                0x8f, 0x43, 0x9f, 0xd0, 0x42, 0xc2, 0x1d, 0x81, 0x36, 0x4b, 0xc2, 0xae, 0x7b, 0xd2,
-                0x9e, 0xab, 0x51, 0x23,
-            ],
-            cmu: [
-                0x38, 0x2c, 0x7d, 0x68, 0x8b, 0xdf, 0x34, 0xb9, 0x4d, 0x40, 0x1c, 0x41, 0x22, 0x79,
-                0x52, 0xa2, 0xb9, 0x31, 0xc5, 0x7b, 0x00, 0x5c, 0x82, 0xf2, 0xc3, 0x63, 0x15, 0xf6,
-                0x1c, 0x35, 0x02, 0x4e,
-            ],
-            esk: [
-                0x4e, 0x41, 0x8c, 0x3c, 0x54, 0x3d, 0x6b, 0xf0, 0x15, 0x31, 0x74, 0xa0, 0x4e, 0x85,
-                0x44, 0xae, 0x7c, 0x58, 0x09, 0x2a, 0x2e, 0x4e, 0x5d, 0x7d, 0x9c, 0x67, 0x2a, 0x3a,
-                0x79, 0x11, 0x09, 0x03,
-            ],
-            epk: [
-                0xe0, 0xc2, 0x9b, 0x43, 0x5d, 0xae, 0xdb, 0xc9, 0x8d, 0x46, 0x5f, 0x38, 0x9b, 0x1b,
-                0x60, 0xd7, 0xdf, 0xac, 0x0e, 0x45, 0x9b, 0x1e, 0x62, 0x8f, 0xa0, 0x18, 0x4e, 0x92,
-                0xf2, 0x64, 0x79, 0xca,
-            ],
-            shared_secret: [
-                0x34, 0xdd, 0x16, 0x13, 0xa8, 0x57, 0x75, 0x2a, 0xa9, 0x07, 0x26, 0xff, 0xf0, 0x7d,
-                0x42, 0x9d, 0xcb, 0x52, 0xd2, 0xca, 0x27, 0x7d, 0x84, 0xeb, 0x7a, 0x12, 0xfa, 0x9a,
-                0xfc, 0x99, 0xa7, 0x35,
-            ],
-            k_enc: [
-                0x03, 0x25, 0xb3, 0x12, 0x63, 0x58, 0x57, 0x3c, 0x09, 0x90, 0xa3, 0x62, 0xb8, 0xf2,
-                0x7c, 0xd0, 0x0c, 0xe0, 0xdc, 0x4b, 0x4d, 0x00, 0xcc, 0x8d, 0x8d, 0x3b, 0xa2, 0xce,
-                0x6e, 0xa9, 0xc2, 0x97,
-            ],
-            _p_enc: [
-                0x01, 0xeb, 0x51, 0x98, 0x82, 0xad, 0x1e, 0x5c, 0xc6, 0x54, 0xcd, 0x59, 0x00, 0x46,
-                0xc3, 0x23, 0x00, 0x00, 0x00, 0x00, 0x68, 0xf0, 0x61, 0x04, 0x60, 0x6b, 0x0c, 0x54,
-                0x49, 0x84, 0x5f, 0xf4, 0xc6, 0x5f, 0x73, 0xe9, 0x0f, 0x45, 0xef, 0x5a, 0x43, 0xc9,
-                0xd7, 0x4c, 0xb2, 0xc8, 0x5c, 0xf5, 0x6c, 0x94, 0xc0, 0x02, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x3f, 0x92, 0x6f, 0x4c, 0x93, 0xff, 0x12, 0x5b, 0xd1, 0xfa, 0x04, 0xc9, 0x1e, 0xf5,
-                0x9e, 0x07, 0x14, 0x33, 0xf5, 0x7c, 0x60, 0x6e, 0xe1, 0xbc, 0x91, 0x2d, 0x54, 0x62,
-                0x8d, 0x14, 0x07, 0x40, 0xa1, 0xab, 0x8a, 0x34, 0x51, 0x6a, 0xde, 0xfb, 0xe6, 0x48,
-                0x00, 0x7f, 0x86, 0xf1, 0x31, 0xf4, 0x99, 0x3b, 0x99, 0xae, 0xbd, 0x18, 0x99, 0x63,
-                0x48, 0xf4, 0xec, 0x85, 0x34, 0x1d, 0xf3, 0x35, 0x42, 0x2b, 0x12, 0x61, 0x8f, 0x63,
-                0xaa, 0x80, 0x4b, 0x30, 0x6c, 0x6c, 0x6b, 0x23, 0x7a, 0x0c, 0x04, 0x4f, 0x79, 0x03,
-                0x3d, 0x02, 0x8d, 0x13, 0xcf, 0x1f, 0x3d, 0x6e, 0x38, 0xac, 0xf3, 0x90, 0xf5, 0x54,
-                0xa8, 0xd4, 0xe4, 0x64, 0x94, 0x8f, 0xb5, 0xa7, 0xf9, 0x8d, 0x16, 0x1e, 0x3a, 0x8a,
-                0x15, 0x7a, 0xf4, 0xc8, 0x94, 0xca, 0x2d, 0xa4, 0x64, 0x7c, 0x53, 0x22, 0x35, 0x4f,
-                0x26, 0x19, 0xfd, 0x6c, 0xcc, 0x3c, 0xab, 0xef, 0x03, 0x71, 0xba, 0x42, 0x2f, 0x3d,
-                0x6d, 0x92, 0x16, 0x99, 0x6e, 0x49, 0xe6, 0x93, 0x87, 0x1c, 0x56, 0x3f, 0xfb, 0xf4,
-                0xc6, 0xd1, 0xd1, 0xc4, 0x73, 0x9f, 0x73, 0x26, 0xda, 0x4c, 0x66, 0x97, 0x61, 0x84,
-                0xf0, 0x13, 0x64, 0x96, 0x71, 0x2a, 0x7e, 0xed, 0x56, 0xea, 0x4c, 0xa1, 0xd0, 0x78,
-                0x4c, 0x7f, 0xa2, 0xc5, 0x56, 0xd6, 0xa9, 0x64, 0x0b, 0x55, 0x45, 0xd2, 0x14, 0x0a,
-                0xd7, 0x45, 0xf1, 0xfc, 0xda, 0xb6, 0xb1, 0xf9, 0xee, 0x59, 0x35, 0x6b, 0xed, 0x24,
-                0x93, 0x38, 0xa5, 0xc6, 0xc1, 0xc6, 0x37, 0xea, 0x9b, 0x77, 0x9b, 0x83, 0x11, 0xa5,
-                0x32, 0x3a, 0x15, 0xd6, 0x1f, 0x1a, 0x0f, 0xfc, 0x7b, 0x2f, 0xc9, 0xe0, 0xbe, 0x58,
-                0xc5, 0xfc, 0xbd, 0xbe, 0x57, 0xa2, 0xe4, 0xd3, 0xbf, 0x21, 0x84, 0x5b, 0x90, 0x16,
-                0x54, 0x1c, 0x8c, 0xb4, 0x4a, 0x59, 0xec, 0xa7, 0xf2, 0xb4, 0x18, 0x3b, 0xfb, 0xbc,
-                0xda, 0x57, 0xeb, 0x54, 0x24, 0xe8, 0x9d, 0xc3, 0xb0, 0x67, 0x14, 0xe2, 0x0e, 0xdf,
-                0x78, 0x46, 0xd6, 0x8a, 0x5f, 0x8a, 0x18, 0x4a, 0x7f, 0x7c, 0x5a, 0x08, 0xfc, 0xcc,
-                0x79, 0x84, 0x12, 0x2e, 0x8c, 0x63, 0x63, 0x03, 0xd0, 0x3b, 0x52, 0xb5, 0x1e, 0xc8,
-                0xcd, 0x97, 0x68, 0x88, 0x97, 0x6a, 0xc5, 0x9f, 0xe4, 0xeb, 0xda, 0x53, 0x95, 0x53,
-                0x8d, 0xbe, 0xa3, 0xd0, 0x09, 0x7b, 0xe5, 0x54, 0x6e, 0x1e, 0x0a, 0xb1, 0xba, 0x4c,
-                0xbb, 0x47, 0xf6, 0x20, 0x3d, 0xca, 0xb8, 0x4b, 0x12, 0x9c, 0x52, 0x99, 0xe3, 0xe9,
-                0x9d, 0x65, 0xeb, 0xcb, 0xe4, 0x0f, 0xd0, 0x5b, 0x87, 0x36, 0x9c, 0x30, 0xdb, 0x29,
-                0x38, 0x37, 0xdb, 0xd0, 0x4e, 0x7a, 0x71, 0x08, 0xab, 0x74, 0x4b, 0x4f, 0xb3, 0xda,
-                0x1f, 0x8a, 0x7d, 0x2c, 0xba, 0x6a, 0x5f, 0x01, 0x4f, 0x0d, 0x70, 0x5e, 0xce, 0x11,
-                0x9a, 0xe9, 0x80, 0xe9, 0x99, 0x3d, 0xa3, 0xdd, 0xaa, 0x3b, 0xf1, 0x89, 0x9a, 0x74,
-                0x74, 0xd6, 0x0b, 0x72, 0xed, 0x1e, 0x39, 0x0d, 0xfe, 0x4a, 0x3a, 0x07, 0x1a, 0xce,
-                0xfb, 0x02, 0xcc, 0xca, 0x0b, 0xa9, 0x39, 0x8c, 0x86, 0x1b, 0xed, 0x45, 0x21, 0x61,
-                0x79, 0xee, 0x2a, 0x08, 0x53, 0x36, 0x1c, 0x7d, 0xea, 0x89, 0xac, 0x1c, 0xd7, 0xe2,
-                0xb4, 0xef, 0xa6, 0xad, 0x82, 0x15, 0xf5, 0xf7, 0x6a, 0xc2, 0x8a, 0x73, 0x1d, 0x27,
-                0x79, 0xc1, 0xff, 0xeb, 0xe9, 0xab, 0x6f, 0x51, 0x3d, 0x9b, 0x5e, 0xe0, 0x08, 0x13,
-                0x5f, 0xf6, 0x0b, 0xb8, 0x6f, 0x8e, 0x13, 0x97, 0x87, 0xc6, 0xc3, 0x46, 0x8d, 0x31,
-                0x29, 0x8f, 0x25, 0x91, 0x76, 0x48, 0xf0, 0x72, 0xa1, 0x1c, 0x0b, 0x8a, 0xf4, 0x0f,
-                0x92, 0xa8, 0xb5, 0x04, 0x2c, 0xd4, 0xaf, 0x4f, 0x5a, 0x2a, 0x55, 0x27, 0x31, 0x54,
-                0x61, 0x90, 0x44, 0x8d, 0xf1, 0x07, 0x86, 0x37, 0xf4, 0x2e, 0x97, 0x54, 0x5a, 0x86,
-                0x64, 0x3a, 0xa4, 0x10, 0x37, 0xc5, 0x34, 0xbc, 0x3e, 0x2e, 0x44, 0xa8, 0x85, 0x34,
-                0x10, 0xa0, 0x6e, 0x91, 0x25, 0x31, 0x8a, 0x96, 0x56, 0x55, 0xf3, 0x3f, 0xed, 0x8e,
-                0xba, 0x35, 0x62, 0x93, 0xd7, 0xcc, 0xfb, 0x97, 0xa2, 0x33, 0x20, 0xbc, 0x35, 0x39,
-                0x70, 0xaa, 0xa1, 0x18, 0xe7, 0x43,
-            ],
-            ock: [
-                0x95, 0x9a, 0x28, 0x02, 0x17, 0xb9, 0xef, 0x54, 0xab, 0x44, 0x3b, 0x8d, 0x0f, 0xea,
-                0x5a, 0x11, 0x75, 0x86, 0xae, 0x8a, 0xdd, 0x64, 0x99, 0x7d, 0x02, 0xec, 0xb8, 0xb5,
-                0xcb, 0xac, 0x14, 0x87,
-            ],
-            _op: [
-                0x6b, 0x27, 0xda, 0xcc, 0xb5, 0xa8, 0x20, 0x7f, 0x53, 0x2d, 0x10, 0xca, 0x23, 0x8f,
-                0x97, 0x86, 0x64, 0x8a, 0x11, 0xb5, 0x96, 0x6e, 0x51, 0xa2, 0xf7, 0xd8, 0x9e, 0x15,
-                0xd2, 0x9b, 0x8f, 0xdf, 0x4e, 0x41, 0x8c, 0x3c, 0x54, 0x3d, 0x6b, 0xf0, 0x15, 0x31,
-                0x74, 0xa0, 0x4e, 0x85, 0x44, 0xae, 0x7c, 0x58, 0x09, 0x2a, 0x2e, 0x4e, 0x5d, 0x7d,
-                0x9c, 0x67, 0x2a, 0x3a, 0x79, 0x11, 0x09, 0x03,
-            ],
-            c_out: [
-                0x65, 0x9d, 0xef, 0x25, 0x08, 0x34, 0x84, 0x6f, 0x85, 0xeb, 0x9e, 0x39, 0x5b, 0xef,
-                0xe1, 0x5e, 0x1d, 0x4d, 0x2a, 0xb4, 0x36, 0x2d, 0x1a, 0xa7, 0xde, 0x84, 0x24, 0x3f,
-                0x74, 0x45, 0xd5, 0xd2, 0x8f, 0x47, 0x92, 0x92, 0x4d, 0x60, 0xc7, 0x60, 0x53, 0x3c,
-                0xef, 0x05, 0x10, 0x47, 0xe5, 0x4d, 0x52, 0x1e, 0x2b, 0x07, 0x2d, 0x13, 0x30, 0xb2,
-                0x68, 0x5e, 0xb8, 0x70, 0x10, 0x6c, 0x66, 0x1f, 0x1f, 0x07, 0xb7, 0x6f, 0xdb, 0xb5,
-                0x14, 0xaa, 0x9b, 0x94, 0xad, 0x41, 0x91, 0xbc, 0x0d, 0x2d,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0xf6, 0x2c, 0x05, 0xe8, 0x48, 0xa8, 0x73, 0xef, 0x88, 0x5e, 0x12, 0xb0, 0x8c, 0x5e,
-                0x7c, 0xa2, 0xf3, 0x24, 0x24, 0xba, 0xcc, 0x75, 0x4c, 0xb6, 0x97, 0x50, 0x44, 0x4d,
-                0x35, 0x5f, 0x51, 0x06,
-            ],
-            ivk: [
-                0xb5, 0xc5, 0x89, 0x49, 0x43, 0x95, 0x69, 0x33, 0xc0, 0xe5, 0xc1, 0x2d, 0x31, 0x1f,
-                0xc1, 0x2c, 0xba, 0x58, 0x35, 0x4b, 0x5c, 0x38, 0x9e, 0xdc, 0x03, 0xda, 0x55, 0x08,
-                0x4f, 0x74, 0xc2, 0x05,
-            ],
-            default_d: [
-                0xbe, 0xbb, 0x0f, 0xb4, 0x6b, 0x8a, 0xaf, 0xf8, 0x90, 0x40, 0xf6,
-            ],
-            default_pk_d: [
-                0xd1, 0x1d, 0xa0, 0x1f, 0x0b, 0x43, 0xbd, 0xd5, 0x28, 0x8d, 0x32, 0x38, 0x5b, 0x87,
-                0x71, 0xd2, 0x23, 0x49, 0x3c, 0x69, 0x80, 0x25, 0x44, 0x04, 0x3f, 0x77, 0xcf, 0x1d,
-                0x71, 0xc1, 0xcb, 0x8c,
-            ],
-            v: 700000000,
-            rcm: [
-                0x49, 0xf9, 0x0b, 0x47, 0xfd, 0x52, 0xfe, 0xe7, 0xc1, 0xc8, 0x1f, 0x0d, 0xcb, 0x5b,
-                0x74, 0xc3, 0xfb, 0x9b, 0x3e, 0x03, 0x97, 0x6f, 0x8b, 0x75, 0x24, 0xea, 0xba, 0xd0,
-                0x08, 0x89, 0x21, 0x07,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x77, 0x08, 0x94, 0xc7, 0xa5, 0x45, 0x8b, 0x16, 0x7d, 0x85, 0x18, 0xa5, 0x47, 0xbc,
-                0x62, 0xb4, 0x6b, 0xa1, 0x89, 0x80, 0x7e, 0xb9, 0x7c, 0x08, 0x28, 0x4e, 0x1b, 0x92,
-                0xb6, 0xda, 0x35, 0x2a,
-            ],
-            cmu: [
-                0x0d, 0xd4, 0x2d, 0x63, 0xff, 0x38, 0xee, 0x4c, 0x46, 0x65, 0x1e, 0x4d, 0x1d, 0xd5,
-                0x22, 0x7d, 0xc5, 0x97, 0x33, 0x9f, 0x7d, 0x70, 0x4c, 0x51, 0x8e, 0xf4, 0x02, 0xf8,
-                0xcd, 0x6f, 0x37, 0x44,
-            ],
-            esk: [
-                0x6d, 0xa9, 0x45, 0xd3, 0x03, 0x81, 0xc2, 0xee, 0xd2, 0xb8, 0x1d, 0x27, 0x08, 0x6d,
-                0x22, 0x48, 0xe7, 0xc4, 0x49, 0xfe, 0x50, 0x9b, 0x38, 0xe2, 0x76, 0x79, 0x11, 0x89,
-                0xea, 0xbc, 0x46, 0x02,
-            ],
-            epk: [
-                0xa5, 0x2f, 0x0b, 0x5a, 0xe4, 0xa9, 0x4f, 0xa8, 0x8a, 0xa7, 0xcb, 0x7e, 0x5f, 0x0f,
-                0x34, 0x3c, 0xa2, 0xfa, 0x66, 0xb3, 0x94, 0x41, 0xba, 0x66, 0x28, 0x20, 0xe4, 0x6a,
-                0x9b, 0xbb, 0xa3, 0xb5,
-            ],
-            shared_secret: [
-                0x81, 0xc7, 0xc5, 0xd5, 0xff, 0x63, 0xe9, 0xe6, 0x1f, 0xe3, 0x5a, 0x4b, 0x39, 0x6e,
-                0xa7, 0xf1, 0x9e, 0x48, 0x07, 0x6f, 0x22, 0x09, 0x0a, 0xe7, 0x29, 0xa4, 0x11, 0x79,
-                0x2f, 0x08, 0x58, 0x4a,
-            ],
-            k_enc: [
-                0xb4, 0xf9, 0xa7, 0xff, 0x9c, 0x60, 0x80, 0x6e, 0xc7, 0xf5, 0x5c, 0xee, 0xbe, 0xc2,
-                0xba, 0x54, 0x76, 0x19, 0x8e, 0x29, 0x1d, 0xf7, 0x57, 0x8c, 0x2b, 0xef, 0x87, 0xe6,
-                0x4a, 0x71, 0x6a, 0xe7,
-            ],
-            _p_enc: [
-                0x01, 0xbe, 0xbb, 0x0f, 0xb4, 0x6b, 0x8a, 0xaf, 0xf8, 0x90, 0x40, 0xf6, 0x00, 0x27,
-                0xb9, 0x29, 0x00, 0x00, 0x00, 0x00, 0x49, 0xf9, 0x0b, 0x47, 0xfd, 0x52, 0xfe, 0xe7,
-                0xc1, 0xc8, 0x1f, 0x0d, 0xcb, 0x5b, 0x74, 0xc3, 0xfb, 0x9b, 0x3e, 0x03, 0x97, 0x6f,
-                0x8b, 0x75, 0x24, 0xea, 0xba, 0xd0, 0x08, 0x89, 0x21, 0x07, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x20, 0x77, 0xdf, 0x43, 0x25, 0x24, 0x61, 0x4c, 0x07, 0x6e, 0x77, 0x93, 0x02, 0x41,
-                0x91, 0xaa, 0xc9, 0xe4, 0x93, 0xf5, 0xc8, 0xa9, 0x87, 0x45, 0xae, 0x65, 0x31, 0x0c,
-                0xfc, 0xb5, 0x75, 0x56, 0x4a, 0x93, 0xf1, 0x27, 0x2b, 0xce, 0x90, 0x07, 0x77, 0xb8,
-                0x50, 0x49, 0x7e, 0x84, 0x54, 0x0c, 0xb1, 0x92, 0x03, 0x85, 0x65, 0x88, 0x2f, 0xa4,
-                0xf3, 0x71, 0x21, 0x3e, 0xb5, 0x09, 0x00, 0x41, 0xff, 0xd9, 0x24, 0x7b, 0xee, 0x2b,
-                0xb1, 0x53, 0x21, 0x22, 0x83, 0xb2, 0x7e, 0x36, 0xe2, 0x84, 0x60, 0x3c, 0x0b, 0xc4,
-                0x0c, 0x46, 0x5f, 0xc6, 0xab, 0x8f, 0x88, 0x98, 0x5e, 0xf5, 0x0e, 0x2a, 0xb0, 0xeb,
-                0x66, 0xa6, 0x34, 0x30, 0x9b, 0xb9, 0x02, 0xc6, 0xcd, 0xd6, 0xa5, 0x55, 0xb8, 0xc3,
-                0x71, 0x48, 0x9f, 0x57, 0xc7, 0xea, 0x3b, 0x54, 0x37, 0xf2, 0x87, 0xc7, 0x4e, 0x35,
-                0xe0, 0x34, 0xcc, 0x68, 0x08, 0xe2, 0xc9, 0xf2, 0xc9, 0x73, 0xfa, 0xc9, 0x6e, 0x84,
-                0x9d, 0x31, 0xde, 0x76, 0xf8, 0x06, 0x63, 0xa5, 0x82, 0xb2, 0x3a, 0xfc, 0x36, 0x45,
-                0x5e, 0xc4, 0x6e, 0x23, 0x8c, 0xb2, 0x84, 0xda, 0xf1, 0x11, 0x4a, 0x6e, 0x5b, 0xd0,
-                0x28, 0x9a, 0xef, 0xb7, 0x46, 0x94, 0x31, 0xb8, 0xb8, 0x60, 0x89, 0xb9, 0xd3, 0x6f,
-                0xfd, 0x67, 0x45, 0xbd, 0x86, 0x7b, 0xaa, 0x6b, 0x58, 0xfb, 0x30, 0xaf, 0xa0, 0x97,
-                0xab, 0x9e, 0x57, 0x38, 0x8f, 0x4f, 0xdf, 0xc0, 0xfd, 0x48, 0x3d, 0xc6, 0x7f, 0x02,
-                0xbc, 0x07, 0x99, 0x0e, 0x1a, 0x39, 0x7b, 0x11, 0x2d, 0x5d, 0xbc, 0xf2, 0x2f, 0x9b,
-                0x64, 0xf5, 0xf5, 0x43, 0x10, 0x24, 0x63, 0xe3, 0x0f, 0x46, 0x81, 0x72, 0x85, 0x39,
-                0xc0, 0xc5, 0xc5, 0xe0, 0x0a, 0x25, 0x35, 0xae, 0xf7, 0x68, 0xe3, 0xaf, 0x7d, 0x47,
-                0xa0, 0x8d, 0xdb, 0x99, 0xea, 0x2e, 0xd0, 0x0c, 0x52, 0xbf, 0x4b, 0x5e, 0xb3, 0x14,
-                0x05, 0x85, 0xb0, 0xf9, 0x0e, 0xcf, 0x7d, 0x21, 0x5b, 0x4c, 0xc1, 0x8a, 0xf9, 0xae,
-                0xc8, 0x17, 0x0c, 0x6d, 0xb6, 0xc6, 0x69, 0x98, 0xb8, 0xda, 0x0f, 0x09, 0x17, 0xf1,
-                0x38, 0x0c, 0x87, 0xa4, 0x18, 0x1b, 0x86, 0xc6, 0xcd, 0xfe, 0x6f, 0x2d, 0xb2, 0x21,
-                0x41, 0xe7, 0x98, 0x4b, 0x1a, 0xac, 0xf7, 0xce, 0xc5, 0xe7, 0xd0, 0x76, 0xaa, 0xc5,
-                0x47, 0x9e, 0xd7, 0x14, 0x40, 0xb2, 0xd4, 0x60, 0x18, 0x5b, 0xa3, 0xdb, 0xea, 0x03,
-                0xc8, 0xfc, 0xca, 0xc0, 0x9a, 0xec, 0xd3, 0x3a, 0x3f, 0xdd, 0xa9, 0xa1, 0x34, 0xea,
-                0x42, 0xa1, 0xa9, 0x78, 0xc4, 0x05, 0x17, 0x99, 0xe6, 0xcc, 0x69, 0x6f, 0x8a, 0x49,
-                0x40, 0x0a, 0xea, 0xd6, 0x65, 0x2f, 0x93, 0xa2, 0x58, 0x22, 0x0c, 0x63, 0x38, 0xb9,
-                0xe7, 0x3b, 0x10, 0xa0, 0x1c, 0xd2, 0xec, 0x39, 0x72, 0x86, 0x1c, 0x7b, 0x62, 0x69,
-                0x5a, 0xda, 0xa5, 0x41, 0x4a, 0x78, 0x74, 0x50, 0xe7, 0xa5, 0xf8, 0x21, 0xe4, 0xf2,
-                0x45, 0xdd, 0x97, 0x2c, 0x08, 0x92, 0xe8, 0x6f, 0xa1, 0x26, 0xba, 0x59, 0x5c, 0x12,
-                0x25, 0x73, 0x8e, 0x2f, 0x8b, 0xe3, 0x6f, 0x11, 0xdc, 0xc5, 0x2c, 0xed, 0x4f, 0x78,
-                0x75, 0xdf, 0x5b, 0xbb, 0xd8, 0x3a, 0xec, 0x8d, 0x43, 0x13, 0x07, 0x2d, 0x7e, 0xc9,
-                0x47, 0xaf, 0x86, 0xb5, 0x6b, 0x65, 0xfc, 0xb1, 0xbd, 0x32, 0xf0, 0xdb, 0x0c, 0xb3,
-                0x7d, 0xea, 0xa6, 0xcd, 0xe0, 0xdf, 0xe4, 0xbd, 0xb8, 0x09, 0x16, 0x1e, 0xda, 0x03,
-                0x4a, 0x94, 0x9a, 0x3a, 0x03, 0x9a, 0xf9, 0xbb, 0xe0, 0x9e, 0xaf, 0xb3, 0x5b, 0x7c,
-                0xd8, 0xb5, 0x32, 0x83, 0x42, 0xc3, 0x93, 0x22, 0x1a, 0x4f, 0x13, 0x4b, 0x15, 0xa4,
-                0x16, 0x3c, 0x05, 0x3b, 0x32, 0xeb, 0xa8, 0x5e, 0x59, 0x36, 0x06, 0xda, 0x67, 0xa1,
-                0x1c, 0xe1, 0x74, 0xb7, 0x7b, 0xbe, 0xfd, 0x50, 0xef, 0x10, 0x25, 0xe9, 0x4a, 0x06,
-                0xc5, 0xe0, 0x98, 0x8d, 0xb7, 0xf9, 0xda, 0x54, 0x0a, 0xa3, 0xb1, 0xc0, 0x33, 0x09,
-                0xb4, 0xb1, 0x40, 0x01, 0xe2, 0xc4, 0x5a, 0xa9, 0x99, 0x65, 0x0b, 0x01, 0xaa, 0x3b,
-                0xef, 0x5f, 0xb2, 0xd3, 0x38, 0x0c, 0xbf, 0x33, 0xc5, 0x5d, 0x45, 0x70, 0x25, 0x9f,
-                0x1e, 0x3e, 0xd7, 0xe0, 0x0c, 0xa9,
-            ],
-            ock: [
-                0x54, 0xce, 0xb1, 0x1b, 0xb0, 0xe8, 0xf8, 0x54, 0x86, 0x10, 0xd1, 0x1f, 0xf1, 0xab,
-                0x14, 0x92, 0xd1, 0x8d, 0x5c, 0x85, 0x3c, 0x8f, 0x2f, 0x0c, 0xd5, 0xd1, 0x9d, 0x6d,
-                0x34, 0xcf, 0x7c, 0x2d,
-            ],
-            _op: [
-                0xd1, 0x1d, 0xa0, 0x1f, 0x0b, 0x43, 0xbd, 0xd5, 0x28, 0x8d, 0x32, 0x38, 0x5b, 0x87,
-                0x71, 0xd2, 0x23, 0x49, 0x3c, 0x69, 0x80, 0x25, 0x44, 0x04, 0x3f, 0x77, 0xcf, 0x1d,
-                0x71, 0xc1, 0xcb, 0x8c, 0x6d, 0xa9, 0x45, 0xd3, 0x03, 0x81, 0xc2, 0xee, 0xd2, 0xb8,
-                0x1d, 0x27, 0x08, 0x6d, 0x22, 0x48, 0xe7, 0xc4, 0x49, 0xfe, 0x50, 0x9b, 0x38, 0xe2,
-                0x76, 0x79, 0x11, 0x89, 0xea, 0xbc, 0x46, 0x02,
-            ],
-            c_out: [
-                0xe7, 0x72, 0xe0, 0x1d, 0x61, 0x09, 0xb6, 0xf9, 0x85, 0xb1, 0x77, 0x2e, 0xd1, 0x55,
-                0x0a, 0x94, 0x7b, 0x35, 0xa8, 0x4b, 0x3e, 0x71, 0x12, 0x33, 0x31, 0xa3, 0xd6, 0x1f,
-                0x1b, 0xf5, 0x96, 0x4e, 0x97, 0x42, 0x54, 0x42, 0xe5, 0xc8, 0xef, 0x2b, 0x9d, 0x84,
-                0xab, 0x3d, 0xcb, 0xab, 0x9c, 0x96, 0xfe, 0x6a, 0x89, 0xce, 0x1d, 0x5e, 0x8a, 0x9b,
-                0x83, 0xb5, 0x09, 0x0b, 0xb0, 0x7c, 0x50, 0x45, 0x0b, 0xbb, 0xfc, 0x8a, 0x74, 0x64,
-                0xa7, 0x7c, 0x33, 0x97, 0x16, 0x33, 0xb2, 0x13, 0x68, 0xf0,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0xe9, 0xe0, 0xdc, 0x1e, 0xd3, 0x11, 0xda, 0xed, 0x64, 0xbd, 0x74, 0xda, 0x5d, 0x94,
-                0xfe, 0x88, 0xa6, 0xea, 0x41, 0x4b, 0x73, 0x12, 0xde, 0x3d, 0x2a, 0x78, 0xf6, 0x46,
-                0x32, 0xbb, 0xe3, 0x73,
-            ],
-            ivk: [
-                0x87, 0x16, 0xc8, 0x28, 0x80, 0xe1, 0x36, 0x83, 0xe1, 0xbb, 0x05, 0x9d, 0xd0, 0x6c,
-                0x80, 0xc9, 0x01, 0x34, 0xa9, 0x6d, 0x5a, 0xfc, 0xa8, 0xaa, 0xc2, 0xbb, 0xf6, 0x8b,
-                0xb0, 0x5f, 0x84, 0x02,
-            ],
-            default_d: [
-                0xad, 0x6e, 0x2e, 0x18, 0x5a, 0x31, 0x00, 0xe3, 0xa6, 0xa8, 0xb3,
-            ],
-            default_pk_d: [
-                0x32, 0xcb, 0x28, 0x06, 0xb8, 0x82, 0xf1, 0x36, 0x8b, 0x0d, 0x4a, 0x89, 0x8f, 0x72,
-                0xc4, 0xc8, 0xf7, 0x28, 0x13, 0x2c, 0xc1, 0x24, 0x56, 0x94, 0x6e, 0x7f, 0x4c, 0xb0,
-                0xfb, 0x05, 0x8d, 0xa9,
-            ],
-            v: 800000000,
-            rcm: [
-                0x51, 0x65, 0xaf, 0xf2, 0x2d, 0xd4, 0xed, 0x56, 0xb4, 0xd8, 0x1d, 0x1f, 0x17, 0x1c,
-                0xc3, 0xd6, 0x43, 0x2f, 0xed, 0x1b, 0xeb, 0xf2, 0x0a, 0x7b, 0xea, 0xb1, 0x2d, 0xb1,
-                0x42, 0xf9, 0x4a, 0x0c,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x29, 0x54, 0xcc, 0x7f, 0x9f, 0x9d, 0xfe, 0xb1, 0x4f, 0x02, 0xee, 0xbf, 0xf3, 0xf8,
-                0x48, 0xd5, 0xd0, 0xe3, 0xd2, 0xe0, 0x1f, 0xeb, 0xc9, 0x16, 0x41, 0xf4, 0x12, 0x6c,
-                0x60, 0x34, 0x33, 0x0c,
-            ],
-            cmu: [
-                0x09, 0x90, 0xcd, 0xb9, 0xa5, 0x2e, 0x5c, 0xd1, 0xba, 0x54, 0xd9, 0x20, 0x4c, 0x26,
-                0x69, 0x1c, 0xb0, 0x36, 0xb1, 0x30, 0x12, 0x21, 0x26, 0xeb, 0x14, 0x12, 0x9c, 0xdf,
-                0x0f, 0xc5, 0x18, 0x3c,
-            ],
-            esk: [
-                0xab, 0x2a, 0xff, 0x03, 0x32, 0xd5, 0x43, 0xfd, 0x1d, 0x80, 0x23, 0x18, 0x5b, 0x8e,
-                0xcb, 0x5f, 0x22, 0xa2, 0x9c, 0x32, 0xef, 0x74, 0x16, 0x33, 0x31, 0x6e, 0xee, 0x51,
-                0x4f, 0xc2, 0x23, 0x09,
-            ],
-            epk: [
-                0xd0, 0x04, 0x99, 0x7c, 0x79, 0xd0, 0x07, 0xa5, 0x3b, 0xf2, 0xfd, 0x2f, 0x6a, 0x66,
-                0xc0, 0xaf, 0xd9, 0xf8, 0x79, 0xb5, 0x5f, 0xec, 0xdc, 0x15, 0x8a, 0x90, 0x12, 0x32,
-                0xb7, 0x88, 0x48, 0x09,
-            ],
-            shared_secret: [
-                0xa8, 0xde, 0xa9, 0xbe, 0x94, 0xdc, 0xca, 0xc8, 0x15, 0x75, 0xb4, 0x4f, 0x4b, 0xe8,
-                0x53, 0xe8, 0xc0, 0xf7, 0xe6, 0xba, 0x7f, 0x0b, 0xf8, 0xf2, 0xb3, 0xa1, 0xb8, 0x9c,
-                0x6a, 0xc8, 0x92, 0x39,
-            ],
-            k_enc: [
-                0x14, 0x1b, 0x55, 0x0a, 0xd3, 0xc2, 0xe7, 0xdf, 0xdc, 0xd4, 0x2d, 0x4a, 0xba, 0x31,
-                0x39, 0x97, 0x42, 0xa9, 0x29, 0xbb, 0x23, 0x10, 0x0a, 0x7c, 0x51, 0xed, 0x32, 0xf9,
-                0xcb, 0x45, 0x96, 0xc6,
-            ],
-            _p_enc: [
-                0x01, 0xad, 0x6e, 0x2e, 0x18, 0x5a, 0x31, 0x00, 0xe3, 0xa6, 0xa8, 0xb3, 0x00, 0x08,
-                0xaf, 0x2f, 0x00, 0x00, 0x00, 0x00, 0x51, 0x65, 0xaf, 0xf2, 0x2d, 0xd4, 0xed, 0x56,
-                0xb4, 0xd8, 0x1d, 0x1f, 0x17, 0x1c, 0xc3, 0xd6, 0x43, 0x2f, 0xed, 0x1b, 0xeb, 0xf2,
-                0x0a, 0x7b, 0xea, 0xb1, 0x2d, 0xb1, 0x42, 0xf9, 0x4a, 0x0c, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x6d, 0x3e, 0xff, 0x72, 0x8a, 0x28, 0x8e, 0x35, 0x59, 0xd8, 0x96, 0x06, 0xa4, 0x50,
-                0xce, 0x14, 0x86, 0x4d, 0xf9, 0x03, 0x23, 0xcb, 0x2f, 0x41, 0xfb, 0xa2, 0x68, 0x84,
-                0x3c, 0xec, 0x77, 0x75, 0x48, 0xbc, 0xc4, 0x25, 0xf5, 0xed, 0x1e, 0x6e, 0x8c, 0x75,
-                0xe2, 0xda, 0xe3, 0x56, 0x16, 0x84, 0x56, 0x39, 0x1b, 0x87, 0xb5, 0xc6, 0xcd, 0x55,
-                0x50, 0x3f, 0x12, 0xc3, 0x4f, 0x94, 0xb0, 0xd8, 0x24, 0xa7, 0x7a, 0xe6, 0x21, 0x3f,
-                0xf4, 0x3f, 0x12, 0xa3, 0x4f, 0x2c, 0x66, 0x8e, 0xa1, 0x6b, 0xd1, 0xf0, 0x4a, 0x91,
-                0xd3, 0x9a, 0x7b, 0x60, 0x19, 0x7c, 0x7b, 0x58, 0x62, 0x90, 0x36, 0xa8, 0x8f, 0xa7,
-                0x0a, 0x8d, 0x5b, 0xf8, 0x3e, 0xd4, 0xdb, 0x40, 0x63, 0xb1, 0xea, 0xce, 0x10, 0x95,
-                0xf9, 0x06, 0x62, 0xce, 0x9f, 0x6a, 0xc0, 0x26, 0x73, 0xf7, 0xb9, 0xa3, 0x6e, 0xbc,
-                0x52, 0xf4, 0x98, 0x4b, 0xd7, 0x11, 0x53, 0xb3, 0xe2, 0xed, 0xca, 0x80, 0x3d, 0x86,
-                0x90, 0x26, 0xee, 0x2f, 0xf0, 0x22, 0x8a, 0xfa, 0x7b, 0x61, 0xd0, 0xd3, 0x8c, 0x9b,
-                0xcc, 0xb3, 0x00, 0x8b, 0x32, 0xc6, 0xa0, 0x59, 0x84, 0x2e, 0xe8, 0xa0, 0x7b, 0xa1,
-                0x2c, 0x63, 0x08, 0x43, 0x6b, 0x64, 0x89, 0x85, 0x35, 0x3d, 0x7d, 0xd5, 0x8b, 0x20,
-                0x92, 0xb5, 0xac, 0x2e, 0xd7, 0xe7, 0x20, 0x65, 0xec, 0xad, 0xa6, 0x50, 0xae, 0xe6,
-                0xcd, 0x00, 0xfd, 0x34, 0xd5, 0x8c, 0x2b, 0x58, 0xd4, 0x1a, 0x48, 0xaa, 0xc7, 0xbf,
-                0x4b, 0x45, 0xc9, 0x6c, 0x53, 0xa1, 0x0b, 0x04, 0xdb, 0x73, 0xcc, 0x83, 0x27, 0x1b,
-                0xa6, 0x71, 0x17, 0xd6, 0x42, 0xe4, 0xd8, 0x19, 0xc3, 0x02, 0xd7, 0x18, 0x5e, 0xcc,
-                0xbf, 0xa5, 0x40, 0x5b, 0x80, 0xc5, 0xb3, 0xe4, 0xb2, 0xc5, 0x52, 0x43, 0x28, 0x60,
-                0x80, 0x81, 0x78, 0xcb, 0x8f, 0xce, 0x40, 0x5b, 0x73, 0xfe, 0xf2, 0xb3, 0x46, 0xc4,
-                0x1b, 0xb2, 0xb2, 0xfa, 0xd7, 0x1a, 0x80, 0x31, 0x3b, 0xe3, 0xcf, 0x01, 0xec, 0xfd,
-                0x88, 0x8f, 0x25, 0x72, 0xed, 0xcf, 0x57, 0xe4, 0xd7, 0x1e, 0x47, 0xcf, 0x8d, 0x52,
-                0xdb, 0xa4, 0xc6, 0x44, 0x0d, 0x0d, 0x4a, 0x9b, 0x19, 0x3f, 0x57, 0x74, 0x8d, 0x20,
-                0xf8, 0x9a, 0xb5, 0xd6, 0xda, 0x16, 0x14, 0x36, 0x2a, 0x5f, 0xb8, 0x5f, 0x6a, 0xb2,
-                0xbe, 0x35, 0xc7, 0x2f, 0xd6, 0x28, 0x7a, 0xe5, 0x5c, 0xd2, 0x77, 0x79, 0x19, 0x44,
-                0xdf, 0x24, 0xa3, 0x76, 0x46, 0x71, 0xdd, 0xd4, 0x06, 0x0a, 0x9b, 0x9c, 0xab, 0x01,
-                0x4a, 0xbe, 0x14, 0x35, 0x09, 0x31, 0x64, 0xa6, 0x9f, 0x61, 0xbf, 0x29, 0x24, 0x8c,
-                0x35, 0x9c, 0xb6, 0x90, 0xab, 0x25, 0xe9, 0x93, 0xce, 0x39, 0x72, 0xd6, 0xee, 0x36,
-                0x78, 0x5e, 0xf0, 0x61, 0x87, 0x20, 0x50, 0xf5, 0x26, 0xf7, 0xdb, 0x7f, 0xf1, 0x98,
-                0xfb, 0xac, 0xff, 0x29, 0x85, 0x81, 0xb7, 0x33, 0x06, 0xef, 0xc0, 0x2b, 0xb9, 0xd4,
-                0xab, 0x32, 0xdf, 0x26, 0x4f, 0x14, 0xa8, 0x0e, 0x7f, 0x0c, 0x76, 0xe5, 0xf1, 0x4d,
-                0xa2, 0x9a, 0xb1, 0xea, 0x04, 0xa3, 0xe3, 0xf5, 0xba, 0x5e, 0x35, 0x05, 0x5d, 0xba,
-                0xd2, 0x76, 0xe1, 0x20, 0x1c, 0xce, 0x0a, 0xec, 0x14, 0x82, 0xcb, 0xec, 0x1d, 0x3f,
-                0xa4, 0xa1, 0x3d, 0x3e, 0x16, 0x51, 0x1b, 0x0d, 0xee, 0x35, 0x58, 0xc5, 0xae, 0xef,
-                0x27, 0xe3, 0xe6, 0x1b, 0x91, 0x51, 0xe5, 0x5a, 0x5a, 0xe1, 0x57, 0x03, 0x0c, 0xe5,
-                0x97, 0xf8, 0x21, 0x82, 0x89, 0x3e, 0xe4, 0xd6, 0xbd, 0x4f, 0xb0, 0x87, 0x29, 0xbb,
-                0xc3, 0x01, 0x41, 0x9c, 0xe0, 0x66, 0x41, 0x45, 0xba, 0x7a, 0xb8, 0xcb, 0xc0, 0x65,
-                0x48, 0xe1, 0xf7, 0xfd, 0xf5, 0x3d, 0x06, 0x05, 0xa7, 0x7b, 0xe6, 0xe4, 0x0c, 0x54,
-                0x00, 0x90, 0xf9, 0x8c, 0x25, 0xb1, 0x25, 0xbe, 0x74, 0x99, 0xf1, 0x76, 0xbb, 0x85,
-                0x01, 0x49, 0x33, 0x53, 0xcf, 0x90, 0x5f, 0x72, 0x25, 0x00, 0x62, 0xd6, 0xcf, 0x01,
-                0x88, 0x14, 0x82, 0x46, 0xee, 0x94, 0xef, 0x9b, 0x21, 0xad, 0xb7, 0xae, 0x1a, 0xe7,
-                0x3b, 0xb6, 0xe6, 0x8f, 0xa9, 0x1d, 0x7f, 0xb4, 0x98, 0x28, 0xd6, 0x57, 0xd8, 0x19,
-                0x5f, 0x6e, 0x95, 0x08, 0x2f, 0xad,
-            ],
-            ock: [
-                0xda, 0xb4, 0x26, 0x26, 0x9e, 0x8d, 0x33, 0x09, 0x55, 0x23, 0x7a, 0x9f, 0xed, 0x86,
-                0x83, 0xa9, 0x27, 0x7c, 0x61, 0x82, 0xa8, 0x08, 0xcc, 0x53, 0xa1, 0xbe, 0xdd, 0xd2,
-                0x03, 0x68, 0xb1, 0x0a,
-            ],
-            _op: [
-                0x32, 0xcb, 0x28, 0x06, 0xb8, 0x82, 0xf1, 0x36, 0x8b, 0x0d, 0x4a, 0x89, 0x8f, 0x72,
-                0xc4, 0xc8, 0xf7, 0x28, 0x13, 0x2c, 0xc1, 0x24, 0x56, 0x94, 0x6e, 0x7f, 0x4c, 0xb0,
-                0xfb, 0x05, 0x8d, 0xa9, 0xab, 0x2a, 0xff, 0x03, 0x32, 0xd5, 0x43, 0xfd, 0x1d, 0x80,
-                0x23, 0x18, 0x5b, 0x8e, 0xcb, 0x5f, 0x22, 0xa2, 0x9c, 0x32, 0xef, 0x74, 0x16, 0x33,
-                0x31, 0x6e, 0xee, 0x51, 0x4f, 0xc2, 0x23, 0x09,
-            ],
-            c_out: [
-                0xaf, 0x4d, 0x97, 0xfb, 0x72, 0x28, 0xf0, 0x1f, 0x6d, 0x9e, 0x2f, 0x79, 0xa1, 0xa1,
-                0xba, 0x45, 0xa2, 0x3d, 0x60, 0x90, 0x59, 0x78, 0x4e, 0xa9, 0x35, 0x0f, 0x1e, 0xb0,
-                0x92, 0xb0, 0x54, 0xa3, 0x26, 0x8c, 0xc0, 0x26, 0xd3, 0xd7, 0x37, 0xef, 0x35, 0xad,
-                0xc2, 0x86, 0xd1, 0x95, 0xea, 0xa4, 0x14, 0x49, 0x3e, 0xd2, 0xa5, 0x1f, 0x2f, 0x61,
-                0x09, 0x9a, 0x34, 0x51, 0xf9, 0x55, 0x5b, 0xab, 0x1a, 0x5e, 0xf3, 0xe3, 0xfb, 0xbe,
-                0x8e, 0xc6, 0x41, 0x6b, 0xd3, 0x3d, 0x50, 0xdf, 0xf9, 0x8f,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0x14, 0x7d, 0xd1, 0x1d, 0x77, 0xeb, 0xa1, 0xb1, 0x63, 0x6f, 0xd6, 0x19, 0x0c, 0x62,
-                0xb9, 0xa5, 0xd0, 0x48, 0x1b, 0xee, 0x7e, 0x91, 0x7f, 0xab, 0x02, 0xe2, 0x18, 0x58,
-                0x06, 0x3a, 0xb5, 0x04,
-            ],
-            ivk: [
-                0x99, 0xc9, 0xb4, 0xb8, 0x4f, 0x4b, 0x4e, 0x35, 0x0f, 0x78, 0x7d, 0x1c, 0xf7, 0x05,
-                0x1d, 0x50, 0xec, 0xc3, 0x4b, 0x1a, 0x5b, 0x20, 0xd2, 0xd2, 0x13, 0x9b, 0x4a, 0xf1,
-                0xf1, 0x60, 0xe0, 0x01,
-            ],
-            default_d: [
-                0x21, 0xc9, 0x0e, 0x1c, 0x65, 0x8b, 0x3e, 0xfe, 0x86, 0xaf, 0x58,
-            ],
-            default_pk_d: [
-                0x9e, 0x64, 0x17, 0x4b, 0x4a, 0xb9, 0x81, 0x40, 0x5c, 0x32, 0x3b, 0x5e, 0x12, 0x47,
-                0x59, 0x45, 0xa4, 0x6d, 0x4f, 0xed, 0xf8, 0x06, 0x08, 0x28, 0x04, 0x1c, 0xd2, 0x0e,
-                0x62, 0xfd, 0x2c, 0xef,
-            ],
-            v: 900000000,
-            rcm: [
-                0x8c, 0x3e, 0x56, 0x44, 0x9d, 0xc8, 0x63, 0x54, 0xd3, 0x3b, 0x02, 0x5e, 0xf2, 0x79,
-                0x34, 0x60, 0xbc, 0xb1, 0x69, 0xf3, 0x32, 0x4e, 0x4a, 0x6b, 0x64, 0xba, 0xa6, 0x08,
-                0x32, 0x31, 0x57, 0x04,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x4a, 0x85, 0xeb, 0x3f, 0x25, 0x3f, 0x3b, 0xaa, 0xf6, 0xb5, 0x5a, 0x99, 0x49, 0x51,
-                0xb2, 0xca, 0x82, 0x48, 0xcb, 0xd6, 0x79, 0xf7, 0xa5, 0x77, 0xe3, 0x3b, 0xcd, 0x66,
-                0x46, 0xb2, 0x13, 0x51,
-            ],
-            cmu: [
-                0x56, 0x90, 0xcd, 0x51, 0xa4, 0x5c, 0xe8, 0x9a, 0x51, 0xac, 0xbe, 0x01, 0x60, 0x60,
-                0xf0, 0xdf, 0xee, 0x0d, 0x2f, 0xc9, 0xb8, 0x97, 0x58, 0x5f, 0x97, 0x4a, 0x40, 0x2e,
-                0x53, 0x7f, 0xe2, 0x18,
-            ],
-            esk: [
-                0xa5, 0x3d, 0x19, 0xf5, 0x69, 0x45, 0x95, 0xd5, 0xae, 0x63, 0x02, 0x27, 0x67, 0x3c,
-                0x80, 0x24, 0x9c, 0xe1, 0x24, 0x41, 0x9f, 0x46, 0xdf, 0x4e, 0x7b, 0x3f, 0xc1, 0x04,
-                0x61, 0x28, 0xcd, 0x0b,
-            ],
-            epk: [
-                0x4d, 0xfc, 0x8a, 0x70, 0xb2, 0x10, 0xdf, 0xd4, 0x48, 0x37, 0xaa, 0x52, 0xd6, 0x3b,
-                0xd5, 0xd8, 0x1a, 0x5e, 0x40, 0xd8, 0xb4, 0xc1, 0x7a, 0x2d, 0xca, 0x25, 0xa5, 0xf7,
-                0x5f, 0xe5, 0x20, 0x2e,
-            ],
-            shared_secret: [
-                0x1f, 0xf7, 0x5f, 0x5e, 0x7a, 0x51, 0x4b, 0x3c, 0xf5, 0xb3, 0x3c, 0xa3, 0x1a, 0x67,
-                0x1f, 0xc5, 0x0c, 0x26, 0x8c, 0xf1, 0xa3, 0x16, 0xb2, 0x1b, 0x98, 0x67, 0x4b, 0xaa,
-                0x45, 0x00, 0x85, 0xcf,
-            ],
-            k_enc: [
-                0x3c, 0x52, 0xd9, 0xc8, 0x32, 0x07, 0xee, 0x14, 0xf5, 0x62, 0x0d, 0x16, 0x21, 0x82,
-                0xa6, 0xb9, 0xca, 0xbe, 0xfd, 0xba, 0x9e, 0x7a, 0x74, 0xf5, 0xba, 0x2f, 0x81, 0xb8,
-                0x71, 0x40, 0x1f, 0x08,
-            ],
-            _p_enc: [
-                0x01, 0x21, 0xc9, 0x0e, 0x1c, 0x65, 0x8b, 0x3e, 0xfe, 0x86, 0xaf, 0x58, 0x00, 0xe9,
-                0xa4, 0x35, 0x00, 0x00, 0x00, 0x00, 0x8c, 0x3e, 0x56, 0x44, 0x9d, 0xc8, 0x63, 0x54,
-                0xd3, 0x3b, 0x02, 0x5e, 0xf2, 0x79, 0x34, 0x60, 0xbc, 0xb1, 0x69, 0xf3, 0x32, 0x4e,
-                0x4a, 0x6b, 0x64, 0xba, 0xa6, 0x08, 0x32, 0x31, 0x57, 0x04, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x84, 0xd3, 0x61, 0x09, 0xbd, 0xd2, 0x1c, 0x67, 0x8e, 0x84, 0x47, 0xf8, 0x89, 0xe5,
-                0x60, 0xef, 0x6d, 0x07, 0xa8, 0x27, 0xaa, 0xab, 0x78, 0x9b, 0x46, 0xc3, 0xf9, 0xeb,
-                0x32, 0x2e, 0xea, 0x21, 0x4c, 0x20, 0xf7, 0xe9, 0xfa, 0x7f, 0x7a, 0xa5, 0xe0, 0x44,
-                0xa4, 0xed, 0x4c, 0xb1, 0x5d, 0xa9, 0xc5, 0x6c, 0x32, 0xf3, 0x7e, 0x4c, 0xbe, 0x7d,
-                0x1e, 0xd1, 0xf6, 0x85, 0xa8, 0x74, 0x8d, 0xbf, 0x78, 0x12, 0x90, 0xf9, 0x7a, 0xc1,
-                0x41, 0x40, 0xaa, 0x8b, 0x50, 0x93, 0x2a, 0x3f, 0x66, 0xc2, 0x08, 0x22, 0x6f, 0x8d,
-                0x8e, 0xc0, 0xde, 0xb7, 0xbb, 0x58, 0x35, 0x72, 0xc9, 0xe9, 0x70, 0xbc, 0xd0, 0xc6,
-                0x44, 0x67, 0x26, 0xaa, 0x5b, 0x6a, 0x5f, 0x81, 0xcf, 0x18, 0xc6, 0x7a, 0x99, 0x2d,
-                0x6c, 0x86, 0x03, 0x86, 0xab, 0xbb, 0x5b, 0x90, 0xbe, 0x58, 0x64, 0x34, 0x4f, 0xc8,
-                0xbf, 0x3e, 0xbb, 0x75, 0x41, 0xaa, 0x9b, 0x9e, 0x1e, 0x3f, 0x96, 0x25, 0xac, 0xce,
-                0x7f, 0x4b, 0xf1, 0x58, 0x39, 0xa0, 0x81, 0x70, 0x68, 0xe9, 0x15, 0x1b, 0x63, 0x7f,
-                0xa2, 0xa2, 0xca, 0x09, 0xb9, 0xbe, 0x28, 0x5f, 0xea, 0x7e, 0x0a, 0x03, 0x31, 0x7c,
-                0x29, 0x8a, 0xd7, 0xff, 0xfe, 0x40, 0xc5, 0xf0, 0xf6, 0xe9, 0xfb, 0x44, 0xe8, 0xf0,
-                0x6e, 0x19, 0x2f, 0x1a, 0xc2, 0x10, 0x8f, 0x3f, 0x11, 0xf7, 0x76, 0x3c, 0xf2, 0x1e,
-                0x96, 0x62, 0x4d, 0x52, 0xf3, 0xe7, 0x2a, 0xaf, 0x15, 0x7f, 0x3b, 0xc7, 0xc5, 0xd1,
-                0x8f, 0x1e, 0xba, 0x3d, 0x82, 0x7f, 0x71, 0x9c, 0x27, 0x9f, 0xd9, 0x66, 0xc2, 0x7d,
-                0x94, 0xd7, 0x47, 0x23, 0xc5, 0x31, 0x1b, 0x86, 0x65, 0xbd, 0x29, 0xb3, 0xa1, 0x00,
-                0xbb, 0x21, 0x11, 0xaa, 0x42, 0x16, 0xf0, 0x66, 0x5b, 0x16, 0x9e, 0xc0, 0x94, 0x17,
-                0x68, 0xa9, 0x57, 0x4a, 0xe5, 0x0c, 0x2b, 0xc7, 0x90, 0x05, 0x53, 0xf5, 0xc4, 0x50,
-                0xee, 0x98, 0x82, 0xaf, 0x44, 0x55, 0xd1, 0xd8, 0xce, 0x35, 0x18, 0x49, 0xd7, 0x8d,
-                0xbb, 0xe6, 0x1e, 0xd1, 0xdb, 0x7a, 0x2f, 0xd6, 0x57, 0x75, 0xd5, 0x50, 0x6d, 0xfd,
-                0x02, 0xa9, 0x4d, 0x9d, 0x42, 0x85, 0xa2, 0x3a, 0x3c, 0xab, 0x8a, 0xa3, 0x32, 0x14,
-                0x22, 0xa4, 0xaa, 0xa5, 0x49, 0x27, 0x4a, 0x25, 0xf7, 0xf1, 0x2f, 0xf7, 0xa5, 0x19,
-                0x5e, 0x51, 0x55, 0x73, 0x9f, 0x31, 0x8c, 0x30, 0xc0, 0x24, 0x8c, 0x3a, 0x21, 0x9a,
-                0x7a, 0xde, 0x72, 0x98, 0x38, 0x0a, 0x59, 0x5c, 0x5c, 0x88, 0x5b, 0x42, 0x06, 0x69,
-                0xcd, 0x6d, 0xeb, 0x2e, 0x5c, 0x80, 0x49, 0x78, 0xcb, 0x42, 0xd2, 0x06, 0x02, 0x74,
-                0x57, 0x33, 0x60, 0x7c, 0xef, 0x4e, 0x26, 0xa5, 0xc9, 0x7c, 0xca, 0x1c, 0xc5, 0x2b,
-                0x7f, 0xdc, 0x10, 0x69, 0x01, 0x70, 0x18, 0x07, 0x6c, 0xac, 0x62, 0xe5, 0xc4, 0xdb,
-                0xf9, 0x07, 0x48, 0x72, 0x05, 0x0a, 0x42, 0x22, 0x19, 0x51, 0x3b, 0xca, 0x27, 0xa8,
-                0x35, 0xf4, 0x82, 0x4f, 0x47, 0xba, 0x33, 0x7d, 0xeb, 0x74, 0x40, 0xf3, 0xf2, 0xca,
-                0xce, 0x9e, 0x33, 0x16, 0x70, 0xdd, 0x98, 0xe3, 0x28, 0xab, 0x0a, 0x16, 0xac, 0x4a,
-                0xb6, 0x62, 0x76, 0xd1, 0xe1, 0x01, 0x8b, 0x2c, 0xf1, 0x79, 0x43, 0x62, 0x66, 0xa4,
-                0x08, 0xda, 0x8d, 0xda, 0xfc, 0x44, 0xb2, 0x27, 0x6b, 0x11, 0x68, 0x52, 0xd4, 0xcc,
-                0xb3, 0x52, 0x89, 0xb4, 0x21, 0x30, 0x09, 0x12, 0x5d, 0x2d, 0x87, 0x84, 0x5d, 0x6e,
-                0xb7, 0x8e, 0x55, 0x03, 0x15, 0x3d, 0x92, 0xfb, 0xd4, 0x93, 0xd1, 0x9e, 0xf0, 0x1f,
-                0x37, 0x00, 0x26, 0xba, 0xf1, 0x72, 0x30, 0x7b, 0x3f, 0xe2, 0xc4, 0x56, 0x96, 0xfb,
-                0xce, 0xda, 0x3b, 0x6e, 0xab, 0x05, 0xe2, 0xb0, 0x68, 0x5c, 0x72, 0x79, 0x04, 0x98,
-                0x23, 0x3a, 0xbb, 0xbd, 0x6e, 0x05, 0xb0, 0xf4, 0x4a, 0x72, 0x98, 0xae, 0x0a, 0x25,
-                0xaf, 0x08, 0xd7, 0x95, 0x74, 0x61, 0x4c, 0xf2, 0xd8, 0x3e, 0xa7, 0x9c, 0x2b, 0x79,
-                0x53, 0xf8, 0x6c, 0xf5, 0xd0, 0x49, 0x27, 0xf0, 0x9c, 0x0d, 0x7d, 0xf8, 0x12, 0xf1,
-                0xcf, 0x18, 0xa4, 0x53, 0xa0, 0x49, 0x70, 0xaf, 0x0d, 0x72, 0x9c, 0xe7, 0xd9, 0xc8,
-                0xd6, 0xa2, 0x4d, 0x7e, 0xed, 0x3d,
-            ],
-            ock: [
-                0xc9, 0x72, 0x1e, 0x9e, 0x65, 0xa2, 0x61, 0x85, 0x10, 0x07, 0xcd, 0x81, 0x46, 0x7b,
-                0xa5, 0xf3, 0x58, 0x05, 0xba, 0x78, 0x5a, 0x2c, 0x92, 0xa9, 0xaa, 0x62, 0x32, 0xb0,
-                0x55, 0x1c, 0xf3, 0xf4,
-            ],
-            _op: [
-                0x9e, 0x64, 0x17, 0x4b, 0x4a, 0xb9, 0x81, 0x40, 0x5c, 0x32, 0x3b, 0x5e, 0x12, 0x47,
-                0x59, 0x45, 0xa4, 0x6d, 0x4f, 0xed, 0xf8, 0x06, 0x08, 0x28, 0x04, 0x1c, 0xd2, 0x0e,
-                0x62, 0xfd, 0x2c, 0xef, 0xa5, 0x3d, 0x19, 0xf5, 0x69, 0x45, 0x95, 0xd5, 0xae, 0x63,
-                0x02, 0x27, 0x67, 0x3c, 0x80, 0x24, 0x9c, 0xe1, 0x24, 0x41, 0x9f, 0x46, 0xdf, 0x4e,
-                0x7b, 0x3f, 0xc1, 0x04, 0x61, 0x28, 0xcd, 0x0b,
-            ],
-            c_out: [
-                0xbc, 0x16, 0xaf, 0xa8, 0xaa, 0xb2, 0x38, 0x06, 0x26, 0x01, 0x8c, 0xe2, 0x75, 0x58,
-                0x67, 0x55, 0x8f, 0x9d, 0x59, 0x85, 0x73, 0x93, 0xa1, 0xf3, 0x48, 0xb2, 0x1c, 0xb5,
-                0x0f, 0x53, 0xea, 0xba, 0xe7, 0xf6, 0xe4, 0x7b, 0x45, 0x24, 0x1f, 0x6b, 0x7b, 0x3d,
-                0x68, 0x94, 0x5d, 0xd4, 0x0c, 0xad, 0xc5, 0x7a, 0x9a, 0xde, 0x6a, 0xf9, 0x69, 0xae,
-                0x07, 0x4f, 0xf2, 0x89, 0xbc, 0xb6, 0x61, 0x0a, 0xe3, 0x8c, 0x82, 0x10, 0xa5, 0xcb,
-                0xd7, 0x47, 0xb8, 0x31, 0x15, 0x1c, 0x56, 0xef, 0x02, 0xc9,
-            ],
-        },
-        TestVector {
-            ovk: [
-                0x57, 0x34, 0x67, 0xa7, 0xb3, 0x0e, 0xad, 0x6c, 0xcc, 0x50, 0x47, 0x44, 0xca, 0x9e,
-                0x1a, 0x28, 0x1a, 0x0d, 0x1a, 0x08, 0x73, 0x8b, 0x06, 0xa0, 0x68, 0x4f, 0xea, 0xcd,
-                0x1e, 0x9d, 0x12, 0x6d,
-            ],
-            ivk: [
-                0xdb, 0x95, 0xea, 0x8b, 0xd9, 0xf9, 0x3d, 0x41, 0xb5, 0xab, 0x2b, 0xeb, 0xc9, 0x1a,
-                0x38, 0xed, 0xd5, 0x27, 0x08, 0x3e, 0x2a, 0x6e, 0xf9, 0xf3, 0xc2, 0x97, 0x02, 0xd5,
-                0xff, 0x89, 0xed, 0x00,
-            ],
-            default_d: [
-                0x23, 0x3c, 0x4a, 0xb8, 0x86, 0xa5, 0x5e, 0x3b, 0xa3, 0x74, 0xc0,
-            ],
-            default_pk_d: [
-                0xb6, 0x8e, 0x9e, 0xe0, 0xc0, 0x67, 0x8d, 0x7b, 0x30, 0x36, 0x93, 0x1c, 0x83, 0x1a,
-                0x25, 0x25, 0x5f, 0x7e, 0xe4, 0x87, 0x38, 0x5a, 0x30, 0x31, 0x6e, 0x15, 0xf6, 0x48,
-                0x2b, 0x87, 0x4f, 0xda,
-            ],
-            v: 1000000000,
-            rcm: [
-                0x6e, 0xbb, 0xed, 0x74, 0x36, 0x19, 0xa2, 0x56, 0xf9, 0xad, 0x2e, 0x85, 0x88, 0x0c,
-                0xfa, 0xa9, 0x09, 0x8a, 0x5f, 0xdb, 0x16, 0x29, 0x99, 0x0d, 0x9a, 0x7d, 0x3b, 0xb9,
-                0x3f, 0xc9, 0x00, 0x03,
-            ],
-            memo: [
-                0xf6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-            ],
-            cv: [
-                0x2a, 0x54, 0x7d, 0x97, 0x8c, 0x7c, 0x90, 0xa8, 0xd0, 0xa5, 0x47, 0x4e, 0x29, 0xdb,
-                0xff, 0xf3, 0x4b, 0xae, 0x81, 0xe6, 0x40, 0x8e, 0xc1, 0xfe, 0x2d, 0x56, 0xa2, 0x52,
-                0x41, 0xa8, 0xe3, 0x29,
-            ],
-            cmu: [
-                0xf4, 0xba, 0x4e, 0xf0, 0x40, 0xf8, 0x0d, 0x00, 0x08, 0x0d, 0x29, 0xa6, 0xb3, 0x99,
-                0xdc, 0x40, 0x32, 0x40, 0x33, 0x61, 0xe0, 0x59, 0x1e, 0xd6, 0x14, 0x99, 0xbc, 0x06,
-                0x8e, 0x41, 0xed, 0x38,
-            ],
-            esk: [
-                0x29, 0x95, 0x89, 0x80, 0x69, 0x4f, 0x7f, 0x67, 0x08, 0x09, 0x97, 0xc2, 0x66, 0x47,
-                0x02, 0x89, 0x0c, 0xd1, 0xb5, 0x03, 0xdd, 0xa4, 0x2d, 0x33, 0xa8, 0x99, 0xce, 0x99,
-                0x1f, 0xe0, 0xf8, 0x00,
-            ],
-            epk: [
-                0xea, 0x6b, 0x3c, 0x98, 0x5f, 0x33, 0xb2, 0xa2, 0x2d, 0x0d, 0xbf, 0x7c, 0xd9, 0x30,
-                0x19, 0xfd, 0x9e, 0x57, 0x31, 0x6c, 0x85, 0xb7, 0x67, 0x49, 0x54, 0x62, 0x9c, 0x77,
-                0xdf, 0xae, 0xc0, 0x66,
-            ],
-            shared_secret: [
-                0xc0, 0x64, 0x58, 0x25, 0xdf, 0xc4, 0x4d, 0x54, 0x82, 0x83, 0xf6, 0xe8, 0x88, 0x25,
-                0x3b, 0xf5, 0xc3, 0x2a, 0x90, 0xde, 0xbb, 0x92, 0x8e, 0x89, 0x67, 0x86, 0xac, 0x0b,
-                0x16, 0xd5, 0xf6, 0x56,
-            ],
-            k_enc: [
-                0x33, 0xd2, 0xda, 0x8d, 0x80, 0xe0, 0xce, 0xd8, 0xb4, 0xbe, 0xec, 0x94, 0x3a, 0x0f,
-                0xc9, 0xc9, 0x60, 0xad, 0x7c, 0xcc, 0x59, 0x77, 0x43, 0x74, 0x4c, 0x18, 0xc9, 0xc2,
-                0xa5, 0x62, 0xf6, 0x3a,
-            ],
-            _p_enc: [
-                0x01, 0x23, 0x3c, 0x4a, 0xb8, 0x86, 0xa5, 0x5e, 0x3b, 0xa3, 0x74, 0xc0, 0x00, 0xca,
-                0x9a, 0x3b, 0x00, 0x00, 0x00, 0x00, 0x6e, 0xbb, 0xed, 0x74, 0x36, 0x19, 0xa2, 0x56,
-                0xf9, 0xad, 0x2e, 0x85, 0x88, 0x0c, 0xfa, 0xa9, 0x09, 0x8a, 0x5f, 0xdb, 0x16, 0x29,
-                0x99, 0x0d, 0x9a, 0x7d, 0x3b, 0xb9, 0x3f, 0xc9, 0x00, 0x03, 0xf6, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-                0x00, 0x00, 0x00, 0x00,
-            ],
-            c_enc: [
-                0x14, 0x9a, 0x52, 0xf8, 0xf5, 0x34, 0x2b, 0x44, 0x84, 0x88, 0x91, 0xf8, 0x85, 0xd3,
-                0xcd, 0x09, 0x9a, 0xbe, 0x80, 0x5a, 0xa5, 0x09, 0x1f, 0xe1, 0x71, 0x0e, 0xb7, 0x35,
-                0x02, 0xde, 0x38, 0x7d, 0xf3, 0xf9, 0x64, 0x67, 0x22, 0xe8, 0xb8, 0x5c, 0x37, 0x7c,
-                0x82, 0x2a, 0x71, 0x03, 0x34, 0x7c, 0x81, 0x01, 0xe9, 0xae, 0x8c, 0x31, 0x82, 0xca,
-                0x36, 0xda, 0xfd, 0x75, 0x8d, 0x96, 0xce, 0xba, 0x48, 0x32, 0x7a, 0x09, 0x82, 0x86,
-                0xa4, 0xe8, 0x32, 0x1d, 0x1e, 0x74, 0xfe, 0x3d, 0x61, 0x59, 0xc0, 0x29, 0x48, 0x3d,
-                0xe9, 0xee, 0xf3, 0xb2, 0x4d, 0x85, 0xe4, 0xd5, 0x16, 0xb8, 0x70, 0x4f, 0x8e, 0x7d,
-                0x93, 0xe7, 0x44, 0x42, 0xed, 0x00, 0x7a, 0xd7, 0x9a, 0x61, 0x52, 0xf2, 0xb6, 0x64,
-                0x2f, 0xbe, 0xe6, 0x04, 0x35, 0xe1, 0x92, 0x09, 0xd8, 0x11, 0xc6, 0x6c, 0x17, 0xb7,
-                0xdf, 0x3d, 0xfd, 0x76, 0x9f, 0xb5, 0xc7, 0xd0, 0x06, 0xb3, 0x67, 0x42, 0xbb, 0xe7,
-                0x26, 0x92, 0x9e, 0x87, 0x9b, 0x11, 0x6d, 0x36, 0x13, 0x57, 0x1a, 0xa6, 0x3a, 0xc2,
-                0xcc, 0xca, 0x43, 0xf8, 0x90, 0x0b, 0x89, 0x3e, 0x64, 0xdd, 0x0b, 0x8f, 0xf9, 0x1e,
-                0xc5, 0x11, 0x40, 0x82, 0xe6, 0xd0, 0x0c, 0xf9, 0x3a, 0x7c, 0xfa, 0x75, 0x18, 0xbb,
-                0x7f, 0xb6, 0x4a, 0x7f, 0x34, 0x64, 0x20, 0xb6, 0x44, 0x78, 0xd7, 0x18, 0x69, 0xe9,
-                0x1d, 0x47, 0x97, 0x90, 0x1f, 0xa8, 0x6e, 0x70, 0xb2, 0x20, 0x1a, 0xfe, 0x4b, 0xd3,
-                0xea, 0x55, 0x03, 0x81, 0x6f, 0xac, 0x68, 0x7d, 0x81, 0x25, 0x2f, 0x65, 0x61, 0x6e,
-                0x7f, 0xb2, 0x68, 0x46, 0x52, 0x1e, 0x39, 0xff, 0x94, 0xbe, 0x73, 0xb8, 0xac, 0xa8,
-                0x04, 0xc6, 0x5c, 0xf9, 0x4e, 0x32, 0x56, 0xbd, 0x3c, 0x69, 0xad, 0x31, 0x8e, 0x6b,
-                0x28, 0x55, 0x19, 0x48, 0x77, 0x93, 0xee, 0x29, 0x88, 0x51, 0x40, 0xf0, 0xbc, 0x00,
-                0x84, 0x5f, 0x67, 0x41, 0x5f, 0x67, 0x0f, 0x04, 0xca, 0x81, 0x8c, 0x5f, 0x32, 0x49,
-                0xd3, 0xfb, 0x70, 0xbf, 0xea, 0x10, 0xc6, 0x25, 0xeb, 0x8c, 0xf2, 0xca, 0xb3, 0xf5,
-                0x83, 0x62, 0x2a, 0x21, 0xa3, 0x8b, 0x8f, 0xe5, 0x1a, 0x5f, 0xf2, 0x91, 0x9e, 0xf4,
-                0xc1, 0xbd, 0x98, 0x30, 0xa9, 0xf2, 0x48, 0x6a, 0xbd, 0x88, 0x5d, 0xd9, 0x43, 0xb9,
-                0x4e, 0xdc, 0x8f, 0x88, 0xc8, 0xb7, 0x8a, 0x5e, 0xb0, 0x31, 0xf3, 0x4b, 0x7d, 0x93,
-                0x1c, 0x87, 0x53, 0xaf, 0xd9, 0x76, 0x8d, 0x0f, 0xa8, 0xd2, 0x6e, 0x88, 0xc9, 0x56,
-                0x7a, 0xd5, 0x89, 0x23, 0xe7, 0xb0, 0xaf, 0xbd, 0xaa, 0xdf, 0x47, 0x7b, 0xd1, 0xd2,
-                0x3f, 0xc4, 0x0a, 0x42, 0xc2, 0x9b, 0x4d, 0x5f, 0xe1, 0x08, 0x76, 0x45, 0xdd, 0xfd,
-                0xeb, 0xa0, 0xc7, 0xd5, 0x67, 0x15, 0xcd, 0x57, 0xf0, 0xd1, 0x74, 0x1a, 0x3d, 0x9c,
-                0xb3, 0x8d, 0x88, 0xd6, 0x47, 0xb1, 0xc5, 0xb2, 0x4a, 0xdd, 0xba, 0xd1, 0xac, 0xfa,
-                0x3a, 0x8d, 0xa3, 0x7a, 0x74, 0x26, 0x05, 0x55, 0xec, 0x0d, 0xea, 0x88, 0xed, 0x2c,
-                0x7f, 0x46, 0xdd, 0x87, 0xb3, 0xf2, 0x79, 0xa9, 0x6a, 0x0e, 0x78, 0x54, 0xec, 0x4a,
-                0x79, 0xce, 0xad, 0xc7, 0x4a, 0x68, 0x0f, 0xc8, 0x2d, 0x75, 0xae, 0xc7, 0xf2, 0xd1,
-                0x3d, 0xfb, 0x62, 0x23, 0x50, 0x57, 0xe4, 0xf7, 0xdc, 0x5b, 0x07, 0xc6, 0xba, 0xba,
-                0x82, 0xb3, 0x2f, 0xe9, 0x0b, 0x5c, 0x6e, 0x9d, 0xc6, 0xb2, 0xfb, 0x33, 0xbe, 0xac,
-                0x88, 0x0d, 0x3a, 0x60, 0xba, 0x08, 0x48, 0xfa, 0xc6, 0x61, 0x9d, 0xa8, 0xca, 0x33,
-                0xa6, 0x32, 0x94, 0xeb, 0x63, 0xd0, 0xf2, 0x4c, 0xbb, 0x1e, 0x03, 0x17, 0x82, 0x88,
-                0x0f, 0xfa, 0x18, 0x35, 0x6c, 0x98, 0x76, 0x2c, 0xcd, 0xd3, 0xaf, 0xab, 0x81, 0xf1,
-                0x9a, 0xbf, 0x3b, 0xdd, 0x2b, 0xc4, 0x3c, 0xb1, 0xf2, 0x15, 0x5c, 0xaf, 0x64, 0x98,
-                0x89, 0x4e, 0x06, 0x8b, 0xa7, 0x49, 0xc9, 0x76, 0xec, 0x23, 0xf2, 0x11, 0x62, 0x26,
-                0x14, 0x60, 0x78, 0x56, 0xd8, 0x7b, 0x74, 0x16, 0x24, 0xf7, 0xf8, 0x34, 0x95, 0xd7,
-                0xde, 0x4d, 0x6d, 0xe2, 0x08, 0xe1, 0x35, 0x74, 0xc8, 0x2a, 0x1b, 0x8b, 0x1c, 0xfe,
-                0x87, 0xe9, 0x18, 0xe7, 0xb3, 0x96,
-            ],
-            ock: [
-                0xdb, 0x5b, 0xa6, 0xb9, 0xdb, 0xb1, 0x1f, 0x7c, 0xe8, 0x12, 0xeb, 0x1b, 0xf3, 0x29,
-                0x8c, 0xca, 0x55, 0x71, 0xee, 0xcc, 0x69, 0xb7, 0x22, 0xa0, 0xa3, 0xb8, 0x67, 0x50,
-                0x72, 0x92, 0x99, 0xa0,
-            ],
-            _op: [
-                0xb6, 0x8e, 0x9e, 0xe0, 0xc0, 0x67, 0x8d, 0x7b, 0x30, 0x36, 0x93, 0x1c, 0x83, 0x1a,
-                0x25, 0x25, 0x5f, 0x7e, 0xe4, 0x87, 0x38, 0x5a, 0x30, 0x31, 0x6e, 0x15, 0xf6, 0x48,
-                0x2b, 0x87, 0x4f, 0xda, 0x29, 0x95, 0x89, 0x80, 0x69, 0x4f, 0x7f, 0x67, 0x08, 0x09,
-                0x97, 0xc2, 0x66, 0x47, 0x02, 0x89, 0x0c, 0xd1, 0xb5, 0x03, 0xdd, 0xa4, 0x2d, 0x33,
-                0xa8, 0x99, 0xce, 0x99, 0x1f, 0xe0, 0xf8, 0x00,
-            ],
-            c_out: [
-                0xe2, 0x7a, 0x46, 0x4d, 0x6f, 0x44, 0xcc, 0x44, 0xf6, 0x17, 0xe2, 0x3c, 0x9f, 0xb1,
-                0xb7, 0x1f, 0xff, 0xd4, 0x6a, 0xeb, 0xf0, 0x36, 0x77, 0xcf, 0x7d, 0xd2, 0x4d, 0x71,
-                0x1b, 0xa0, 0xc6, 0xca, 0x38, 0x53, 0x09, 0x7b, 0x24, 0x7a, 0xb7, 0x4c, 0x15, 0xbb,
-                0x93, 0x8e, 0xd6, 0x02, 0xfb, 0xcd, 0x30, 0xf4, 0xa6, 0x59, 0x56, 0x43, 0x0f, 0x47,
-                0xa0, 0xfb, 0xcb, 0xe8, 0xe0, 0x8a, 0xad, 0xa3, 0x86, 0x30, 0x78, 0x5a, 0x80, 0x57,
-                0x53, 0xba, 0x33, 0xb3, 0x34, 0xcd, 0x2a, 0x4b, 0xfc, 0x3d,
-            ],
-        },
-    ]
-}
diff --git a/zcash_primitives/src/transaction/builder.rs b/zcash_primitives/src/transaction/builder.rs
index 958a64454e..fe5a811346 100644
--- a/zcash_primitives/src/transaction/builder.rs
+++ b/zcash_primitives/src/transaction/builder.rs
@@ -5,35 +5,42 @@ use std::error;
 use std::fmt;
 use std::sync::mpsc::Sender;
 
-use rand::{rngs::OsRng, CryptoRng, RngCore};
+use rand::{CryptoRng, RngCore};
 
 use crate::{
-    consensus::{self, BlockHeight, BranchId},
-    keys::OutgoingViewingKey,
+    consensus::{self, BlockHeight, BranchId, NetworkUpgrade},
     legacy::TransparentAddress,
     memo::MemoBytes,
-    sapling::{self, prover::TxProver, value::NoteValue, Diversifier, Note, PaymentAddress},
+    sapling::{
+        self,
+        builder::SaplingMetadata,
+        prover::{OutputProver, SpendProver},
+        Note, PaymentAddress,
+    },
     transaction::{
         components::{
             amount::{Amount, BalanceError},
-            sapling::{
-                builder::{self as sapling_builder, SaplingBuilder, SaplingMetadata},
-                fees as sapling_fees,
-            },
-            transparent::{self, builder::TransparentBuilder},
+            transparent::{self, builder::TransparentBuilder, TxOut},
+        },
+        fees::{
+            transparent::{InputView, OutputView},
+            FeeRule,
         },
-        fees::FeeRule,
         sighash::{signature_hash, SignableInput},
         txid::TxIdDigester,
         Transaction, TransactionData, TxVersion, Unauthorized,
     },
-    zip32::ExtendedSpendingKey,
 };
 
+use zcash_protocol::value::ZatBalance;
+
 #[cfg(feature = "transparent-inputs")]
-use crate::transaction::components::transparent::TxOut;
+use crate::transaction::components::transparent::builder::TransparentInputInfo;
+
+#[cfg(not(feature = "transparent-inputs"))]
+use std::convert::Infallible;
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 use crate::{
     extensions::transparent::{ExtensionTxBuilder, ToPayload},
     transaction::{
@@ -45,13 +52,32 @@ use crate::{
     },
 };
 
+use super::components::amount::NonNegativeAmount;
+use super::components::sapling::zip212_enforcement;
+
 /// Since Blossom activation, the default transaction expiry delta should be 40 blocks.
 /// <https://zips.z.cash/zip-0203#changes-for-blossom>
-const DEFAULT_TX_EXPIRY_DELTA: u32 = 40;
+pub const DEFAULT_TX_EXPIRY_DELTA: u32 = 40;
+
+/// Errors that can occur during fee calculation.
+#[derive(Debug)]
+pub enum FeeError<FE> {
+    FeeRule(FE),
+    Bundle(&'static str),
+}
+
+impl<FE: fmt::Display> fmt::Display for FeeError<FE> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            FeeError::FeeRule(e) => write!(f, "An error occurred in fee calculation: {}", e),
+            FeeError::Bundle(b) => write!(f, "Bundle structure invalid in fee calculation: {}", b),
+        }
+    }
+}
 
 /// Errors that can occur during transaction construction.
-#[derive(Debug, PartialEq, Eq)]
-pub enum Error<FeeError> {
+#[derive(Debug)]
+pub enum Error<FE> {
     /// Insufficient funds were provided to the transaction builder; the given
     /// additional amount is required in order to construct the transaction.
     InsufficientFunds(Amount),
@@ -59,15 +85,27 @@ pub enum Error<FeeError> {
     /// add a change output.
     ChangeRequired(Amount),
     /// An error occurred in computing the fees for a transaction.
-    Fee(FeeError),
+    Fee(FeeError<FE>),
     /// An overflow or underflow occurred when computing value balances
     Balance(BalanceError),
     /// An error occurred in constructing the transparent parts of a transaction.
     TransparentBuild(transparent::builder::Error),
     /// An error occurred in constructing the Sapling parts of a transaction.
-    SaplingBuild(sapling_builder::Error),
+    SaplingBuild(sapling::builder::Error),
+    /// An error occurred in constructing the Orchard parts of a transaction.
+    OrchardBuild(orchard::builder::BuildError),
+    /// An error occurred in adding an Orchard Spend to a transaction.
+    OrchardSpend(orchard::builder::SpendError),
+    /// An error occurred in adding an Orchard Output to a transaction.
+    OrchardRecipient(orchard::builder::OutputError),
+    /// The builder was constructed without support for the Sapling pool, but a Sapling
+    /// spend or output was added.
+    SaplingBuilderNotAvailable,
+    /// The builder was constructed with a target height before NU5 activation, but an Orchard
+    /// spend or output was added.
+    OrchardBuilderNotAvailable,
     /// An error occurred in constructing the TZE parts of a transaction.
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     TzeBuild(tze::builder::Error),
 }
 
@@ -88,7 +126,18 @@ impl<FE: fmt::Display> fmt::Display for Error<FE> {
             Error::Fee(e) => write!(f, "An error occurred in fee calculation: {}", e),
             Error::TransparentBuild(err) => err.fmt(f),
             Error::SaplingBuild(err) => err.fmt(f),
-            #[cfg(feature = "zfuture")]
+            Error::OrchardBuild(err) => write!(f, "{:?}", err),
+            Error::OrchardSpend(err) => write!(f, "Could not add Orchard spend: {}", err),
+            Error::OrchardRecipient(err) => write!(f, "Could not add Orchard recipient: {}", err),
+            Error::SaplingBuilderNotAvailable => write!(
+                f,
+                "Cannot create Sapling transactions without a Sapling anchor"
+            ),
+            Error::OrchardBuilderNotAvailable => write!(
+                f,
+                "Cannot create Orchard transactions without an Orchard anchor, or before NU5 activation"
+            ),
+            #[cfg(zcash_unstable = "tze")]
             Error::TzeBuild(err) => err.fmt(f),
         }
     }
@@ -102,6 +151,24 @@ impl<FE> From<BalanceError> for Error<FE> {
     }
 }
 
+impl<FE> From<FeeError<FE>> for Error<FE> {
+    fn from(e: FeeError<FE>) -> Self {
+        Error::Fee(e)
+    }
+}
+
+impl<FE> From<sapling::builder::Error> for Error<FE> {
+    fn from(e: sapling::builder::Error) -> Self {
+        Error::SaplingBuild(e)
+    }
+}
+
+impl<FE> From<orchard::builder::SpendError> for Error<FE> {
+    fn from(e: orchard::builder::SpendError) -> Self {
+        Error::OrchardSpend(e)
+    }
+}
+
 /// Reports on the progress made by the builder towards building a transaction.
 pub struct Progress {
     /// The number of steps completed.
@@ -110,11 +177,16 @@ pub struct Progress {
     end: Option<u32>,
 }
 
-impl Progress {
-    pub fn new(cur: u32, end: Option<u32>) -> Self {
-        Self { cur, end }
+impl From<(u32, u32)> for Progress {
+    fn from((cur, end): (u32, u32)) -> Self {
+        Self {
+            cur,
+            end: Some(end),
+        }
     }
+}
 
+impl Progress {
     /// Returns the number of steps completed so far while building the transaction.
     ///
     /// Note that each step may not be of the same complexity/duration.
@@ -131,22 +203,101 @@ impl Progress {
     }
 }
 
+/// Rules for how the builder should be configured for each shielded pool.
+#[derive(Clone, Copy)]
+pub enum BuildConfig {
+    Standard {
+        sapling_anchor: Option<sapling::Anchor>,
+        orchard_anchor: Option<orchard::Anchor>,
+    },
+    Coinbase,
+}
+
+impl BuildConfig {
+    /// Returns the Sapling bundle type and anchor for this configuration.
+    pub fn sapling_builder_config(
+        &self,
+    ) -> Option<(sapling::builder::BundleType, sapling::Anchor)> {
+        match self {
+            BuildConfig::Standard { sapling_anchor, .. } => sapling_anchor
+                .as_ref()
+                .map(|a| (sapling::builder::BundleType::DEFAULT, *a)),
+            BuildConfig::Coinbase => Some((
+                sapling::builder::BundleType::Coinbase,
+                sapling::Anchor::empty_tree(),
+            )),
+        }
+    }
+
+    /// Returns the Orchard bundle type and anchor for this configuration.
+    pub fn orchard_builder_config(
+        &self,
+    ) -> Option<(orchard::builder::BundleType, orchard::Anchor)> {
+        match self {
+            BuildConfig::Standard { orchard_anchor, .. } => orchard_anchor
+                .as_ref()
+                .map(|a| (orchard::builder::BundleType::DEFAULT, *a)),
+            BuildConfig::Coinbase => Some((
+                orchard::builder::BundleType::Coinbase,
+                orchard::Anchor::empty_tree(),
+            )),
+        }
+    }
+}
+
+/// The result of a transaction build operation, which includes the resulting transaction along
+/// with metadata describing how spends and outputs were shuffled in creating the transaction's
+/// shielded bundles.
+#[derive(Debug)]
+pub struct BuildResult {
+    transaction: Transaction,
+    sapling_meta: SaplingMetadata,
+    orchard_meta: orchard::builder::BundleMetadata,
+}
+
+impl BuildResult {
+    /// Returns the transaction that was constructed by the builder.
+    pub fn transaction(&self) -> &Transaction {
+        &self.transaction
+    }
+
+    /// Returns the mapping from Sapling inputs and outputs to their randomized positions in the
+    /// Sapling bundle in the newly constructed transaction.
+    pub fn sapling_meta(&self) -> &SaplingMetadata {
+        &self.sapling_meta
+    }
+
+    /// Returns the mapping from Orchard inputs and outputs to the randomized positions of the
+    /// Actions that contain them in the Orchard bundle in the newly constructed transaction.
+    pub fn orchard_meta(&self) -> &orchard::builder::BundleMetadata {
+        &self.orchard_meta
+    }
+}
+
 /// Generates a [`Transaction`] from its inputs and outputs.
-pub struct Builder<'a, P, R> {
+pub struct Builder<'a, P, U: sapling::builder::ProverProgress> {
     params: P,
-    rng: R,
+    build_config: BuildConfig,
     target_height: BlockHeight,
     expiry_height: BlockHeight,
     transparent_builder: TransparentBuilder,
-    sapling_builder: SaplingBuilder<P>,
-    #[cfg(feature = "zfuture")]
+    sapling_builder: Option<sapling::builder::Builder>,
+    orchard_builder: Option<orchard::builder::Builder>,
+    // TODO: In the future, instead of taking the spending keys as arguments when calling
+    // `add_sapling_spend` or `add_orchard_spend`, we will build an unauthorized, unproven
+    // transaction, and then the caller will be responsible for using the spending keys or their
+    // derivatives for proving and signing to complete transaction creation.
+    sapling_asks: Vec<sapling::keys::SpendAuthorizingKey>,
+    orchard_saks: Vec<orchard::keys::SpendAuthorizingKey>,
+    zip233_amount: Option<NonNegativeAmount>,
+    #[cfg(zcash_unstable = "tze")]
     tze_builder: TzeBuilder<'a, TransactionData<Unauthorized>>,
-    #[cfg(not(feature = "zfuture"))]
+    #[cfg(not(zcash_unstable = "tze"))]
     tze_builder: std::marker::PhantomData<&'a ()>,
-    progress_notifier: Option<Sender<Progress>>,
+    progress_notifier: U,
 }
 
-impl<'a, P, R> Builder<'a, P, R> {
+impl<'a, P, U: sapling::builder::ProverProgress> Builder<'a, P, U> {
     /// Returns the network parameters that the builder has been configured for.
     pub fn params(&self) -> &P {
         &self.params
@@ -159,114 +310,192 @@ impl<'a, P, R> Builder<'a, P, R> {
 
     /// Returns the set of transparent inputs currently committed to be consumed
     /// by the transaction.
-    pub fn transparent_inputs(&self) -> &[impl transparent::fees::InputView] {
+    #[cfg(feature = "transparent-inputs")]
+    pub fn transparent_inputs(&self) -> &[TransparentInputInfo] {
         self.transparent_builder.inputs()
     }
 
     /// Returns the set of transparent outputs currently set to be produced by
     /// the transaction.
-    pub fn transparent_outputs(&self) -> &[impl transparent::fees::OutputView] {
+    pub fn transparent_outputs(&self) -> &[TxOut] {
         self.transparent_builder.outputs()
     }
 
     /// Returns the set of Sapling inputs currently committed to be consumed
     /// by the transaction.
-    pub fn sapling_inputs(&self) -> &[impl sapling_fees::InputView<()>] {
-        self.sapling_builder.inputs()
+    pub fn sapling_inputs(&self) -> &[sapling::builder::SpendInfo] {
+        self.sapling_builder
+            .as_ref()
+            .map_or_else(|| &[][..], |b| b.inputs())
     }
 
     /// Returns the set of Sapling outputs currently set to be produced by
     /// the transaction.
-    pub fn sapling_outputs(&self) -> &[impl sapling_fees::OutputView] {
-        self.sapling_builder.outputs()
+    pub fn sapling_outputs(&self) -> &[sapling::builder::OutputInfo] {
+        self.sapling_builder
+            .as_ref()
+            .map_or_else(|| &[][..], |b| b.outputs())
     }
 }
 
-impl<'a, P: consensus::Parameters> Builder<'a, P, OsRng> {
+impl<'a, P: consensus::Parameters> Builder<'a, P, ()> {
     /// Creates a new `Builder` targeted for inclusion in the block with the given height,
-    /// using default values for general transaction fields and the default OS random.
+    /// using default values for general transaction fields.
     ///
     /// # Default values
     ///
     /// The expiry height will be set to the given height plus the default transaction
     /// expiry delta (20 blocks).
-    pub fn new(params: P, target_height: BlockHeight) -> Self {
-        Builder::new_with_rng(params, target_height, OsRng)
-    }
-}
+    pub fn new(params: P, target_height: BlockHeight, build_config: BuildConfig) -> Self {
+        let orchard_builder = if params.is_nu_active(NetworkUpgrade::Nu5, target_height) {
+            build_config
+                .orchard_builder_config()
+                .map(|(bundle_type, anchor)| orchard::builder::Builder::new(bundle_type, anchor))
+        } else {
+            None
+        };
 
-impl<'a, P: consensus::Parameters, R: RngCore + CryptoRng> Builder<'a, P, R> {
-    /// Creates a new `Builder` targeted for inclusion in the block with the given height
-    /// and randomness source, using default values for general transaction fields.
-    ///
-    /// # Default values
-    ///
-    /// The expiry height will be set to the given height plus the default transaction
-    /// expiry delta.
-    pub fn new_with_rng(params: P, target_height: BlockHeight, rng: R) -> Builder<'a, P, R> {
-        Self::new_internal(params, rng, target_height)
-    }
-}
+        let sapling_builder = build_config
+            .sapling_builder_config()
+            .map(|(bundle_type, anchor)| {
+                sapling::builder::Builder::new(
+                    zip212_enforcement(&params, target_height),
+                    bundle_type,
+                    anchor,
+                )
+            });
 
-impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
-    /// Common utility function for builder construction.
-    ///
-    /// WARNING: THIS MUST REMAIN PRIVATE AS IT ALLOWS CONSTRUCTION
-    /// OF BUILDERS WITH NON-CryptoRng RNGs
-    fn new_internal(params: P, rng: R, target_height: BlockHeight) -> Builder<'a, P, R> {
         Builder {
-            params: params.clone(),
-            rng,
+            params,
+            build_config,
             target_height,
             expiry_height: target_height + DEFAULT_TX_EXPIRY_DELTA,
             transparent_builder: TransparentBuilder::empty(),
-            sapling_builder: SaplingBuilder::new(params, target_height),
-            #[cfg(feature = "zfuture")]
+            sapling_builder,
+            orchard_builder,
+            sapling_asks: vec![],
+            orchard_saks: Vec::new(),
+            zip233_amount: None,
+            #[cfg(zcash_unstable = "tze")]
             tze_builder: TzeBuilder::empty(),
-            #[cfg(not(feature = "zfuture"))]
+            #[cfg(not(zcash_unstable = "tze"))]
             tze_builder: std::marker::PhantomData,
-            progress_notifier: None,
+            progress_notifier: (),
+        }
+    }
+
+    /// Sets the notifier channel, where progress of building the transaction is sent.
+    ///
+    /// An update is sent after every Sapling Spend or Output is computed, and the `u32`
+    /// sent represents the total steps completed so far. It will eventually send number
+    /// of spends + outputs. If there's an error building the transaction, the channel is
+    /// closed.
+    pub fn with_progress_notifier(
+        self,
+        progress_notifier: Sender<Progress>,
+    ) -> Builder<'a, P, Sender<Progress>> {
+        Builder {
+            params: self.params,
+            build_config: self.build_config,
+            target_height: self.target_height,
+            expiry_height: self.expiry_height,
+            transparent_builder: self.transparent_builder,
+            sapling_builder: self.sapling_builder,
+            orchard_builder: self.orchard_builder,
+            sapling_asks: self.sapling_asks,
+            orchard_saks: self.orchard_saks,
+            zip233_amount: self.zip233_amount,
+            tze_builder: self.tze_builder,
+            progress_notifier,
+        }
+    }
+}
+
+impl<'a, P: consensus::Parameters, U: sapling::builder::ProverProgress> Builder<'a, P, U> {
+    /// Adds an Orchard note to be spent in this bundle.
+    ///
+    /// Returns an error if the given Merkle path does not have the required anchor for
+    /// the given note.
+    pub fn add_orchard_spend<FE>(
+        &mut self,
+        sk: &orchard::keys::SpendingKey,
+        note: orchard::Note,
+        merkle_path: orchard::tree::MerklePath,
+    ) -> Result<(), Error<FE>> {
+        if let Some(builder) = self.orchard_builder.as_mut() {
+            builder.add_spend(orchard::keys::FullViewingKey::from(sk), note, merkle_path)?;
+
+            self.orchard_saks
+                .push(orchard::keys::SpendAuthorizingKey::from(sk));
+
+            Ok(())
+        } else {
+            Err(Error::OrchardBuilderNotAvailable)
         }
     }
 
+    /// Adds an Orchard recipient to the transaction.
+    pub fn add_orchard_output<FE>(
+        &mut self,
+        ovk: Option<orchard::keys::OutgoingViewingKey>,
+        recipient: orchard::Address,
+        value: u64,
+        memo: MemoBytes,
+    ) -> Result<(), Error<FE>> {
+        self.orchard_builder
+            .as_mut()
+            .ok_or(Error::OrchardBuilderNotAvailable)?
+            .add_output(
+                ovk,
+                recipient,
+                orchard::value::NoteValue::from_raw(value),
+                Some(*memo.as_array()),
+            )
+            .map_err(Error::OrchardRecipient)
+    }
+
     /// Adds a Sapling note to be spent in this transaction.
     ///
     /// Returns an error if the given Merkle path does not have the same anchor as the
     /// paths for previous Sapling notes.
-    pub fn add_sapling_spend(
+    pub fn add_sapling_spend<FE>(
         &mut self,
-        extsk: ExtendedSpendingKey,
-        diversifier: Diversifier,
+        extsk: &sapling::zip32::ExtendedSpendingKey,
         note: Note,
         merkle_path: sapling::MerklePath,
-    ) -> Result<(), sapling_builder::Error> {
-        self.sapling_builder
-            .add_spend(&mut self.rng, extsk, diversifier, note, merkle_path)
+    ) -> Result<(), Error<FE>> {
+        if let Some(builder) = self.sapling_builder.as_mut() {
+            builder.add_spend(extsk, note, merkle_path)?;
+
+            self.sapling_asks.push(extsk.expsk.ask.clone());
+            Ok(())
+        } else {
+            Err(Error::SaplingBuilderNotAvailable)
+        }
     }
 
     /// Adds a Sapling address to send funds to.
-    pub fn add_sapling_output(
+    pub fn add_sapling_output<FE>(
         &mut self,
-        ovk: Option<OutgoingViewingKey>,
+        ovk: Option<sapling::keys::OutgoingViewingKey>,
         to: PaymentAddress,
-        value: Amount,
+        value: NonNegativeAmount,
         memo: MemoBytes,
-    ) -> Result<(), sapling_builder::Error> {
-        if value.is_negative() {
-            return Err(sapling_builder::Error::InvalidAmount);
-        }
-        self.sapling_builder.add_output(
-            &mut self.rng,
-            ovk,
-            to,
-            NoteValue::from_raw(value.into()),
-            memo,
-        )
+    ) -> Result<(), Error<FE>> {
+        self.sapling_builder
+            .as_mut()
+            .ok_or(Error::SaplingBuilderNotAvailable)?
+            .add_output(
+                ovk,
+                to,
+                sapling::value::NoteValue::from_raw(value.into()),
+                Some(*memo.as_array()),
+            )
+            .map_err(Error::SaplingBuild)
     }
 
     /// Adds a transparent coin to be spent in this transaction.
     #[cfg(feature = "transparent-inputs")]
-    #[cfg_attr(docsrs, doc(cfg(feature = "transparent-inputs")))]
     pub fn add_transparent_input(
         &mut self,
         sk: secp256k1::SecretKey,
@@ -280,27 +509,31 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
     pub fn add_transparent_output(
         &mut self,
         to: &TransparentAddress,
-        value: Amount,
+        value: NonNegativeAmount,
     ) -> Result<(), transparent::builder::Error> {
         self.transparent_builder.add_output(to, value)
     }
 
-    /// Sets the notifier channel, where progress of building the transaction is sent.
-    ///
-    /// An update is sent after every Spend or Output is computed, and the `u32` sent
-    /// represents the total steps completed so far. It will eventually send number of
-    /// spends + outputs. If there's an error building the transaction, the channel is
-    /// closed.
-    pub fn with_progress_notifier(&mut self, progress_notifier: Sender<Progress>) {
-        self.progress_notifier = Some(progress_notifier);
-    }
-
-    /// Returns the sum of the transparent, Sapling, and TZE value balances.
+    /// Returns the sum of the transparent, Sapling, Orchard, and TZE value balances.
     fn value_balance(&self) -> Result<Amount, BalanceError> {
         let value_balances = [
             self.transparent_builder.value_balance()?,
-            self.sapling_builder.value_balance(),
-            #[cfg(feature = "zfuture")]
+            self.sapling_builder
+                .as_ref()
+                .map_or_else(Amount::zero, |builder| builder.value_balance::<Amount>()),
+            self.orchard_builder.as_ref().map_or_else(
+                || Ok(Amount::zero()),
+                |builder| {
+                    builder
+                        .value_balance::<Amount>()
+                        .map_err(|_| BalanceError::Overflow)
+                },
+            )?,
+            -self
+                .zip233_amount
+                .map(Into::into)
+                .unwrap_or(ZatBalance::zero()),
+            #[cfg(zcash_unstable = "tze")]
             self.tze_builder.value_balance()?,
         ];
 
@@ -310,59 +543,150 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
             .ok_or(BalanceError::Overflow)
     }
 
-    /// Builds a transaction from the configured spends and outputs.
+    /// Reports the calculated fee given the specified fee rule.
     ///
-    /// Upon success, returns a tuple containing the final transaction, and the
-    /// [`SaplingMetadata`] generated during the build process.
-    pub fn build<FR: FeeRule>(
-        self,
-        prover: &impl TxProver,
+    /// This fee is a function of the spends and outputs that have been added to the builder,
+    /// pursuant to the specified [`FeeRule`].
+    pub fn get_fee<FR: FeeRule>(
+        &self,
         fee_rule: &FR,
-    ) -> Result<(Transaction, SaplingMetadata), Error<FR::Error>> {
-        let fee = fee_rule
+    ) -> Result<NonNegativeAmount, FeeError<FR::Error>> {
+        #[cfg(feature = "transparent-inputs")]
+        let transparent_inputs = self.transparent_builder.inputs();
+
+        #[cfg(not(feature = "transparent-inputs"))]
+        let transparent_inputs: &[Infallible] = &[];
+
+        let sapling_spends = self
+            .sapling_builder
+            .as_ref()
+            .map_or(0, |builder| builder.inputs().len());
+
+        fee_rule
             .fee_required(
                 &self.params,
                 self.target_height,
-                self.transparent_builder.inputs(),
-                self.transparent_builder.outputs(),
-                self.sapling_builder.inputs().len(),
-                self.sapling_builder.bundle_output_count(),
+                transparent_inputs.iter().map(|i| i.serialized_size()),
+                self.transparent_builder
+                    .outputs()
+                    .iter()
+                    .map(|i| i.serialized_size()),
+                sapling_spends,
+                self.sapling_builder
+                    .as_ref()
+                    .zip(self.build_config.sapling_builder_config())
+                    .map_or(Ok(0), |(builder, (bundle_type, _))| {
+                        bundle_type
+                            .num_outputs(sapling_spends, builder.outputs().len())
+                            .map_err(FeeError::Bundle)
+                    })?,
+                self.orchard_builder
+                    .as_ref()
+                    .zip(self.build_config.orchard_builder_config())
+                    .map_or(Ok(0), |(builder, (bundle_type, _))| {
+                        bundle_type
+                            .num_actions(builder.spends().len(), builder.outputs().len())
+                            .map_err(FeeError::Bundle)
+                    })?,
             )
-            .map_err(Error::Fee)?;
-        self.build_internal(prover, fee)
+            .map_err(FeeError::FeeRule)
     }
 
-    /// Builds a transaction from the configured spends and outputs.
-    ///
-    /// Upon success, returns a tuple containing the final transaction, and the
-    /// [`SaplingMetadata`] generated during the build process.
-    #[cfg(feature = "zfuture")]
-    pub fn build_zfuture<FR: FutureFeeRule>(
-        self,
-        prover: &impl TxProver,
+    #[cfg(zcash_unstable = "tze")]
+    pub fn get_fee_zfuture<FR: FeeRule + FutureFeeRule>(
+        &self,
         fee_rule: &FR,
-    ) -> Result<(Transaction, SaplingMetadata), Error<FR::Error>> {
-        let fee = fee_rule
+    ) -> Result<NonNegativeAmount, FeeError<FR::Error>> {
+        #[cfg(feature = "transparent-inputs")]
+        let transparent_inputs = self.transparent_builder.inputs();
+
+        #[cfg(not(feature = "transparent-inputs"))]
+        let transparent_inputs: &[Infallible] = &[];
+
+        let sapling_spends = self
+            .sapling_builder
+            .as_ref()
+            .map_or(0, |builder| builder.inputs().len());
+
+        fee_rule
             .fee_required_zfuture(
                 &self.params,
                 self.target_height,
-                self.transparent_builder.inputs(),
-                self.transparent_builder.outputs(),
-                self.sapling_builder.inputs().len(),
-                self.sapling_builder.bundle_output_count(),
+                transparent_inputs.iter().map(|i| i.serialized_size()),
+                self.transparent_builder
+                    .outputs()
+                    .iter()
+                    .map(|i| i.serialized_size()),
+                sapling_spends,
+                self.sapling_builder
+                    .as_ref()
+                    .zip(self.build_config.sapling_builder_config())
+                    .map_or(Ok(0), |(builder, (bundle_type, _))| {
+                        bundle_type
+                            .num_outputs(sapling_spends, builder.outputs().len())
+                            .map_err(FeeError::Bundle)
+                    })?,
+                self.orchard_builder
+                    .as_ref()
+                    .zip(self.build_config.orchard_builder_config())
+                    .map_or(Ok(0), |(builder, (bundle_type, _))| {
+                        bundle_type
+                            .num_actions(builder.spends().len(), builder.outputs().len())
+                            .map_err(FeeError::Bundle)
+                    })?,
                 self.tze_builder.inputs(),
                 self.tze_builder.outputs(),
             )
-            .map_err(Error::Fee)?;
+            .map_err(FeeError::FeeRule)
+    }
+
+    pub fn set_zip233_amount(&mut self, zip233_amount: Option<NonNegativeAmount>) {
+        self.zip233_amount = zip233_amount;
+    }
+
+    /// Builds a transaction from the configured spends and outputs.
+    ///
+    /// Upon success, returns a tuple containing the final transaction, and the
+    /// [`SaplingMetadata`] generated during the build process.
+    pub fn build<R: RngCore + CryptoRng, SP: SpendProver, OP: OutputProver, FR: FeeRule>(
+        self,
+        rng: R,
+        spend_prover: &SP,
+        output_prover: &OP,
+        fee_rule: &FR,
+    ) -> Result<BuildResult, Error<FR::Error>> {
+        let fee = self.get_fee(fee_rule).map_err(Error::Fee)?;
+        self.build_internal(rng, spend_prover, output_prover, fee)
+    }
 
-        self.build_internal(prover, fee)
+    /// Builds a transaction from the configured spends and outputs.
+    ///
+    /// Upon success, returns a tuple containing the final transaction, and the
+    /// [`SaplingMetadata`] generated during the build process.
+    #[cfg(zcash_unstable = "tze")]
+    pub fn build_zfuture<
+        R: RngCore + CryptoRng,
+        SP: SpendProver,
+        OP: OutputProver,
+        FR: FutureFeeRule,
+    >(
+        self,
+        rng: R,
+        spend_prover: &SP,
+        output_prover: &OP,
+        fee_rule: &FR,
+    ) -> Result<BuildResult, Error<FR::Error>> {
+        let fee = self.get_fee_zfuture(fee_rule).map_err(Error::Fee)?;
+        self.build_internal(rng, spend_prover, output_prover, fee)
     }
 
-    fn build_internal<FE>(
+    fn build_internal<R: RngCore + CryptoRng, SP: SpendProver, OP: OutputProver, FE>(
         self,
-        prover: &impl TxProver,
-        fee: Amount,
-    ) -> Result<(Transaction, SaplingMetadata), Error<FE>> {
+        mut rng: R,
+        spend_prover: &SP,
+        output_prover: &OP,
+        fee: NonNegativeAmount,
+    ) -> Result<BuildResult, Error<FE>> {
         let consensus_branch_id = BranchId::for_height(&self.params, self.target_height);
 
         // determine transaction version
@@ -373,7 +697,8 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
         //
 
         // After fees are accounted for, the value balance of the transaction must be zero.
-        let balance_after_fees = (self.value_balance()? - fee).ok_or(BalanceError::Underflow)?;
+        let balance_after_fees =
+            (self.value_balance()? - fee.into()).ok_or(BalanceError::Underflow)?;
 
         match balance_after_fees.cmp(&Amount::zero()) {
             Ordering::Less => {
@@ -387,20 +712,51 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
 
         let transparent_bundle = self.transparent_builder.build();
 
-        let mut rng = self.rng;
-        let mut ctx = prover.new_sapling_proving_context();
-        let sapling_bundle = self
+        let (sapling_bundle, sapling_meta) = match self
             .sapling_builder
-            .build(
-                prover,
-                &mut ctx,
-                &mut rng,
-                self.target_height,
-                self.progress_notifier.as_ref(),
-            )
-            .map_err(Error::SaplingBuild)?;
+            .and_then(|builder| {
+                builder
+                    .build::<SP, OP, _, _>(&mut rng)
+                    .map_err(Error::SaplingBuild)
+                    .transpose()
+                    .map(|res| {
+                        res.map(|(bundle, sapling_meta)| {
+                            // We need to create proofs before signatures, because we still support
+                            // creating V4 transactions, which commit to the Sapling proofs in the
+                            // transaction digest.
+                            (
+                                bundle.create_proofs(
+                                    spend_prover,
+                                    output_prover,
+                                    &mut rng,
+                                    self.progress_notifier,
+                                ),
+                                sapling_meta,
+                            )
+                        })
+                    })
+            })
+            .transpose()?
+        {
+            Some((bundle, meta)) => (Some(bundle), meta),
+            None => (None, SaplingMetadata::empty()),
+        };
 
-        #[cfg(feature = "zfuture")]
+        let (orchard_bundle, orchard_meta) = match self
+            .orchard_builder
+            .and_then(|builder| {
+                builder
+                    .build(&mut rng)
+                    .map_err(Error::OrchardBuild)
+                    .transpose()
+            })
+            .transpose()?
+        {
+            Some((bundle, meta)) => (Some(bundle), meta),
+            None => (None, orchard::builder::BundleMetadata::empty()),
+        };
+
+        #[cfg(zcash_unstable = "tze")]
         let (tze_bundle, tze_signers) = self.tze_builder.build();
 
         let unauthed_tx: TransactionData<Unauthorized> = TransactionData {
@@ -411,8 +767,9 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
             transparent_bundle,
             sprout_bundle: None,
             sapling_bundle,
-            orchard_bundle: None,
-            #[cfg(feature = "zfuture")]
+            orchard_bundle,
+            zip233_amount: self.zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             tze_bundle,
         };
 
@@ -430,7 +787,7 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
             )
         });
 
-        #[cfg(feature = "zfuture")]
+        #[cfg(zcash_unstable = "tze")]
         let tze_bundle = unauthed_tx
             .tze_bundle
             .clone()
@@ -444,17 +801,32 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
         let shielded_sig_commitment =
             signature_hash(&unauthed_tx, &SignableInput::Shielded, &txid_parts);
 
-        let (sapling_bundle, tx_metadata) = match unauthed_tx
+        let sapling_bundle = unauthed_tx
             .sapling_bundle
             .map(|b| {
-                b.apply_signatures(prover, &mut ctx, &mut rng, shielded_sig_commitment.as_ref())
+                b.apply_signatures(
+                    &mut rng,
+                    *shielded_sig_commitment.as_ref(),
+                    &self.sapling_asks,
+                )
             })
             .transpose()
-            .map_err(Error::SaplingBuild)?
-        {
-            Some((bundle, meta)) => (Some(bundle), meta),
-            None => (None, SaplingMetadata::empty()),
-        };
+            .map_err(Error::SaplingBuild)?;
+
+        let orchard_bundle = unauthed_tx
+            .orchard_bundle
+            .map(|b| {
+                b.create_proof(&orchard::circuit::ProvingKey::build(), &mut rng)
+                    .and_then(|b| {
+                        b.apply_signatures(
+                            &mut rng,
+                            *shielded_sig_commitment.as_ref(),
+                            &self.orchard_saks,
+                        )
+                    })
+            })
+            .transpose()
+            .map_err(Error::OrchardBuild)?;
 
         let authorized_tx = TransactionData {
             version: unauthed_tx.version,
@@ -464,20 +836,25 @@ impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
             transparent_bundle,
             sprout_bundle: unauthed_tx.sprout_bundle,
             sapling_bundle,
-            orchard_bundle: None,
-            #[cfg(feature = "zfuture")]
+            orchard_bundle,
+            zip233_amount: self.zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             tze_bundle,
         };
 
         // The unwrap() here is safe because the txid hashing
         // of freeze() should be infalliable.
-        Ok((authorized_tx.freeze().unwrap(), tx_metadata))
+        Ok(BuildResult {
+            transaction: authorized_tx.freeze().unwrap(),
+            sapling_meta,
+            orchard_meta,
+        })
     }
 }
 
-#[cfg(feature = "zfuture")]
-impl<'a, P: consensus::Parameters, R: RngCore + CryptoRng> ExtensionTxBuilder<'a>
-    for Builder<'a, P, R>
+#[cfg(zcash_unstable = "tze")]
+impl<'a, P: consensus::Parameters, U: sapling::builder::ProverProgress> ExtensionTxBuilder<'a>
+    for Builder<'a, P, U>
 {
     type BuildCtx = TransactionData<Unauthorized>;
     type BuildError = tze::builder::Error;
@@ -511,38 +888,61 @@ impl<'a, P: consensus::Parameters, R: RngCore + CryptoRng> ExtensionTxBuilder<'a
 #[cfg(any(test, feature = "test-dependencies"))]
 mod testing {
     use rand::RngCore;
-    use std::convert::Infallible;
+    use rand_core::CryptoRng;
 
-    use super::{Builder, Error, SaplingMetadata};
+    use super::{BuildResult, Builder, Error};
     use crate::{
-        consensus::{self, BlockHeight},
-        sapling::prover::mock::MockTxProver,
-        transaction::{fees::fixed, Transaction},
+        consensus,
+        sapling::{
+            self,
+            prover::mock::{MockOutputProver, MockSpendProver},
+        },
+        transaction::fees::zip317,
     };
 
-    impl<'a, P: consensus::Parameters, R: RngCore> Builder<'a, P, R> {
-        /// Creates a new `Builder` targeted for inclusion in the block with the given height
-        /// and randomness source, using default values for general transaction fields.
-        ///
-        /// # Default values
-        ///
-        /// The expiry height will be set to the given height plus the default transaction
-        /// expiry delta.
-        ///
-        /// WARNING: DO NOT USE IN PRODUCTION
-        pub fn test_only_new_with_rng(params: P, height: BlockHeight, rng: R) -> Builder<'a, P, R> {
-            Self::new_internal(params, rng, height)
-        }
+    impl<'a, P: consensus::Parameters, U: sapling::builder::ProverProgress> Builder<'a, P, U> {
+        /// Build the transaction using mocked randomness and proving capabilities.
+        /// DO NOT USE EXCEPT FOR UNIT TESTING.
+        pub fn mock_build<R: RngCore>(
+            self,
+            rng: R,
+        ) -> Result<BuildResult, Error<zip317::FeeError>> {
+            struct FakeCryptoRng<R: RngCore>(R);
+            impl<R: RngCore> CryptoRng for FakeCryptoRng<R> {}
+            impl<R: RngCore> RngCore for FakeCryptoRng<R> {
+                fn next_u32(&mut self) -> u32 {
+                    self.0.next_u32()
+                }
+
+                fn next_u64(&mut self) -> u64 {
+                    self.0.next_u64()
+                }
+
+                fn fill_bytes(&mut self, dest: &mut [u8]) {
+                    self.0.fill_bytes(dest)
+                }
+
+                fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), rand_core::Error> {
+                    self.0.try_fill_bytes(dest)
+                }
+            }
 
-        pub fn mock_build(self) -> Result<(Transaction, SaplingMetadata), Error<Infallible>> {
-            #[allow(deprecated)]
-            self.build(&MockTxProver, &fixed::FeeRule::standard())
+            self.build(
+                FakeCryptoRng(rng),
+                &MockSpendProver,
+                &MockOutputProver,
+                #[allow(deprecated)]
+                &zip317::FeeRule::standard(),
+            )
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use std::convert::Infallible;
+
+    use assert_matches::assert_matches;
     use ff::Field;
     use incrementalmerkletree::{frontier::CommitmentTree, witness::IncrementalWitness};
     use rand_core::OsRng;
@@ -551,60 +951,33 @@ mod tests {
         consensus::{NetworkUpgrade, Parameters, TEST_NETWORK},
         legacy::TransparentAddress,
         memo::MemoBytes,
-        sapling::{Node, Rseed},
-        transaction::components::{
-            amount::Amount,
-            sapling::builder::{self as sapling_builder},
-            transparent::builder::{self as transparent_builder},
+        sapling::{self, zip32::ExtendedSpendingKey, Node, Rseed},
+        transaction::{
+            builder::BuildConfig,
+            components::amount::{Amount, BalanceError, NonNegativeAmount},
         },
-        zip32::ExtendedSpendingKey,
     };
 
     use super::{Builder, Error};
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     #[cfg(feature = "transparent-inputs")]
     use super::TzeBuilder;
 
     #[cfg(feature = "transparent-inputs")]
     use crate::{
         legacy::keys::{AccountPrivKey, IncomingViewingKey},
-        transaction::{
-            builder::{SaplingBuilder, DEFAULT_TX_EXPIRY_DELTA},
-            OutPoint, TxOut,
-        },
+        transaction::{builder::DEFAULT_TX_EXPIRY_DELTA, OutPoint, TxOut},
         zip32::AccountId,
     };
 
-    #[test]
-    fn fails_on_negative_output() {
-        let extsk = ExtendedSpendingKey::master(&[]);
-        let dfvk = extsk.to_diversifiable_full_viewing_key();
-        let ovk = dfvk.fvk().ovk;
-        let to = dfvk.default_address().1;
-
-        let sapling_activation_height = TEST_NETWORK
-            .activation_height(NetworkUpgrade::Sapling)
-            .unwrap();
-
-        let mut builder = Builder::new(TEST_NETWORK, sapling_activation_height);
-        assert_eq!(
-            builder.add_sapling_output(
-                Some(ovk),
-                to,
-                Amount::from_i64(-1).unwrap(),
-                MemoBytes::empty()
-            ),
-            Err(sapling_builder::Error::InvalidAmount)
-        );
-    }
-
     // This test only works with the transparent_inputs feature because we have to
     // be able to create a tx with a valid balance, without using Sapling inputs.
     #[test]
     #[cfg(feature = "transparent-inputs")]
     fn binding_sig_absent_if_no_shielded_spend_or_output() {
         use crate::consensus::NetworkUpgrade;
+        use crate::legacy::keys::NonHardenedChildIndex;
         use crate::transaction::builder::{self, TransparentBuilder};
 
         let sapling_activation_height = TEST_NETWORK
@@ -614,33 +987,41 @@ mod tests {
         // Create a builder with 0 fee, so we can construct t outputs
         let mut builder = builder::Builder {
             params: TEST_NETWORK,
-            rng: OsRng,
+            build_config: BuildConfig::Standard {
+                sapling_anchor: Some(sapling::Anchor::empty_tree()),
+                orchard_anchor: Some(orchard::Anchor::empty_tree()),
+            },
             target_height: sapling_activation_height,
             expiry_height: sapling_activation_height + DEFAULT_TX_EXPIRY_DELTA,
             transparent_builder: TransparentBuilder::empty(),
-            sapling_builder: SaplingBuilder::new(TEST_NETWORK, sapling_activation_height),
-            #[cfg(feature = "zfuture")]
+            sapling_builder: None,
+            zip233_amount: None,
+            #[cfg(zcash_unstable = "tze")]
             tze_builder: TzeBuilder::empty(),
-            #[cfg(not(feature = "zfuture"))]
+            #[cfg(not(zcash_unstable = "tze"))]
             tze_builder: std::marker::PhantomData,
-            progress_notifier: None,
+            progress_notifier: (),
+            orchard_builder: None,
+            sapling_asks: vec![],
+            orchard_saks: Vec::new(),
         };
 
-        let tsk = AccountPrivKey::from_seed(&TEST_NETWORK, &[0u8; 32], AccountId::from(0)).unwrap();
+        let tsk = AccountPrivKey::from_seed(&TEST_NETWORK, &[0u8; 32], AccountId::ZERO).unwrap();
         let prev_coin = TxOut {
-            value: Amount::from_u64(50000).unwrap(),
+            value: NonNegativeAmount::const_from_u64(50000),
             script_pubkey: tsk
                 .to_account_pubkey()
                 .derive_external_ivk()
                 .unwrap()
-                .derive_address(0)
+                .derive_address(NonHardenedChildIndex::ZERO)
                 .unwrap()
                 .script(),
         };
         builder
             .add_transparent_input(
-                tsk.derive_external_secret_key(0).unwrap(),
-                OutPoint::new([0u8; 32], 1),
+                tsk.derive_external_secret_key(NonHardenedChildIndex::ZERO)
+                    .unwrap(),
+                OutPoint::fake(),
                 prev_coin,
             )
             .unwrap();
@@ -648,14 +1029,14 @@ mod tests {
         // Create a tx with only t output. No binding_sig should be present
         builder
             .add_transparent_output(
-                &TransparentAddress::PublicKey([0; 20]),
-                Amount::from_u64(40000).unwrap(),
+                &TransparentAddress::PublicKeyHash([0; 20]),
+                NonNegativeAmount::const_from_u64(40000),
             )
             .unwrap();
 
-        let (tx, _) = builder.mock_build().unwrap();
+        let res = builder.mock_build(OsRng).unwrap();
         // No binding signature, because only t input and outputs
-        assert!(tx.sapling_bundle.is_none());
+        assert!(res.transaction().sapling_bundle.is_none());
     }
 
     #[test]
@@ -666,7 +1047,10 @@ mod tests {
 
         let mut rng = OsRng;
 
-        let note1 = to.create_note(50000, Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)));
+        let note1 = to.create_note(
+            sapling::value::NoteValue::from_raw(50000),
+            Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)),
+        );
         let cmu1 = Node::from_cmu(&note1.cmu());
         let mut tree = CommitmentTree::<Node, 32>::empty();
         tree.append(cmu1).unwrap();
@@ -675,41 +1059,28 @@ mod tests {
         let tx_height = TEST_NETWORK
             .activation_height(NetworkUpgrade::Sapling)
             .unwrap();
-        let mut builder = Builder::new(TEST_NETWORK, tx_height);
+
+        let build_config = BuildConfig::Standard {
+            sapling_anchor: Some(witness1.root().into()),
+            orchard_anchor: None,
+        };
+        let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
 
         // Create a tx with a sapling spend. binding_sig should be present
         builder
-            .add_sapling_spend(extsk, *to.diversifier(), note1, witness1.path().unwrap())
+            .add_sapling_spend::<Infallible>(&extsk, note1, witness1.path().unwrap())
             .unwrap();
 
         builder
             .add_transparent_output(
-                &TransparentAddress::PublicKey([0; 20]),
-                Amount::from_u64(40000).unwrap(),
+                &TransparentAddress::PublicKeyHash([0; 20]),
+                NonNegativeAmount::const_from_u64(35000),
             )
             .unwrap();
 
-        // Expect a binding signature error, because our inputs aren't valid, but this shows
-        // that a binding signature was attempted
-        assert_eq!(
-            builder.mock_build(),
-            Err(Error::SaplingBuild(sapling_builder::Error::BindingSig))
-        );
-    }
-
-    #[test]
-    fn fails_on_negative_transparent_output() {
-        let tx_height = TEST_NETWORK
-            .activation_height(NetworkUpgrade::Sapling)
-            .unwrap();
-        let mut builder = Builder::new(TEST_NETWORK, tx_height);
-        assert_eq!(
-            builder.add_transparent_output(
-                &TransparentAddress::PublicKey([0; 20]),
-                Amount::from_i64(-1).unwrap(),
-            ),
-            Err(transparent_builder::Error::InvalidAmount)
-        );
+        // A binding signature (and bundle) is present because there is a Sapling spend.
+        let res = builder.mock_build(OsRng).unwrap();
+        assert!(res.transaction().sapling_bundle().is_some());
     }
 
     #[test]
@@ -727,10 +1098,14 @@ mod tests {
         // Fails with no inputs or outputs
         // 0.0001 t-ZEC fee
         {
-            let builder = Builder::new(TEST_NETWORK, tx_height);
-            assert_eq!(
-                builder.mock_build(),
-                Err(Error::InsufficientFunds(MINIMUM_FEE))
+            let build_config = BuildConfig::Standard {
+                sapling_anchor: None,
+                orchard_anchor: None,
+            };
+            let builder = Builder::new(TEST_NETWORK, tx_height, build_config);
+            assert_matches!(
+                builder.mock_build(OsRng),
+                Err(Error::InsufficientFunds(expected)) if expected == MINIMUM_FEE.into()
             );
         }
 
@@ -741,121 +1116,211 @@ mod tests {
         // Fail if there is only a Sapling output
         // 0.0005 z-ZEC out, 0.0001 t-ZEC fee
         {
-            let mut builder = Builder::new(TEST_NETWORK, tx_height);
+            let build_config = BuildConfig::Standard {
+                sapling_anchor: Some(sapling::Anchor::empty_tree()),
+                orchard_anchor: Some(orchard::Anchor::empty_tree()),
+            };
+            let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
             builder
-                .add_sapling_output(
+                .add_sapling_output::<Infallible>(
                     ovk,
                     to,
-                    Amount::from_u64(50000).unwrap(),
+                    NonNegativeAmount::const_from_u64(50000),
                     MemoBytes::empty(),
                 )
                 .unwrap();
-            assert_eq!(
-                builder.mock_build(),
-                Err(Error::InsufficientFunds(
-                    (Amount::from_i64(50000).unwrap() + MINIMUM_FEE).unwrap()
-                ))
+            assert_matches!(
+                builder.mock_build(OsRng),
+                Err(Error::InsufficientFunds(expected)) if
+                    expected == (NonNegativeAmount::const_from_u64(50000) + MINIMUM_FEE).unwrap().into()
             );
         }
 
         // Fail if there is only a transparent output
         // 0.0005 t-ZEC out, 0.0001 t-ZEC fee
         {
-            let mut builder = Builder::new(TEST_NETWORK, tx_height);
+            let build_config = BuildConfig::Standard {
+                sapling_anchor: Some(sapling::Anchor::empty_tree()),
+                orchard_anchor: Some(orchard::Anchor::empty_tree()),
+            };
+            let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
             builder
                 .add_transparent_output(
-                    &TransparentAddress::PublicKey([0; 20]),
-                    Amount::from_u64(50000).unwrap(),
+                    &TransparentAddress::PublicKeyHash([0; 20]),
+                    NonNegativeAmount::const_from_u64(50000),
                 )
                 .unwrap();
-            assert_eq!(
-                builder.mock_build(),
-                Err(Error::InsufficientFunds(
-                    (Amount::from_i64(50000).unwrap() + MINIMUM_FEE).unwrap()
-                ))
+            assert_matches!(
+                builder.mock_build(OsRng),
+                Err(Error::InsufficientFunds(expected)) if expected ==
+                    (NonNegativeAmount::const_from_u64(50000) + MINIMUM_FEE).unwrap().into()
             );
         }
 
-        let note1 = to.create_note(59999, Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)));
+        // Fail if there is only a burn
+        // 0.0005 burned, 0.0001 t-ZEC fee
+        let build_config = BuildConfig::Standard {
+            sapling_anchor: Some(sapling::Anchor::empty_tree()),
+            orchard_anchor: Some(orchard::Anchor::empty_tree()),
+        };
+        let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
+        builder.set_zip233_amount(Some(NonNegativeAmount::const_from_u64(50000)));
+
+        assert_matches!(
+            builder.mock_build(OsRng),
+            Err(Error::InsufficientFunds(expected)) if expected ==
+                (NonNegativeAmount::const_from_u64(50000) + MINIMUM_FEE).unwrap().into()
+        );
+
+        let note1 = to.create_note(
+            sapling::value::NoteValue::from_raw(59999),
+            Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)),
+        );
         let cmu1 = Node::from_cmu(&note1.cmu());
         let mut tree = CommitmentTree::<Node, 32>::empty();
         tree.append(cmu1).unwrap();
         let mut witness1 = IncrementalWitness::from_tree(tree.clone());
 
         // Fail if there is insufficient input
-        // 0.0003 z-ZEC out, 0.0002 t-ZEC out, 0.0001 t-ZEC fee, 0.00059999 z-ZEC in
+        // 0.0003 z-ZEC out, 0.00015 t-ZEC out, 0.0001 t-ZEC fee, 0.00059999 z-ZEC in
         {
-            let mut builder = Builder::new(TEST_NETWORK, tx_height);
+            let build_config = BuildConfig::Standard {
+                sapling_anchor: Some(witness1.root().into()),
+                orchard_anchor: Some(orchard::Anchor::empty_tree()),
+            };
+            let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
             builder
-                .add_sapling_spend(
-                    extsk.clone(),
-                    *to.diversifier(),
-                    note1.clone(),
-                    witness1.path().unwrap(),
-                )
+                .add_sapling_spend::<Infallible>(&extsk, note1.clone(), witness1.path().unwrap())
                 .unwrap();
             builder
-                .add_sapling_output(
+                .add_sapling_output::<Infallible>(
                     ovk,
                     to,
-                    Amount::from_u64(30000).unwrap(),
+                    NonNegativeAmount::const_from_u64(30000),
                     MemoBytes::empty(),
                 )
                 .unwrap();
             builder
                 .add_transparent_output(
-                    &TransparentAddress::PublicKey([0; 20]),
-                    Amount::from_u64(20000).unwrap(),
+                    &TransparentAddress::PublicKeyHash([0; 20]),
+                    NonNegativeAmount::const_from_u64(15000),
                 )
                 .unwrap();
-            assert_eq!(
-                builder.mock_build(),
-                Err(Error::InsufficientFunds(Amount::from_i64(1).unwrap()))
+            assert_matches!(
+                builder.mock_build(OsRng),
+                Err(Error::InsufficientFunds(expected)) if expected == Amount::const_from_i64(1)
             );
         }
 
-        let note2 = to.create_note(1, Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)));
+        // 0.0003 z-ZEC out, 0.00005 t-ZEC out, 0.0001 burned, 0.0001 t-ZEC fee, 0.00059999 z-ZEC in
+        let build_config = BuildConfig::Standard {
+            sapling_anchor: Some(witness1.root().into()),
+            orchard_anchor: Some(orchard::Anchor::empty_tree()),
+        };
+        let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
+        builder
+            .add_sapling_spend::<Infallible>(&extsk, note1.clone(), witness1.path().unwrap())
+            .unwrap();
+        builder
+            .add_sapling_output::<Infallible>(
+                ovk,
+                to,
+                NonNegativeAmount::const_from_u64(30000),
+                MemoBytes::empty(),
+            )
+            .unwrap();
+        builder
+            .add_transparent_output(
+                &TransparentAddress::PublicKeyHash([0; 20]),
+                NonNegativeAmount::const_from_u64(5000),
+            )
+            .unwrap();
+        builder.set_zip233_amount(Some(NonNegativeAmount::const_from_u64(10000)));
+        assert_matches!(
+            builder.mock_build(OsRng),
+            Err(Error::InsufficientFunds(expected)) if expected == Amount::const_from_i64(1)
+        );
+
+        let note2 = to.create_note(
+            sapling::value::NoteValue::from_raw(1),
+            Rseed::BeforeZip212(jubjub::Fr::random(&mut rng)),
+        );
         let cmu2 = Node::from_cmu(&note2.cmu());
         tree.append(cmu2).unwrap();
         witness1.append(cmu2).unwrap();
         let witness2 = IncrementalWitness::from_tree(tree);
 
         // Succeeds if there is sufficient input
-        // 0.0003 z-ZEC out, 0.0002 t-ZEC out, 0.0001 t-ZEC fee, 0.0006 z-ZEC in
-        //
-        // (Still fails because we are using a MockTxProver which doesn't correctly
-        // compute bindingSig.)
+        // 0.0003 z-ZEC out, 0.00015 t-ZEC out, 0.00015 t-ZEC fee, 0.0006 z-ZEC in
         {
-            let mut builder = Builder::new(TEST_NETWORK, tx_height);
+            let build_config = BuildConfig::Standard {
+                sapling_anchor: Some(witness1.root().into()),
+                orchard_anchor: Some(orchard::Anchor::empty_tree()),
+            };
+            let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
             builder
-                .add_sapling_spend(
-                    extsk.clone(),
-                    *to.diversifier(),
-                    note1,
-                    witness1.path().unwrap(),
-                )
+                .add_sapling_spend::<Infallible>(&extsk, note1.clone(), witness1.path().unwrap())
                 .unwrap();
             builder
-                .add_sapling_spend(extsk, *to.diversifier(), note2, witness2.path().unwrap())
+                .add_sapling_spend::<Infallible>(&extsk, note2.clone(), witness2.path().unwrap())
                 .unwrap();
             builder
-                .add_sapling_output(
+                .add_sapling_output::<Infallible>(
                     ovk,
                     to,
-                    Amount::from_u64(30000).unwrap(),
+                    NonNegativeAmount::const_from_u64(30000),
                     MemoBytes::empty(),
                 )
                 .unwrap();
             builder
                 .add_transparent_output(
-                    &TransparentAddress::PublicKey([0; 20]),
-                    Amount::from_u64(20000).unwrap(),
+                    &TransparentAddress::PublicKeyHash([0; 20]),
+                    NonNegativeAmount::const_from_u64(15000),
                 )
                 .unwrap();
+            let res = builder.mock_build(OsRng).unwrap();
             assert_eq!(
-                builder.mock_build(),
-                Err(Error::SaplingBuild(sapling_builder::Error::BindingSig))
-            )
+                res.transaction()
+                    .fee_paid(|_| Err(BalanceError::Overflow))
+                    .unwrap(),
+                Amount::const_from_i64(15_000)
+            );
         }
+
+        // Succeeds if there is sufficient input
+        // 0.0003 z-ZEC out, 0.00005 t-ZEC out, 0.0001 burned, 0.00015 t-ZEC fee, 0.0006 z-ZEC in
+        let build_config = BuildConfig::Standard {
+            sapling_anchor: Some(witness1.root().into()),
+            orchard_anchor: Some(orchard::Anchor::empty_tree()),
+        };
+        let mut builder = Builder::new(TEST_NETWORK, tx_height, build_config);
+        builder
+            .add_sapling_spend::<Infallible>(&extsk, note1, witness1.path().unwrap())
+            .unwrap();
+        builder
+            .add_sapling_spend::<Infallible>(&extsk, note2, witness2.path().unwrap())
+            .unwrap();
+        builder
+            .add_sapling_output::<Infallible>(
+                ovk,
+                to,
+                NonNegativeAmount::const_from_u64(30000),
+                MemoBytes::empty(),
+            )
+            .unwrap();
+        builder
+            .add_transparent_output(
+                &TransparentAddress::PublicKeyHash([0; 20]),
+                NonNegativeAmount::const_from_u64(5000),
+            )
+            .unwrap();
+        builder.set_zip233_amount(Some(NonNegativeAmount::const_from_u64(10000)));
+        let res = builder.mock_build(OsRng).unwrap();
+        assert_eq!(
+            res.transaction()
+                .fee_paid(|_| Err(BalanceError::Overflow))
+                .unwrap(),
+            Amount::const_from_i64(15_000)
+        );
     }
 }
diff --git a/zcash_primitives/src/transaction/components.rs b/zcash_primitives/src/transaction/components.rs
index 759d85c73b..b0edec3cee 100644
--- a/zcash_primitives/src/transaction/components.rs
+++ b/zcash_primitives/src/transaction/components.rs
@@ -1,19 +1,32 @@
 //! Structs representing the components within Zcash transactions.
+pub mod amount {
+    pub use zcash_protocol::value::{
+        BalanceError, ZatBalance as Amount, Zatoshis as NonNegativeAmount, COIN,
+    };
 
-pub mod amount;
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub mod testing {
+        pub use zcash_protocol::value::testing::{
+            arb_positive_zat_balance as arb_positive_amount, arb_zat_balance as arb_amount,
+            arb_zatoshis as arb_nonnegative_amount,
+        };
+    }
+}
 pub mod orchard;
 pub mod sapling;
 pub mod sprout;
 pub mod transparent;
+#[cfg(zcash_unstable = "tze")]
 pub mod tze;
+
 pub use self::{
     amount::Amount,
-    sapling::{OutputDescription, SpendDescription},
     sprout::JsDescription,
     transparent::{OutPoint, TxIn, TxOut},
 };
+pub use crate::sapling::bundle::{OutputDescription, SpendDescription};
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 pub use self::tze::{TzeIn, TzeOut};
 
 // π_A + π_B + π_C
diff --git a/zcash_primitives/src/transaction/components/amount.rs b/zcash_primitives/src/transaction/components/amount.rs
deleted file mode 100644
index 83b57c38d9..0000000000
--- a/zcash_primitives/src/transaction/components/amount.rs
+++ /dev/null
@@ -1,397 +0,0 @@
-use std::convert::TryFrom;
-use std::iter::Sum;
-use std::ops::{Add, AddAssign, Mul, Neg, Sub, SubAssign};
-
-use memuse::DynamicUsage;
-use orchard::value as orchard;
-
-pub const COIN: i64 = 1_0000_0000;
-pub const MAX_MONEY: i64 = 21_000_000 * COIN;
-
-#[deprecated(
-    since = "0.12.0",
-    note = "To calculate the ZIP 317 fee, use `transaction::fees::zip317::FeeRule`.
-For a constant representing the minimum ZIP 317 fee, use `transaction::fees::zip317::MINIMUM_FEE`.
-For the constant amount 1000 zatoshis, use `Amount::const_from_i64(1000)`."
-)]
-pub const DEFAULT_FEE: Amount = Amount(1000);
-
-/// A type-safe representation of some quantity of Zcash.
-///
-/// An Amount can only be constructed from an integer that is within the valid monetary
-/// range of `{-MAX_MONEY..MAX_MONEY}` (where `MAX_MONEY` = 21,000,000 × 10⁸ zatoshis).
-/// However, this range is not preserved as an invariant internally; it is possible to
-/// add two valid Amounts together to obtain an invalid Amount. It is the user's
-/// responsibility to handle the result of serializing potentially-invalid Amounts. In
-/// particular, a [`Transaction`] containing serialized invalid Amounts will be rejected
-/// by the network consensus rules.
-///
-/// [`Transaction`]: crate::transaction::Transaction
-#[derive(Clone, Copy, Debug, PartialEq, PartialOrd, Eq, Ord)]
-pub struct Amount(i64);
-
-memuse::impl_no_dynamic_usage!(Amount);
-
-impl Amount {
-    /// Returns a zero-valued Amount.
-    pub const fn zero() -> Self {
-        Amount(0)
-    }
-
-    /// Creates a constant Amount from an i64.
-    ///
-    /// Panics: if the amount is outside the range `{-MAX_MONEY..MAX_MONEY}`.
-    pub const fn const_from_i64(amount: i64) -> Self {
-        assert!(-MAX_MONEY <= amount && amount <= MAX_MONEY); // contains is not const
-        Amount(amount)
-    }
-
-    /// Creates an Amount from an i64.
-    ///
-    /// Returns an error if the amount is outside the range `{-MAX_MONEY..MAX_MONEY}`.
-    pub fn from_i64(amount: i64) -> Result<Self, ()> {
-        if (-MAX_MONEY..=MAX_MONEY).contains(&amount) {
-            Ok(Amount(amount))
-        } else {
-            Err(())
-        }
-    }
-
-    /// Creates a non-negative Amount from an i64.
-    ///
-    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
-    pub fn from_nonnegative_i64(amount: i64) -> Result<Self, ()> {
-        if (0..=MAX_MONEY).contains(&amount) {
-            Ok(Amount(amount))
-        } else {
-            Err(())
-        }
-    }
-
-    /// Creates an Amount from a u64.
-    ///
-    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
-    pub fn from_u64(amount: u64) -> Result<Self, ()> {
-        if amount <= MAX_MONEY as u64 {
-            Ok(Amount(amount as i64))
-        } else {
-            Err(())
-        }
-    }
-
-    /// Reads an Amount from a signed 64-bit little-endian integer.
-    ///
-    /// Returns an error if the amount is outside the range `{-MAX_MONEY..MAX_MONEY}`.
-    pub fn from_i64_le_bytes(bytes: [u8; 8]) -> Result<Self, ()> {
-        let amount = i64::from_le_bytes(bytes);
-        Amount::from_i64(amount)
-    }
-
-    /// Reads a non-negative Amount from a signed 64-bit little-endian integer.
-    ///
-    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
-    pub fn from_nonnegative_i64_le_bytes(bytes: [u8; 8]) -> Result<Self, ()> {
-        let amount = i64::from_le_bytes(bytes);
-        Amount::from_nonnegative_i64(amount)
-    }
-
-    /// Reads an Amount from an unsigned 64-bit little-endian integer.
-    ///
-    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
-    pub fn from_u64_le_bytes(bytes: [u8; 8]) -> Result<Self, ()> {
-        let amount = u64::from_le_bytes(bytes);
-        Amount::from_u64(amount)
-    }
-
-    /// Returns the Amount encoded as a signed 64-bit little-endian integer.
-    pub fn to_i64_le_bytes(self) -> [u8; 8] {
-        self.0.to_le_bytes()
-    }
-
-    /// Returns `true` if `self` is positive and `false` if the Amount is zero or
-    /// negative.
-    pub const fn is_positive(self) -> bool {
-        self.0.is_positive()
-    }
-
-    /// Returns `true` if `self` is negative and `false` if the Amount is zero or
-    /// positive.
-    pub const fn is_negative(self) -> bool {
-        self.0.is_negative()
-    }
-
-    pub fn sum<I: IntoIterator<Item = Amount>>(values: I) -> Option<Amount> {
-        let mut result = Amount::zero();
-        for value in values {
-            result = (result + value)?;
-        }
-        Some(result)
-    }
-}
-
-impl TryFrom<i64> for Amount {
-    type Error = ();
-
-    fn try_from(value: i64) -> Result<Self, ()> {
-        Amount::from_i64(value)
-    }
-}
-
-impl From<Amount> for i64 {
-    fn from(amount: Amount) -> i64 {
-        amount.0
-    }
-}
-
-impl From<&Amount> for i64 {
-    fn from(amount: &Amount) -> i64 {
-        amount.0
-    }
-}
-
-impl From<Amount> for u64 {
-    fn from(amount: Amount) -> u64 {
-        amount.0 as u64
-    }
-}
-
-impl Add<Amount> for Amount {
-    type Output = Option<Amount>;
-
-    fn add(self, rhs: Amount) -> Option<Amount> {
-        Amount::from_i64(self.0 + rhs.0).ok()
-    }
-}
-
-impl Add<Amount> for Option<Amount> {
-    type Output = Self;
-
-    fn add(self, rhs: Amount) -> Option<Amount> {
-        self.and_then(|lhs| lhs + rhs)
-    }
-}
-
-impl AddAssign<Amount> for Amount {
-    fn add_assign(&mut self, rhs: Amount) {
-        *self = (*self + rhs).expect("Addition must produce a valid amount value.")
-    }
-}
-
-impl Sub<Amount> for Amount {
-    type Output = Option<Amount>;
-
-    fn sub(self, rhs: Amount) -> Option<Amount> {
-        Amount::from_i64(self.0 - rhs.0).ok()
-    }
-}
-
-impl Sub<Amount> for Option<Amount> {
-    type Output = Self;
-
-    fn sub(self, rhs: Amount) -> Option<Amount> {
-        self.and_then(|lhs| lhs - rhs)
-    }
-}
-
-impl SubAssign<Amount> for Amount {
-    fn sub_assign(&mut self, rhs: Amount) {
-        *self = (*self - rhs).expect("Subtraction must produce a valid amount value.")
-    }
-}
-
-impl Sum<Amount> for Option<Amount> {
-    fn sum<I: Iterator<Item = Amount>>(iter: I) -> Self {
-        iter.fold(Some(Amount::zero()), |acc, a| acc? + a)
-    }
-}
-
-impl<'a> Sum<&'a Amount> for Option<Amount> {
-    fn sum<I: Iterator<Item = &'a Amount>>(iter: I) -> Self {
-        iter.fold(Some(Amount::zero()), |acc, a| acc? + *a)
-    }
-}
-
-impl Neg for Amount {
-    type Output = Self;
-
-    fn neg(self) -> Self {
-        Amount(-self.0)
-    }
-}
-
-impl Mul<usize> for Amount {
-    type Output = Option<Amount>;
-
-    fn mul(self, rhs: usize) -> Option<Amount> {
-        let rhs: i64 = rhs.try_into().ok()?;
-        self.0
-            .checked_mul(rhs)
-            .and_then(|i| Amount::try_from(i).ok())
-    }
-}
-
-impl TryFrom<orchard::ValueSum> for Amount {
-    type Error = ();
-
-    fn try_from(v: orchard::ValueSum) -> Result<Amount, Self::Error> {
-        i64::try_from(v).map_err(|_| ()).and_then(Amount::try_from)
-    }
-}
-
-/// A type-safe representation of some nonnegative amount of Zcash.
-///
-/// A NonNegativeAmount can only be constructed from an integer that is within the valid monetary
-/// range of `{0..MAX_MONEY}` (where `MAX_MONEY` = 21,000,000 × 10⁸ zatoshis).
-#[derive(Clone, Copy, Debug, PartialEq, PartialOrd, Eq, Ord)]
-pub struct NonNegativeAmount(Amount);
-
-impl NonNegativeAmount {
-    /// Creates a NonNegativeAmount from a u64.
-    ///
-    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
-    pub fn from_u64(amount: u64) -> Result<Self, ()> {
-        Amount::from_u64(amount).map(NonNegativeAmount)
-    }
-
-    /// Creates a NonNegativeAmount from an i64.
-    ///
-    /// Returns an error if the amount is outside the range `{0..MAX_MONEY}`.
-    pub fn from_nonnegative_i64(amount: i64) -> Result<Self, ()> {
-        Amount::from_nonnegative_i64(amount).map(NonNegativeAmount)
-    }
-}
-
-impl From<NonNegativeAmount> for Amount {
-    fn from(n: NonNegativeAmount) -> Self {
-        n.0
-    }
-}
-
-/// A type for balance violations in amount addition and subtraction
-/// (overflow and underflow of allowed ranges)
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
-pub enum BalanceError {
-    Overflow,
-    Underflow,
-}
-
-impl std::fmt::Display for BalanceError {
-    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
-        match &self {
-            BalanceError::Overflow => {
-                write!(
-                    f,
-                    "Amount addition resulted in a value outside the valid range."
-                )
-            }
-            BalanceError::Underflow => write!(
-                f,
-                "Amount subtraction resulted in a value outside the valid range."
-            ),
-        }
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod testing {
-    use proptest::prelude::prop_compose;
-
-    use super::{Amount, MAX_MONEY};
-
-    prop_compose! {
-        pub fn arb_amount()(amt in -MAX_MONEY..MAX_MONEY) -> Amount {
-            Amount::from_i64(amt).unwrap()
-        }
-    }
-
-    prop_compose! {
-        pub fn arb_nonnegative_amount()(amt in 0i64..MAX_MONEY) -> Amount {
-            Amount::from_i64(amt).unwrap()
-        }
-    }
-
-    prop_compose! {
-        pub fn arb_positive_amount()(amt in 1i64..MAX_MONEY) -> Amount {
-            Amount::from_i64(amt).unwrap()
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{Amount, MAX_MONEY};
-
-    #[test]
-    fn amount_in_range() {
-        let zero = b"\x00\x00\x00\x00\x00\x00\x00\x00";
-        assert_eq!(Amount::from_u64_le_bytes(*zero).unwrap(), Amount(0));
-        assert_eq!(
-            Amount::from_nonnegative_i64_le_bytes(*zero).unwrap(),
-            Amount(0)
-        );
-        assert_eq!(Amount::from_i64_le_bytes(*zero).unwrap(), Amount(0));
-
-        let neg_one = b"\xff\xff\xff\xff\xff\xff\xff\xff";
-        assert!(Amount::from_u64_le_bytes(*neg_one).is_err());
-        assert!(Amount::from_nonnegative_i64_le_bytes(*neg_one).is_err());
-        assert_eq!(Amount::from_i64_le_bytes(*neg_one).unwrap(), Amount(-1));
-
-        let max_money = b"\x00\x40\x07\x5a\xf0\x75\x07\x00";
-        assert_eq!(
-            Amount::from_u64_le_bytes(*max_money).unwrap(),
-            Amount(MAX_MONEY)
-        );
-        assert_eq!(
-            Amount::from_nonnegative_i64_le_bytes(*max_money).unwrap(),
-            Amount(MAX_MONEY)
-        );
-        assert_eq!(
-            Amount::from_i64_le_bytes(*max_money).unwrap(),
-            Amount(MAX_MONEY)
-        );
-
-        let max_money_p1 = b"\x01\x40\x07\x5a\xf0\x75\x07\x00";
-        assert!(Amount::from_u64_le_bytes(*max_money_p1).is_err());
-        assert!(Amount::from_nonnegative_i64_le_bytes(*max_money_p1).is_err());
-        assert!(Amount::from_i64_le_bytes(*max_money_p1).is_err());
-
-        let neg_max_money = b"\x00\xc0\xf8\xa5\x0f\x8a\xf8\xff";
-        assert!(Amount::from_u64_le_bytes(*neg_max_money).is_err());
-        assert!(Amount::from_nonnegative_i64_le_bytes(*neg_max_money).is_err());
-        assert_eq!(
-            Amount::from_i64_le_bytes(*neg_max_money).unwrap(),
-            Amount(-MAX_MONEY)
-        );
-
-        let neg_max_money_m1 = b"\xff\xbf\xf8\xa5\x0f\x8a\xf8\xff";
-        assert!(Amount::from_u64_le_bytes(*neg_max_money_m1).is_err());
-        assert!(Amount::from_nonnegative_i64_le_bytes(*neg_max_money_m1).is_err());
-        assert!(Amount::from_i64_le_bytes(*neg_max_money_m1).is_err());
-    }
-
-    #[test]
-    fn add_overflow() {
-        let v = Amount(MAX_MONEY);
-        assert_eq!(v + Amount(1), None)
-    }
-
-    #[test]
-    #[should_panic]
-    fn add_assign_panics_on_overflow() {
-        let mut a = Amount(MAX_MONEY);
-        a += Amount(1);
-    }
-
-    #[test]
-    fn sub_underflow() {
-        let v = Amount(-MAX_MONEY);
-        assert_eq!(v - Amount(1), None)
-    }
-
-    #[test]
-    #[should_panic]
-    fn sub_assign_panics_on_underflow() {
-        let mut a = Amount(-MAX_MONEY);
-        a -= Amount(1);
-    }
-}
diff --git a/zcash_primitives/src/transaction/components/orchard.rs b/zcash_primitives/src/transaction/components/orchard.rs
index 440e8ab8b4..9f7df66b6a 100644
--- a/zcash_primitives/src/transaction/components/orchard.rs
+++ b/zcash_primitives/src/transaction/components/orchard.rs
@@ -20,14 +20,6 @@ pub const FLAG_SPENDS_ENABLED: u8 = 0b0000_0001;
 pub const FLAG_OUTPUTS_ENABLED: u8 = 0b0000_0010;
 pub const FLAGS_EXPECTED_UNSET: u8 = !(FLAG_SPENDS_ENABLED | FLAG_OUTPUTS_ENABLED);
 
-/// Marker for a bundle with no proofs or signatures.
-#[derive(Debug)]
-pub struct Unauthorized;
-
-impl Authorization for Unauthorized {
-    type SpendAuth = ();
-}
-
 pub trait MapAuth<A: Authorization, B: Authorization> {
     fn map_spend_auth(&self, s: A::SpendAuth) -> B::SpendAuth;
     fn map_authorization(&self, a: A) -> B;
diff --git a/zcash_primitives/src/transaction/components/sapling.rs b/zcash_primitives/src/transaction/components/sapling.rs
index 149bfdbd4c..2eb1c90108 100644
--- a/zcash_primitives/src/transaction/components/sapling.rs
+++ b/zcash_primitives/src/transaction/components/sapling.rs
@@ -1,296 +1,89 @@
-use core::fmt::Debug;
-
 use ff::PrimeField;
-use memuse::DynamicUsage;
+use redjubjub::SpendAuth;
+use sapling::note_encryption::Zip212Enforcement;
+use zcash_protocol::consensus::{BlockHeight, NetworkUpgrade, Parameters, ZIP212_GRACE_PERIOD};
 
 use std::io::{self, Read, Write};
 
-use zcash_note_encryption::{
-    EphemeralKeyBytes, ShieldedOutput, COMPACT_NOTE_SIZE, ENC_CIPHERTEXT_SIZE,
-};
+use zcash_encoding::{Array, CompactSize, Vector};
+use zcash_note_encryption::{EphemeralKeyBytes, ENC_CIPHERTEXT_SIZE, OUT_CIPHERTEXT_SIZE};
 
 use crate::{
-    consensus,
     sapling::{
+        bundle::{
+            Authorization, Authorized, Bundle, GrothProofBytes, OutputDescription,
+            OutputDescriptionV5, SpendDescription, SpendDescriptionV5,
+        },
         note::ExtractedNoteCommitment,
-        note_encryption::SaplingDomain,
-        redjubjub::{self, PublicKey, Signature},
         value::ValueCommitment,
         Nullifier,
     },
+    transaction::Transaction,
 };
 
-use super::{amount::Amount, GROTH_PROOF_SIZE};
-
-pub type GrothProofBytes = [u8; GROTH_PROOF_SIZE];
-
-pub mod builder;
-pub mod fees;
-
-/// Defines the authorization type of a Sapling bundle.
-pub trait Authorization: Debug {
-    type SpendProof: Clone + Debug;
-    type OutputProof: Clone + Debug;
-    type AuthSig: Clone + Debug;
-}
-
-#[derive(Debug, Copy, Clone, PartialEq, Eq)]
-pub struct Unproven;
-
-impl Authorization for Unproven {
-    type SpendProof = ();
-    type OutputProof = ();
-    type AuthSig = ();
-}
+use super::{Amount, GROTH_PROOF_SIZE};
 
-/// Authorizing data for a bundle of Sapling spends and outputs, ready to be committed to
-/// the ledger.
-#[derive(Debug, Copy, Clone)]
-pub struct Authorized {
-    pub binding_sig: redjubjub::Signature,
-}
+/// Returns the enforcement policy for ZIP 212 at the given height.
+pub fn zip212_enforcement(params: &impl Parameters, height: BlockHeight) -> Zip212Enforcement {
+    if params.is_nu_active(NetworkUpgrade::Canopy, height) {
+        let grace_period_end_height =
+            params.activation_height(NetworkUpgrade::Canopy).unwrap() + ZIP212_GRACE_PERIOD;
 
-impl Authorization for Authorized {
-    type SpendProof = GrothProofBytes;
-    type OutputProof = GrothProofBytes;
-    type AuthSig = redjubjub::Signature;
+        if height < grace_period_end_height {
+            Zip212Enforcement::GracePeriod
+        } else {
+            Zip212Enforcement::On
+        }
+    } else {
+        Zip212Enforcement::Off
+    }
 }
 
+/// A map from one bundle authorization to another.
+///
+/// For use with [`TransactionData::map_authorization`].
+///
+/// [`TransactionData::map_authorization`]: crate::transaction::TransactionData::map_authorization
 pub trait MapAuth<A: Authorization, B: Authorization> {
-    fn map_spend_proof(&self, p: A::SpendProof) -> B::SpendProof;
-    fn map_output_proof(&self, p: A::OutputProof) -> B::OutputProof;
-    fn map_auth_sig(&self, s: A::AuthSig) -> B::AuthSig;
-    fn map_authorization(&self, a: A) -> B;
+    fn map_spend_proof(&mut self, p: A::SpendProof) -> B::SpendProof;
+    fn map_output_proof(&mut self, p: A::OutputProof) -> B::OutputProof;
+    fn map_auth_sig(&mut self, s: A::AuthSig) -> B::AuthSig;
+    fn map_authorization(&mut self, a: A) -> B;
 }
 
 /// The identity map.
 ///
 /// This can be used with [`TransactionData::map_authorization`] when you want to map the
-/// authorization of a subset of the transaction's bundles.
+/// authorization of a subset of a transaction's bundles.
 ///
 /// [`TransactionData::map_authorization`]: crate::transaction::TransactionData::map_authorization
 impl MapAuth<Authorized, Authorized> for () {
     fn map_spend_proof(
-        &self,
+        &mut self,
         p: <Authorized as Authorization>::SpendProof,
     ) -> <Authorized as Authorization>::SpendProof {
         p
     }
 
     fn map_output_proof(
-        &self,
+        &mut self,
         p: <Authorized as Authorization>::OutputProof,
     ) -> <Authorized as Authorization>::OutputProof {
         p
     }
 
     fn map_auth_sig(
-        &self,
+        &mut self,
         s: <Authorized as Authorization>::AuthSig,
     ) -> <Authorized as Authorization>::AuthSig {
         s
     }
 
-    fn map_authorization(&self, a: Authorized) -> Authorized {
+    fn map_authorization(&mut self, a: Authorized) -> Authorized {
         a
     }
 }
 
-#[derive(Debug, Clone)]
-pub struct Bundle<A: Authorization> {
-    shielded_spends: Vec<SpendDescription<A>>,
-    shielded_outputs: Vec<OutputDescription<A::OutputProof>>,
-    value_balance: Amount,
-    authorization: A,
-}
-
-impl<A: Authorization> Bundle<A> {
-    /// Constructs a `Bundle` from its constituent parts.
-    #[cfg(feature = "temporary-zcashd")]
-    pub fn temporary_zcashd_from_parts(
-        shielded_spends: Vec<SpendDescription<A>>,
-        shielded_outputs: Vec<OutputDescription<A::OutputProof>>,
-        value_balance: Amount,
-        authorization: A,
-    ) -> Self {
-        Self::from_parts(
-            shielded_spends,
-            shielded_outputs,
-            value_balance,
-            authorization,
-        )
-    }
-
-    /// Constructs a `Bundle` from its constituent parts.
-    pub(crate) fn from_parts(
-        shielded_spends: Vec<SpendDescription<A>>,
-        shielded_outputs: Vec<OutputDescription<A::OutputProof>>,
-        value_balance: Amount,
-        authorization: A,
-    ) -> Self {
-        Bundle {
-            shielded_spends,
-            shielded_outputs,
-            value_balance,
-            authorization,
-        }
-    }
-
-    /// Returns the list of spends in this bundle.
-    pub fn shielded_spends(&self) -> &[SpendDescription<A>] {
-        &self.shielded_spends
-    }
-
-    /// Returns the list of outputs in this bundle.
-    pub fn shielded_outputs(&self) -> &[OutputDescription<A::OutputProof>] {
-        &self.shielded_outputs
-    }
-
-    /// Returns the net value moved into or out of the Sapling shielded pool.
-    ///
-    /// This is the sum of Sapling spends minus the sum of Sapling outputs.
-    pub fn value_balance(&self) -> &Amount {
-        &self.value_balance
-    }
-
-    /// Returns the authorization for this bundle.
-    ///
-    /// In the case of a `Bundle<Authorized>`, this is the binding signature.
-    pub fn authorization(&self) -> &A {
-        &self.authorization
-    }
-
-    pub fn map_authorization<B: Authorization, F: MapAuth<A, B>>(self, f: F) -> Bundle<B> {
-        Bundle {
-            shielded_spends: self
-                .shielded_spends
-                .into_iter()
-                .map(|d| SpendDescription {
-                    cv: d.cv,
-                    anchor: d.anchor,
-                    nullifier: d.nullifier,
-                    rk: d.rk,
-                    zkproof: f.map_spend_proof(d.zkproof),
-                    spend_auth_sig: f.map_auth_sig(d.spend_auth_sig),
-                })
-                .collect(),
-            shielded_outputs: self
-                .shielded_outputs
-                .into_iter()
-                .map(|o| OutputDescription {
-                    cv: o.cv,
-                    cmu: o.cmu,
-                    ephemeral_key: o.ephemeral_key,
-                    enc_ciphertext: o.enc_ciphertext,
-                    out_ciphertext: o.out_ciphertext,
-                    zkproof: f.map_output_proof(o.zkproof),
-                })
-                .collect(),
-            value_balance: self.value_balance,
-            authorization: f.map_authorization(self.authorization),
-        }
-    }
-}
-
-impl DynamicUsage for Bundle<Authorized> {
-    fn dynamic_usage(&self) -> usize {
-        self.shielded_spends.dynamic_usage() + self.shielded_outputs.dynamic_usage()
-    }
-
-    fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
-        let bounds = (
-            self.shielded_spends.dynamic_usage_bounds(),
-            self.shielded_outputs.dynamic_usage_bounds(),
-        );
-
-        (
-            bounds.0 .0 + bounds.1 .0,
-            bounds.0 .1.zip(bounds.1 .1).map(|(a, b)| a + b),
-        )
-    }
-}
-
-#[derive(Clone)]
-pub struct SpendDescription<A: Authorization> {
-    cv: ValueCommitment,
-    anchor: bls12_381::Scalar,
-    nullifier: Nullifier,
-    rk: PublicKey,
-    zkproof: A::SpendProof,
-    spend_auth_sig: A::AuthSig,
-}
-
-impl<A: Authorization> std::fmt::Debug for SpendDescription<A> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
-        write!(
-            f,
-            "SpendDescription(cv = {:?}, anchor = {:?}, nullifier = {:?}, rk = {:?}, spend_auth_sig = {:?})",
-            self.cv, self.anchor, self.nullifier, self.rk, self.spend_auth_sig
-        )
-    }
-}
-
-impl<A: Authorization> SpendDescription<A> {
-    #[cfg(feature = "temporary-zcashd")]
-    pub fn temporary_zcashd_from_parts(
-        cv: ValueCommitment,
-        anchor: bls12_381::Scalar,
-        nullifier: Nullifier,
-        rk: PublicKey,
-        zkproof: A::SpendProof,
-        spend_auth_sig: A::AuthSig,
-    ) -> Self {
-        Self {
-            cv,
-            anchor,
-            nullifier,
-            rk,
-            zkproof,
-            spend_auth_sig,
-        }
-    }
-
-    /// Returns the commitment to the value consumed by this spend.
-    pub fn cv(&self) -> &ValueCommitment {
-        &self.cv
-    }
-
-    /// Returns the root of the Sapling commitment tree that this spend commits to.
-    pub fn anchor(&self) -> &bls12_381::Scalar {
-        &self.anchor
-    }
-
-    /// Returns the nullifier of the note being spent.
-    pub fn nullifier(&self) -> &Nullifier {
-        &self.nullifier
-    }
-
-    /// Returns the randomized verification key for the note being spent.
-    pub fn rk(&self) -> &PublicKey {
-        &self.rk
-    }
-
-    /// Returns the proof for this spend.
-    pub fn zkproof(&self) -> &A::SpendProof {
-        &self.zkproof
-    }
-
-    /// Returns the authorization signature for this spend.
-    pub fn spend_auth_sig(&self) -> &A::AuthSig {
-        &self.spend_auth_sig
-    }
-}
-
-impl DynamicUsage for SpendDescription<Authorized> {
-    fn dynamic_usage(&self) -> usize {
-        self.zkproof.dynamic_usage()
-    }
-
-    fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
-        self.zkproof.dynamic_usage_bounds()
-    }
-}
-
 /// Consensus rules (§4.4) & (§4.5):
 /// - Canonical encoding is enforced here.
 /// - "Not small order" is enforced here.
@@ -317,10 +110,10 @@ fn read_cmu<R: Read>(mut reader: R) -> io::Result<ExtractedNoteCommitment> {
 
 /// Consensus rules (§7.3) & (§7.4):
 /// - Canonical encoding is enforced here
-pub fn read_base<R: Read>(mut reader: R, field: &str) -> io::Result<bls12_381::Scalar> {
+pub fn read_base<R: Read>(mut reader: R, field: &str) -> io::Result<jubjub::Base> {
     let mut f = [0u8; 32];
     reader.read_exact(&mut f)?;
-    Option::from(bls12_381::Scalar::from_repr(f)).ok_or_else(|| {
+    Option::from(jubjub::Base::from_repr(f)).ok_or_else(|| {
         io::Error::new(
             io::ErrorKind::InvalidInput,
             format!("{} not in field", field),
@@ -340,500 +133,395 @@ pub fn read_zkproof<R: Read>(mut reader: R) -> io::Result<GrothProofBytes> {
     Ok(zkproof)
 }
 
-impl SpendDescription<Authorized> {
-    pub fn read_nullifier<R: Read>(mut reader: R) -> io::Result<Nullifier> {
-        let mut nullifier = Nullifier([0u8; 32]);
-        reader.read_exact(&mut nullifier.0)?;
-        Ok(nullifier)
-    }
-
-    /// Consensus rules (§4.4):
-    /// - Canonical encoding is enforced here.
-    /// - "Not small order" is enforced in SaplingVerificationContext::check_spend()
-    pub fn read_rk<R: Read>(mut reader: R) -> io::Result<PublicKey> {
-        PublicKey::read(&mut reader)
-    }
-
-    /// Consensus rules (§4.4):
-    /// - Canonical encoding is enforced here.
-    /// - Signature validity is enforced in SaplingVerificationContext::check_spend()
-    pub fn read_spend_auth_sig<R: Read>(mut reader: R) -> io::Result<Signature> {
-        Signature::read(&mut reader)
-    }
-
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        // Consensus rules (§4.4) & (§4.5):
-        // - Canonical encoding is enforced here.
-        // - "Not small order" is enforced in SaplingVerificationContext::(check_spend()/check_output())
-        //   (located in zcash_proofs::sapling::verifier).
-        let cv = read_value_commitment(&mut reader)?;
-        // Consensus rules (§7.3) & (§7.4):
-        // - Canonical encoding is enforced here
-        let anchor = read_base(&mut reader, "anchor")?;
-        let nullifier = Self::read_nullifier(&mut reader)?;
-        let rk = Self::read_rk(&mut reader)?;
-        let zkproof = read_zkproof(&mut reader)?;
-        let spend_auth_sig = Self::read_spend_auth_sig(&mut reader)?;
-
-        Ok(SpendDescription {
-            cv,
-            anchor,
-            nullifier,
-            rk,
-            zkproof,
-            spend_auth_sig,
-        })
-    }
-
-    pub fn write_v4<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.cv.to_bytes())?;
-        writer.write_all(self.anchor.to_repr().as_ref())?;
-        writer.write_all(&self.nullifier.0)?;
-        self.rk.write(&mut writer)?;
-        writer.write_all(&self.zkproof)?;
-        self.spend_auth_sig.write(&mut writer)
-    }
-
-    pub fn write_v5_without_witness_data<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.cv.to_bytes())?;
-        writer.write_all(&self.nullifier.0)?;
-        self.rk.write(&mut writer)
-    }
+fn read_nullifier<R: Read>(mut reader: R) -> io::Result<Nullifier> {
+    let mut nullifier = Nullifier([0u8; 32]);
+    reader.read_exact(&mut nullifier.0)?;
+    Ok(nullifier)
 }
 
-#[derive(Clone)]
-pub struct SpendDescriptionV5 {
-    cv: ValueCommitment,
-    nullifier: Nullifier,
-    rk: PublicKey,
-}
-
-impl SpendDescriptionV5 {
-    pub fn read<R: Read>(mut reader: &mut R) -> io::Result<Self> {
-        let cv = read_value_commitment(&mut reader)?;
-        let nullifier = SpendDescription::read_nullifier(&mut reader)?;
-        let rk = SpendDescription::read_rk(&mut reader)?;
-
-        Ok(SpendDescriptionV5 { cv, nullifier, rk })
-    }
-
-    pub fn into_spend_description(
-        self,
-        anchor: bls12_381::Scalar,
-        zkproof: GrothProofBytes,
-        spend_auth_sig: Signature,
-    ) -> SpendDescription<Authorized> {
-        SpendDescription {
-            cv: self.cv,
-            anchor,
-            nullifier: self.nullifier,
-            rk: self.rk,
-            zkproof,
-            spend_auth_sig,
-        }
-    }
-}
-
-#[derive(Clone)]
-pub struct OutputDescription<Proof> {
-    cv: ValueCommitment,
-    cmu: ExtractedNoteCommitment,
-    ephemeral_key: EphemeralKeyBytes,
-    enc_ciphertext: [u8; 580],
-    out_ciphertext: [u8; 80],
-    zkproof: Proof,
-}
-
-impl<Proof> OutputDescription<Proof> {
-    /// Returns the commitment to the value consumed by this output.
-    pub fn cv(&self) -> &ValueCommitment {
-        &self.cv
-    }
-
-    /// Returns the commitment to the new note being created.
-    pub fn cmu(&self) -> &ExtractedNoteCommitment {
-        &self.cmu
-    }
-
-    pub fn ephemeral_key(&self) -> &EphemeralKeyBytes {
-        &self.ephemeral_key
-    }
-
-    /// Returns the encrypted note ciphertext.
-    pub fn enc_ciphertext(&self) -> &[u8; 580] {
-        &self.enc_ciphertext
-    }
-
-    /// Returns the output recovery ciphertext.
-    pub fn out_ciphertext(&self) -> &[u8; 80] {
-        &self.out_ciphertext
-    }
-
-    /// Returns the proof for this output.
-    pub fn zkproof(&self) -> &Proof {
-        &self.zkproof
-    }
-
-    #[cfg(feature = "temporary-zcashd")]
-    pub fn temporary_zcashd_from_parts(
-        cv: ValueCommitment,
-        cmu: ExtractedNoteCommitment,
-        ephemeral_key: EphemeralKeyBytes,
-        enc_ciphertext: [u8; 580],
-        out_ciphertext: [u8; 80],
-        zkproof: Proof,
-    ) -> Self {
-        Self::from_parts(
-            cv,
-            cmu,
-            ephemeral_key,
-            enc_ciphertext,
-            out_ciphertext,
-            zkproof,
-        )
-    }
-
-    #[cfg(any(test, feature = "temporary-zcashd"))]
-    pub(crate) fn from_parts(
-        cv: ValueCommitment,
-        cmu: ExtractedNoteCommitment,
-        ephemeral_key: EphemeralKeyBytes,
-        enc_ciphertext: [u8; 580],
-        out_ciphertext: [u8; 80],
-        zkproof: Proof,
-    ) -> Self {
-        OutputDescription {
-            cv,
-            cmu,
-            ephemeral_key,
-            enc_ciphertext,
-            out_ciphertext,
-            zkproof,
-        }
-    }
-}
-
-#[cfg(test)]
-impl<Proof> OutputDescription<Proof> {
-    pub(crate) fn cv_mut(&mut self) -> &mut ValueCommitment {
-        &mut self.cv
-    }
-    pub(crate) fn cmu_mut(&mut self) -> &mut ExtractedNoteCommitment {
-        &mut self.cmu
-    }
-    pub(crate) fn ephemeral_key_mut(&mut self) -> &mut EphemeralKeyBytes {
-        &mut self.ephemeral_key
-    }
-    pub(crate) fn enc_ciphertext_mut(&mut self) -> &mut [u8; 580] {
-        &mut self.enc_ciphertext
-    }
-    pub(crate) fn out_ciphertext_mut(&mut self) -> &mut [u8; 80] {
-        &mut self.out_ciphertext
-    }
+/// Consensus rules (§4.4):
+/// - Canonical encoding is enforced here.
+/// - "Not small order" is enforced in SaplingVerificationContext::check_spend()
+fn read_rk<R: Read>(mut reader: R) -> io::Result<redjubjub::VerificationKey<SpendAuth>> {
+    let mut bytes = [0; 32];
+    reader.read_exact(&mut bytes)?;
+    redjubjub::VerificationKey::try_from(bytes)
+        .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))
 }
 
-impl<Proof: DynamicUsage> DynamicUsage for OutputDescription<Proof> {
-    fn dynamic_usage(&self) -> usize {
-        self.zkproof.dynamic_usage()
+/// Consensus rules (§4.4):
+/// - Canonical encoding is enforced here.
+/// - Signature validity is enforced in SaplingVerificationContext::check_spend()
+fn read_spend_auth_sig<R: Read>(mut reader: R) -> io::Result<redjubjub::Signature<SpendAuth>> {
+    let mut sig = [0; 64];
+    reader.read_exact(&mut sig)?;
+    Ok(redjubjub::Signature::from(sig))
+}
+
+#[cfg(feature = "temporary-zcashd")]
+pub fn temporary_zcashd_read_spend_v4<R: Read>(
+    reader: R,
+) -> io::Result<SpendDescription<Authorized>> {
+    read_spend_v4(reader)
+}
+
+fn read_spend_v4<R: Read>(mut reader: R) -> io::Result<SpendDescription<Authorized>> {
+    // Consensus rules (§4.4) & (§4.5):
+    // - Canonical encoding is enforced here.
+    // - "Not small order" is enforced in SaplingVerificationContext::(check_spend()/check_output())
+    //   (located in zcash_proofs::sapling::verifier).
+    let cv = read_value_commitment(&mut reader)?;
+    // Consensus rules (§7.3) & (§7.4):
+    // - Canonical encoding is enforced here
+    let anchor = read_base(&mut reader, "anchor")?;
+    let nullifier = read_nullifier(&mut reader)?;
+    let rk = read_rk(&mut reader)?;
+    let zkproof = read_zkproof(&mut reader)?;
+    let spend_auth_sig = read_spend_auth_sig(&mut reader)?;
+
+    Ok(SpendDescription::from_parts(
+        cv,
+        anchor,
+        nullifier,
+        rk,
+        zkproof,
+        spend_auth_sig,
+    ))
+}
+
+fn write_spend_v4<W: Write>(mut writer: W, spend: &SpendDescription<Authorized>) -> io::Result<()> {
+    writer.write_all(&spend.cv().to_bytes())?;
+    writer.write_all(spend.anchor().to_repr().as_ref())?;
+    writer.write_all(&spend.nullifier().0)?;
+    writer.write_all(&<[u8; 32]>::from(*spend.rk()))?;
+    writer.write_all(spend.zkproof())?;
+    writer.write_all(&<[u8; 64]>::from(*spend.spend_auth_sig()))
+}
+
+fn write_spend_v5_without_witness_data<W: Write>(
+    mut writer: W,
+    spend: &SpendDescription<Authorized>,
+) -> io::Result<()> {
+    writer.write_all(&spend.cv().to_bytes())?;
+    writer.write_all(&spend.nullifier().0)?;
+    writer.write_all(&<[u8; 32]>::from(*spend.rk()))
+}
+
+fn read_spend_v5<R: Read>(mut reader: &mut R) -> io::Result<SpendDescriptionV5> {
+    let cv = read_value_commitment(&mut reader)?;
+    let nullifier = read_nullifier(&mut reader)?;
+    let rk = read_rk(&mut reader)?;
+
+    Ok(SpendDescriptionV5::from_parts(cv, nullifier, rk))
+}
+
+#[cfg(feature = "temporary-zcashd")]
+pub fn temporary_zcashd_read_output_v4<R: Read>(
+    mut reader: R,
+) -> io::Result<OutputDescription<GrothProofBytes>> {
+    read_output_v4(&mut reader)
+}
+
+fn read_output_v4<R: Read>(mut reader: &mut R) -> io::Result<OutputDescription<GrothProofBytes>> {
+    // Consensus rules (§4.5):
+    // - Canonical encoding is enforced here.
+    // - "Not small order" is enforced in SaplingVerificationContext::check_output()
+    //   (located in zcash_proofs::sapling::verifier).
+    let cv = read_value_commitment(&mut reader)?;
+
+    // Consensus rule (§7.4): Canonical encoding is enforced here
+    let cmu = read_cmu(&mut reader)?;
+
+    // Consensus rules (§4.5):
+    // - Canonical encoding is enforced in librustzcash_sapling_check_output by zcashd
+    // - "Not small order" is enforced in SaplingVerificationContext::check_output()
+    let mut ephemeral_key = EphemeralKeyBytes([0u8; 32]);
+    reader.read_exact(&mut ephemeral_key.0)?;
+
+    let mut enc_ciphertext = [0u8; ENC_CIPHERTEXT_SIZE];
+    let mut out_ciphertext = [0u8; OUT_CIPHERTEXT_SIZE];
+    reader.read_exact(&mut enc_ciphertext)?;
+    reader.read_exact(&mut out_ciphertext)?;
+
+    let zkproof = read_zkproof(&mut reader)?;
+
+    Ok(OutputDescription::from_parts(
+        cv,
+        cmu,
+        ephemeral_key,
+        enc_ciphertext,
+        out_ciphertext,
+        zkproof,
+    ))
+}
+
+#[cfg(feature = "temporary-zcashd")]
+pub fn temporary_zcashd_write_output_v4<W: Write>(
+    writer: W,
+    output: &OutputDescription<GrothProofBytes>,
+) -> io::Result<()> {
+    write_output_v4(writer, output)
+}
+
+pub(crate) fn write_output_v4<W: Write>(
+    mut writer: W,
+    output: &OutputDescription<GrothProofBytes>,
+) -> io::Result<()> {
+    writer.write_all(&output.cv().to_bytes())?;
+    writer.write_all(output.cmu().to_bytes().as_ref())?;
+    writer.write_all(output.ephemeral_key().as_ref())?;
+    writer.write_all(output.enc_ciphertext())?;
+    writer.write_all(output.out_ciphertext())?;
+    writer.write_all(output.zkproof())
+}
+
+fn write_output_v5_without_proof<W: Write>(
+    mut writer: W,
+    output: &OutputDescription<GrothProofBytes>,
+) -> io::Result<()> {
+    writer.write_all(&output.cv().to_bytes())?;
+    writer.write_all(output.cmu().to_bytes().as_ref())?;
+    writer.write_all(output.ephemeral_key().as_ref())?;
+    writer.write_all(output.enc_ciphertext())?;
+    writer.write_all(output.out_ciphertext())
+}
+
+fn read_output_v5<R: Read>(mut reader: &mut R) -> io::Result<OutputDescriptionV5> {
+    let cv = read_value_commitment(&mut reader)?;
+    let cmu = read_cmu(&mut reader)?;
+
+    // Consensus rules (§4.5):
+    // - Canonical encoding is enforced in librustzcash_sapling_check_output by zcashd
+    // - "Not small order" is enforced in SaplingVerificationContext::check_output()
+    let mut ephemeral_key = EphemeralKeyBytes([0u8; 32]);
+    reader.read_exact(&mut ephemeral_key.0)?;
+
+    let mut enc_ciphertext = [0u8; 580];
+    let mut out_ciphertext = [0u8; 80];
+    reader.read_exact(&mut enc_ciphertext)?;
+    reader.read_exact(&mut out_ciphertext)?;
+
+    Ok(OutputDescriptionV5::from_parts(
+        cv,
+        cmu,
+        ephemeral_key,
+        enc_ciphertext,
+        out_ciphertext,
+    ))
+}
+
+/// Reads the Sapling components of a v4 transaction.
+#[cfg(feature = "temporary-zcashd")]
+#[allow(clippy::type_complexity)]
+pub fn temporary_zcashd_read_v4_components<R: Read>(
+    reader: R,
+    tx_has_sapling: bool,
+) -> io::Result<(
+    Amount,
+    Vec<SpendDescription<Authorized>>,
+    Vec<OutputDescription<GrothProofBytes>>,
+)> {
+    read_v4_components(reader, tx_has_sapling)
+}
+
+/// Reads the Sapling components of a v4 transaction.
+#[allow(clippy::type_complexity)]
+pub(crate) fn read_v4_components<R: Read>(
+    mut reader: R,
+    tx_has_sapling: bool,
+) -> io::Result<(
+    Amount,
+    Vec<SpendDescription<Authorized>>,
+    Vec<OutputDescription<GrothProofBytes>>,
+)> {
+    if tx_has_sapling {
+        let vb = Transaction::read_amount(&mut reader)?;
+        #[allow(clippy::redundant_closure)]
+        let ss: Vec<SpendDescription<Authorized>> =
+            Vector::read(&mut reader, |r| read_spend_v4(r))?;
+        #[allow(clippy::redundant_closure)]
+        let so: Vec<OutputDescription<GrothProofBytes>> =
+            Vector::read(&mut reader, |r| read_output_v4(r))?;
+        Ok((vb, ss, so))
+    } else {
+        Ok((Amount::zero(), vec![], vec![]))
+    }
+}
+
+/// Writes the Sapling components of a v4 transaction.
+#[cfg(feature = "temporary-zcashd")]
+pub fn temporary_zcashd_write_v4_components<W: Write>(
+    writer: W,
+    bundle: Option<&Bundle<Authorized, Amount>>,
+    tx_has_sapling: bool,
+) -> io::Result<()> {
+    write_v4_components(writer, bundle, tx_has_sapling)
+}
+
+/// Writes the Sapling components of a v4 transaction.
+pub(crate) fn write_v4_components<W: Write>(
+    mut writer: W,
+    bundle: Option<&Bundle<Authorized, Amount>>,
+    tx_has_sapling: bool,
+) -> io::Result<()> {
+    if tx_has_sapling {
+        writer.write_all(
+            &bundle
+                .map_or(Amount::zero(), |b| *b.value_balance())
+                .to_i64_le_bytes(),
+        )?;
+        Vector::write(
+            &mut writer,
+            bundle.map_or(&[], |b| b.shielded_spends()),
+            |w, e| write_spend_v4(w, e),
+        )?;
+        Vector::write(
+            &mut writer,
+            bundle.map_or(&[], |b| b.shielded_outputs()),
+            |w, e| write_output_v4(w, e),
+        )?;
+    } else if bundle.is_some() {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "Sapling components may not be present if Sapling is not active.",
+        ));
     }
 
-    fn dynamic_usage_bounds(&self) -> (usize, Option<usize>) {
-        self.zkproof.dynamic_usage_bounds()
-    }
+    Ok(())
 }
 
-impl<P: consensus::Parameters, A> ShieldedOutput<SaplingDomain<P>, ENC_CIPHERTEXT_SIZE>
-    for OutputDescription<A>
-{
-    fn ephemeral_key(&self) -> EphemeralKeyBytes {
-        self.ephemeral_key.clone()
-    }
+/// Reads a [`Bundle`] from a v5 transaction format.
+#[allow(clippy::redundant_closure)]
+pub(crate) fn read_v5_bundle<R: Read>(
+    mut reader: R,
+) -> io::Result<Option<Bundle<Authorized, Amount>>> {
+    let sd_v5s = Vector::read(&mut reader, read_spend_v5)?;
+    let od_v5s = Vector::read(&mut reader, read_output_v5)?;
+    let n_spends = sd_v5s.len();
+    let n_outputs = od_v5s.len();
+    let value_balance = if n_spends > 0 || n_outputs > 0 {
+        Transaction::read_amount(&mut reader)?
+    } else {
+        Amount::zero()
+    };
 
-    fn cmstar_bytes(&self) -> [u8; 32] {
-        self.cmu.to_bytes()
-    }
+    let anchor = if n_spends > 0 {
+        Some(read_base(&mut reader, "anchor")?)
+    } else {
+        None
+    };
 
-    fn enc_ciphertext(&self) -> &[u8; ENC_CIPHERTEXT_SIZE] {
-        &self.enc_ciphertext
-    }
-}
+    let v_spend_proofs = Array::read(&mut reader, n_spends, |r| read_zkproof(r))?;
+    let v_spend_auth_sigs = Array::read(&mut reader, n_spends, |r| read_spend_auth_sig(r))?;
+    let v_output_proofs = Array::read(&mut reader, n_outputs, |r| read_zkproof(r))?;
 
-impl<A> std::fmt::Debug for OutputDescription<A> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
-        write!(
-            f,
-            "OutputDescription(cv = {:?}, cmu = {:?}, ephemeral_key = {:?})",
-            self.cv, self.cmu, self.ephemeral_key
-        )
-    }
-}
+    let binding_sig = if n_spends > 0 || n_outputs > 0 {
+        let mut sig = [0; 64];
+        reader.read_exact(&mut sig)?;
+        Some(redjubjub::Signature::from(sig))
+    } else {
+        None
+    };
 
-impl OutputDescription<GrothProofBytes> {
-    pub fn read<R: Read>(mut reader: &mut R) -> io::Result<Self> {
-        // Consensus rules (§4.5):
-        // - Canonical encoding is enforced here.
-        // - "Not small order" is enforced in SaplingVerificationContext::check_output()
-        //   (located in zcash_proofs::sapling::verifier).
-        let cv = read_value_commitment(&mut reader)?;
-
-        // Consensus rule (§7.4): Canonical encoding is enforced here
-        let cmu = read_cmu(&mut reader)?;
-
-        // Consensus rules (§4.5):
-        // - Canonical encoding is enforced in librustzcash_sapling_check_output by zcashd
-        // - "Not small order" is enforced in SaplingVerificationContext::check_output()
-        let mut ephemeral_key = EphemeralKeyBytes([0u8; 32]);
-        reader.read_exact(&mut ephemeral_key.0)?;
-
-        let mut enc_ciphertext = [0u8; 580];
-        let mut out_ciphertext = [0u8; 80];
-        reader.read_exact(&mut enc_ciphertext)?;
-        reader.read_exact(&mut out_ciphertext)?;
-
-        let zkproof = read_zkproof(&mut reader)?;
-
-        Ok(OutputDescription {
-            cv,
-            cmu,
-            ephemeral_key,
-            enc_ciphertext,
-            out_ciphertext,
-            zkproof,
+    let shielded_spends = sd_v5s
+        .into_iter()
+        .zip(v_spend_proofs.into_iter().zip(v_spend_auth_sigs))
+        .map(|(sd_5, (zkproof, spend_auth_sig))| {
+            // the following `unwrap` is safe because we know n_spends > 0.
+            sd_5.into_spend_description(anchor.unwrap(), zkproof, spend_auth_sig)
         })
-    }
+        .collect();
 
-    pub fn write_v4<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.cv.to_bytes())?;
-        writer.write_all(self.cmu.to_bytes().as_ref())?;
-        writer.write_all(self.ephemeral_key.as_ref())?;
-        writer.write_all(&self.enc_ciphertext)?;
-        writer.write_all(&self.out_ciphertext)?;
-        writer.write_all(&self.zkproof)
-    }
+    let shielded_outputs = od_v5s
+        .into_iter()
+        .zip(v_output_proofs)
+        .map(|(od_5, zkproof)| od_5.into_output_description(zkproof))
+        .collect();
 
-    pub fn write_v5_without_proof<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.cv.to_bytes())?;
-        writer.write_all(self.cmu.to_bytes().as_ref())?;
-        writer.write_all(self.ephemeral_key.as_ref())?;
-        writer.write_all(&self.enc_ciphertext)?;
-        writer.write_all(&self.out_ciphertext)
-    }
+    Ok(binding_sig.and_then(|binding_sig| {
+        Bundle::from_parts(
+            shielded_spends,
+            shielded_outputs,
+            value_balance,
+            Authorized { binding_sig },
+        )
+    }))
 }
 
-#[derive(Clone)]
-pub struct OutputDescriptionV5 {
-    cv: ValueCommitment,
-    cmu: ExtractedNoteCommitment,
-    ephemeral_key: EphemeralKeyBytes,
-    enc_ciphertext: [u8; 580],
-    out_ciphertext: [u8; 80],
-}
+/// Writes a [`Bundle`] in the v5 transaction format.
+pub(crate) fn write_v5_bundle<W: Write>(
+    mut writer: W,
+    sapling_bundle: Option<&Bundle<Authorized, Amount>>,
+) -> io::Result<()> {
+    if let Some(bundle) = sapling_bundle {
+        Vector::write(&mut writer, bundle.shielded_spends(), |w, e| {
+            write_spend_v5_without_witness_data(w, e)
+        })?;
 
-memuse::impl_no_dynamic_usage!(OutputDescriptionV5);
-
-impl OutputDescriptionV5 {
-    pub fn read<R: Read>(mut reader: &mut R) -> io::Result<Self> {
-        let cv = read_value_commitment(&mut reader)?;
-        let cmu = read_cmu(&mut reader)?;
-
-        // Consensus rules (§4.5):
-        // - Canonical encoding is enforced in librustzcash_sapling_check_output by zcashd
-        // - "Not small order" is enforced in SaplingVerificationContext::check_output()
-        let mut ephemeral_key = EphemeralKeyBytes([0u8; 32]);
-        reader.read_exact(&mut ephemeral_key.0)?;
-
-        let mut enc_ciphertext = [0u8; 580];
-        let mut out_ciphertext = [0u8; 80];
-        reader.read_exact(&mut enc_ciphertext)?;
-        reader.read_exact(&mut out_ciphertext)?;
-
-        Ok(OutputDescriptionV5 {
-            cv,
-            cmu,
-            ephemeral_key,
-            enc_ciphertext,
-            out_ciphertext,
-        })
-    }
+        Vector::write(&mut writer, bundle.shielded_outputs(), |w, e| {
+            write_output_v5_without_proof(w, e)
+        })?;
 
-    pub fn into_output_description(
-        self,
-        zkproof: GrothProofBytes,
-    ) -> OutputDescription<GrothProofBytes> {
-        OutputDescription {
-            cv: self.cv,
-            cmu: self.cmu,
-            ephemeral_key: self.ephemeral_key,
-            enc_ciphertext: self.enc_ciphertext,
-            out_ciphertext: self.out_ciphertext,
-            zkproof,
+        if !(bundle.shielded_spends().is_empty() && bundle.shielded_outputs().is_empty()) {
+            writer.write_all(&bundle.value_balance().to_i64_le_bytes())?;
         }
-    }
-}
-
-#[derive(Clone)]
-pub struct CompactOutputDescription {
-    pub ephemeral_key: EphemeralKeyBytes,
-    pub cmu: ExtractedNoteCommitment,
-    pub enc_ciphertext: [u8; COMPACT_NOTE_SIZE],
-}
-
-memuse::impl_no_dynamic_usage!(CompactOutputDescription);
-
-impl<A> From<OutputDescription<A>> for CompactOutputDescription {
-    fn from(out: OutputDescription<A>) -> CompactOutputDescription {
-        CompactOutputDescription {
-            ephemeral_key: out.ephemeral_key,
-            cmu: out.cmu,
-            enc_ciphertext: out.enc_ciphertext[..COMPACT_NOTE_SIZE].try_into().unwrap(),
+        if !bundle.shielded_spends().is_empty() {
+            writer.write_all(bundle.shielded_spends()[0].anchor().to_repr().as_ref())?;
         }
-    }
-}
 
-impl<P: consensus::Parameters> ShieldedOutput<SaplingDomain<P>, COMPACT_NOTE_SIZE>
-    for CompactOutputDescription
-{
-    fn ephemeral_key(&self) -> EphemeralKeyBytes {
-        self.ephemeral_key.clone()
-    }
-
-    fn cmstar_bytes(&self) -> [u8; 32] {
-        self.cmu.to_bytes()
+        Array::write(
+            &mut writer,
+            bundle.shielded_spends().iter().map(|s| &s.zkproof()[..]),
+            |w, e| w.write_all(e),
+        )?;
+        Array::write(
+            &mut writer,
+            bundle.shielded_spends().iter().map(|s| s.spend_auth_sig()),
+            |w, e| w.write_all(&<[u8; 64]>::from(**e)),
+        )?;
+
+        Array::write(
+            &mut writer,
+            bundle.shielded_outputs().iter().map(|s| &s.zkproof()[..]),
+            |w, e| w.write_all(e),
+        )?;
+
+        if !(bundle.shielded_spends().is_empty() && bundle.shielded_outputs().is_empty()) {
+            writer.write_all(&<[u8; 64]>::from(bundle.authorization().binding_sig))?;
+        }
+    } else {
+        CompactSize::write(&mut writer, 0)?;
+        CompactSize::write(&mut writer, 0)?;
     }
 
-    fn enc_ciphertext(&self) -> &[u8; COMPACT_NOTE_SIZE] {
-        &self.enc_ciphertext
-    }
+    Ok(())
 }
 
 #[cfg(any(test, feature = "test-dependencies"))]
 pub mod testing {
-    use ff::Field;
-    use group::{Group, GroupEncoding};
-    use proptest::collection::vec;
     use proptest::prelude::*;
-    use rand::{rngs::StdRng, SeedableRng};
 
     use crate::{
-        constants::{SPENDING_KEY_GENERATOR, VALUE_COMMITMENT_RANDOMNESS_GENERATOR},
-        sapling::{
-            note::ExtractedNoteCommitment,
-            redjubjub::{PrivateKey, PublicKey},
-            value::{
-                testing::{arb_note_value_bounded, arb_trapdoor},
-                ValueCommitment, MAX_NOTE_VALUE,
-            },
-            Nullifier,
-        },
+        sapling::bundle::{testing as t_sap, Authorized, Bundle},
         transaction::{
-            components::{amount::testing::arb_amount, GROTH_PROOF_SIZE},
+            components::{amount::testing::arb_amount, Amount},
             TxVersion,
         },
     };
 
-    use super::{Authorized, Bundle, GrothProofBytes, OutputDescription, SpendDescription};
-
-    prop_compose! {
-        fn arb_extended_point()(rng_seed in prop::array::uniform32(any::<u8>())) -> jubjub::ExtendedPoint {
-            let mut rng = StdRng::from_seed(rng_seed);
-            let scalar = jubjub::Scalar::random(&mut rng);
-            jubjub::ExtendedPoint::generator() * scalar
-        }
-    }
-
-    prop_compose! {
-        /// produce a spend description with invalid data (useful only for serialization
-        /// roundtrip testing).
-        fn arb_spend_description(n_spends: usize)(
-            value in arb_note_value_bounded(MAX_NOTE_VALUE.checked_div(n_spends as u64).unwrap_or(0)),
-            rcv in arb_trapdoor(),
-            anchor in vec(any::<u8>(), 64)
-                .prop_map(|v| <[u8;64]>::try_from(v.as_slice()).unwrap())
-                .prop_map(|v| bls12_381::Scalar::from_bytes_wide(&v)),
-            nullifier in prop::array::uniform32(any::<u8>())
-                .prop_map(|v| Nullifier::from_slice(&v).unwrap()),
-            zkproof in vec(any::<u8>(), GROTH_PROOF_SIZE)
-                .prop_map(|v| <[u8;GROTH_PROOF_SIZE]>::try_from(v.as_slice()).unwrap()),
-            rng_seed in prop::array::uniform32(prop::num::u8::ANY),
-            fake_sighash_bytes in prop::array::uniform32(prop::num::u8::ANY),
-        ) -> SpendDescription<Authorized> {
-            let mut rng = StdRng::from_seed(rng_seed);
-            let sk1 = PrivateKey(jubjub::Fr::random(&mut rng));
-            let rk = PublicKey::from_private(&sk1, SPENDING_KEY_GENERATOR);
-            let cv = ValueCommitment::derive(value, rcv);
-            SpendDescription {
-                cv,
-                anchor,
-                nullifier,
-                rk,
-                zkproof,
-                spend_auth_sig: sk1.sign(&fake_sighash_bytes, &mut rng, SPENDING_KEY_GENERATOR),
-            }
-        }
-    }
-
-    prop_compose! {
-        /// produce an output description with invalid data (useful only for serialization
-        /// roundtrip testing).
-        pub fn arb_output_description(n_outputs: usize)(
-            value in arb_note_value_bounded(MAX_NOTE_VALUE.checked_div(n_outputs as u64).unwrap_or(0)),
-            rcv in arb_trapdoor(),
-            cmu in vec(any::<u8>(), 64)
-                .prop_map(|v| <[u8;64]>::try_from(v.as_slice()).unwrap())
-                .prop_map(|v| bls12_381::Scalar::from_bytes_wide(&v)),
-            enc_ciphertext in vec(any::<u8>(), 580)
-                .prop_map(|v| <[u8;580]>::try_from(v.as_slice()).unwrap()),
-            epk in arb_extended_point(),
-            out_ciphertext in vec(any::<u8>(), 80)
-                .prop_map(|v| <[u8;80]>::try_from(v.as_slice()).unwrap()),
-            zkproof in vec(any::<u8>(), GROTH_PROOF_SIZE)
-                .prop_map(|v| <[u8;GROTH_PROOF_SIZE]>::try_from(v.as_slice()).unwrap()),
-        ) -> OutputDescription<GrothProofBytes> {
-            let cv = ValueCommitment::derive(value, rcv);
-            let cmu = ExtractedNoteCommitment::from_bytes(&cmu.to_bytes()).unwrap();
-            OutputDescription {
-                cv,
-                cmu,
-                ephemeral_key: epk.to_bytes().into(),
-                enc_ciphertext,
-                out_ciphertext,
-                zkproof,
-            }
-        }
-    }
-
     prop_compose! {
-        pub fn arb_bundle()(
-            n_spends in 0usize..30,
-            n_outputs in 0usize..30,
+        fn arb_bundle()(
+            value_balance in arb_amount()
         )(
-            shielded_spends in vec(arb_spend_description(n_spends), n_spends),
-            shielded_outputs in vec(arb_output_description(n_outputs), n_outputs),
-            value_balance in arb_amount(),
-            rng_seed in prop::array::uniform32(prop::num::u8::ANY),
-            fake_bvk_bytes in prop::array::uniform32(prop::num::u8::ANY),
-        ) -> Option<Bundle<Authorized>> {
-            if shielded_spends.is_empty() && shielded_outputs.is_empty() {
-                None
-            } else {
-                let mut rng = StdRng::from_seed(rng_seed);
-                let bsk = PrivateKey(jubjub::Fr::random(&mut rng));
-
-                Some(
-                    Bundle {
-                        shielded_spends,
-                        shielded_outputs,
-                        value_balance,
-                        authorization: Authorized { binding_sig: bsk.sign(&fake_bvk_bytes, &mut rng, VALUE_COMMITMENT_RANDOMNESS_GENERATOR) },
-                    }
-                )
-            }
+            bundle in t_sap::arb_bundle(value_balance)
+        ) -> Option<Bundle<Authorized, Amount>> {
+            bundle
         }
     }
 
     pub fn arb_bundle_for_version(
         v: TxVersion,
-    ) -> impl Strategy<Value = Option<Bundle<Authorized>>> {
+    ) -> impl Strategy<Value = Option<Bundle<Authorized, Amount>>> {
         if v.has_sapling() {
             Strategy::boxed(arb_bundle())
         } else {
diff --git a/zcash_primitives/src/transaction/components/sapling/builder.rs b/zcash_primitives/src/transaction/components/sapling/builder.rs
deleted file mode 100644
index 7890d5143c..0000000000
--- a/zcash_primitives/src/transaction/components/sapling/builder.rs
+++ /dev/null
@@ -1,658 +0,0 @@
-//! Types and functions for building Sapling transaction components.
-
-use core::fmt;
-use std::sync::mpsc::Sender;
-
-use ff::Field;
-use rand::{seq::SliceRandom, RngCore};
-
-use crate::{
-    consensus::{self, BlockHeight},
-    keys::OutgoingViewingKey,
-    memo::MemoBytes,
-    sapling::{
-        keys::SaplingIvk,
-        note_encryption::sapling_note_encryption,
-        prover::TxProver,
-        redjubjub::{PrivateKey, Signature},
-        spend_sig_internal,
-        util::generate_random_rseed_internal,
-        value::{NoteValue, ValueSum},
-        Diversifier, MerklePath, Node, Note, PaymentAddress,
-    },
-    transaction::{
-        builder::Progress,
-        components::{
-            amount::Amount,
-            sapling::{
-                fees, Authorization, Authorized, Bundle, GrothProofBytes, OutputDescription,
-                SpendDescription,
-            },
-        },
-    },
-    zip32::ExtendedSpendingKey,
-};
-
-/// If there are any shielded inputs, always have at least two shielded outputs, padding
-/// with dummy outputs if necessary. See <https://github.com/zcash/zcash/issues/3615>.
-const MIN_SHIELDED_OUTPUTS: usize = 2;
-
-#[derive(Debug, PartialEq, Eq)]
-pub enum Error {
-    AnchorMismatch,
-    BindingSig,
-    InvalidAddress,
-    InvalidAmount,
-    SpendProof,
-}
-
-impl fmt::Display for Error {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            Error::AnchorMismatch => {
-                write!(f, "Anchor mismatch (anchors for all spends must be equal)")
-            }
-            Error::BindingSig => write!(f, "Failed to create bindingSig"),
-            Error::InvalidAddress => write!(f, "Invalid address"),
-            Error::InvalidAmount => write!(f, "Invalid amount"),
-            Error::SpendProof => write!(f, "Failed to create Sapling spend proof"),
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct SpendDescriptionInfo {
-    extsk: ExtendedSpendingKey,
-    diversifier: Diversifier,
-    note: Note,
-    alpha: jubjub::Fr,
-    merkle_path: MerklePath,
-}
-
-impl fees::InputView<()> for SpendDescriptionInfo {
-    fn note_id(&self) -> &() {
-        // The builder does not make use of note identifiers, so we can just return the unit value.
-        &()
-    }
-
-    fn value(&self) -> Amount {
-        // An existing note to be spent must have a valid amount value.
-        Amount::from_u64(self.note.value().inner()).unwrap()
-    }
-}
-
-/// A struct containing the information required in order to construct a
-/// Sapling output to a transaction.
-#[derive(Clone)]
-struct SaplingOutputInfo {
-    /// `None` represents the `ovk = ⊥` case.
-    ovk: Option<OutgoingViewingKey>,
-    note: Note,
-    memo: MemoBytes,
-}
-
-impl SaplingOutputInfo {
-    fn new_internal<P: consensus::Parameters, R: RngCore>(
-        params: &P,
-        rng: &mut R,
-        target_height: BlockHeight,
-        ovk: Option<OutgoingViewingKey>,
-        to: PaymentAddress,
-        value: NoteValue,
-        memo: MemoBytes,
-    ) -> Self {
-        let rseed = generate_random_rseed_internal(params, target_height, rng);
-
-        let note = Note::from_parts(to, value, rseed);
-
-        SaplingOutputInfo { ovk, note, memo }
-    }
-
-    fn build<P: consensus::Parameters, Pr: TxProver, R: RngCore>(
-        self,
-        prover: &Pr,
-        ctx: &mut Pr::SaplingProvingContext,
-        rng: &mut R,
-    ) -> OutputDescription<GrothProofBytes> {
-        let encryptor =
-            sapling_note_encryption::<R, P>(self.ovk, self.note.clone(), self.memo, rng);
-
-        let (zkproof, cv) = prover.output_proof(
-            ctx,
-            encryptor.esk().0,
-            self.note.recipient(),
-            self.note.rcm(),
-            self.note.value().inner(),
-        );
-
-        let cmu = self.note.cmu();
-
-        let enc_ciphertext = encryptor.encrypt_note_plaintext();
-        let out_ciphertext = encryptor.encrypt_outgoing_plaintext(&cv, &cmu, rng);
-
-        let epk = encryptor.epk();
-
-        OutputDescription {
-            cv,
-            cmu,
-            ephemeral_key: epk.to_bytes(),
-            enc_ciphertext,
-            out_ciphertext,
-            zkproof,
-        }
-    }
-}
-
-impl fees::OutputView for SaplingOutputInfo {
-    fn value(&self) -> Amount {
-        Amount::from_u64(self.note.value().inner())
-            .expect("Note values should be checked at construction.")
-    }
-}
-
-/// Metadata about a transaction created by a [`SaplingBuilder`].
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SaplingMetadata {
-    spend_indices: Vec<usize>,
-    output_indices: Vec<usize>,
-}
-
-impl SaplingMetadata {
-    pub fn empty() -> Self {
-        SaplingMetadata {
-            spend_indices: vec![],
-            output_indices: vec![],
-        }
-    }
-
-    /// Returns the index within the transaction of the [`SpendDescription`] corresponding
-    /// to the `n`-th call to [`SaplingBuilder::add_spend`].
-    ///
-    /// Note positions are randomized when building transactions for indistinguishability.
-    /// This means that the transaction consumer cannot assume that e.g. the first spend
-    /// they added (via the first call to [`SaplingBuilder::add_spend`]) is the first
-    /// [`SpendDescription`] in the transaction.
-    pub fn spend_index(&self, n: usize) -> Option<usize> {
-        self.spend_indices.get(n).copied()
-    }
-
-    /// Returns the index within the transaction of the [`OutputDescription`] corresponding
-    /// to the `n`-th call to [`SaplingBuilder::add_output`].
-    ///
-    /// Note positions are randomized when building transactions for indistinguishability.
-    /// This means that the transaction consumer cannot assume that e.g. the first output
-    /// they added (via the first call to [`SaplingBuilder::add_output`]) is the first
-    /// [`OutputDescription`] in the transaction.
-    pub fn output_index(&self, n: usize) -> Option<usize> {
-        self.output_indices.get(n).copied()
-    }
-}
-
-pub struct SaplingBuilder<P> {
-    params: P,
-    anchor: Option<bls12_381::Scalar>,
-    target_height: BlockHeight,
-    value_balance: ValueSum,
-    spends: Vec<SpendDescriptionInfo>,
-    outputs: Vec<SaplingOutputInfo>,
-}
-
-#[derive(Clone)]
-pub struct Unauthorized {
-    tx_metadata: SaplingMetadata,
-}
-
-impl std::fmt::Debug for Unauthorized {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
-        write!(f, "Unauthorized")
-    }
-}
-
-impl Authorization for Unauthorized {
-    type SpendProof = GrothProofBytes;
-    type OutputProof = GrothProofBytes;
-    type AuthSig = SpendDescriptionInfo;
-}
-
-impl<P> SaplingBuilder<P> {
-    pub fn new(params: P, target_height: BlockHeight) -> Self {
-        SaplingBuilder {
-            params,
-            anchor: None,
-            target_height,
-            value_balance: ValueSum::zero(),
-            spends: vec![],
-            outputs: vec![],
-        }
-    }
-
-    /// Returns the list of Sapling inputs that will be consumed by the transaction being
-    /// constructed.
-    pub fn inputs(&self) -> &[impl fees::InputView<()>] {
-        &self.spends
-    }
-
-    /// Returns the Sapling outputs that will be produced by the transaction being constructed
-    pub fn outputs(&self) -> &[impl fees::OutputView] {
-        &self.outputs
-    }
-
-    /// Returns the number of outputs that will be present in the Sapling bundle built by
-    /// this builder.
-    ///
-    /// This may be larger than the number of outputs that have been added to the builder,
-    /// depending on whether padding is going to be applied.
-    pub(in crate::transaction) fn bundle_output_count(&self) -> usize {
-        // This matches the padding behaviour in `Self::build`.
-        match self.spends.len() {
-            0 => self.outputs.len(),
-            _ => std::cmp::max(MIN_SHIELDED_OUTPUTS, self.outputs.len()),
-        }
-    }
-
-    /// Returns the net value represented by the spends and outputs added to this builder,
-    /// or an error if the values added to this builder overflow the range of a Zcash
-    /// monetary amount.
-    fn try_value_balance(&self) -> Result<Amount, Error> {
-        self.value_balance
-            .try_into()
-            .map_err(|_| ())
-            .and_then(Amount::from_i64)
-            .map_err(|()| Error::InvalidAmount)
-    }
-
-    /// Returns the net value represented by the spends and outputs added to this builder.
-    pub fn value_balance(&self) -> Amount {
-        self.try_value_balance()
-            .expect("we check this when mutating self.value_balance")
-    }
-}
-
-impl<P: consensus::Parameters> SaplingBuilder<P> {
-    /// Adds a Sapling note to be spent in this transaction.
-    ///
-    /// Returns an error if the given Merkle path does not have the same anchor as the
-    /// paths for previous Sapling notes.
-    pub fn add_spend<R: RngCore>(
-        &mut self,
-        mut rng: R,
-        extsk: ExtendedSpendingKey,
-        diversifier: Diversifier,
-        note: Note,
-        merkle_path: MerklePath,
-    ) -> Result<(), Error> {
-        // Consistency check: all anchors must equal the first one
-        let node = Node::from_cmu(&note.cmu());
-        if let Some(anchor) = self.anchor {
-            let path_root: bls12_381::Scalar = merkle_path.root(node).into();
-            if path_root != anchor {
-                return Err(Error::AnchorMismatch);
-            }
-        } else {
-            self.anchor = Some(merkle_path.root(node).into())
-        }
-
-        let alpha = jubjub::Fr::random(&mut rng);
-
-        self.value_balance = (self.value_balance + note.value()).ok_or(Error::InvalidAmount)?;
-        self.try_value_balance()?;
-
-        self.spends.push(SpendDescriptionInfo {
-            extsk,
-            diversifier,
-            note,
-            alpha,
-            merkle_path,
-        });
-
-        Ok(())
-    }
-
-    /// Adds a Sapling address to send funds to.
-    #[allow(clippy::too_many_arguments)]
-    pub fn add_output<R: RngCore>(
-        &mut self,
-        mut rng: R,
-        ovk: Option<OutgoingViewingKey>,
-        to: PaymentAddress,
-        value: NoteValue,
-        memo: MemoBytes,
-    ) -> Result<(), Error> {
-        let output = SaplingOutputInfo::new_internal(
-            &self.params,
-            &mut rng,
-            self.target_height,
-            ovk,
-            to,
-            value,
-            memo,
-        );
-
-        self.value_balance = (self.value_balance - value).ok_or(Error::InvalidAddress)?;
-        self.try_value_balance()?;
-
-        self.outputs.push(output);
-
-        Ok(())
-    }
-
-    pub fn build<Pr: TxProver, R: RngCore>(
-        self,
-        prover: &Pr,
-        ctx: &mut Pr::SaplingProvingContext,
-        mut rng: R,
-        target_height: BlockHeight,
-        progress_notifier: Option<&Sender<Progress>>,
-    ) -> Result<Option<Bundle<Unauthorized>>, Error> {
-        let value_balance = self.try_value_balance()?;
-
-        // Record initial positions of spends and outputs
-        let params = self.params;
-        let mut indexed_spends: Vec<_> = self.spends.into_iter().enumerate().collect();
-        let mut indexed_outputs: Vec<_> = self
-            .outputs
-            .iter()
-            .enumerate()
-            .map(|(i, o)| Some((i, o)))
-            .collect();
-
-        // Set up the transaction metadata that will be used to record how
-        // inputs and outputs are shuffled.
-        let mut tx_metadata = SaplingMetadata::empty();
-        tx_metadata.spend_indices.resize(indexed_spends.len(), 0);
-        tx_metadata.output_indices.resize(indexed_outputs.len(), 0);
-
-        // Pad Sapling outputs
-        if !indexed_spends.is_empty() {
-            while indexed_outputs.len() < MIN_SHIELDED_OUTPUTS {
-                indexed_outputs.push(None);
-            }
-        }
-
-        // Randomize order of inputs and outputs
-        indexed_spends.shuffle(&mut rng);
-        indexed_outputs.shuffle(&mut rng);
-
-        // Keep track of the total number of steps computed
-        let total_progress = indexed_spends.len() as u32 + indexed_outputs.len() as u32;
-        let mut progress = 0u32;
-
-        // Create Sapling SpendDescriptions
-        let shielded_spends: Vec<SpendDescription<Unauthorized>> = if !indexed_spends.is_empty() {
-            let anchor = self
-                .anchor
-                .expect("Sapling anchor must be set if Sapling spends are present.");
-
-            indexed_spends
-                .into_iter()
-                .enumerate()
-                .map(|(i, (pos, spend))| {
-                    let proof_generation_key = spend.extsk.expsk.proof_generation_key();
-
-                    let nullifier = spend.note.nf(
-                        &proof_generation_key.to_viewing_key().nk,
-                        u64::try_from(spend.merkle_path.position())
-                            .expect("Sapling note commitment tree position must fit into a u64"),
-                    );
-
-                    let (zkproof, cv, rk) = prover
-                        .spend_proof(
-                            ctx,
-                            proof_generation_key,
-                            spend.diversifier,
-                            *spend.note.rseed(),
-                            spend.alpha,
-                            spend.note.value().inner(),
-                            anchor,
-                            spend.merkle_path.clone(),
-                        )
-                        .map_err(|_| Error::SpendProof)?;
-
-                    // Record the post-randomized spend location
-                    tx_metadata.spend_indices[pos] = i;
-
-                    // Update progress and send a notification on the channel
-                    progress += 1;
-                    if let Some(sender) = progress_notifier {
-                        // If the send fails, we should ignore the error, not crash.
-                        sender
-                            .send(Progress::new(progress, Some(total_progress)))
-                            .unwrap_or(());
-                    }
-
-                    Ok(SpendDescription {
-                        cv,
-                        anchor,
-                        nullifier,
-                        rk,
-                        zkproof,
-                        spend_auth_sig: spend,
-                    })
-                })
-                .collect::<Result<Vec<_>, Error>>()?
-        } else {
-            vec![]
-        };
-
-        // Create Sapling OutputDescriptions
-        let shielded_outputs: Vec<OutputDescription<GrothProofBytes>> = indexed_outputs
-            .into_iter()
-            .enumerate()
-            .map(|(i, output)| {
-                let result = if let Some((pos, output)) = output {
-                    // Record the post-randomized output location
-                    tx_metadata.output_indices[pos] = i;
-
-                    output.clone().build::<P, _, _>(prover, ctx, &mut rng)
-                } else {
-                    // This is a dummy output
-                    let dummy_note = {
-                        let payment_address = {
-                            let mut diversifier = Diversifier([0; 11]);
-                            loop {
-                                rng.fill_bytes(&mut diversifier.0);
-                                let dummy_ivk = SaplingIvk(jubjub::Fr::random(&mut rng));
-                                if let Some(addr) = dummy_ivk.to_payment_address(diversifier) {
-                                    break addr;
-                                }
-                            }
-                        };
-
-                        let rseed =
-                            generate_random_rseed_internal(&params, target_height, &mut rng);
-
-                        Note::from_parts(payment_address, NoteValue::from_raw(0), rseed)
-                    };
-
-                    let esk = dummy_note.generate_or_derive_esk_internal(&mut rng);
-                    let epk = esk.derive_public(
-                        dummy_note
-                            .recipient()
-                            .diversifier()
-                            .g_d()
-                            .expect("checked at construction")
-                            .into(),
-                    );
-
-                    let (zkproof, cv) = prover.output_proof(
-                        ctx,
-                        esk.0,
-                        dummy_note.recipient(),
-                        dummy_note.rcm(),
-                        dummy_note.value().inner(),
-                    );
-
-                    let cmu = dummy_note.cmu();
-
-                    let mut enc_ciphertext = [0u8; 580];
-                    let mut out_ciphertext = [0u8; 80];
-                    rng.fill_bytes(&mut enc_ciphertext[..]);
-                    rng.fill_bytes(&mut out_ciphertext[..]);
-
-                    OutputDescription {
-                        cv,
-                        cmu,
-                        ephemeral_key: epk.to_bytes(),
-                        enc_ciphertext,
-                        out_ciphertext,
-                        zkproof,
-                    }
-                };
-
-                // Update progress and send a notification on the channel
-                progress += 1;
-                if let Some(sender) = progress_notifier {
-                    // If the send fails, we should ignore the error, not crash.
-                    sender
-                        .send(Progress::new(progress, Some(total_progress)))
-                        .unwrap_or(());
-                }
-
-                result
-            })
-            .collect();
-
-        let bundle = if shielded_spends.is_empty() && shielded_outputs.is_empty() {
-            None
-        } else {
-            Some(Bundle {
-                shielded_spends,
-                shielded_outputs,
-                value_balance,
-                authorization: Unauthorized { tx_metadata },
-            })
-        };
-
-        Ok(bundle)
-    }
-}
-
-impl SpendDescription<Unauthorized> {
-    pub fn apply_signature(&self, spend_auth_sig: Signature) -> SpendDescription<Authorized> {
-        SpendDescription {
-            cv: self.cv.clone(),
-            anchor: self.anchor,
-            nullifier: self.nullifier,
-            rk: self.rk.clone(),
-            zkproof: self.zkproof,
-            spend_auth_sig,
-        }
-    }
-}
-
-impl Bundle<Unauthorized> {
-    pub fn apply_signatures<Pr: TxProver, R: RngCore>(
-        self,
-        prover: &Pr,
-        ctx: &mut Pr::SaplingProvingContext,
-        rng: &mut R,
-        sighash_bytes: &[u8; 32],
-    ) -> Result<(Bundle<Authorized>, SaplingMetadata), Error> {
-        let binding_sig = prover
-            .binding_sig(ctx, self.value_balance, sighash_bytes)
-            .map_err(|_| Error::BindingSig)?;
-
-        Ok((
-            Bundle {
-                shielded_spends: self
-                    .shielded_spends
-                    .iter()
-                    .map(|spend| {
-                        spend.apply_signature(spend_sig_internal(
-                            PrivateKey(spend.spend_auth_sig.extsk.expsk.ask),
-                            spend.spend_auth_sig.alpha,
-                            sighash_bytes,
-                            rng,
-                        ))
-                    })
-                    .collect(),
-                shielded_outputs: self.shielded_outputs,
-                value_balance: self.value_balance,
-                authorization: Authorized { binding_sig },
-            },
-            self.authorization.tx_metadata,
-        ))
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod testing {
-    use proptest::collection::vec;
-    use proptest::prelude::*;
-    use rand::{rngs::StdRng, SeedableRng};
-
-    use crate::{
-        consensus::{
-            testing::{arb_branch_id, arb_height},
-            TEST_NETWORK,
-        },
-        sapling::{
-            prover::mock::MockTxProver,
-            testing::{arb_node, arb_note},
-            value::testing::arb_positive_note_value,
-            Diversifier,
-        },
-        transaction::components::{
-            amount::MAX_MONEY,
-            sapling::{Authorized, Bundle},
-        },
-        zip32::sapling::testing::arb_extended_spending_key,
-    };
-    use incrementalmerkletree::{
-        frontier::testing::arb_commitment_tree, witness::IncrementalWitness,
-    };
-
-    use super::SaplingBuilder;
-
-    prop_compose! {
-        fn arb_bundle()(n_notes in 1..30usize)(
-            extsk in arb_extended_spending_key(),
-            spendable_notes in vec(
-                arb_positive_note_value(MAX_MONEY as u64 / 10000).prop_flat_map(arb_note),
-                n_notes
-            ),
-            commitment_trees in vec(
-                arb_commitment_tree::<_, _, 32>(n_notes, arb_node()).prop_map(
-                    |t| IncrementalWitness::from_tree(t).path().unwrap()
-                ),
-                n_notes
-            ),
-            diversifiers in vec(prop::array::uniform11(any::<u8>()).prop_map(Diversifier), n_notes),
-            target_height in arb_branch_id().prop_flat_map(|b| arb_height(b, &TEST_NETWORK)),
-            rng_seed in prop::array::uniform32(any::<u8>()),
-            fake_sighash_bytes in prop::array::uniform32(any::<u8>()),
-        ) -> Bundle<Authorized> {
-            let mut builder = SaplingBuilder::new(TEST_NETWORK, target_height.unwrap());
-            let mut rng = StdRng::from_seed(rng_seed);
-
-            for ((note, path), diversifier) in spendable_notes.into_iter().zip(commitment_trees.into_iter()).zip(diversifiers.into_iter()) {
-                builder.add_spend(
-                    &mut rng,
-                    extsk.clone(),
-                    diversifier,
-                    note,
-                    path
-                ).unwrap();
-            }
-
-            let prover = MockTxProver;
-
-            let bundle = builder.build(
-                &prover,
-                &mut (),
-                &mut rng,
-                target_height.unwrap(),
-                None
-            ).unwrap().unwrap();
-
-            let (bundle, _) = bundle.apply_signatures(
-                &prover,
-                &mut (),
-                &mut rng,
-                &fake_sighash_bytes,
-            ).unwrap();
-
-            bundle
-        }
-    }
-}
diff --git a/zcash_primitives/src/transaction/components/sapling/fees.rs b/zcash_primitives/src/transaction/components/sapling/fees.rs
deleted file mode 100644
index 10d72adb60..0000000000
--- a/zcash_primitives/src/transaction/components/sapling/fees.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//! Types related to computation of fees and change related to the Sapling components
-//! of a transaction.
-
-use crate::transaction::components::amount::Amount;
-
-/// A trait that provides a minimized view of a Sapling input suitable for use in
-/// fee and change calculation.
-pub trait InputView<NoteRef> {
-    /// An identifier for the input being spent.
-    fn note_id(&self) -> &NoteRef;
-    /// The value of the input being spent.
-    fn value(&self) -> Amount;
-}
-
-/// A trait that provides a minimized view of a Sapling output suitable for use in
-/// fee and change calculation.
-pub trait OutputView {
-    /// The value of the output being produced.
-    fn value(&self) -> Amount;
-}
diff --git a/zcash_primitives/src/transaction/components/transparent.rs b/zcash_primitives/src/transaction/components/transparent.rs
index 988174e2f9..e2c82fd848 100644
--- a/zcash_primitives/src/transaction/components/transparent.rs
+++ b/zcash_primitives/src/transaction/components/transparent.rs
@@ -5,12 +5,14 @@ use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use std::fmt::Debug;
 use std::io::{self, Read, Write};
 
-use crate::legacy::{Script, TransparentAddress};
+use crate::{
+    legacy::{Script, TransparentAddress},
+    transaction::TxId,
+};
 
-use super::amount::{Amount, BalanceError};
+use super::amount::{Amount, BalanceError, NonNegativeAmount};
 
 pub mod builder;
-pub mod fees;
 
 pub trait Authorization: Debug {
     type ScriptSig: Debug + Clone + PartialEq;
@@ -82,7 +84,7 @@ impl<A: Authorization> Bundle<A> {
         let output_sum = self
             .vout
             .iter()
-            .map(|p| p.value)
+            .map(|p| Amount::from(p.value))
             .sum::<Option<Amount>>()
             .ok_or(BalanceError::Overflow)?;
 
@@ -92,40 +94,61 @@ impl<A: Authorization> Bundle<A> {
 
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct OutPoint {
-    hash: [u8; 32],
+    hash: TxId,
     n: u32,
 }
 
 impl OutPoint {
+    /// Constructs an `OutPoint` for the output at index `n` in the transaction
+    /// with txid `hash`.
     pub fn new(hash: [u8; 32], n: u32) -> Self {
-        OutPoint { hash, n }
+        OutPoint {
+            hash: TxId::from_bytes(hash),
+            n,
+        }
+    }
+
+    /// Constructs a fake `OutPoint` for use in tests.
+    #[cfg(any(test, feature = "test-dependencies"))]
+    pub const fn fake() -> Self {
+        OutPoint {
+            hash: TxId([1u8; 32]),
+            n: 1,
+        }
     }
 
     pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
         let mut hash = [0u8; 32];
         reader.read_exact(&mut hash)?;
         let n = reader.read_u32::<LittleEndian>()?;
-        Ok(OutPoint { hash, n })
+        Ok(OutPoint::new(hash, n))
     }
 
     pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.hash)?;
+        writer.write_all(self.hash.as_ref())?;
         writer.write_u32::<LittleEndian>(self.n)
     }
 
-    /// Returns `true` if this `OutPoint` is "null" in the Bitcoin sense: it points to the
-    /// `u32::MAX`th output of the transaction with the all-zeroes txid.
+    /// Returns `true` if this `OutPoint` is "null" in the Bitcoin sense: it has txid set to
+    /// all-zeroes and output index set to `u32::MAX`.
     fn is_null(&self) -> bool {
         // From `BaseOutPoint::IsNull()` in zcashd:
         //   return (hash.IsNull() && n == (uint32_t) -1);
-        self.hash == [0; 32] && self.n == u32::MAX
+        self.hash.as_ref() == &[0; 32] && self.n == u32::MAX
     }
 
+    /// Returns the output index of this `OutPoint`.
     pub fn n(&self) -> u32 {
         self.n
     }
 
+    /// Returns the byte representation of the txid of the transaction containing this `OutPoint`.
     pub fn hash(&self) -> &[u8; 32] {
+        self.hash.as_ref()
+    }
+
+    /// Returns the txid of the transaction containing this `OutPoint`.
+    pub fn txid(&self) -> &TxId {
         &self.hash
     }
 }
@@ -159,7 +182,7 @@ impl TxIn<Authorized> {
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct TxOut {
-    pub value: Amount,
+    pub value: NonNegativeAmount,
     pub script_pubkey: Script,
 }
 
@@ -168,7 +191,7 @@ impl TxOut {
         let value = {
             let mut tmp = [0u8; 8];
             reader.read_exact(&mut tmp)?;
-            Amount::from_nonnegative_i64_le_bytes(tmp)
+            NonNegativeAmount::from_nonnegative_i64_le_bytes(tmp)
         }
         .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "value out of range"))?;
         let script_pubkey = Script::read(&mut reader)?;
diff --git a/zcash_primitives/src/transaction/components/transparent/builder.rs b/zcash_primitives/src/transaction/components/transparent/builder.rs
index a65645fc93..c275065fe1 100644
--- a/zcash_primitives/src/transaction/components/transparent/builder.rs
+++ b/zcash_primitives/src/transaction/components/transparent/builder.rs
@@ -6,11 +6,10 @@ use crate::{
     legacy::{Script, TransparentAddress},
     transaction::{
         components::{
-            amount::{Amount, BalanceError},
-            transparent::{self, fees, Authorization, Authorized, Bundle, TxIn, TxOut},
+            amount::{Amount, BalanceError, NonNegativeAmount},
+            transparent::{self, Authorization, Authorized, Bundle, TxIn, TxOut},
         },
         sighash::TransparentAuthorizingContext,
-        OutPoint,
     },
 };
 
@@ -18,6 +17,7 @@ use crate::{
 use {
     crate::transaction::{
         self as tx,
+        components::transparent::OutPoint,
         sighash::{signature_hash, SignableInput, SIGHASH_ALL},
         TransactionData, TxDigests,
     },
@@ -40,24 +40,9 @@ impl fmt::Display for Error {
     }
 }
 
-/// An uninhabited type that allows the type of [`TransparentBuilder::inputs`]
-/// to resolve when the transparent-inputs feature is not turned on.
-#[cfg(not(feature = "transparent-inputs"))]
-enum InvalidTransparentInput {}
-
-#[cfg(not(feature = "transparent-inputs"))]
-impl fees::InputView for InvalidTransparentInput {
-    fn outpoint(&self) -> &OutPoint {
-        panic!("transparent-inputs feature flag is not enabled.");
-    }
-    fn coin(&self) -> &TxOut {
-        panic!("transparent-inputs feature flag is not enabled.");
-    }
-}
-
 #[cfg(feature = "transparent-inputs")]
 #[derive(Debug, Clone)]
-struct TransparentInputInfo {
+pub struct TransparentInputInfo {
     sk: secp256k1::SecretKey,
     pubkey: [u8; secp256k1::constants::PUBLIC_KEY_SIZE],
     utxo: OutPoint,
@@ -65,12 +50,12 @@ struct TransparentInputInfo {
 }
 
 #[cfg(feature = "transparent-inputs")]
-impl fees::InputView for TransparentInputInfo {
-    fn outpoint(&self) -> &OutPoint {
+impl TransparentInputInfo {
+    pub fn outpoint(&self) -> &OutPoint {
         &self.utxo
     }
 
-    fn coin(&self) -> &TxOut {
+    pub fn coin(&self) -> &TxOut {
         &self.coin
     }
 }
@@ -109,19 +94,13 @@ impl TransparentBuilder {
 
     /// Returns the list of transparent inputs that will be consumed by the transaction being
     /// constructed.
-    pub fn inputs(&self) -> &[impl fees::InputView] {
-        #[cfg(feature = "transparent-inputs")]
-        return &self.inputs;
-
-        #[cfg(not(feature = "transparent-inputs"))]
-        {
-            let invalid: &[InvalidTransparentInput] = &[];
-            invalid
-        }
+    #[cfg(feature = "transparent-inputs")]
+    pub fn inputs(&self) -> &[TransparentInputInfo] {
+        &self.inputs
     }
 
     /// Returns the transparent outputs that will be produced by the transaction being constructed.
-    pub fn outputs(&self) -> &[impl fees::OutputView] {
+    pub fn outputs(&self) -> &[TxOut] {
         &self.vout
     }
 
@@ -133,16 +112,12 @@ impl TransparentBuilder {
         utxo: OutPoint,
         coin: TxOut,
     ) -> Result<(), Error> {
-        if coin.value.is_negative() {
-            return Err(Error::InvalidAmount);
-        }
-
         // Ensure that the RIPEMD-160 digest of the public key associated with the
         // provided secret key matches that of the address to which the provided
         // output may be spent.
         let pubkey = secp256k1::PublicKey::from_secret_key(&self.secp, &sk).serialize();
         match coin.script_pubkey.address() {
-            Some(TransparentAddress::PublicKey(hash)) => {
+            Some(TransparentAddress::PublicKeyHash(hash)) => {
                 use ripemd::Ripemd160;
                 use sha2::Sha256;
 
@@ -163,11 +138,11 @@ impl TransparentBuilder {
         Ok(())
     }
 
-    pub fn add_output(&mut self, to: &TransparentAddress, value: Amount) -> Result<(), Error> {
-        if value.is_negative() {
-            return Err(Error::InvalidAmount);
-        }
-
+    pub fn add_output(
+        &mut self,
+        to: &TransparentAddress,
+        value: NonNegativeAmount,
+    ) -> Result<(), Error> {
         self.vout.push(TxOut {
             value,
             script_pubkey: to.script(),
@@ -182,20 +157,20 @@ impl TransparentBuilder {
             .inputs
             .iter()
             .map(|input| input.coin.value)
-            .sum::<Option<Amount>>()
+            .sum::<Option<NonNegativeAmount>>()
             .ok_or(BalanceError::Overflow)?;
 
         #[cfg(not(feature = "transparent-inputs"))]
-        let input_sum = Amount::zero();
+        let input_sum = NonNegativeAmount::ZERO;
 
         let output_sum = self
             .vout
             .iter()
             .map(|vo| vo.value)
-            .sum::<Option<Amount>>()
+            .sum::<Option<NonNegativeAmount>>()
             .ok_or(BalanceError::Overflow)?;
 
-        (input_sum - output_sum).ok_or(BalanceError::Underflow)
+        (Amount::from(input_sum) - Amount::from(output_sum)).ok_or(BalanceError::Underflow)
     }
 
     pub fn build(self) -> Option<transparent::Bundle<Unauthorized>> {
@@ -228,7 +203,6 @@ impl TransparentBuilder {
 
 impl TxIn<Unauthorized> {
     #[cfg(feature = "transparent-inputs")]
-    #[cfg_attr(docsrs, doc(cfg(feature = "transparent-inputs")))]
     pub fn new(prevout: OutPoint) -> Self {
         TxIn {
             prevout,
@@ -240,7 +214,7 @@ impl TxIn<Unauthorized> {
 
 #[cfg(not(feature = "transparent-inputs"))]
 impl TransparentAuthorizingContext for Unauthorized {
-    fn input_amounts(&self) -> Vec<Amount> {
+    fn input_amounts(&self) -> Vec<NonNegativeAmount> {
         vec![]
     }
 
@@ -251,7 +225,7 @@ impl TransparentAuthorizingContext for Unauthorized {
 
 #[cfg(feature = "transparent-inputs")]
 impl TransparentAuthorizingContext for Unauthorized {
-    fn input_amounts(&self) -> Vec<Amount> {
+    fn input_amounts(&self) -> Vec<NonNegativeAmount> {
         return self.inputs.iter().map(|txin| txin.coin.value).collect();
     }
 
diff --git a/zcash_primitives/src/transaction/components/transparent/fees.rs b/zcash_primitives/src/transaction/components/transparent/fees.rs
deleted file mode 100644
index 1e63e16c33..0000000000
--- a/zcash_primitives/src/transaction/components/transparent/fees.rs
+++ /dev/null
@@ -1,36 +0,0 @@
-//! Types related to computation of fees and change related to the transparent components
-//! of a transaction.
-
-use super::TxOut;
-use crate::{
-    legacy::Script,
-    transaction::{components::amount::Amount, OutPoint},
-};
-
-/// This trait provides a minimized view of a transparent input suitable for use in
-/// fee and change computation.
-pub trait InputView {
-    /// The outpoint to which the input refers.
-    fn outpoint(&self) -> &OutPoint;
-    /// The previous output being spent.
-    fn coin(&self) -> &TxOut;
-}
-
-/// This trait provides a minimized view of a transparent output suitable for use in
-/// fee and change computation.
-pub trait OutputView {
-    /// Returns the value of the output being created.
-    fn value(&self) -> Amount;
-    /// Returns the script corresponding to the newly created output.
-    fn script_pubkey(&self) -> &Script;
-}
-
-impl OutputView for TxOut {
-    fn value(&self) -> Amount {
-        self.value
-    }
-
-    fn script_pubkey(&self) -> &Script {
-        &self.script_pubkey
-    }
-}
diff --git a/zcash_primitives/src/transaction/components/tze.rs b/zcash_primitives/src/transaction/components/tze.rs
index e766d2f9f5..7a948e5806 100644
--- a/zcash_primitives/src/transaction/components/tze.rs
+++ b/zcash_primitives/src/transaction/components/tze.rs
@@ -1,5 +1,4 @@
 //! Structs representing the TZE components within Zcash transactions.
-#![cfg(feature = "zfuture")]
 
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
 use std::convert::TryFrom;
@@ -12,7 +11,6 @@ use super::amount::Amount;
 use crate::{extensions::transparent as tze, transaction::TxId};
 
 pub mod builder;
-pub mod fees;
 
 fn to_io_error(_: std::num::TryFromIntError) -> io::Error {
     io::Error::new(io::ErrorKind::InvalidData, "value out of range")
@@ -34,6 +32,25 @@ pub trait MapAuth<A: Authorization, B: Authorization> {
     fn map_authorization(&self, s: A) -> B;
 }
 
+/// The identity map.
+///
+/// This can be used with [`TransactionData::map_authorization`] when you want to map the
+/// authorization of a subset of the transaction's bundles.
+///
+/// [`TransactionData::map_authorization`]: crate::transaction::TransactionData::map_authorization
+impl MapAuth<Authorized, Authorized> for () {
+    fn map_witness(
+        &self,
+        s: <Authorized as Authorization>::Witness,
+    ) -> <Authorized as Authorization>::Witness {
+        s
+    }
+
+    fn map_authorization(&self, a: Authorized) -> Authorized {
+        a
+    }
+}
+
 #[derive(Debug, Clone, PartialEq)]
 pub struct Bundle<A: Authorization> {
     pub vin: Vec<TzeIn<A::Witness>>,
@@ -253,7 +270,7 @@ pub mod testing {
 
     prop_compose! {
         pub fn arb_tzeout()(value in arb_nonnegative_amount(), precondition in arb_precondition()) -> TzeOut {
-            TzeOut { value, precondition }
+            TzeOut { value: value.into(), precondition }
         }
     }
 
diff --git a/zcash_primitives/src/transaction/components/tze/builder.rs b/zcash_primitives/src/transaction/components/tze/builder.rs
index 82bd1f2e0d..974dac9ce8 100644
--- a/zcash_primitives/src/transaction/components/tze/builder.rs
+++ b/zcash_primitives/src/transaction/components/tze/builder.rs
@@ -1,5 +1,4 @@
 //! Types and functions for building TZE transaction components
-#![cfg(feature = "zfuture")]
 
 use std::fmt;
 
@@ -9,7 +8,7 @@ use crate::{
         self as tx,
         components::{
             amount::{Amount, BalanceError},
-            tze::{fees, Authorization, Authorized, Bundle, OutPoint, TzeIn, TzeOut},
+            tze::{Authorization, Authorized, Bundle, OutPoint, TzeIn, TzeOut},
         },
     },
 };
@@ -36,16 +35,16 @@ pub struct TzeSigner<'a, BuildCtx> {
 }
 
 #[derive(Clone)]
-struct TzeBuildInput {
+pub struct TzeBuildInput {
     tzein: TzeIn<()>,
     coin: TzeOut,
 }
 
-impl fees::InputView for TzeBuildInput {
-    fn outpoint(&self) -> &OutPoint {
+impl TzeBuildInput {
+    pub fn outpoint(&self) -> &OutPoint {
         &self.tzein.prevout
     }
-    fn coin(&self) -> &TzeOut {
+    pub fn coin(&self) -> &TzeOut {
         &self.coin
     }
 }
@@ -72,11 +71,11 @@ impl<'a, BuildCtx> TzeBuilder<'a, BuildCtx> {
         }
     }
 
-    pub fn inputs(&self) -> &[impl fees::InputView] {
+    pub fn inputs(&self) -> &[TzeBuildInput] {
         &self.vin
     }
 
-    pub fn outputs(&self) -> &[impl fees::OutputView] {
+    pub fn outputs(&self) -> &[TzeOut] {
         &self.vout
     }
 
diff --git a/zcash_primitives/src/transaction/fees.rs b/zcash_primitives/src/transaction/fees.rs
index e29913acc1..96cfe3a5ad 100644
--- a/zcash_primitives/src/transaction/fees.rs
+++ b/zcash_primitives/src/transaction/fees.rs
@@ -2,15 +2,17 @@
 
 use crate::{
     consensus::{self, BlockHeight},
-    transaction::components::{amount::Amount, transparent::fees as transparent},
+    transaction::{components::amount::NonNegativeAmount, fees::transparent::InputSize},
 };
 
-#[cfg(feature = "zfuture")]
-use crate::transaction::components::tze::fees as tze;
-
+#[cfg(feature = "non-standard-fees")]
 pub mod fixed;
+pub mod transparent;
 pub mod zip317;
 
+#[cfg(zcash_unstable = "tze")]
+pub mod tze;
+
 /// A trait that represents the ability to compute the fees that must be paid
 /// by a transaction having a specified set of inputs and outputs.
 pub trait FeeRule {
@@ -21,20 +23,22 @@ pub trait FeeRule {
     /// Implementations of this method should compute the fee amount given exactly the inputs and
     /// outputs specified, and should NOT compute speculative fees given any additional change
     /// outputs that may need to be created in order for inputs and outputs to balance.
+    #[allow(clippy::too_many_arguments)]
     fn fee_required<P: consensus::Parameters>(
         &self,
         params: &P,
         target_height: BlockHeight,
-        transparent_inputs: &[impl transparent::InputView],
-        transparent_outputs: &[impl transparent::OutputView],
+        transparent_input_sizes: impl IntoIterator<Item = InputSize>,
+        transparent_output_sizes: impl IntoIterator<Item = usize>,
         sapling_input_count: usize,
         sapling_output_count: usize,
-    ) -> Result<Amount, Self::Error>;
+        orchard_action_count: usize,
+    ) -> Result<NonNegativeAmount, Self::Error>;
 }
 
 /// A trait that represents the ability to compute the fees that must be paid by a transaction
 /// having a specified set of inputs and outputs, for use when experimenting with the TZE feature.
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 pub trait FutureFeeRule: FeeRule {
     /// Computes the total fee required for a transaction given the provided inputs and outputs.
     ///
@@ -46,11 +50,12 @@ pub trait FutureFeeRule: FeeRule {
         &self,
         params: &P,
         target_height: BlockHeight,
-        transparent_inputs: &[impl transparent::InputView],
-        transparent_outputs: &[impl transparent::OutputView],
+        transparent_input_sizes: impl IntoIterator<Item = InputSize>,
+        transparent_output_sizes: impl IntoIterator<Item = usize>,
         sapling_input_count: usize,
         sapling_output_count: usize,
+        orchard_action_count: usize,
         tze_inputs: &[impl tze::InputView],
         tze_outputs: &[impl tze::OutputView],
-    ) -> Result<Amount, Self::Error>;
+    ) -> Result<NonNegativeAmount, Self::Error>;
 }
diff --git a/zcash_primitives/src/transaction/fees/fixed.rs b/zcash_primitives/src/transaction/fees/fixed.rs
index c3028dcace..fa0d6d0283 100644
--- a/zcash_primitives/src/transaction/fees/fixed.rs
+++ b/zcash_primitives/src/transaction/fees/fixed.rs
@@ -1,46 +1,27 @@
 use crate::{
     consensus::{self, BlockHeight},
-    transaction::components::{amount::Amount, transparent::fees as transparent},
-    transaction::fees::zip317,
+    transaction::components::amount::NonNegativeAmount,
+    transaction::fees::transparent,
 };
 
-#[cfg(feature = "zfuture")]
-use crate::transaction::components::tze::fees as tze;
+#[cfg(zcash_unstable = "tze")]
+use crate::transaction::fees::tze;
 
 /// A fee rule that always returns a fixed fee, irrespective of the structure of
 /// the transaction being constructed.
 #[derive(Clone, Copy, Debug)]
 pub struct FeeRule {
-    fixed_fee: Amount,
+    fixed_fee: NonNegativeAmount,
 }
 
 impl FeeRule {
     /// Creates a new nonstandard fixed fee rule with the specified fixed fee.
-    pub fn non_standard(fixed_fee: Amount) -> Self {
+    pub fn non_standard(fixed_fee: NonNegativeAmount) -> Self {
         Self { fixed_fee }
     }
 
-    /// Creates a new fixed fee rule with the minimum possible [ZIP 317] fee,
-    /// i.e. 10000 zatoshis.
-    ///
-    /// Note that using a fixed fee is not compliant with [ZIP 317]; consider
-    /// using [`zcash_primitives::transaction::fees::zip317::FeeRule::standard()`]
-    /// instead.
-    ///
-    /// [`zcash_primitives::transaction::fees::zip317::FeeRule::standard()`]: crate::transaction::fees::zip317::FeeRule::standard
-    /// [ZIP 317]: https://zips.z.cash/zip-0317
-    #[deprecated(
-        since = "0.12.0",
-        note = "To calculate the ZIP 317 fee, use `transaction::fees::zip317::FeeRule::standard()`. For a fixed fee, use the `non_standard` constructor."
-    )]
-    pub fn standard() -> Self {
-        Self {
-            fixed_fee: zip317::MINIMUM_FEE,
-        }
-    }
-
-    /// Returns the fixed fee amount which which this rule was configured.
-    pub fn fixed_fee(&self) -> Amount {
+    /// Returns the fixed fee amount which this rule was configured.
+    pub fn fixed_fee(&self) -> NonNegativeAmount {
         self.fixed_fee
     }
 }
@@ -52,28 +33,30 @@ impl super::FeeRule for FeeRule {
         &self,
         _params: &P,
         _target_height: BlockHeight,
-        _transparent_inputs: &[impl transparent::InputView],
-        _transparent_outputs: &[impl transparent::OutputView],
+        _transparent_input_sizes: impl IntoIterator<Item = transparent::InputSize>,
+        _transparent_output_sizes: impl IntoIterator<Item = usize>,
         _sapling_input_count: usize,
         _sapling_output_count: usize,
-    ) -> Result<Amount, Self::Error> {
+        _orchard_action_count: usize,
+    ) -> Result<NonNegativeAmount, Self::Error> {
         Ok(self.fixed_fee)
     }
 }
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 impl super::FutureFeeRule for FeeRule {
     fn fee_required_zfuture<P: consensus::Parameters>(
         &self,
         _params: &P,
         _target_height: BlockHeight,
-        _transparent_inputs: &[impl transparent::InputView],
-        _transparent_outputs: &[impl transparent::OutputView],
+        _transparent_input_sizes: impl IntoIterator<Item = transparent::InputSize>,
+        _transparent_output_sizes: impl IntoIterator<Item = usize>,
         _sapling_input_count: usize,
         _sapling_output_count: usize,
+        _orchard_action_count: usize,
         _tze_inputs: &[impl tze::InputView],
         _tze_outputs: &[impl tze::OutputView],
-    ) -> Result<Amount, Self::Error> {
+    ) -> Result<NonNegativeAmount, Self::Error> {
         Ok(self.fixed_fee)
     }
 }
diff --git a/zcash_primitives/src/transaction/fees/transparent.rs b/zcash_primitives/src/transaction/fees/transparent.rs
new file mode 100644
index 0000000000..a2fbfd4526
--- /dev/null
+++ b/zcash_primitives/src/transaction/fees/transparent.rs
@@ -0,0 +1,96 @@
+//! Types related to computation of fees and change related to the transparent components
+//! of a transaction.
+
+use std::convert::Infallible;
+
+use crate::{
+    legacy::{Script, TransparentAddress},
+    transaction::{
+        components::{amount::NonNegativeAmount, transparent::TxOut, OutPoint},
+        fees::zip317::P2PKH_STANDARD_INPUT_SIZE,
+    },
+};
+
+#[cfg(feature = "transparent-inputs")]
+use crate::transaction::components::transparent::builder::TransparentInputInfo;
+
+/// The size of a transparent input, or the outpoint corresponding to the input
+/// if the size of the script required to spend that input is unknown.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum InputSize {
+    /// The txin size is known.
+    Known(usize),
+    /// The size of the script required to spend this input (and therefore the txin size)
+    /// is unknown.
+    Unknown(OutPoint),
+}
+
+impl InputSize {
+    /// An `InputSize` corresponding to the upper bound on the size of a P2PKH input used by ZIP 317.
+    pub const STANDARD_P2PKH: InputSize = InputSize::Known(P2PKH_STANDARD_INPUT_SIZE);
+}
+
+/// This trait provides a minimized view of a transparent input suitable for use in
+/// fee and change computation.
+pub trait InputView: std::fmt::Debug {
+    /// The outpoint to which the input refers.
+    fn outpoint(&self) -> &OutPoint;
+
+    /// The previous output being spent.
+    fn coin(&self) -> &TxOut;
+
+    /// The size of the transparent script required to spend this input.
+    fn serialized_size(&self) -> InputSize {
+        match self.coin().script_pubkey.address() {
+            Some(TransparentAddress::PublicKeyHash(_)) => InputSize::STANDARD_P2PKH,
+            _ => InputSize::Unknown(self.outpoint().clone()),
+        }
+    }
+}
+
+#[cfg(feature = "transparent-inputs")]
+impl InputView for TransparentInputInfo {
+    fn outpoint(&self) -> &OutPoint {
+        self.outpoint()
+    }
+
+    fn coin(&self) -> &TxOut {
+        self.coin()
+    }
+}
+
+impl InputView for Infallible {
+    fn outpoint(&self) -> &OutPoint {
+        unreachable!()
+    }
+    fn coin(&self) -> &TxOut {
+        unreachable!()
+    }
+}
+
+/// This trait provides a minimized view of a transparent output suitable for use in
+/// fee and change computation.
+pub trait OutputView: std::fmt::Debug {
+    /// Returns the value of the output being created.
+    fn value(&self) -> NonNegativeAmount;
+
+    /// Returns the script corresponding to the newly created output.
+    fn script_pubkey(&self) -> &Script;
+
+    /// Returns the serialized size of the txout.
+    fn serialized_size(&self) -> usize {
+        // The serialized size of a transparent `TxOut` is the serialized size of an amount
+        // plus the serialized size of the script pubkey.
+        8 + self.script_pubkey().serialized_size()
+    }
+}
+
+impl OutputView for TxOut {
+    fn value(&self) -> NonNegativeAmount {
+        self.value
+    }
+
+    fn script_pubkey(&self) -> &Script {
+        &self.script_pubkey
+    }
+}
diff --git a/zcash_primitives/src/transaction/components/tze/fees.rs b/zcash_primitives/src/transaction/fees/tze.rs
similarity index 78%
rename from zcash_primitives/src/transaction/components/tze/fees.rs
rename to zcash_primitives/src/transaction/fees/tze.rs
index 1a72d6cc32..1a603f2065 100644
--- a/zcash_primitives/src/transaction/components/tze/fees.rs
+++ b/zcash_primitives/src/transaction/fees/tze.rs
@@ -1,10 +1,10 @@
 //! Abstractions and types related to fee calculations for TZE components of a transaction.
 
 use crate::{
-    extensions::transparent::{self as tze},
+    extensions::transparent as tze,
     transaction::components::{
         amount::Amount,
-        tze::{OutPoint, TzeOut},
+        tze::{builder::TzeBuildInput, OutPoint, TzeOut},
     },
 };
 
@@ -17,6 +17,15 @@ pub trait InputView {
     fn coin(&self) -> &TzeOut;
 }
 
+impl InputView for TzeBuildInput {
+    fn outpoint(&self) -> &OutPoint {
+        self.outpoint()
+    }
+    fn coin(&self) -> &TzeOut {
+        self.coin()
+    }
+}
+
 /// This trait provides a minimized view of a TZE output suitable for use in
 /// fee computation.
 pub trait OutputView {
diff --git a/zcash_primitives/src/transaction/fees/zip317.rs b/zcash_primitives/src/transaction/fees/zip317.rs
index 60fcd767f9..7ea41415c4 100644
--- a/zcash_primitives/src/transaction/fees/zip317.rs
+++ b/zcash_primitives/src/transaction/fees/zip317.rs
@@ -6,31 +6,56 @@ use core::cmp::max;
 
 use crate::{
     consensus::{self, BlockHeight},
-    legacy::TransparentAddress,
-    transaction::components::{
-        amount::{Amount, BalanceError},
-        transparent::{fees as transparent, OutPoint},
+    transaction::{
+        components::{
+            amount::{BalanceError, NonNegativeAmount},
+            transparent::OutPoint,
+        },
+        fees::transparent,
     },
 };
 
-/// The minimum conventional fee using the standard [ZIP 317] constants. Equivalent to
-/// `(FeeRule::standard().marginal_fee() * FeeRule::standard().grace_actions()).unwrap()`,
-/// but as a constant.
+/// The standard [ZIP 317] marginal fee.
 ///
 /// [ZIP 317]: https//zips.z.cash/zip-0317
-pub const MINIMUM_FEE: Amount = Amount::const_from_i64(10_000);
+pub const MARGINAL_FEE: NonNegativeAmount = NonNegativeAmount::const_from_u64(5_000);
+
+/// The minimum number of logical actions that must be paid according to [ZIP 317].
+///
+/// [ZIP 317]: https//zips.z.cash/zip-0317
+pub const GRACE_ACTIONS: usize = 2;
+
+/// The standard size of a P2PKH input, in bytes, according to [ZIP 317].
+///
+/// [ZIP 317]: https//zips.z.cash/zip-0317
+pub const P2PKH_STANDARD_INPUT_SIZE: usize = 150;
+
+/// The standard size of a P2PKH output, in bytes, according to [ZIP 317].
+///
+/// [ZIP 317]: https//zips.z.cash/zip-0317
+pub const P2PKH_STANDARD_OUTPUT_SIZE: usize = 34;
+
+/// The minimum conventional fee computed from the standard [ZIP 317] constants. Equivalent to
+/// `MARGINAL_FEE * GRACE_ACTIONS`.
+///
+/// [ZIP 317]: https//zips.z.cash/zip-0317
+pub const MINIMUM_FEE: NonNegativeAmount = NonNegativeAmount::const_from_u64(10_000);
 
 /// A [`FeeRule`] implementation that implements the [ZIP 317] fee rule.
 ///
-/// This fee rule supports only P2pkh transparent inputs; an error will be returned if a coin
-/// containing a non-p2pkh script is provided as an input.  This fee rule may slightly overestimate
-/// fees in case where the user is attempting to spend more than ~150 transparent inputs.
+/// This fee rule supports Orchard, Sapling, and (P2PKH only) transparent inputs.
+/// Returns an error if a coin containing a non-P2PKH script is provided as an input.
+///
+/// This fee rule may slightly overestimate fees in case where the user is attempting
+/// to spend a large number of transparent inputs. This is intentional and is relied
+/// on for the correctness of transaction construction algorithms in the
+/// `zcash_client_backend` crate.
 ///
 /// [`FeeRule`]: crate::transaction::fees::FeeRule
 /// [ZIP 317]: https//zips.z.cash/zip-0317
 #[derive(Clone, Debug)]
 pub struct FeeRule {
-    marginal_fee: Amount,
+    marginal_fee: NonNegativeAmount,
     grace_actions: usize,
     p2pkh_standard_input_size: usize,
     p2pkh_standard_output_size: usize,
@@ -42,19 +67,28 @@ impl FeeRule {
     /// [ZIP 317]: https//zips.z.cash/zip-0317
     pub fn standard() -> Self {
         Self {
-            marginal_fee: Amount::from_u64(5000).unwrap(),
-            grace_actions: 2,
-            p2pkh_standard_input_size: 150,
-            p2pkh_standard_output_size: 34,
+            marginal_fee: MARGINAL_FEE,
+            grace_actions: GRACE_ACTIONS,
+            p2pkh_standard_input_size: P2PKH_STANDARD_INPUT_SIZE,
+            p2pkh_standard_output_size: P2PKH_STANDARD_OUTPUT_SIZE,
         }
     }
 
     /// Construct a new FeeRule instance with the specified parameter values.
     ///
+    /// Using this fee rule with
+    /// ```compile_fail
+    /// marginal_fee < 5000 || grace_actions < 2
+    ///     || p2pkh_standard_input_size > P2PKH_STANDARD_INPUT_SIZE
+    ///     || p2pkh_standard_output_size > P2PKH_STANDARD_OUTPUT_SIZE
+    /// ```
+    /// violates ZIP 317, and might cause transactions built with it to fail.
+    ///
     /// Returns `None` if either `p2pkh_standard_input_size` or `p2pkh_standard_output_size` are
     /// zero.
+    #[cfg(feature = "non-standard-fees")]
     pub fn non_standard(
-        marginal_fee: Amount,
+        marginal_fee: NonNegativeAmount,
         grace_actions: usize,
         p2pkh_standard_input_size: usize,
         p2pkh_standard_output_size: usize,
@@ -72,7 +106,7 @@ impl FeeRule {
     }
 
     /// Returns the ZIP 317 marginal fee.
-    pub fn marginal_fee(&self) -> Amount {
+    pub fn marginal_fee(&self) -> NonNegativeAmount {
         self.marginal_fee
     }
     /// Returns the ZIP 317 number of grace actions
@@ -125,33 +159,38 @@ impl super::FeeRule for FeeRule {
         &self,
         _params: &P,
         _target_height: BlockHeight,
-        transparent_inputs: &[impl transparent::InputView],
-        transparent_outputs: &[impl transparent::OutputView],
+        transparent_input_sizes: impl IntoIterator<Item = transparent::InputSize>,
+        transparent_output_sizes: impl IntoIterator<Item = usize>,
         sapling_input_count: usize,
         sapling_output_count: usize,
-    ) -> Result<Amount, Self::Error> {
-        let non_p2pkh_inputs: Vec<_> = transparent_inputs
-            .iter()
-            .filter_map(|t_in| match t_in.coin().script_pubkey.address() {
-                Some(TransparentAddress::PublicKey(_)) => None,
-                _ => Some(t_in.outpoint()),
-            })
-            .cloned()
-            .collect();
+        orchard_action_count: usize,
+    ) -> Result<NonNegativeAmount, Self::Error> {
+        let mut t_in_total_size: usize = 0;
+        let mut non_p2pkh_outpoints = vec![];
+        for sz in transparent_input_sizes.into_iter() {
+            match sz {
+                transparent::InputSize::Known(s) => {
+                    t_in_total_size += s;
+                }
+                transparent::InputSize::Unknown(outpoint) => {
+                    non_p2pkh_outpoints.push(outpoint.clone());
+                }
+            }
+        }
 
-        if !non_p2pkh_inputs.is_empty() {
-            return Err(FeeError::NonP2pkhInputs(non_p2pkh_inputs));
+        if !non_p2pkh_outpoints.is_empty() {
+            return Err(FeeError::NonP2pkhInputs(non_p2pkh_outpoints));
         }
 
-        let t_in_total_size = transparent_inputs.len() * 150;
-        let t_out_total_size = transparent_outputs.len() * 34;
+        let t_out_total_size = transparent_output_sizes.into_iter().sum();
 
         let ceildiv = |num: usize, den: usize| (num + den - 1) / den;
 
         let logical_actions = max(
             ceildiv(t_in_total_size, self.p2pkh_standard_input_size),
             ceildiv(t_out_total_size, self.p2pkh_standard_output_size),
-        ) + max(sapling_input_count, sapling_output_count);
+        ) + max(sapling_input_count, sapling_output_count)
+            + orchard_action_count;
 
         (self.marginal_fee * max(self.grace_actions, logical_actions))
             .ok_or_else(|| BalanceError::Overflow.into())
diff --git a/zcash_primitives/src/transaction/mod.rs b/zcash_primitives/src/transaction/mod.rs
index a500b54bb7..a40d09af88 100644
--- a/zcash_primitives/src/transaction/mod.rs
+++ b/zcash_primitives/src/transaction/mod.rs
@@ -13,27 +13,23 @@ mod tests;
 
 use blake2b_simd::Hash as Blake2bHash;
 use byteorder::{LittleEndian, ReadBytesExt, WriteBytesExt};
-use ff::PrimeField;
 use memuse::DynamicUsage;
 use std::convert::TryFrom;
 use std::fmt;
 use std::fmt::Debug;
 use std::io::{self, Read, Write};
 use std::ops::Deref;
-use zcash_encoding::{Array, CompactSize, Vector};
+use zcash_encoding::{CompactSize, Vector};
 
 use crate::{
     consensus::{BlockHeight, BranchId},
-    sapling::redjubjub,
+    sapling::{self, builder as sapling_builder},
 };
 
 use self::{
     components::{
         amount::{Amount, BalanceError},
-        orchard as orchard_serialization,
-        sapling::{
-            self, OutputDescription, OutputDescriptionV5, SpendDescription, SpendDescriptionV5,
-        },
+        orchard as orchard_serialization, sapling as sapling_serialization,
         sprout::{self, JsDescription},
         transparent::{self, TxIn, TxOut},
         OutPoint,
@@ -42,7 +38,9 @@ use self::{
     util::sha256d::{HashReader, HashWriter},
 };
 
-#[cfg(feature = "zfuture")]
+use {components::amount::NonNegativeAmount, zcash_protocol::value::ZatBalance};
+
+#[cfg(zcash_unstable = "tze")]
 use self::components::tze::{self, TzeIn, TzeOut};
 
 const OVERWINTER_VERSION_GROUP_ID: u32 = 0x03C48270;
@@ -53,17 +51,28 @@ const SAPLING_TX_VERSION: u32 = 4;
 const V5_TX_VERSION: u32 = 5;
 const V5_VERSION_GROUP_ID: u32 = 0x26A7270A;
 
+const V6_TX_VERSION: u32 = 6;
+// TODO: change this
+const V6_VERSION_GROUP_ID: u32 = 0xFFFFFFFF;
+
 /// These versions are used exclusively for in-development transaction
 /// serialization, and will never be active under the consensus rules.
 /// When new consensus transaction versions are added, all call sites
 /// using these constants should be inspected, and use of these constants
 /// should be removed as appropriate in favor of the new consensus
 /// transaction version and group.
-#[cfg(feature = "zfuture")]
-const ZFUTURE_VERSION_GROUP_ID: u32 = 0xFFFFFFFF;
-#[cfg(feature = "zfuture")]
-const ZFUTURE_TX_VERSION: u32 = 0x0000FFFF;
+#[cfg(zcash_unstable = "zfuture")]
+pub const ZFUTURE_VERSION_GROUP_ID: u32 = 0xFFFFFFFF;
+#[cfg(zcash_unstable = "zfuture")]
+pub const ZFUTURE_TX_VERSION: u32 = 0x0000FFFF;
 
+/// The identifier for a Zcash transaction.
+///
+/// - For v1-4 transactions, this is a double-SHA-256 hash of the encoded transaction.
+///   This means that it is malleable, and only a reliable identifier for transactions
+///   that have been mined.
+/// - For v5 transactions onwards, this identifier is derived only from "effecting" data,
+///   and is non-malleable in all contexts.
 #[derive(Clone, Copy, PartialOrd, Ord, PartialEq, Eq, Hash)]
 pub struct TxId([u8; 32]);
 
@@ -92,6 +101,12 @@ impl AsRef<[u8; 32]> for TxId {
     }
 }
 
+impl From<TxId> for [u8; 32] {
+    fn from(value: TxId) -> Self {
+        value.0
+    }
+}
+
 impl TxId {
     pub fn from_bytes(bytes: [u8; 32]) -> Self {
         TxId(bytes)
@@ -122,7 +137,8 @@ pub enum TxVersion {
     Overwinter,
     Sapling,
     Zip225,
-    #[cfg(feature = "zfuture")]
+    Zip230,
+    #[cfg(zcash_unstable = "zfuture")]
     ZFuture,
 }
 
@@ -137,7 +153,8 @@ impl TxVersion {
                 (OVERWINTER_TX_VERSION, OVERWINTER_VERSION_GROUP_ID) => Ok(TxVersion::Overwinter),
                 (SAPLING_TX_VERSION, SAPLING_VERSION_GROUP_ID) => Ok(TxVersion::Sapling),
                 (V5_TX_VERSION, V5_VERSION_GROUP_ID) => Ok(TxVersion::Zip225),
-                #[cfg(feature = "zfuture")]
+                (V6_TX_VERSION, V6_VERSION_GROUP_ID) => Ok(TxVersion::Zip230),
+                #[cfg(zcash_unstable = "zfuture")]
                 (ZFUTURE_TX_VERSION, ZFUTURE_VERSION_GROUP_ID) => Ok(TxVersion::ZFuture),
                 _ => Err(io::Error::new(
                     io::ErrorKind::InvalidInput,
@@ -167,7 +184,8 @@ impl TxVersion {
                 TxVersion::Overwinter => OVERWINTER_TX_VERSION,
                 TxVersion::Sapling => SAPLING_TX_VERSION,
                 TxVersion::Zip225 => V5_TX_VERSION,
-                #[cfg(feature = "zfuture")]
+                TxVersion::Zip230 => V6_TX_VERSION,
+                #[cfg(zcash_unstable = "zfuture")]
                 TxVersion::ZFuture => ZFUTURE_TX_VERSION,
             }
     }
@@ -178,7 +196,8 @@ impl TxVersion {
             TxVersion::Overwinter => OVERWINTER_VERSION_GROUP_ID,
             TxVersion::Sapling => SAPLING_VERSION_GROUP_ID,
             TxVersion::Zip225 => V5_VERSION_GROUP_ID,
-            #[cfg(feature = "zfuture")]
+            TxVersion::Zip230 => V6_VERSION_GROUP_ID,
+            #[cfg(zcash_unstable = "zfuture")]
             TxVersion::ZFuture => ZFUTURE_VERSION_GROUP_ID,
         }
     }
@@ -191,12 +210,14 @@ impl TxVersion {
         }
     }
 
+    /// Returns `true` if this transaction version supports the Sprout protocol.
     pub fn has_sprout(&self) -> bool {
         match self {
             TxVersion::Sprout(v) => *v >= 2u32,
             TxVersion::Overwinter | TxVersion::Sapling => true,
             TxVersion::Zip225 => false,
-            #[cfg(feature = "zfuture")]
+            TxVersion::Zip230 => true,
+            #[cfg(zcash_unstable = "zfuture")]
             TxVersion::ZFuture => true,
         }
     }
@@ -205,30 +226,35 @@ impl TxVersion {
         !matches!(self, TxVersion::Sprout(_))
     }
 
+    /// Returns `true` if this transaction version supports the Sapling protocol.
     pub fn has_sapling(&self) -> bool {
         match self {
             TxVersion::Sprout(_) | TxVersion::Overwinter => false,
             TxVersion::Sapling => true,
             TxVersion::Zip225 => true,
-            #[cfg(feature = "zfuture")]
+            TxVersion::Zip230 => true,
+            #[cfg(zcash_unstable = "zfuture")]
             TxVersion::ZFuture => true,
         }
     }
 
+    /// Returns `true` if this transaction version supports the Orchard protocol.
     pub fn has_orchard(&self) -> bool {
         match self {
             TxVersion::Sprout(_) | TxVersion::Overwinter | TxVersion::Sapling => false,
             TxVersion::Zip225 => true,
-            #[cfg(feature = "zfuture")]
+            TxVersion::Zip230 => true,
+            #[cfg(zcash_unstable = "zfuture")]
             TxVersion::ZFuture => true,
         }
     }
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "zfuture")]
     pub fn has_tze(&self) -> bool {
         matches!(self, TxVersion::ZFuture)
     }
 
+    /// Suggests the transaction version that should be used in the given Zcash epoch.
     pub fn suggested_for_branch(consensus_branch_id: BranchId) -> Self {
         match consensus_branch_id {
             BranchId::Sprout => TxVersion::Sprout(2),
@@ -237,7 +263,9 @@ impl TxVersion {
                 TxVersion::Sapling
             }
             BranchId::Nu5 => TxVersion::Zip225,
-            #[cfg(feature = "zfuture")]
+            BranchId::Nu6 => TxVersion::Zip225,
+            BranchId::Nu7 => TxVersion::Zip230,
+            #[cfg(zcash_unstable = "zfuture")]
             BranchId::ZFuture => TxVersion::ZFuture,
         }
     }
@@ -246,33 +274,40 @@ impl TxVersion {
 /// Authorization state for a bundle of transaction data.
 pub trait Authorization {
     type TransparentAuth: transparent::Authorization;
-    type SaplingAuth: sapling::Authorization;
+    type SaplingAuth: sapling::bundle::Authorization;
     type OrchardAuth: orchard::bundle::Authorization;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeAuth: tze::Authorization;
 }
 
+/// [`Authorization`] marker type for fully-authorized transactions.
 #[derive(Debug)]
 pub struct Authorized;
 
 impl Authorization for Authorized {
     type TransparentAuth = transparent::Authorized;
-    type SaplingAuth = sapling::Authorized;
+    type SaplingAuth = sapling::bundle::Authorized;
     type OrchardAuth = orchard::bundle::Authorized;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeAuth = tze::Authorized;
 }
 
+/// [`Authorization`] marker type for transactions without authorization data.
+///
+/// Currently this includes Sapling proofs because the types in this crate support v4
+/// transactions, which commit to the Sapling proofs in the transaction digest.
 pub struct Unauthorized;
 
 impl Authorization for Unauthorized {
     type TransparentAuth = transparent::builder::Unauthorized;
-    type SaplingAuth = sapling::builder::Unauthorized;
-    type OrchardAuth = orchard_serialization::Unauthorized;
+    type SaplingAuth =
+        sapling_builder::InProgress<sapling_builder::Proven, sapling_builder::Unsigned>;
+    type OrchardAuth =
+        orchard::builder::InProgress<orchard::builder::Unproven, orchard::builder::Unauthorized>;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeAuth = tze::builder::Unauthorized;
 }
 
@@ -297,6 +332,7 @@ impl PartialEq for Transaction {
     }
 }
 
+/// The information contained in a Zcash transaction.
 #[derive(Debug)]
 pub struct TransactionData<A: Authorization> {
     version: TxVersion,
@@ -305,13 +341,15 @@ pub struct TransactionData<A: Authorization> {
     expiry_height: BlockHeight,
     transparent_bundle: Option<transparent::Bundle<A::TransparentAuth>>,
     sprout_bundle: Option<sprout::Bundle>,
-    sapling_bundle: Option<sapling::Bundle<A::SaplingAuth>>,
+    sapling_bundle: Option<sapling::Bundle<A::SaplingAuth, Amount>>,
     orchard_bundle: Option<orchard::bundle::Bundle<A::OrchardAuth, Amount>>,
-    #[cfg(feature = "zfuture")]
+    zip233_amount: Option<NonNegativeAmount>,
+    #[cfg(zcash_unstable = "tze")]
     tze_bundle: Option<tze::Bundle<A::TzeAuth>>,
 }
 
 impl<A: Authorization> TransactionData<A> {
+    /// Constructs a `TransactionData` from its constituent parts.
     #[allow(clippy::too_many_arguments)]
     pub fn from_parts(
         version: TxVersion,
@@ -320,8 +358,10 @@ impl<A: Authorization> TransactionData<A> {
         expiry_height: BlockHeight,
         transparent_bundle: Option<transparent::Bundle<A::TransparentAuth>>,
         sprout_bundle: Option<sprout::Bundle>,
-        sapling_bundle: Option<sapling::Bundle<A::SaplingAuth>>,
+        sapling_bundle: Option<sapling::Bundle<A::SaplingAuth, Amount>>,
         orchard_bundle: Option<orchard::Bundle<A::OrchardAuth, Amount>>,
+        zip233_amount: Option<NonNegativeAmount>,
+        #[cfg(zcash_unstable = "tze")] tze_bundle: Option<tze::Bundle<A::TzeAuth>>,
     ) -> Self {
         TransactionData {
             version,
@@ -332,41 +372,18 @@ impl<A: Authorization> TransactionData<A> {
             sprout_bundle,
             sapling_bundle,
             orchard_bundle,
-            #[cfg(feature = "zfuture")]
-            tze_bundle: None,
-        }
-    }
-
-    #[cfg(feature = "zfuture")]
-    #[allow(clippy::too_many_arguments)]
-    pub fn from_parts_zfuture(
-        version: TxVersion,
-        consensus_branch_id: BranchId,
-        lock_time: u32,
-        expiry_height: BlockHeight,
-        transparent_bundle: Option<transparent::Bundle<A::TransparentAuth>>,
-        sprout_bundle: Option<sprout::Bundle>,
-        sapling_bundle: Option<sapling::Bundle<A::SaplingAuth>>,
-        orchard_bundle: Option<orchard::Bundle<A::OrchardAuth, Amount>>,
-        tze_bundle: Option<tze::Bundle<A::TzeAuth>>,
-    ) -> Self {
-        TransactionData {
-            version,
-            consensus_branch_id,
-            lock_time,
-            expiry_height,
-            transparent_bundle,
-            sprout_bundle,
-            sapling_bundle,
-            orchard_bundle,
+            zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             tze_bundle,
         }
     }
 
+    /// Returns the transaction version.
     pub fn version(&self) -> TxVersion {
         self.version
     }
 
+    /// Returns the Zcash epoch that this transaction can be mined in.
     pub fn consensus_branch_id(&self) -> BranchId {
         self.consensus_branch_id
     }
@@ -387,7 +404,7 @@ impl<A: Authorization> TransactionData<A> {
         self.sprout_bundle.as_ref()
     }
 
-    pub fn sapling_bundle(&self) -> Option<&sapling::Bundle<A::SaplingAuth>> {
+    pub fn sapling_bundle(&self) -> Option<&sapling::Bundle<A::SaplingAuth, Amount>> {
         self.sapling_bundle.as_ref()
     }
 
@@ -395,7 +412,11 @@ impl<A: Authorization> TransactionData<A> {
         self.orchard_bundle.as_ref()
     }
 
-    #[cfg(feature = "zfuture")]
+    pub fn zip233_amount(&self) -> Option<NonNegativeAmount> {
+        self.zip233_amount
+    }
+
+    #[cfg(zcash_unstable = "tze")]
     pub fn tze_bundle(&self) -> Option<&tze::Bundle<A::TzeAuth>> {
         self.tze_bundle.as_ref()
     }
@@ -422,6 +443,10 @@ impl<A: Authorization> TransactionData<A> {
             self.orchard_bundle
                 .as_ref()
                 .map_or_else(Amount::zero, |b| *b.value_balance()),
+            -self
+                .zip233_amount
+                .map(Into::into)
+                .unwrap_or(ZatBalance::zero()),
         ];
 
         value_balances
@@ -437,11 +462,12 @@ impl<A: Authorization> TransactionData<A> {
                 self.consensus_branch_id,
                 self.lock_time,
                 self.expiry_height,
+                self.zip233_amount.as_ref(),
             ),
             digester.digest_transparent(self.transparent_bundle.as_ref()),
             digester.digest_sapling(self.sapling_bundle.as_ref()),
             digester.digest_orchard(self.orchard_bundle.as_ref()),
-            #[cfg(feature = "zfuture")]
+            #[cfg(zcash_unstable = "tze")]
             digester.digest_tze(self.tze_bundle.as_ref()),
         )
     }
@@ -456,12 +482,12 @@ impl<A: Authorization> TransactionData<A> {
             Option<transparent::Bundle<A::TransparentAuth>>,
         ) -> Option<transparent::Bundle<B::TransparentAuth>>,
         f_sapling: impl FnOnce(
-            Option<sapling::Bundle<A::SaplingAuth>>,
-        ) -> Option<sapling::Bundle<B::SaplingAuth>>,
+            Option<sapling::Bundle<A::SaplingAuth, Amount>>,
+        ) -> Option<sapling::Bundle<B::SaplingAuth, Amount>>,
         f_orchard: impl FnOnce(
             Option<orchard::bundle::Bundle<A::OrchardAuth, Amount>>,
         ) -> Option<orchard::bundle::Bundle<B::OrchardAuth, Amount>>,
-        #[cfg(feature = "zfuture")] f_tze: impl FnOnce(
+        #[cfg(zcash_unstable = "tze")] f_tze: impl FnOnce(
             Option<tze::Bundle<A::TzeAuth>>,
         ) -> Option<tze::Bundle<B::TzeAuth>>,
     ) -> TransactionData<B> {
@@ -474,7 +500,8 @@ impl<A: Authorization> TransactionData<A> {
             sprout_bundle: self.sprout_bundle,
             sapling_bundle: f_sapling(self.sapling_bundle),
             orchard_bundle: f_orchard(self.orchard_bundle),
-            #[cfg(feature = "zfuture")]
+            zip233_amount: self.zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             tze_bundle: f_tze(self.tze_bundle),
         }
     }
@@ -482,9 +509,9 @@ impl<A: Authorization> TransactionData<A> {
     pub fn map_authorization<B: Authorization>(
         self,
         f_transparent: impl transparent::MapAuth<A::TransparentAuth, B::TransparentAuth>,
-        f_sapling: impl sapling::MapAuth<A::SaplingAuth, B::SaplingAuth>,
+        mut f_sapling: impl sapling_serialization::MapAuth<A::SaplingAuth, B::SaplingAuth>,
         mut f_orchard: impl orchard_serialization::MapAuth<A::OrchardAuth, B::OrchardAuth>,
-        #[cfg(feature = "zfuture")] f_tze: impl tze::MapAuth<A::TzeAuth, B::TzeAuth>,
+        #[cfg(zcash_unstable = "tze")] f_tze: impl tze::MapAuth<A::TzeAuth, B::TzeAuth>,
     ) -> TransactionData<B> {
         TransactionData {
             version: self.version,
@@ -495,7 +522,15 @@ impl<A: Authorization> TransactionData<A> {
                 .transparent_bundle
                 .map(|b| b.map_authorization(f_transparent)),
             sprout_bundle: self.sprout_bundle,
-            sapling_bundle: self.sapling_bundle.map(|b| b.map_authorization(f_sapling)),
+            sapling_bundle: self.sapling_bundle.map(|b| {
+                b.map_authorization(
+                    &mut f_sapling,
+                    |f, p| f.map_spend_proof(p),
+                    |f, p| f.map_output_proof(p),
+                    |f, s| f.map_auth_sig(s),
+                    |f, a| f.map_authorization(a),
+                )
+            }),
             orchard_bundle: self.orchard_bundle.map(|b| {
                 b.map_authorization(
                     &mut f_orchard,
@@ -503,7 +538,8 @@ impl<A: Authorization> TransactionData<A> {
                     |f, a| f.map_authorization(a),
                 )
             }),
-            #[cfg(feature = "zfuture")]
+            zip233_amount: self.zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             tze_bundle: self.tze_bundle.map(|b| b.map_authorization(f_tze)),
         }
     }
@@ -530,7 +566,8 @@ impl Transaction {
                 Self::from_data_v4(data)
             }
             TxVersion::Zip225 => Ok(Self::from_data_v5(data)),
-            #[cfg(feature = "zfuture")]
+            TxVersion::Zip230 => Ok(Self::from_data_v5(data)),
+            #[cfg(zcash_unstable = "zfuture")]
             TxVersion::ZFuture => Ok(Self::from_data_v5(data)),
         }
     }
@@ -572,9 +609,10 @@ impl Transaction {
             TxVersion::Sprout(_) | TxVersion::Overwinter | TxVersion::Sapling => {
                 Self::read_v4(reader, version, consensus_branch_id)
             }
-            TxVersion::Zip225 => Self::read_v5(reader.into_base_reader(), version),
-            #[cfg(feature = "zfuture")]
-            TxVersion::ZFuture => Self::read_v5(reader.into_base_reader(), version),
+            TxVersion::Zip225 => Self::read_v5(&mut reader.into_base_reader(), version),
+            TxVersion::Zip230 => Self::read_v6(&mut reader.into_base_reader(), version),
+            #[cfg(zcash_unstable = "zfuture")]
+            TxVersion::ZFuture => Self::read_v6(&mut reader.into_base_reader(), version),
         }
     }
 
@@ -593,18 +631,8 @@ impl Transaction {
             0u32.into()
         };
 
-        let (value_balance, shielded_spends, shielded_outputs) = if version.has_sapling() {
-            let vb = Self::read_amount(&mut reader)?;
-            #[allow(clippy::redundant_closure)]
-            let ss: Vec<SpendDescription<sapling::Authorized>> =
-                Vector::read(&mut reader, |r| SpendDescription::read(r))?;
-            #[allow(clippy::redundant_closure)]
-            let so: Vec<OutputDescription<sapling::GrothProofBytes>> =
-                Vector::read(&mut reader, |r| OutputDescription::read(r))?;
-            (vb, ss, so)
-        } else {
-            (Amount::zero(), vec![], vec![])
-        };
+        let (value_balance, shielded_spends, shielded_outputs) =
+            sapling_serialization::read_v4_components(&mut reader, version.has_sapling())?;
 
         let sprout_bundle = if version.has_sprout() {
             let joinsplits = Vector::read(&mut reader, |r| {
@@ -630,7 +658,9 @@ impl Transaction {
         let binding_sig = if version.has_sapling()
             && !(shielded_spends.is_empty() && shielded_outputs.is_empty())
         {
-            Some(redjubjub::Signature::read(&mut reader)?)
+            let mut sig = [0; 64];
+            reader.read_exact(&mut sig)?;
+            Some(redjubjub::Signature::from(sig))
         } else {
             None
         };
@@ -648,16 +678,17 @@ impl Transaction {
                 expiry_height,
                 transparent_bundle,
                 sprout_bundle,
-                sapling_bundle: binding_sig.map(|binding_sig| {
+                sapling_bundle: binding_sig.and_then(|binding_sig| {
                     sapling::Bundle::from_parts(
                         shielded_spends,
                         shielded_outputs,
                         value_balance,
-                        sapling::Authorized { binding_sig },
+                        sapling::bundle::Authorized { binding_sig },
                     )
                 }),
                 orchard_bundle: None,
-                #[cfg(feature = "zfuture")]
+                zip233_amount: None,
+                #[cfg(zcash_unstable = "tze")]
                 tze_bundle: None,
             },
         })
@@ -690,16 +721,47 @@ impl Transaction {
         let (consensus_branch_id, lock_time, expiry_height) =
             Self::read_v5_header_fragment(&mut reader)?;
         let transparent_bundle = Self::read_transparent(&mut reader)?;
-        let sapling_bundle = Self::read_v5_sapling(&mut reader)?;
+        let sapling_bundle = sapling_serialization::read_v5_bundle(&mut reader)?;
+        let orchard_bundle = orchard_serialization::read_v5_bundle(&mut reader)?;
+
+        let zip233_amount = None;
+
+        #[cfg(zcash_unstable = "tze")]
+        let tze_bundle = Self::read_tze(&mut reader)?;
+
+        let data = TransactionData {
+            version,
+            consensus_branch_id,
+            lock_time,
+            expiry_height,
+            transparent_bundle,
+            sprout_bundle: None,
+            sapling_bundle,
+            orchard_bundle,
+            zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
+            tze_bundle,
+        };
+
+        Ok(Self::from_data_v5(data))
+    }
+
+    fn read_v6<R: Read>(mut reader: R, version: TxVersion) -> io::Result<Self> {
+        let (consensus_branch_id, lock_time, expiry_height) =
+            Self::read_v5_header_fragment(&mut reader)?;
+        let transparent_bundle = Self::read_transparent(&mut reader)?;
+        let sapling_bundle = sapling_serialization::read_v5_bundle(&mut reader)?;
         let orchard_bundle = orchard_serialization::read_v5_bundle(&mut reader)?;
 
-        #[cfg(feature = "zfuture")]
-        let tze_bundle = if version.has_tze() {
-            Self::read_tze(&mut reader)?
+        let zip233_amount = if version == TxVersion::Zip230 {
+            Some(Self::read_zip233_amount(&mut reader)?)
         } else {
             None
         };
 
+        #[cfg(zcash_unstable = "tze")]
+        let tze_bundle = Self::read_tze(&mut reader)?;
+
         let data = TransactionData {
             version,
             consensus_branch_id,
@@ -709,7 +771,8 @@ impl Transaction {
             sprout_bundle: None,
             sapling_bundle,
             orchard_bundle,
-            #[cfg(feature = "zfuture")]
+            zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             tze_bundle,
         };
 
@@ -733,72 +796,17 @@ impl Transaction {
     #[cfg(feature = "temporary-zcashd")]
     pub fn temporary_zcashd_read_v5_sapling<R: Read>(
         reader: R,
-    ) -> io::Result<Option<sapling::Bundle<sapling::Authorized>>> {
-        Self::read_v5_sapling(reader)
+    ) -> io::Result<Option<sapling::Bundle<sapling::bundle::Authorized, Amount>>> {
+        sapling_serialization::read_v5_bundle(reader)
     }
 
-    #[allow(clippy::redundant_closure)]
-    fn read_v5_sapling<R: Read>(
-        mut reader: R,
-    ) -> io::Result<Option<sapling::Bundle<sapling::Authorized>>> {
-        let sd_v5s = Vector::read(&mut reader, SpendDescriptionV5::read)?;
-        let od_v5s = Vector::read(&mut reader, OutputDescriptionV5::read)?;
-        let n_spends = sd_v5s.len();
-        let n_outputs = od_v5s.len();
-        let value_balance = if n_spends > 0 || n_outputs > 0 {
-            Self::read_amount(&mut reader)?
-        } else {
-            Amount::zero()
-        };
-
-        let anchor = if n_spends > 0 {
-            Some(sapling::read_base(&mut reader, "anchor")?)
-        } else {
-            None
-        };
-
-        let v_spend_proofs = Array::read(&mut reader, n_spends, |r| sapling::read_zkproof(r))?;
-        let v_spend_auth_sigs = Array::read(&mut reader, n_spends, |r| {
-            SpendDescription::read_spend_auth_sig(r)
-        })?;
-        let v_output_proofs = Array::read(&mut reader, n_outputs, |r| sapling::read_zkproof(r))?;
-
-        let binding_sig = if n_spends > 0 || n_outputs > 0 {
-            Some(redjubjub::Signature::read(&mut reader)?)
-        } else {
-            None
-        };
-
-        let shielded_spends = sd_v5s
-            .into_iter()
-            .zip(
-                v_spend_proofs
-                    .into_iter()
-                    .zip(v_spend_auth_sigs.into_iter()),
-            )
-            .map(|(sd_5, (zkproof, spend_auth_sig))| {
-                // the following `unwrap` is safe because we know n_spends > 0.
-                sd_5.into_spend_description(anchor.unwrap(), zkproof, spend_auth_sig)
-            })
-            .collect();
-
-        let shielded_outputs = od_v5s
-            .into_iter()
-            .zip(v_output_proofs.into_iter())
-            .map(|(od_5, zkproof)| od_5.into_output_description(zkproof))
-            .collect();
-
-        Ok(binding_sig.map(|binding_sig| {
-            sapling::Bundle::from_parts(
-                shielded_spends,
-                shielded_outputs,
-                value_balance,
-                sapling::Authorized { binding_sig },
-            )
-        }))
+    fn read_zip233_amount<R: Read>(mut reader: R) -> io::Result<NonNegativeAmount> {
+        NonNegativeAmount::from_u64(reader.read_u64::<LittleEndian>()?)
+            .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "burnAmount out of range"))
+            .map(Into::into)
     }
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     fn read_tze<R: Read>(mut reader: &mut R) -> io::Result<Option<tze::Bundle<tze::Authorized>>> {
         let vin = Vector::read(&mut reader, TzeIn::read)?;
         let vout = Vector::read(&mut reader, TzeOut::read)?;
@@ -819,8 +827,9 @@ impl Transaction {
                 self.write_v4(writer)
             }
             TxVersion::Zip225 => self.write_v5(writer),
-            #[cfg(feature = "zfuture")]
-            TxVersion::ZFuture => self.write_v5(writer),
+            TxVersion::Zip230 => self.write_v6(writer),
+            #[cfg(zcash_unstable = "zfuture")]
+            TxVersion::ZFuture => self.write_v6(writer),
         }
     }
 
@@ -833,34 +842,11 @@ impl Transaction {
             writer.write_u32::<LittleEndian>(u32::from(self.expiry_height))?;
         }
 
-        if self.version.has_sapling() {
-            writer.write_all(
-                &self
-                    .sapling_bundle
-                    .as_ref()
-                    .map_or(Amount::zero(), |b| *b.value_balance())
-                    .to_i64_le_bytes(),
-            )?;
-            Vector::write(
-                &mut writer,
-                self.sapling_bundle
-                    .as_ref()
-                    .map_or(&[], |b| b.shielded_spends()),
-                |w, e| e.write_v4(w),
-            )?;
-            Vector::write(
-                &mut writer,
-                self.sapling_bundle
-                    .as_ref()
-                    .map_or(&[], |b| b.shielded_outputs()),
-                |w, e| e.write_v4(w),
-            )?;
-        } else if self.sapling_bundle.is_some() {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "Sapling components may not be present if Sapling is not active.",
-            ));
-        }
+        sapling_serialization::write_v4_components(
+            &mut writer,
+            self.sapling_bundle.as_ref(),
+            self.version.has_sapling(),
+        )?;
 
         if self.version.has_sprout() {
             if let Some(bundle) = self.sprout_bundle.as_ref() {
@@ -874,7 +860,7 @@ impl Transaction {
 
         if self.version.has_sapling() {
             if let Some(bundle) = self.sapling_bundle.as_ref() {
-                bundle.authorization().binding_sig.write(&mut writer)?;
+                writer.write_all(&<[u8; 64]>::from(bundle.authorization().binding_sig))?;
             }
         }
 
@@ -911,7 +897,29 @@ impl Transaction {
         self.write_transparent(&mut writer)?;
         self.write_v5_sapling(&mut writer)?;
         orchard_serialization::write_v5_bundle(self.orchard_bundle.as_ref(), &mut writer)?;
-        #[cfg(feature = "zfuture")]
+
+        #[cfg(zcash_unstable = "tze")]
+        self.write_tze(&mut writer)?;
+        Ok(())
+    }
+
+    pub fn write_v6<W: Write>(&self, mut writer: W) -> io::Result<()> {
+        if self.sprout_bundle.is_some() {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "Sprout components cannot be present when serializing to the V6 transaction format.",
+            ));
+        }
+        self.write_v5_header(&mut writer)?;
+        self.write_transparent(&mut writer)?;
+        self.write_v5_sapling(&mut writer)?;
+        orchard_serialization::write_v5_bundle(self.orchard_bundle.as_ref(), &mut writer)?;
+
+        if let Some(zip233_amount) = self.zip233_amount {
+            writer.write_u64::<LittleEndian>(zip233_amount.into())?;
+        }
+
+        #[cfg(zcash_unstable = "tze")]
         self.write_tze(&mut writer)?;
         Ok(())
     }
@@ -926,65 +934,17 @@ impl Transaction {
 
     #[cfg(feature = "temporary-zcashd")]
     pub fn temporary_zcashd_write_v5_sapling<W: Write>(
-        sapling_bundle: Option<&sapling::Bundle<sapling::Authorized>>,
+        sapling_bundle: Option<&sapling::Bundle<sapling::bundle::Authorized, Amount>>,
         writer: W,
     ) -> io::Result<()> {
-        Self::write_v5_sapling_inner(sapling_bundle, writer)
+        sapling_serialization::write_v5_bundle(writer, sapling_bundle)
     }
 
     pub fn write_v5_sapling<W: Write>(&self, writer: W) -> io::Result<()> {
-        Self::write_v5_sapling_inner(self.sapling_bundle.as_ref(), writer)
-    }
-
-    fn write_v5_sapling_inner<W: Write>(
-        sapling_bundle: Option<&sapling::Bundle<sapling::Authorized>>,
-        mut writer: W,
-    ) -> io::Result<()> {
-        if let Some(bundle) = sapling_bundle {
-            Vector::write(&mut writer, bundle.shielded_spends(), |w, e| {
-                e.write_v5_without_witness_data(w)
-            })?;
-
-            Vector::write(&mut writer, bundle.shielded_outputs(), |w, e| {
-                e.write_v5_without_proof(w)
-            })?;
-
-            if !(bundle.shielded_spends().is_empty() && bundle.shielded_outputs().is_empty()) {
-                writer.write_all(&bundle.value_balance().to_i64_le_bytes())?;
-            }
-            if !bundle.shielded_spends().is_empty() {
-                writer.write_all(bundle.shielded_spends()[0].anchor().to_repr().as_ref())?;
-            }
-
-            Array::write(
-                &mut writer,
-                bundle.shielded_spends().iter().map(|s| &s.zkproof()[..]),
-                |w, e| w.write_all(e),
-            )?;
-            Array::write(
-                &mut writer,
-                bundle.shielded_spends().iter().map(|s| s.spend_auth_sig()),
-                |w, e| e.write(w),
-            )?;
-
-            Array::write(
-                &mut writer,
-                bundle.shielded_outputs().iter().map(|s| &s.zkproof()[..]),
-                |w, e| w.write_all(e),
-            )?;
-
-            if !(bundle.shielded_spends().is_empty() && bundle.shielded_outputs().is_empty()) {
-                bundle.authorization().binding_sig.write(&mut writer)?;
-            }
-        } else {
-            CompactSize::write(&mut writer, 0)?;
-            CompactSize::write(&mut writer, 0)?;
-        }
-
-        Ok(())
+        sapling_serialization::write_v5_bundle(writer, self.sapling_bundle.as_ref())
     }
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     pub fn write_tze<W: Write>(&self, mut writer: W) -> io::Result<()> {
         if let Some(bundle) = &self.tze_bundle {
             Vector::write(&mut writer, &bundle.vin, |w, e| e.write(w))?;
@@ -1023,7 +983,7 @@ pub struct TxDigests<A> {
     pub transparent_digests: Option<TransparentDigests<A>>,
     pub sapling_digest: Option<A>,
     pub orchard_digest: Option<A>,
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     pub tze_digests: Option<TzeDigests<A>>,
 }
 
@@ -1033,7 +993,7 @@ pub trait TransactionDigest<A: Authorization> {
     type SaplingDigest;
     type OrchardDigest;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeDigest;
 
     type Digest;
@@ -1044,6 +1004,7 @@ pub trait TransactionDigest<A: Authorization> {
         consensus_branch_id: BranchId,
         lock_time: u32,
         expiry_height: BlockHeight,
+        zip233_amount: Option<&NonNegativeAmount>,
     ) -> Self::HeaderDigest;
 
     fn digest_transparent(
@@ -1053,7 +1014,7 @@ pub trait TransactionDigest<A: Authorization> {
 
     fn digest_sapling(
         &self,
-        sapling_bundle: Option<&sapling::Bundle<A::SaplingAuth>>,
+        sapling_bundle: Option<&sapling::Bundle<A::SaplingAuth, Amount>>,
     ) -> Self::SaplingDigest;
 
     fn digest_orchard(
@@ -1061,7 +1022,7 @@ pub trait TransactionDigest<A: Authorization> {
         orchard_bundle: Option<&orchard::Bundle<A::OrchardAuth, Amount>>,
     ) -> Self::OrchardDigest;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     fn digest_tze(&self, tze_bundle: Option<&tze::Bundle<A::TzeAuth>>) -> Self::TzeDigest;
 
     fn combine(
@@ -1070,7 +1031,7 @@ pub trait TransactionDigest<A: Authorization> {
         transparent_digest: Self::TransparentDigest,
         sapling_digest: Self::SaplingDigest,
         orchard_digest: Self::OrchardDigest,
-        #[cfg(feature = "zfuture")] tze_digest: Self::TzeDigest,
+        #[cfg(zcash_unstable = "tze")] tze_digest: Self::TzeDigest,
     ) -> Self::Digest;
 }
 
@@ -1086,14 +1047,15 @@ pub mod testing {
 
     use super::{
         components::{
-            orchard::testing::{self as orchard},
-            sapling::testing::{self as sapling},
-            transparent::testing::{self as transparent},
+            orchard::testing as orchard, sapling::testing as sapling,
+            transparent::testing as transparent,
         },
         Authorized, Transaction, TransactionData, TxId, TxVersion,
     };
 
-    #[cfg(feature = "zfuture")]
+    use {super::components::amount::NonNegativeAmount, zcash_protocol::value::MAX_MONEY};
+
+    #[cfg(zcash_unstable = "tze")]
     use super::components::tze::testing::{self as tze};
 
     pub fn arb_txid() -> impl Strategy<Value = TxId> {
@@ -1108,22 +1070,25 @@ pub mod testing {
                 Just(TxVersion::Sapling).boxed()
             }
             BranchId::Nu5 => Just(TxVersion::Zip225).boxed(),
-            #[cfg(feature = "zfuture")]
+            BranchId::Nu6 => Just(TxVersion::Zip225).boxed(),
+            BranchId::Nu7 => Just(TxVersion::Zip230).boxed(),
+            #[cfg(zcash_unstable = "zfuture")]
             BranchId::ZFuture => Just(TxVersion::ZFuture).boxed(),
         }
     }
 
-    #[cfg(not(feature = "zfuture"))]
+    #[cfg(not(zcash_unstable = "tze"))]
     prop_compose! {
         pub fn arb_txdata(consensus_branch_id: BranchId)(
-            version in arb_tx_version(consensus_branch_id),
+            version in arb_tx_version(consensus_branch_id)
         )(
             lock_time in any::<u32>(),
             expiry_height in any::<u32>(),
             transparent_bundle in transparent::arb_bundle(),
             sapling_bundle in sapling::arb_bundle_for_version(version),
             orchard_bundle in orchard::arb_bundle_for_version(version),
-            version in Just(version)
+            version in Just(version),
+            zip233_amount in 0..MAX_MONEY,
         ) -> TransactionData<Authorized> {
             TransactionData {
                 version,
@@ -1133,12 +1098,13 @@ pub mod testing {
                 transparent_bundle,
                 sprout_bundle: None,
                 sapling_bundle,
-                orchard_bundle
+                orchard_bundle,
+                zip233_amount: Some(NonNegativeAmount::from_u64(zip233_amount).unwrap()),
             }
         }
     }
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     prop_compose! {
         pub fn arb_txdata(consensus_branch_id: BranchId)(
             version in arb_tx_version(consensus_branch_id),
@@ -1149,6 +1115,7 @@ pub mod testing {
             sapling_bundle in sapling::arb_bundle_for_version(version),
             orchard_bundle in orchard::arb_bundle_for_version(version),
             tze_bundle in tze::arb_bundle(consensus_branch_id),
+            zip233_amount in 0..MAX_MONEY,
             version in Just(version)
         ) -> TransactionData<Authorized> {
             TransactionData {
@@ -1160,6 +1127,7 @@ pub mod testing {
                 sprout_bundle: None,
                 sapling_bundle,
                 orchard_bundle,
+                zip233_amount: Some(NonNegativeAmount::from_u64(zip233_amount).unwrap()),
                 tze_bundle
             }
         }
diff --git a/zcash_primitives/src/transaction/sighash.rs b/zcash_primitives/src/transaction/sighash.rs
index 3fd9b8b2ea..0162e71c54 100644
--- a/zcash_primitives/src/transaction/sighash.rs
+++ b/zcash_primitives/src/transaction/sighash.rs
@@ -1,18 +1,18 @@
-use crate::legacy::Script;
 use blake2b_simd::Hash as Blake2bHash;
 
 use super::{
-    components::{
-        sapling::{self, GrothProofBytes},
-        transparent, Amount,
-    },
+    components::{amount::NonNegativeAmount, transparent},
     sighash_v4::v4_signature_hash,
     sighash_v5::v5_signature_hash,
     Authorization, TransactionData, TxDigests, TxVersion,
 };
+use crate::{
+    legacy::Script,
+    sapling::{self, bundle::GrothProofBytes},
+};
 
-#[cfg(feature = "zfuture")]
-use crate::extensions::transparent::Precondition;
+#[cfg(zcash_unstable = "zfuture")]
+use {super::components::Amount, crate::extensions::transparent::Precondition};
 
 pub const SIGHASH_ALL: u8 = 0x01;
 pub const SIGHASH_NONE: u8 = 0x02;
@@ -27,9 +27,9 @@ pub enum SignableInput<'a> {
         index: usize,
         script_code: &'a Script,
         script_pubkey: &'a Script,
-        value: Amount,
+        value: NonNegativeAmount,
     },
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     Tze {
         index: usize,
         precondition: &'a Precondition,
@@ -42,7 +42,7 @@ impl<'a> SignableInput<'a> {
         match self {
             SignableInput::Shielded => SIGHASH_ALL,
             SignableInput::Transparent { hash_type, .. } => *hash_type,
-            #[cfg(feature = "zfuture")]
+            #[cfg(zcash_unstable = "tze")]
             SignableInput::Tze { .. } => SIGHASH_ALL,
         }
     }
@@ -63,7 +63,7 @@ pub trait TransparentAuthorizingContext: transparent::Authorization {
     /// so that wallets can commit to the transparent input breakdown
     /// without requiring the full data of the previous transactions
     /// providing these inputs.
-    fn input_amounts(&self) -> Vec<Amount>;
+    fn input_amounts(&self) -> Vec<NonNegativeAmount>;
     /// Returns the list of all transparent input scriptPubKeys, provided
     /// so that wallets can commit to the transparent input breakdown
     /// without requiring the full data of the previous transactions
@@ -76,13 +76,12 @@ pub trait TransparentAuthorizingContext: transparent::Authorization {
 /// set of precomputed hashes produced in the construction of the
 /// transaction ID.
 pub fn signature_hash<
-    'a,
     TA: TransparentAuthorizingContext,
-    SA: sapling::Authorization<SpendProof = GrothProofBytes, OutputProof = GrothProofBytes>,
+    SA: sapling::bundle::Authorization<SpendProof = GrothProofBytes, OutputProof = GrothProofBytes>,
     A: Authorization<SaplingAuth = SA, TransparentAuth = TA>,
 >(
     tx: &TransactionData<A>,
-    signable_input: &SignableInput<'a>,
+    signable_input: &SignableInput,
     txid_parts: &TxDigests<Blake2bHash>,
 ) -> SignatureHash {
     SignatureHash(match tx.version {
@@ -92,7 +91,9 @@ pub fn signature_hash<
 
         TxVersion::Zip225 => v5_signature_hash(tx, signable_input, txid_parts),
 
-        #[cfg(feature = "zfuture")]
+        TxVersion::Zip230 => v5_signature_hash(tx, signable_input, txid_parts),
+
+        #[cfg(zcash_unstable = "zfuture")]
         TxVersion::ZFuture => v5_signature_hash(tx, signable_input, txid_parts),
     })
 }
diff --git a/zcash_primitives/src/transaction/sighash_v4.rs b/zcash_primitives/src/transaction/sighash_v4.rs
index b5eeed7b1c..5d7bcbcc81 100644
--- a/zcash_primitives/src/transaction/sighash_v4.rs
+++ b/zcash_primitives/src/transaction/sighash_v4.rs
@@ -1,12 +1,17 @@
 use blake2b_simd::{Hash as Blake2bHash, Params as Blake2bParams};
-use byteorder::{LittleEndian, WriteBytesExt};
 use ff::PrimeField;
 
-use crate::consensus::BranchId;
+use crate::{
+    consensus::BranchId,
+    sapling::{
+        self,
+        bundle::{GrothProofBytes, OutputDescription, SpendDescription},
+    },
+};
 
 use super::{
     components::{
-        sapling::{self, GrothProofBytes, OutputDescription, SpendDescription},
+        sapling as sapling_serialization,
         sprout::JsDescription,
         transparent::{self, TxIn, TxOut},
     },
@@ -22,13 +27,6 @@ const ZCASH_JOINSPLITS_HASH_PERSONALIZATION: &[u8; 16] = b"ZcashJSplitsHash";
 const ZCASH_SHIELDED_SPENDS_HASH_PERSONALIZATION: &[u8; 16] = b"ZcashSSpendsHash";
 const ZCASH_SHIELDED_OUTPUTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZcashSOutputHash";
 
-macro_rules! update_u32 {
-    ($h:expr, $value:expr, $tmp:expr) => {
-        (&mut $tmp[..4]).write_u32::<LittleEndian>($value).unwrap();
-        $h.update(&$tmp[..4]);
-    };
-}
-
 macro_rules! update_hash {
     ($h:expr, $cond:expr, $value:expr) => {
         if $cond {
@@ -53,7 +51,7 @@ fn prevout_hash<TA: transparent::Authorization>(vin: &[TxIn<TA>]) -> Blake2bHash
 fn sequence_hash<TA: transparent::Authorization>(vin: &[TxIn<TA>]) -> Blake2bHash {
     let mut data = Vec::with_capacity(vin.len() * 4);
     for t_in in vin {
-        data.write_u32::<LittleEndian>(t_in.sequence).unwrap();
+        data.extend_from_slice(&t_in.sequence.to_le_bytes());
     }
     Blake2bParams::new()
         .hash_length(32)
@@ -105,7 +103,7 @@ fn joinsplits_hash(
 }
 
 fn shielded_spends_hash<
-    A: sapling::Authorization<SpendProof = GrothProofBytes, OutputProof = GrothProofBytes>,
+    A: sapling::bundle::Authorization<SpendProof = GrothProofBytes, OutputProof = GrothProofBytes>,
 >(
     shielded_spends: &[SpendDescription<A>],
 ) -> Blake2bHash {
@@ -114,7 +112,7 @@ fn shielded_spends_hash<
         data.extend_from_slice(&s_spend.cv().to_bytes());
         data.extend_from_slice(s_spend.anchor().to_repr().as_ref());
         data.extend_from_slice(s_spend.nullifier().as_ref());
-        s_spend.rk().write(&mut data).unwrap();
+        data.extend_from_slice(&<[u8; 32]>::from(*s_spend.rk()));
         data.extend_from_slice(s_spend.zkproof());
     }
     Blake2bParams::new()
@@ -126,7 +124,7 @@ fn shielded_spends_hash<
 fn shielded_outputs_hash(shielded_outputs: &[OutputDescription<GrothProofBytes>]) -> Blake2bHash {
     let mut data = Vec::with_capacity(shielded_outputs.len() * 948);
     for s_out in shielded_outputs {
-        s_out.write_v4(&mut data).unwrap();
+        sapling_serialization::write_output_v4(&mut data, s_out).unwrap();
     }
     Blake2bParams::new()
         .hash_length(32)
@@ -135,7 +133,7 @@ fn shielded_outputs_hash(shielded_outputs: &[OutputDescription<GrothProofBytes>]
 }
 
 pub fn v4_signature_hash<
-    SA: sapling::Authorization<SpendProof = GrothProofBytes, OutputProof = GrothProofBytes>,
+    SA: sapling::bundle::Authorization<SpendProof = GrothProofBytes, OutputProof = GrothProofBytes>,
     A: Authorization<SaplingAuth = SA>,
 >(
     tx: &TransactionData<A>,
@@ -145,18 +143,15 @@ pub fn v4_signature_hash<
     if tx.version.has_overwinter() {
         let mut personal = [0; 16];
         personal[..12].copy_from_slice(ZCASH_SIGHASH_PERSONALIZATION_PREFIX);
-        (&mut personal[12..])
-            .write_u32::<LittleEndian>(tx.consensus_branch_id.into())
-            .unwrap();
+        personal[12..].copy_from_slice(&u32::from(tx.consensus_branch_id).to_le_bytes());
 
         let mut h = Blake2bParams::new()
             .hash_length(32)
             .personal(&personal)
             .to_state();
-        let mut tmp = [0; 8];
 
-        update_u32!(h, tx.version.header(), tmp);
-        update_u32!(h, tx.version.version_group_id(), tmp);
+        h.update(&tx.version.header().to_le_bytes());
+        h.update(&tx.version.version_group_id().to_le_bytes());
         update_hash!(
             h,
             hash_type & SIGHASH_ANYONECANPAY == 0,
@@ -231,12 +226,12 @@ pub fn v4_signature_hash<
                 shielded_outputs_hash(tx.sapling_bundle.as_ref().unwrap().shielded_outputs())
             );
         }
-        update_u32!(h, tx.lock_time, tmp);
-        update_u32!(h, tx.expiry_height.into(), tmp);
+        h.update(&tx.lock_time.to_le_bytes());
+        h.update(&u32::from(tx.expiry_height).to_le_bytes());
         if tx.version.has_sapling() {
             h.update(&tx.sapling_value_balance().to_i64_le_bytes());
         }
-        update_u32!(h, hash_type.into(), tmp);
+        h.update(&u32::from(hash_type).to_le_bytes());
 
         match signable_input {
             SignableInput::Shielded => (),
@@ -251,8 +246,7 @@ pub fn v4_signature_hash<
                     bundle.vin[*index].prevout.write(&mut data).unwrap();
                     script_code.write(&mut data).unwrap();
                     data.extend_from_slice(&value.to_i64_le_bytes());
-                    data.write_u32::<LittleEndian>(bundle.vin[*index].sequence)
-                        .unwrap();
+                    data.extend_from_slice(&bundle.vin[*index].sequence.to_le_bytes());
                     h.update(&data);
                 } else {
                     panic!(
@@ -261,7 +255,7 @@ pub fn v4_signature_hash<
                 }
             }
 
-            #[cfg(feature = "zfuture")]
+            #[cfg(zcash_unstable = "tze")]
             SignableInput::Tze { .. } => {
                 panic!("A request has been made to sign a TZE input, but the transaction version is not ZFuture");
             }
diff --git a/zcash_primitives/src/transaction/sighash_v5.rs b/zcash_primitives/src/transaction/sighash_v5.rs
index aebe5f9193..3521c0c79b 100644
--- a/zcash_primitives/src/transaction/sighash_v5.rs
+++ b/zcash_primitives/src/transaction/sighash_v5.rs
@@ -1,7 +1,6 @@
 use std::io::Write;
 
 use blake2b_simd::{Hash as Blake2bHash, Params, State};
-use byteorder::{LittleEndian, WriteBytesExt};
 use zcash_encoding::Array;
 
 use crate::transaction::{
@@ -17,17 +16,18 @@ use crate::transaction::{
     Authorization, TransactionData, TransparentDigests, TxDigests,
 };
 
-#[cfg(feature = "zfuture")]
-use zcash_encoding::{CompactSize, Vector};
-
-#[cfg(feature = "zfuture")]
-use crate::transaction::{components::tze, TzeDigests};
+#[cfg(zcash_unstable = "tze")]
+use {
+    crate::transaction::{components::tze, TzeDigests},
+    byteorder::WriteBytesExt,
+    zcash_encoding::{CompactSize, Vector},
+};
 
 const ZCASH_TRANSPARENT_INPUT_HASH_PERSONALIZATION: &[u8; 16] = b"Zcash___TxInHash";
 const ZCASH_TRANSPARENT_AMOUNTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxTrAmountsHash";
 const ZCASH_TRANSPARENT_SCRIPTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxTrScriptsHash";
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 const ZCASH_TZE_INPUT_HASH_PERSONALIZATION: &[u8; 16] = b"Zcash__TzeInHash";
 
 fn hasher(personal: &[u8; 16]) -> State {
@@ -121,7 +121,7 @@ fn transparent_sig_digest<A: TransparentAuthorizingContext>(
                 txin.prevout.write(&mut ch).unwrap();
                 ch.write_all(&value.to_i64_le_bytes()).unwrap();
                 script_pubkey.write(&mut ch).unwrap();
-                ch.write_u32::<LittleEndian>(txin.sequence).unwrap();
+                ch.write_all(&txin.sequence.to_le_bytes()).unwrap();
             }
             let txin_sig_digest = ch.finalize();
 
@@ -138,7 +138,7 @@ fn transparent_sig_digest<A: TransparentAuthorizingContext>(
     }
 }
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 fn tze_input_sigdigests<A: tze::Authorization>(
     bundle: &tze::Bundle<A>,
     input: &SignableInput<'_>,
@@ -195,7 +195,7 @@ pub fn v5_signature_hash<
         ),
         txid_parts.sapling_digest,
         txid_parts.orchard_digest,
-        #[cfg(feature = "zfuture")]
+        #[cfg(zcash_unstable = "tze")]
         tx.tze_bundle
             .as_ref()
             .zip(txid_parts.tze_digests.as_ref())
diff --git a/zcash_primitives/src/transaction/tests.rs b/zcash_primitives/src/transaction/tests.rs
index 9335d89840..319abe0840 100644
--- a/zcash_primitives/src/transaction/tests.rs
+++ b/zcash_primitives/src/transaction/tests.rs
@@ -3,15 +3,15 @@ use std::ops::Deref;
 
 use proptest::prelude::*;
 
-use crate::{consensus::BranchId, legacy::Script};
+use crate::{
+    consensus::BranchId,
+    legacy::Script,
+    transaction::{components::amount::NonNegativeAmount, TxVersion},
+};
 
 use super::{
-    components::Amount,
     sapling,
-    sighash::{
-        SignableInput, TransparentAuthorizingContext, SIGHASH_ALL, SIGHASH_ANYONECANPAY,
-        SIGHASH_NONE, SIGHASH_SINGLE,
-    },
+    sighash::{SignableInput, TransparentAuthorizingContext},
     sighash_v4::v4_signature_hash,
     sighash_v5::v5_signature_hash,
     testing::arb_tx,
@@ -20,8 +20,10 @@ use super::{
     Authorization, Transaction, TransactionData, TxDigests, TxIn,
 };
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 use super::components::tze;
+#[cfg(not(zcash_unstable = "tze"))]
+use super::sighash::{SIGHASH_ALL, SIGHASH_ANYONECANPAY, SIGHASH_NONE, SIGHASH_SINGLE};
 
 #[test]
 fn tx_read_write() {
@@ -43,7 +45,7 @@ fn check_roundtrip(tx: Transaction) -> Result<(), TestCaseError> {
     let txo = Transaction::read(&txn_bytes[..], tx.consensus_branch_id).unwrap();
 
     prop_assert_eq!(tx.version, txo.version);
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     prop_assert_eq!(tx.tze_bundle.as_ref(), txo.tze_bundle.as_ref());
     prop_assert_eq!(tx.lock_time, txo.lock_time);
     prop_assert_eq!(
@@ -55,12 +57,16 @@ fn check_roundtrip(tx: Transaction) -> Result<(), TestCaseError> {
         tx.orchard_bundle.as_ref().map(|v| *v.value_balance()),
         txo.orchard_bundle.as_ref().map(|v| *v.value_balance())
     );
+    if tx.version == TxVersion::Zip230 {
+        prop_assert_eq!(tx.zip233_amount, txo.zip233_amount);
+    }
     Ok(())
 }
 
 proptest! {
     #[test]
     #[ignore]
+    #[cfg(feature = "expensive-tests")]
     fn tx_serialization_roundtrip_sprout(tx in arb_tx(BranchId::Sprout)) {
         check_roundtrip(tx)?;
     }
@@ -69,6 +75,7 @@ proptest! {
 proptest! {
     #[test]
     #[ignore]
+    #[cfg(feature = "expensive-tests")]
     fn tx_serialization_roundtrip_overwinter(tx in arb_tx(BranchId::Overwinter)) {
         check_roundtrip(tx)?;
     }
@@ -77,6 +84,7 @@ proptest! {
 proptest! {
     #[test]
     #[ignore]
+    #[cfg(feature = "expensive-tests")]
     fn tx_serialization_roundtrip_sapling(tx in arb_tx(BranchId::Sapling)) {
         check_roundtrip(tx)?;
     }
@@ -85,6 +93,7 @@ proptest! {
 proptest! {
     #[test]
     #[ignore]
+    #[cfg(feature = "expensive-tests")]
     fn tx_serialization_roundtrip_blossom(tx in arb_tx(BranchId::Blossom)) {
         check_roundtrip(tx)?;
     }
@@ -93,6 +102,7 @@ proptest! {
 proptest! {
     #[test]
     #[ignore]
+    #[cfg(feature = "expensive-tests")]
     fn tx_serialization_roundtrip_heartwood(tx in arb_tx(BranchId::Heartwood)) {
         check_roundtrip(tx)?;
     }
@@ -114,10 +124,19 @@ proptest! {
     }
 }
 
-#[cfg(feature = "zfuture")]
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(10))]
+    #[test]
+    fn tx_serialization_roundtrip_nu7(tx in arb_tx(BranchId::Nu7)) {
+        check_roundtrip(tx)?;
+    }
+}
+
+#[cfg(zcash_unstable = "zfuture")]
 proptest! {
     #[test]
     #[ignore]
+    #[cfg(feature = "expensive-tests")]
     fn tx_serialization_roundtrip_future(tx in arb_tx(BranchId::ZFuture)) {
         check_roundtrip(tx)?;
     }
@@ -134,7 +153,7 @@ fn zip_0143() {
                 index: n as usize,
                 script_code: &tv.script_code,
                 script_pubkey: &tv.script_code,
-                value: Amount::from_nonnegative_i64(tv.amount).unwrap(),
+                value: NonNegativeAmount::from_nonnegative_i64(tv.amount).unwrap(),
             },
             _ => SignableInput::Shielded,
         };
@@ -156,7 +175,7 @@ fn zip_0243() {
                 index: n as usize,
                 script_code: &tv.script_code,
                 script_pubkey: &tv.script_code,
-                value: Amount::from_nonnegative_i64(tv.amount).unwrap(),
+                value: NonNegativeAmount::from_nonnegative_i64(tv.amount).unwrap(),
             },
             _ => SignableInput::Shielded,
         };
@@ -170,7 +189,7 @@ fn zip_0243() {
 
 #[derive(Debug)]
 struct TestTransparentAuth {
-    input_amounts: Vec<Amount>,
+    input_amounts: Vec<NonNegativeAmount>,
     input_scriptpubkeys: Vec<Script>,
 }
 
@@ -179,7 +198,7 @@ impl transparent::Authorization for TestTransparentAuth {
 }
 
 impl TransparentAuthorizingContext for TestTransparentAuth {
-    fn input_amounts(&self) -> Vec<Amount> {
+    fn input_amounts(&self) -> Vec<NonNegativeAmount> {
         self.input_amounts.clone()
     }
 
@@ -192,13 +211,14 @@ struct TestUnauthorized;
 
 impl Authorization for TestUnauthorized {
     type TransparentAuth = TestTransparentAuth;
-    type SaplingAuth = sapling::Authorized;
+    type SaplingAuth = sapling::bundle::Authorized;
     type OrchardAuth = orchard::bundle::Authorized;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeAuth = tze::Authorized;
 }
 
+#[cfg(not(zcash_unstable = "tze"))]
 #[test]
 fn zip_0244() {
     fn to_test_txdata(
@@ -214,7 +234,7 @@ fn zip_0244() {
         let input_amounts = tv
             .amounts
             .iter()
-            .map(|amount| Amount::from_nonnegative_i64(*amount).unwrap())
+            .map(|amount| NonNegativeAmount::from_nonnegative_i64(*amount).unwrap())
             .collect();
         let input_scriptpubkeys = tv
             .script_pubkeys
@@ -245,7 +265,6 @@ fn zip_0244() {
                 },
             });
 
-        #[cfg(not(feature = "zfuture"))]
         let tdata = TransactionData::from_parts(
             txdata.version(),
             txdata.consensus_branch_id(),
@@ -255,17 +274,8 @@ fn zip_0244() {
             txdata.sprout_bundle().cloned(),
             txdata.sapling_bundle().cloned(),
             txdata.orchard_bundle().cloned(),
-        );
-        #[cfg(feature = "zfuture")]
-        let tdata = TransactionData::from_parts_zfuture(
-            txdata.version(),
-            txdata.consensus_branch_id(),
-            txdata.lock_time(),
-            txdata.expiry_height(),
-            test_bundle,
-            txdata.sprout_bundle().cloned(),
-            txdata.sapling_bundle().cloned(),
-            txdata.orchard_bundle().cloned(),
+            txdata.zip233_amount,
+            #[cfg(zcash_unstable = "tze")]
             txdata.tze_bundle().cloned(),
         );
         (tdata, txdata.digest(TxIdDigester))
@@ -349,3 +359,75 @@ fn zip_0244() {
         );
     }
 }
+
+#[cfg(not(zcash_unstable = "tze"))]
+#[test]
+fn zip_0233() {
+    fn to_test_txdata(
+        tv: &self::data::zip_0233::TestVector,
+    ) -> (TransactionData<TestUnauthorized>, TxDigests<Blake2bHash>) {
+        let tx = Transaction::read(&tv.tx[..], BranchId::Nu7).unwrap();
+
+        assert_eq!(tx.txid.as_ref(), &tv.txid);
+        assert_eq!(tx.auth_commitment().as_ref(), &tv.auth_digest);
+
+        let txdata = tx.deref();
+
+        let input_amounts = tv
+            .amounts
+            .iter()
+            .map(|amount| NonNegativeAmount::from_nonnegative_i64(*amount).unwrap())
+            .collect();
+        let input_scriptpubkeys = tv
+            .script_pubkeys
+            .iter()
+            .map(|s| Script(s.clone()))
+            .collect();
+
+        let test_bundle = txdata
+            .transparent_bundle
+            .as_ref()
+            .map(|b| transparent::Bundle {
+                // we have to do this map/clone to make the types line up, since the
+                // Authorization::ScriptSig type is bound to transparent::Authorized, and we need
+                // it to be bound to TestTransparentAuth.
+                vin: b
+                    .vin
+                    .iter()
+                    .map(|vin| TxIn {
+                        prevout: vin.prevout.clone(),
+                        script_sig: vin.script_sig.clone(),
+                        sequence: vin.sequence,
+                    })
+                    .collect(),
+                vout: b.vout.clone(),
+                authorization: TestTransparentAuth {
+                    input_amounts,
+                    input_scriptpubkeys,
+                },
+            });
+
+        let tdata = TransactionData::from_parts(
+            txdata.version(),
+            txdata.consensus_branch_id(),
+            txdata.lock_time(),
+            txdata.expiry_height(),
+            test_bundle,
+            txdata.sprout_bundle().cloned(),
+            txdata.sapling_bundle().cloned(),
+            txdata.orchard_bundle().cloned(),
+            txdata.zip233_amount,
+        );
+
+        (tdata, txdata.digest(TxIdDigester))
+    }
+
+    for tv in self::data::zip_0233::make_test_vectors() {
+        let (txdata, txid_parts) = to_test_txdata(&tv);
+
+        assert_eq!(
+            v5_signature_hash(&txdata, &SignableInput::Shielded, &txid_parts).as_ref(),
+            tv.sighash_shielded
+        );
+    }
+}
diff --git a/zcash_primitives/src/transaction/tests/data.rs b/zcash_primitives/src/transaction/tests/data.rs
index 5b73779fea..76076ee920 100644
--- a/zcash_primitives/src/transaction/tests/data.rs
+++ b/zcash_primitives/src/transaction/tests/data.rs
@@ -5685,6 +5685,7 @@ pub mod zip_0243 {
     }
 }
 
+#[cfg(not(zcash_unstable = "tze"))]
 pub mod zip_0244 {
     pub struct TestVector {
         pub tx: Vec<u8>,
@@ -7373,3 +7374,2203 @@ pub mod zip_0244 {
         ]
     }
 }
+
+#[cfg(not(zcash_unstable = "tze"))]
+pub mod zip_0233 {
+    pub struct TestVector {
+        pub tx: Vec<u8>,
+        pub txid: [u8; 32],
+        pub auth_digest: [u8; 32],
+        pub amounts: Vec<i64>,
+        pub zip233_amount: u64,
+        pub script_pubkeys: Vec<Vec<u8>>,
+        pub transparent_input: Option<u32>,
+        pub sighash_shielded: [u8; 32],
+        pub sighash_all: Option<[u8; 32]>,
+        pub sighash_none: Option<[u8; 32]>,
+        pub sighash_single: Option<[u8; 32]>,
+        pub sighash_all_anyone: Option<[u8; 32]>,
+        pub sighash_none_anyone: Option<[u8; 32]>,
+        pub sighash_single_anyone: Option<[u8; 32]>,
+    }
+
+    // From https://github.com/zcash-hackworks/zcash-test-vectors/blob/master/zip_nsm.py
+    pub fn make_test_vectors() -> Vec<TestVector> {
+        vec![
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9b,
+                    0xa2, 0x13, 0x90, 0xc8, 0x36, 0xe4, 0x0e, 0x03, 0x89, 0x80, 0x1f, 0x68, 0x57,
+                    0x17, 0xae, 0xf8, 0xf1, 0x88, 0xb7, 0x51, 0x21, 0x07, 0x79, 0x72, 0xf1, 0x8f,
+                    0x21, 0xbd, 0x21, 0x88, 0xb2, 0x7c, 0x6d, 0x54, 0xec, 0x21, 0xbb, 0x62, 0x2d,
+                    0x45, 0xd5, 0x78, 0x9e, 0xcb, 0x04, 0x63, 0x63, 0x6a, 0x00, 0x7e, 0x3e, 0xce,
+                    0x7a, 0x11, 0x21, 0xb4, 0xa9, 0xfa, 0xa1, 0x8f, 0x08, 0x8b, 0xce, 0x5d, 0xc7,
+                    0xbc, 0xc8, 0x97, 0x1b, 0xc0, 0x0e, 0xde, 0x98, 0x44, 0x3c, 0x64, 0x5f, 0xb1,
+                    0x8c, 0x0c, 0x89, 0x4d, 0xc6, 0x22, 0xdd, 0xd9, 0x05, 0xea, 0x16, 0x06, 0x51,
+                    0xac, 0x65, 0x51, 0xac, 0x52, 0x64, 0x82, 0xa5, 0xed, 0x29, 0x94, 0x99, 0x52,
+                    0x34, 0x0c, 0x1a, 0x56, 0xf1, 0x00, 0x1e, 0x4c, 0x94, 0x3c, 0xf8, 0x74, 0x04,
+                    0xbc, 0x7f, 0xe4, 0xcc, 0xf7, 0x9e, 0x60, 0x2a, 0x1e, 0x43, 0x7c, 0x7d, 0xe4,
+                    0x28, 0xef, 0x11, 0xaf, 0x54, 0xa2, 0x06, 0xac, 0xac, 0x52, 0x6a, 0x63, 0x00,
+                    0x96, 0x37, 0x6c, 0x1c, 0x00, 0x02, 0x77, 0xbe, 0xa7, 0xa4, 0x2f, 0xe7, 0xa4,
+                    0xf9, 0x96, 0xee, 0x42, 0x03, 0x69, 0x8f, 0x43, 0x3e, 0x71, 0x4b, 0x73, 0x70,
+                    0xfe, 0xe7, 0xc6, 0xff, 0x27, 0x58, 0x02, 0x20, 0x60, 0x5b, 0xb3, 0xa9, 0x9c,
+                    0x70, 0xe4, 0x1c, 0xbb, 0xf3, 0x4a, 0x9b, 0x01, 0x25, 0x87, 0x74, 0x2a, 0xba,
+                    0x90, 0xf2, 0x00, 0xbc, 0x6b, 0x0d, 0x17, 0x1a, 0x10, 0x10, 0x5d, 0x9c, 0x37,
+                    0x07, 0xb3, 0x71, 0x3f, 0x51, 0xc1, 0x39, 0x51, 0x2a, 0x4d, 0x76, 0x93, 0x07,
+                    0x4d, 0x29, 0x5b, 0xa7, 0x3d, 0x36, 0x06, 0x67, 0xcf, 0xf0, 0x2d, 0x59, 0x8d,
+                    0x82, 0x8b, 0x2c, 0x8e, 0x2f, 0x36, 0x52, 0x9d, 0xbf, 0xaa, 0x0b, 0xd1, 0x83,
+                    0x55, 0xab, 0xc7, 0x57, 0x94, 0x85, 0xf6, 0xa8, 0xb9, 0xd3, 0xff, 0x08, 0xaf,
+                    0xe3, 0x68, 0x91, 0x15, 0x54, 0x9b, 0xcb, 0x06, 0x8c, 0x3e, 0x33, 0x09, 0x64,
+                    0x5e, 0x9f, 0x35, 0xd9, 0xa0, 0xec, 0xf5, 0x4a, 0x04, 0xd4, 0x08, 0x60, 0xa7,
+                    0xaf, 0x91, 0x9d, 0xbd, 0xa1, 0xb1, 0x60, 0x9d, 0xa9, 0x41, 0x6e, 0x6a, 0x7f,
+                    0x4e, 0x73, 0x69, 0xb5, 0xea, 0x9e, 0x12, 0x5c, 0xd7, 0x5f, 0xbd, 0x30, 0x5d,
+                    0xf7, 0xa7, 0xa6, 0x49, 0xaf, 0x5e, 0xed, 0xe7, 0xa0, 0x28, 0x73, 0x7a, 0x98,
+                    0x71, 0x38, 0x40, 0xe9, 0xb2, 0x87, 0x0b, 0xb8, 0x62, 0x22, 0x58, 0x93, 0xf0,
+                    0x74, 0x33, 0x63, 0x02, 0x58, 0xe5, 0x88, 0x12, 0xbb, 0x72, 0xbc, 0x72, 0x2d,
+                    0xf0, 0x55, 0xff, 0xb5, 0x73, 0x97, 0x3f, 0x21, 0x67, 0x6d, 0xb5, 0xc5, 0x72,
+                    0x92, 0xcd, 0x9d, 0xf0, 0xb9, 0x7a, 0xd6, 0x4a, 0xc8, 0xd7, 0x1f, 0x19, 0x78,
+                    0xd3, 0x43, 0x10, 0x53, 0x3d, 0x49, 0x50, 0x50, 0xa0, 0xa4, 0x96, 0xcd, 0xc6,
+                    0x82, 0xc7, 0x7a, 0x6f, 0x4f, 0x54, 0xed, 0x8d, 0x30, 0xa5, 0xc0, 0xf0, 0x81,
+                    0x2f, 0x59, 0x4c, 0x57, 0x27, 0x15, 0x1d, 0x58, 0x18, 0x6d, 0x83, 0x7c, 0x1d,
+                    0xdb, 0xa4, 0x19, 0x4a, 0x5f, 0x8f, 0x00, 0x50, 0x66, 0x86, 0xc8, 0xda, 0xc8,
+                    0x91, 0x4b, 0xf9, 0x8a, 0xc4, 0x37, 0xef, 0x31, 0x87, 0x8a, 0x02, 0xa9, 0x1b,
+                    0x29, 0xd5, 0xe7, 0xac, 0x77, 0x1f, 0xf1, 0x77, 0xed, 0xc3, 0xeb, 0x03, 0x71,
+                    0x75, 0x38, 0x5e, 0x31, 0xfe, 0xa1, 0x20, 0xce, 0x01, 0xa9, 0xc1, 0xe6, 0x6d,
+                    0xf4, 0x63, 0x36, 0xc7, 0x82, 0x14, 0x5b, 0xa5, 0xab, 0xbd, 0x6b, 0x77, 0xb4,
+                    0x98, 0xb7, 0x4e, 0xe2, 0x7c, 0xc9, 0x63, 0x68, 0xab, 0xe9, 0x45, 0x00, 0x03,
+                    0xe2, 0x4d, 0x16, 0x00, 0x99, 0xda, 0x82, 0xfc, 0x70, 0xea, 0x52, 0xe4, 0x40,
+                    0x6a, 0x3a, 0xac, 0x2e, 0x4f, 0x4e, 0x12, 0x7b, 0x98, 0x9e, 0xef, 0xf6, 0xe3,
+                    0x26, 0xd4, 0xca, 0xec, 0x8f, 0x99, 0xbf, 0xdf, 0xf7, 0x5c, 0x6e, 0x35, 0xa0,
+                    0x43, 0x76, 0xbf, 0x7b, 0x3b, 0x1d, 0x42, 0x5c, 0x2a, 0x0a, 0x03, 0x5d, 0x8d,
+                    0x76, 0xdd, 0xdb, 0x32, 0xca, 0xec, 0xef, 0x33, 0x30, 0xc9, 0xaf, 0xb4, 0x35,
+                    0xca, 0x6c, 0xd4, 0xa8, 0xcc, 0x46, 0xe7, 0xa8, 0x67, 0x1e, 0xd3, 0xf8, 0xbc,
+                    0x18, 0x9a, 0xed, 0x66, 0x50, 0x6e, 0xac, 0x21, 0x33, 0x1d, 0xc5, 0x24, 0x94,
+                    0x83, 0x72, 0xca, 0x46, 0x90, 0xf1, 0x9e, 0x4e, 0xb5, 0x27, 0x87, 0xdb, 0x96,
+                    0xee, 0xb4, 0x14, 0x66, 0x8e, 0x15, 0xb1, 0xf4, 0xe9, 0xda, 0x0d, 0x80, 0xb4,
+                    0xd3, 0x8f, 0xa4, 0x7a, 0x2e, 0xe9, 0xef, 0xaf, 0x2a, 0x73, 0x12, 0xb2, 0x33,
+                    0x81, 0x6e, 0xa5, 0x48, 0xde, 0xf5, 0xab, 0x51, 0xf4, 0x7c, 0xf6, 0xb1, 0xc2,
+                    0xe9, 0x08, 0x35, 0x78, 0x82, 0x07, 0xb4, 0x6c, 0x47, 0x00, 0xf0, 0xff, 0xed,
+                    0x87, 0xe5, 0x55, 0xe8, 0xd0, 0x21, 0x33, 0x32, 0x84, 0x77, 0x88, 0x85, 0xb9,
+                    0x4a, 0x87, 0x87, 0x03, 0xa6, 0xd8, 0x50, 0x13, 0xc0, 0x68, 0xf8, 0xb1, 0x0e,
+                    0xd0, 0xc3, 0x86, 0x2a, 0xc4, 0x9e, 0x96, 0xa1, 0x6c, 0x27, 0xaa, 0x2f, 0x44,
+                    0xac, 0x32, 0x52, 0xf2, 0x93, 0xd0, 0x77, 0x34, 0x98, 0x1a, 0x1b, 0xd0, 0xf5,
+                    0x9f, 0x18, 0xcc, 0x4b, 0x5e, 0xde, 0x83, 0x9c, 0x80, 0x13, 0x4c, 0x9c, 0xe8,
+                    0xf1, 0x43, 0x29, 0x76, 0xfd, 0x66, 0x90, 0x72, 0x11, 0xd7, 0x9c, 0xa2, 0x4c,
+                    0xa7, 0xf7, 0xf9, 0xf3, 0x51, 0xfb, 0xf4, 0xff, 0x72, 0x6b, 0xd1, 0x16, 0xcd,
+                    0xb6, 0x7b, 0x50, 0xcc, 0x5c, 0xd8, 0x4c, 0x92, 0x7a, 0x7f, 0x9d, 0x5d, 0x54,
+                    0x7a, 0x64, 0xde, 0x8d, 0x42, 0xb0, 0xce, 0x49, 0xbb, 0x8f, 0x1a, 0x70, 0xe6,
+                    0x6c, 0x03, 0xd1, 0x28, 0x68, 0x88, 0x0d, 0x27, 0xb7, 0x1a, 0xef, 0xcc, 0x85,
+                    0x4c, 0x3e, 0xdc, 0x07, 0x46, 0x48, 0xbc, 0x61, 0x2b, 0xc2, 0x64, 0x36, 0xf8,
+                    0x38, 0x03, 0x3a, 0x61, 0x81, 0xfb, 0xb5, 0x6a, 0x30, 0xaa, 0xfb, 0xed, 0x05,
+                    0x15, 0xb8, 0xe5, 0x1e, 0x45, 0xeb, 0xa7, 0xc6, 0xcb, 0xa2, 0x50, 0x2a, 0x04,
+                    0xe3, 0xfb, 0xd2, 0xe3, 0x79, 0xa8, 0x45, 0x2a, 0xc3, 0x8d, 0x03, 0xfa, 0x03,
+                    0xa3, 0x7d, 0xf2, 0x5a, 0x64, 0xc4, 0x72, 0xd2, 0x57, 0x7f, 0xa9, 0x8a, 0xc7,
+                    0x5f, 0xfd, 0x8b, 0x1e, 0x05, 0x32, 0x79, 0x96, 0x01, 0xc4, 0xec, 0x0d, 0x15,
+                    0x54, 0x30, 0x22, 0xd3, 0x7a, 0xcb, 0x3a, 0x2f, 0x76, 0xec, 0x09, 0xca, 0xc3,
+                    0x1e, 0x02, 0xa2, 0xbd, 0xc9, 0x87, 0x6a, 0xad, 0xdf, 0xe0, 0x4b, 0x6f, 0x85,
+                    0x00, 0x42, 0x64, 0x1c, 0x39, 0xc9, 0xa2, 0xac, 0xd1, 0x24, 0x19, 0x21, 0xe4,
+                    0xab, 0xf9, 0xea, 0x72, 0x42, 0x59, 0xb5, 0x0e, 0x6b, 0xfe, 0xbb, 0x55, 0x59,
+                    0x63, 0x92, 0x30, 0x76, 0x09, 0x73, 0x72, 0xce, 0x72, 0x51, 0xf1, 0xef, 0x5d,
+                    0x88, 0x5a, 0x2b, 0xe2, 0x7a, 0x2f, 0x6b, 0x48, 0xe8, 0x0c, 0xa9, 0xa4, 0x75,
+                    0x93, 0x8f, 0xe1, 0x17, 0xe2, 0x90, 0xc5, 0x3c, 0xd2, 0xaf, 0x38, 0x90, 0x9f,
+                    0x79, 0xb4, 0x58, 0x24, 0x23, 0x10, 0x40, 0x03, 0x7e, 0x29, 0xca, 0x93, 0xb2,
+                    0x34, 0xf0, 0x94, 0x99, 0xff, 0xa3, 0x00, 0x94, 0x9b, 0x7f, 0xf8, 0x6d, 0x6c,
+                    0x8b, 0xbf, 0x16, 0x9e, 0x73, 0xc8, 0xb2, 0x3f, 0x15, 0x8f, 0xcf, 0x37, 0x47,
+                    0x6c, 0xb0, 0x0f, 0xf0, 0x56, 0xe9, 0x02, 0x0c, 0x23, 0x93, 0x67, 0xe1, 0x6d,
+                    0x6c, 0x19, 0xbd, 0x59, 0x20, 0xf9, 0xd8, 0x4f, 0xc8, 0x79, 0xee, 0xdf, 0x8d,
+                    0x30, 0x69, 0xfd, 0xf9, 0xe5, 0xf0, 0xb2, 0x1b, 0x59, 0xa3, 0x97, 0xa8, 0x1f,
+                    0xe4, 0xab, 0xf8, 0x5b, 0x69, 0x02, 0xb7, 0xe2, 0x1d, 0x37, 0x5d, 0x3f, 0x1e,
+                    0x96, 0x84, 0x14, 0xd3, 0xc5, 0x51, 0x1c, 0x6b, 0xe0, 0x9c, 0x3a, 0x73, 0x6e,
+                    0x4f, 0x39, 0xc2, 0xa1, 0x38, 0xb6, 0x97, 0xd3, 0x03, 0x9b, 0xd6, 0xa3, 0x6c,
+                    0x7b, 0xdd, 0x35, 0x24, 0xf1, 0xe7, 0xa1, 0x81, 0xa3, 0x9e, 0x46, 0x07, 0x5d,
+                    0xdd, 0x0d, 0x9c, 0x87, 0xdf, 0xbe, 0x75, 0x2d, 0x0a, 0x47, 0x66, 0x6d, 0x9e,
+                    0x41, 0x36, 0x45, 0x93, 0x2e, 0x45, 0x32, 0x80, 0x68, 0xe7, 0x3c, 0x40, 0x03,
+                    0x64, 0x51, 0x13, 0xba, 0xd1, 0xe8, 0xa1, 0x99, 0x3e, 0x6f, 0xe0, 0xfc, 0xf2,
+                    0x8a, 0x3a, 0xf1, 0x81, 0x35, 0x60, 0x45, 0xec, 0x22, 0xb6, 0x08, 0x55, 0xd8,
+                    0x28, 0x3f, 0x33, 0xe0, 0x53, 0xf8, 0x61, 0x42, 0x53, 0x7a, 0x03, 0x3d, 0x27,
+                    0x28, 0xda, 0x55, 0x4d, 0x7c, 0xaa, 0xc9, 0xe8, 0x09, 0x60, 0x44, 0x46, 0x28,
+                    0xc9, 0x6c, 0xbd, 0xbd, 0x54, 0x7a, 0x32, 0x15, 0x77, 0x25, 0x64, 0xf1, 0x53,
+                    0x37, 0xbb, 0x77, 0x54, 0x63, 0x5b, 0x3e, 0x06, 0x8b, 0xf6, 0x4a, 0xa8, 0x73,
+                    0x8d, 0xad, 0xfc, 0x4d, 0xe0, 0xb0, 0xe2, 0x0d, 0x68, 0x40, 0x13, 0x94, 0xc7,
+                    0x8b, 0xe4, 0xe2, 0x6d, 0x42, 0xc5, 0x81, 0x57, 0xcd, 0x89, 0xf4, 0x6b, 0xb7,
+                    0x6f, 0xac, 0x66, 0x49, 0xd5, 0x27, 0x97, 0xb6, 0x4a, 0xf9, 0x05, 0xd6, 0x93,
+                    0xac, 0x18, 0x37, 0xdd, 0x87, 0xb1, 0xc1, 0x29, 0x33, 0xe4, 0x4b, 0xe8, 0x16,
+                    0xe4, 0xe0, 0xa5, 0xd3, 0xc9, 0x09, 0x0e, 0x7b, 0xbd, 0xcf, 0x9f, 0x90, 0x85,
+                    0x45, 0x1d, 0x64, 0x1d, 0xac, 0x9e, 0x99, 0x1d, 0xa1, 0x56, 0x34, 0x83, 0x42,
+                    0x89, 0x48, 0x27, 0x8e, 0x00, 0x5e, 0x2e, 0xc9, 0xc1, 0x50, 0x69, 0x94, 0xa2,
+                    0x13, 0xd6, 0x63, 0x65, 0x64, 0x8f, 0x43, 0x3b, 0x25, 0x55, 0x1c, 0xb0, 0xc3,
+                    0xa9, 0x64, 0x64, 0x5b, 0xe7, 0xe8, 0xf8, 0x36, 0x5b, 0x64, 0x87, 0x71, 0xcd,
+                    0xbd, 0xec, 0x00, 0xc9, 0x9d, 0x26, 0x4f, 0x3d, 0x42, 0x0d, 0x5e, 0xe7, 0x96,
+                    0xbd, 0x9c, 0x1e, 0x55, 0x01, 0x38, 0x45, 0x7f, 0x84, 0x48, 0x84, 0x9c, 0x9a,
+                    0x72, 0x70, 0x2c, 0x7f, 0xf5, 0xbb, 0x10, 0xc7, 0x18, 0xdd, 0x3f, 0x50, 0x89,
+                    0x16, 0x30, 0x8e, 0x05, 0x05, 0xe8, 0xce, 0xd2, 0x34, 0x89, 0x9c, 0x99, 0x8b,
+                    0x12, 0x13, 0x4b, 0x49, 0x96, 0xe3, 0xc1, 0xf4, 0x84, 0x77, 0xef, 0x3c, 0x03,
+                    0x34, 0x9b, 0x8f, 0xef, 0xb0, 0xd9, 0xfb, 0xc0, 0x68, 0xa9, 0x17, 0x0b, 0x69,
+                    0x0f, 0x2b, 0x4e, 0x3c, 0xef, 0xb7, 0x29, 0xb4, 0xcf, 0x41, 0xa5, 0xcc, 0x14,
+                    0x65, 0x11, 0x30, 0x60, 0xec, 0xb9, 0x2f, 0x80, 0x32, 0x31, 0xed, 0x21, 0x45,
+                    0x7c, 0xc1, 0x04, 0xcd, 0xa4, 0x6e, 0xe1, 0x2a, 0xf2, 0xff, 0xee, 0x1e, 0x55,
+                    0xb4, 0x15, 0x9b, 0x4c, 0xe7, 0x29, 0x95, 0x5e, 0x86, 0xd1, 0x18, 0xae, 0x07,
+                    0x46, 0xc3, 0x71, 0x32, 0x03, 0x19, 0xc1, 0x32, 0x74, 0x9b, 0x69, 0xd5, 0x81,
+                    0xbb, 0x91, 0x0f, 0xbe, 0x5d, 0x30, 0x21, 0xf0, 0x0c, 0x14, 0x19, 0xa5, 0xc3,
+                    0xe1, 0xf1, 0x4e, 0x2e, 0x0c, 0xa8, 0xd0, 0xcb, 0x2b, 0x6b, 0x79, 0xd4, 0x6e,
+                    0x8e, 0x2a, 0xdf, 0x94, 0xf2, 0xa3, 0xa1, 0x67, 0x57, 0x87, 0x34, 0xa0, 0x28,
+                    0x1a, 0xef, 0xf2, 0xf6, 0x89, 0x1a, 0xf3, 0xeb, 0x72, 0xf5, 0x6b, 0x1c, 0x2c,
+                    0xfc, 0x6b, 0x80, 0x12, 0x61, 0x97, 0xdb, 0x35, 0x35, 0xcb, 0x00, 0xb2, 0x72,
+                    0x64, 0xdc, 0x8b, 0x0c, 0xfe, 0x20, 0x0a, 0xaa, 0xf2, 0xf3, 0xfa, 0x12, 0xd5,
+                    0xc6, 0xfe, 0x11, 0xd7, 0x2f, 0x19, 0x12, 0x31, 0x58, 0xf7, 0xc8, 0xc5, 0x11,
+                    0x2d, 0x3c, 0xd4, 0x96, 0x29, 0xd9, 0xdb, 0x87, 0x90, 0x2c, 0xa6, 0xf9, 0xfe,
+                    0x06, 0xf1, 0x0d, 0x51, 0xf6, 0x83, 0x67, 0x78, 0x81, 0x2c, 0xc0, 0x3c, 0x54,
+                    0x4a, 0xb1, 0x25, 0xb6, 0xda, 0xd1, 0x56, 0xde, 0xf9, 0xad, 0xff, 0xc4, 0xa3,
+                    0x52, 0x71, 0x9b, 0x2b, 0x9b, 0xcd, 0xec, 0x51, 0x67, 0x59, 0x28, 0x86, 0x95,
+                    0xb7, 0x1a, 0x91, 0xcd, 0x37, 0xf9, 0x5c, 0xfd, 0x49, 0x73, 0x4d, 0x53, 0xf5,
+                    0x1b, 0xd9, 0xfd, 0xd9, 0xda, 0xba, 0xe9, 0xd4, 0x7c, 0x51, 0x91, 0x88, 0x2c,
+                    0x1a, 0xba, 0x05, 0x11, 0x88, 0x48, 0x43, 0x35, 0x1e, 0x15, 0x37, 0x16, 0x2a,
+                    0x45, 0x54, 0xd4, 0x39, 0x64, 0xe1, 0x66, 0xeb, 0x76, 0x08, 0xb4, 0x7a, 0xbc,
+                    0x61, 0xea, 0xbb, 0xda, 0x5c, 0xd1, 0x69, 0xc3, 0x59, 0x40, 0x4a, 0x52, 0x74,
+                    0x8f, 0xb2, 0xd9, 0x5c, 0xf9, 0x26, 0x6a, 0x7a, 0x0e, 0xef, 0x13, 0x0d, 0xfc,
+                    0x41, 0xb6, 0x31, 0x3c, 0x49, 0x80, 0x22, 0x28, 0x14, 0xd6, 0xb6, 0xc6, 0xf1,
+                    0x71, 0x1a, 0x22, 0x4f, 0xc1, 0x3a, 0x0b, 0xc5, 0xba, 0xfc, 0xa0, 0x1c, 0x71,
+                    0xd9, 0xc4, 0xf4, 0x2a, 0xfd, 0x3f, 0xa4, 0x27, 0x7d, 0x85, 0xee, 0x38, 0x2d,
+                    0x30, 0xb0, 0x43, 0xf5, 0xdd, 0x10, 0x86, 0x24, 0x59, 0xf0, 0x82, 0x32, 0xcd,
+                    0xd5, 0xb7, 0x68, 0xfd, 0xf2, 0x12, 0x60, 0x97, 0xa4, 0x48, 0x00, 0x8e, 0xe4,
+                    0x7a, 0xb5, 0x89, 0x2f, 0x3d, 0xd3, 0x2d, 0xe3, 0x99, 0x74, 0x7a, 0xf5, 0xc7,
+                    0xd5, 0xdd, 0x97, 0xeb, 0xf7, 0x47, 0x8f, 0x30, 0xaf, 0xfb, 0xd6, 0x04, 0x44,
+                    0x8a, 0x9f, 0x52, 0xa9, 0xc1, 0x22, 0xd6, 0x48, 0x76, 0x23, 0x3f, 0x74, 0x4a,
+                    0x05, 0xe3, 0x42, 0x51, 0xd1, 0x7f, 0x82, 0x96, 0xee, 0x52, 0x27, 0x51, 0x57,
+                    0xba, 0xe7, 0x6e, 0x29, 0xfe, 0x01, 0x15, 0xb2, 0x7b, 0x9e, 0x59, 0x3b, 0xb5,
+                    0xd8, 0xb5, 0x77, 0x94, 0xa3, 0x32, 0x78, 0xf6, 0xb3, 0x3d, 0x66, 0x17, 0xee,
+                    0x7f, 0x11, 0x73, 0x8e, 0x84, 0x8b, 0x1f, 0xb4, 0x2a, 0xa2, 0x74, 0x9c, 0x12,
+                    0x0e, 0x04, 0x5d, 0x51, 0x35, 0x82, 0xdd, 0x29, 0x61, 0x0f, 0x39, 0x81, 0x2d,
+                    0x15, 0x01, 0x6e, 0x1e, 0x44, 0xa9, 0x3b, 0x9b, 0x59, 0x29, 0x43, 0x82, 0xde,
+                    0xf7, 0xcf, 0xc6, 0xc9, 0x0a, 0xe8, 0x9c, 0x54, 0xba, 0x84, 0x0a, 0x87, 0xc8,
+                    0xfe, 0x04, 0x00, 0x52, 0xa6, 0x69, 0xbf, 0x8d, 0xed, 0x0d, 0x90, 0x90, 0x90,
+                    0xab, 0x48, 0xa3, 0xdf, 0x92, 0xbc, 0x39, 0x9e, 0x7f, 0x35, 0x8a, 0xa9, 0xb5,
+                    0x5c, 0x93, 0x37, 0x56, 0x85, 0xb1, 0xc8, 0x7e, 0x4e, 0xba, 0x2a, 0x25, 0x92,
+                    0x1c, 0x93, 0x3c, 0x41, 0x10, 0x06, 0x4b, 0xe8, 0xf3, 0xf5, 0x28, 0x76, 0xe0,
+                    0x15, 0xa5, 0x27, 0x73, 0xd0, 0xbd, 0x4b, 0x40, 0xe3, 0x08, 0x23, 0xcf, 0xf5,
+                    0x59, 0xd5, 0x42, 0xb7, 0x58, 0x0c, 0x8c, 0x23, 0x5e, 0xcc, 0x42, 0xbd, 0x8b,
+                    0xb1, 0x39, 0x40, 0x2e, 0x7e, 0x82, 0xb5, 0x8a, 0x61, 0xf2, 0x98, 0x0c, 0x3e,
+                    0x32, 0xbd, 0xff, 0xac, 0x46, 0x80, 0x01, 0xa6, 0x70, 0x83, 0x00, 0xeb, 0x20,
+                    0x97, 0x52, 0xbc, 0x95, 0xbe, 0x47, 0xb8, 0xbf, 0x2c, 0x0d, 0xc1, 0x8e, 0x2c,
+                    0x9e, 0x9f, 0x7c, 0x25, 0x99, 0x86, 0xca, 0xf6, 0x6c, 0xd9, 0xc6, 0xba, 0x58,
+                    0x5d, 0x05, 0x8f, 0x8d, 0x04, 0xea, 0xd6, 0xd9, 0xfb, 0xc5, 0xee, 0xe7, 0xf3,
+                    0x40, 0x24, 0x18, 0xe4, 0xbd, 0x9d, 0x41, 0xf2, 0x39, 0x28, 0xc3, 0x6f, 0x64,
+                    0x9a, 0x28, 0xe2, 0xa9, 0x44, 0xaf, 0x0f, 0x10, 0xb7, 0xa9, 0xa2, 0x05, 0xa1,
+                    0x51, 0xd6, 0xaa, 0x39, 0xf0, 0xf8, 0x70, 0x80, 0x75, 0xff, 0x53, 0x0d, 0x42,
+                    0x48, 0x29, 0x64, 0x83, 0xa7, 0xee, 0x04, 0xe7, 0xad, 0x6b, 0x27, 0x9b, 0x84,
+                    0x83, 0x9c, 0xd8, 0x4a, 0xa6, 0xb0, 0x94, 0xdc, 0x18, 0x39, 0xf5, 0x00, 0xc3,
+                    0x6d, 0x50, 0x03, 0x31, 0xed, 0xa7, 0xf7, 0xc2, 0x2f, 0xbf, 0xe3, 0xfe, 0x67,
+                    0x13, 0x1c, 0xf5, 0xa5, 0x72, 0xf1, 0x11, 0x19, 0xa6, 0xa8, 0xd8, 0x5f, 0x2c,
+                    0x54, 0x36, 0xbf, 0x83, 0x5f, 0xf6, 0x67, 0x09, 0x45, 0x4d, 0xc0, 0x37, 0x19,
+                    0x79, 0x0e, 0xa3, 0xba, 0x72, 0x40, 0x71, 0x8e, 0x36, 0x49, 0x94, 0xde, 0x0a,
+                    0x93, 0x98, 0xdb, 0x7f, 0x94, 0xa7, 0xcc, 0x24, 0x25, 0x78, 0x9b, 0x1d, 0x16,
+                    0x53, 0xe3, 0xc9, 0x94, 0xa7, 0xcc, 0xc8, 0xbf, 0x7a, 0x11, 0xea, 0xea, 0xda,
+                    0x05, 0x47, 0x50, 0xbb, 0xca, 0xd3, 0x55, 0x38, 0x53, 0xff, 0x5e, 0x5d, 0x8a,
+                    0x0c, 0xee, 0xfa, 0x4e, 0x25, 0x01, 0x7f, 0x11, 0x09, 0x9a, 0x2f, 0x08, 0xcc,
+                    0xe8, 0x7f, 0x27, 0x1d, 0x24, 0xcc, 0x6e, 0x9c, 0xf1, 0x46, 0xb2, 0xf2, 0x01,
+                    0x2d, 0xfb, 0xed, 0xec, 0xba, 0x59, 0xcf, 0x48, 0x43, 0xfc, 0x4b, 0x58, 0xa9,
+                    0x2a, 0x6e, 0xb2, 0xfc, 0x89, 0xbe, 0x55, 0xc9, 0x1a, 0x24, 0xf7, 0xc1, 0x68,
+                    0x24, 0x94, 0xcd, 0x0a, 0xb5, 0x85, 0x34, 0xa7, 0xf5, 0xcf, 0xa6, 0xe8, 0x0c,
+                    0x00, 0x6a, 0x4d, 0x8e, 0x1f, 0x67, 0x83, 0xd2, 0x79, 0x3f, 0x74, 0x53, 0x11,
+                    0xc4, 0x57, 0x78, 0xf4, 0xa5, 0x3c, 0xa8, 0x85, 0x6a, 0xfb, 0x05, 0xc0, 0x53,
+                    0x84, 0xa0, 0x92, 0xd5, 0x08, 0x34, 0x60, 0x43, 0x9f, 0xc0, 0xe7, 0x92, 0xb7,
+                    0xd0, 0xf2, 0x13, 0x76, 0xa3, 0x6e, 0x60, 0x4d, 0x76, 0xef, 0xa3, 0xeb, 0x60,
+                    0x44, 0xd6, 0x2a, 0x49, 0xd4, 0x52, 0xa2, 0x6c, 0xdf, 0x01, 0x5d, 0x4e, 0xe4,
+                    0x7a, 0x39, 0x05, 0xe9, 0x82, 0x80, 0x30, 0x2f, 0x54, 0x1a, 0x0d, 0x1c, 0x9f,
+                    0x33, 0xe1, 0xbc, 0x62, 0xd9, 0x25, 0xfb, 0xf3, 0x29, 0x39, 0xe4, 0x93, 0xd4,
+                    0xa2, 0xa2, 0x4a, 0x79, 0xc8, 0x9a, 0x41, 0x9e, 0x61, 0x5f, 0x0a, 0xb8, 0x7a,
+                    0x37, 0x2d, 0x25, 0x41, 0x0f, 0x8b, 0x7a, 0x72, 0xa8, 0x44, 0x06, 0x54, 0x78,
+                    0x5e, 0x05, 0xe9, 0x23, 0x4e, 0x2c, 0xf9, 0x34, 0xca, 0xae, 0x8e, 0x6b, 0x75,
+                    0xd7, 0x65, 0xe9, 0xc3, 0x6d, 0x55, 0xdc, 0xf7, 0xd0, 0x69, 0xcb, 0x1c, 0xc0,
+                    0x2a, 0xbc, 0x81, 0x4f, 0xa0, 0x4a, 0x9b, 0x15, 0xe1, 0xec, 0x30, 0x1f, 0x32,
+                    0x5b, 0x4e, 0xe4, 0x5f, 0xd0, 0xdc, 0xfd, 0xe3, 0xaf, 0xbd, 0xc5, 0x91, 0xe7,
+                    0xfe, 0xdd, 0x5e, 0x99, 0x09, 0x93, 0x10, 0x70, 0xd2, 0x66, 0x0d, 0xcc, 0x96,
+                    0x06, 0x08, 0xee, 0xe1, 0x4a, 0x0f, 0x65, 0x40, 0xa1, 0x62, 0x43, 0x79, 0x6b,
+                    0xb2, 0xd8, 0xaf, 0x33, 0xde, 0xd0, 0x36, 0xdf, 0xef, 0xe5, 0x1c, 0xaa, 0x92,
+                    0xca, 0x8b, 0x92, 0x2b, 0x67, 0x65, 0x6c, 0x04, 0xfa, 0xd7, 0xa1, 0xbd, 0xd7,
+                    0x7d, 0x67, 0x49, 0xd4, 0x92, 0x5c, 0x09, 0x34, 0x9e, 0xcc, 0xe9, 0x65, 0x6f,
+                    0xb4, 0x42, 0x61, 0x6b, 0xfa, 0x9f, 0x71, 0x13, 0xcc, 0xa0, 0xe0, 0x9d, 0x3a,
+                    0x9f, 0xc7, 0x9d, 0xf6, 0x5f, 0xcb, 0x9d, 0xb1, 0xf9, 0x75, 0xbb, 0xf9, 0xf9,
+                    0x46, 0x12, 0xa9, 0x48, 0xa9, 0x6b, 0x35, 0x53, 0xd8, 0x72, 0x00, 0x93, 0xdb,
+                    0x84, 0x0a, 0xc2, 0x6a, 0xcc, 0x35, 0x05, 0xda, 0x95, 0xd8, 0x0d, 0x3c, 0x5a,
+                    0x3c, 0xb1, 0x80, 0x9d, 0x47, 0x82, 0xa5, 0x2a, 0xe2, 0x76, 0x84, 0xb9, 0xa3,
+                    0x11, 0xf9, 0x09, 0x86, 0xa9, 0x2c, 0xcf, 0x8e, 0x58, 0x8c, 0x93, 0x69, 0x35,
+                    0xa1, 0x0d, 0x18, 0x3b, 0x65, 0x7f, 0xe4, 0x89, 0xcf, 0x19, 0xd5, 0xc1, 0xf2,
+                    0x61, 0x3d, 0x8b, 0x96, 0x7f, 0x0e, 0x55, 0x7f, 0x58, 0x6c, 0xc9, 0x19, 0x80,
+                    0x96, 0x32, 0xea, 0xbd, 0x13, 0xe8, 0x36, 0x12, 0x7d, 0x7d, 0x74, 0xff, 0x1c,
+                    0xb9, 0xc2, 0xe8, 0x4a, 0xe8, 0xb9, 0x6e, 0xd4, 0x87, 0x2d, 0x5c, 0x13, 0x6a,
+                    0xfb, 0xec, 0x2e, 0x77, 0xfa, 0xfd, 0x21, 0x83, 0x77, 0xda, 0x60, 0x99, 0x96,
+                    0x22, 0x12, 0xf1, 0xe8, 0x7c, 0xc4, 0xee, 0xbd, 0x6c, 0x73, 0x99, 0xc2, 0x93,
+                    0x70, 0x13, 0x91, 0xb8, 0x82, 0x5b, 0xc0, 0x61, 0xc3, 0x26, 0xa5, 0x80, 0x85,
+                    0x77, 0x7f, 0x5d, 0xa3, 0xf9, 0x66, 0xd6, 0xba, 0xa5, 0x3b, 0x95, 0x3d, 0x23,
+                    0xe6, 0x5d, 0x72, 0x23, 0xc4, 0xb5, 0x80, 0xcf, 0x2b, 0x1d, 0x5c, 0x22, 0xc8,
+                    0xc8, 0xf1, 0x5c, 0x28, 0xbc, 0xab, 0x72, 0x86, 0x92, 0xa8, 0x07, 0x76, 0x59,
+                    0x6a, 0xdc, 0x5a, 0xe6, 0x23, 0x84, 0xe0, 0x23, 0x42, 0x40, 0xfd, 0x51, 0x4e,
+                    0xed, 0xee, 0x5a, 0x37, 0x67, 0x10, 0xcc, 0x47, 0xd3, 0xca, 0x84, 0xf5, 0x47,
+                    0x04, 0xc0, 0x0e, 0x2e, 0x09, 0xec, 0x31, 0x8b, 0x30, 0xa9, 0xe4, 0x5e, 0xc0,
+                    0x0e, 0x28, 0x8d, 0x94, 0x3c, 0x42, 0x62, 0xf5, 0x24, 0x20, 0x9f, 0xc0, 0x7b,
+                    0x28, 0x56, 0xcc, 0x71, 0xa8, 0xd9, 0x40, 0x95, 0xb8, 0xec, 0x6f, 0x7e, 0x24,
+                    0x09, 0x45, 0x31, 0xb9, 0xec, 0x17, 0x7a, 0x19, 0xb5, 0x73, 0x95, 0x26, 0x68,
+                    0xc8, 0x99, 0xad, 0xe7, 0xe9, 0x6d, 0x5f, 0x6c, 0xcc, 0xb9, 0xa6, 0xfa, 0x1e,
+                    0x02, 0x66, 0xe9, 0x70, 0x2c, 0x10, 0xd3, 0x60, 0xbb, 0x6b, 0xab, 0xc8, 0xc1,
+                    0x41, 0x78, 0xc4, 0xe6, 0xc9, 0xba, 0x91, 0x74, 0x8c, 0xf5, 0xb5, 0x89, 0x9a,
+                    0x0b, 0xb9, 0x65, 0x90, 0x33, 0xea, 0x7e, 0x52, 0x93, 0xd0, 0x9a, 0x29, 0x03,
+                    0x72, 0x1b, 0x3e, 0x90, 0x66, 0xf1, 0x9a, 0x68, 0xea, 0xfa, 0x1a, 0xe6, 0x4f,
+                    0x1a, 0x3e, 0x84, 0xa4, 0x25, 0x9d, 0xf7, 0x6d, 0xb8, 0x97, 0x57, 0xc4, 0xbb,
+                    0xef, 0x9d, 0x85, 0xc7, 0xee, 0x02, 0xa1, 0xd6, 0x09, 0xd8, 0xb6, 0xe4, 0xd3,
+                    0xb3, 0x79, 0x4b, 0xa2, 0xce, 0x1a, 0x54, 0xb9, 0xc0, 0xe9, 0x32, 0x0a, 0xb4,
+                    0x47, 0xeb, 0x49, 0x77, 0xa9, 0x62, 0x0c, 0x00, 0x57, 0x12, 0x1e, 0xe3, 0xf1,
+                    0xce, 0x01, 0x00,
+                ],
+                txid: [
+                    0xdf, 0x60, 0x85, 0xd2, 0xa1, 0xc2, 0x7b, 0x22, 0xdf, 0x02, 0x9d, 0x18, 0x8a,
+                    0xf6, 0x1d, 0xfd, 0x91, 0x48, 0x46, 0x04, 0x3e, 0xaf, 0x3b, 0xa7, 0x81, 0x86,
+                    0x21, 0xf2, 0x68, 0xab, 0x42, 0xe4,
+                ],
+                auth_digest: [
+                    0xbd, 0x30, 0x39, 0xfc, 0xc0, 0x21, 0xf4, 0x8d, 0x9e, 0x35, 0x39, 0x37, 0x58,
+                    0x64, 0x06, 0x30, 0x15, 0x93, 0x12, 0x4f, 0x8a, 0xf0, 0x86, 0xc5, 0xb3, 0xd4,
+                    0x48, 0xd4, 0xa8, 0x65, 0xab, 0xe3,
+                ],
+                amounts: vec![2002665803571713, 531521585593360, 1483825548543377],
+                zip233_amount: 509013269549655,
+                script_pubkeys: vec![
+                    vec![0xac, 0x51, 0xac, 0x51, 0x53, 0x63],
+                    vec![0x51, 0x51, 0x00],
+                    vec![0x6a, 0x53, 0x51, 0x6a, 0x65, 0x53, 0xac],
+                ],
+                transparent_input: Some(1),
+                sighash_shielded: [
+                    0x1d, 0x87, 0x56, 0x59, 0x4a, 0x02, 0x59, 0x75, 0x93, 0x74, 0x67, 0x37, 0xc7,
+                    0x27, 0x13, 0x61, 0xae, 0x28, 0xa3, 0x2c, 0x0d, 0x22, 0x46, 0x03, 0xef, 0xf6,
+                    0xcc, 0x1e, 0x1f, 0x4d, 0x43, 0xa3,
+                ],
+                sighash_all: Some([
+                    0x76, 0x75, 0xa5, 0xcb, 0x22, 0x34, 0x7b, 0xbe, 0x24, 0x7c, 0xc9, 0x76, 0x21,
+                    0xf9, 0x9f, 0x4e, 0xd9, 0xef, 0x0f, 0xb1, 0xbc, 0xfb, 0xb0, 0x20, 0x26, 0x0d,
+                    0x03, 0xf5, 0x90, 0xfa, 0xa3, 0x9a,
+                ]),
+                sighash_none: Some([
+                    0xe7, 0x20, 0xf8, 0x33, 0x8c, 0x07, 0xab, 0xe6, 0xda, 0x86, 0x28, 0x41, 0x15,
+                    0xad, 0x44, 0x23, 0x4e, 0xb9, 0x84, 0x6c, 0x11, 0xc4, 0xf0, 0x3d, 0x08, 0xb9,
+                    0xa5, 0x8b, 0x7e, 0x11, 0x47, 0xce,
+                ]),
+                sighash_single: None,
+                sighash_all_anyone: Some([
+                    0x6e, 0xc6, 0x11, 0x35, 0x0a, 0xed, 0x25, 0x9f, 0x2e, 0x6c, 0x04, 0x02, 0x15,
+                    0x4d, 0x69, 0xf8, 0x1a, 0x0b, 0x92, 0x37, 0x7d, 0xfd, 0xf3, 0x57, 0x02, 0x80,
+                    0x59, 0x84, 0x73, 0x29, 0xf9, 0x03,
+                ]),
+                sighash_none_anyone: Some([
+                    0x02, 0x74, 0xd5, 0x11, 0x56, 0xb1, 0xb7, 0xe0, 0x5f, 0x46, 0xf1, 0x31, 0xd3,
+                    0x1c, 0x06, 0x36, 0x90, 0xd3, 0xf9, 0xdd, 0x37, 0x32, 0xee, 0x13, 0x5d, 0xe8,
+                    0xcf, 0xf6, 0x2d, 0x5e, 0xb0, 0x4c,
+                ]),
+                sighash_single_anyone: None,
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf4,
+                    0x96, 0x08, 0x41, 0x8b, 0xd5, 0x63, 0x09, 0x03, 0xc0, 0x2c, 0xdf, 0xc6, 0x5a,
+                    0xab, 0x96, 0x81, 0x15, 0xcf, 0x7d, 0x94, 0x86, 0x78, 0xf2, 0x13, 0xa9, 0x54,
+                    0x73, 0x19, 0x31, 0xea, 0x49, 0x15, 0x13, 0x1d, 0xdf, 0xa6, 0xa4, 0x06, 0x09,
+                    0xf3, 0x66, 0x12, 0x77, 0x58, 0x01, 0x65, 0x2d, 0x87, 0x2d, 0x98, 0xab, 0x3f,
+                    0xc1, 0x19, 0x3a, 0x44, 0xab, 0xb6, 0xcf, 0x32, 0x73, 0xed, 0xfb, 0x91, 0x68,
+                    0x6c, 0xf3, 0x9b, 0xf5, 0x40, 0xa0, 0x27, 0xcf, 0x3f, 0x00, 0x89, 0xb9, 0x35,
+                    0x48, 0xd1, 0xaa, 0x8c, 0xe5, 0x8e, 0x5e, 0xe1, 0x01, 0x51, 0x92, 0xbe, 0x47,
+                    0xa4, 0x2c, 0xee, 0xac, 0x63, 0xa8, 0x22, 0x32, 0x25, 0x35, 0x42, 0x57, 0xe3,
+                    0xe3, 0x45, 0x30, 0xee, 0x2e, 0x01, 0x6b, 0x90, 0x91, 0xfc, 0xdc, 0x07, 0x24,
+                    0x79, 0xe7, 0xc3, 0x77, 0xa8, 0xf2, 0x51, 0x92, 0xa8, 0xdd, 0x1d, 0x09, 0xac,
+                    0x52, 0x6a, 0x51, 0x63, 0x52, 0x63, 0xac, 0x53, 0xde, 0x27, 0xd8, 0xdb, 0x03,
+                    0xb1, 0x60, 0xd7, 0x78, 0x27, 0x66, 0x00, 0x00, 0x02, 0x65, 0x53, 0x87, 0x8c,
+                    0x29, 0xe3, 0xe7, 0x5b, 0x00, 0x00, 0x06, 0x6a, 0x53, 0x6a, 0x52, 0x63, 0x53,
+                    0x6d, 0xd9, 0x2d, 0xa9, 0xff, 0x0b, 0x05, 0x00, 0x02, 0x6a, 0x52, 0x00, 0x00,
+                    0x03, 0xa2, 0x8b, 0x59, 0x59, 0xe5, 0x4e, 0x36, 0x53, 0x0e, 0xc7, 0x4b, 0xe8,
+                    0x29, 0x22, 0x1d, 0x07, 0x57, 0x4c, 0xb1, 0xe2, 0xae, 0xb0, 0xe2, 0xd9, 0xa6,
+                    0xf1, 0x03, 0x22, 0x74, 0xc0, 0x1a, 0x98, 0xab, 0x5c, 0x27, 0xea, 0x2e, 0x3d,
+                    0xba, 0xe0, 0x48, 0x75, 0xaf, 0x4a, 0xd9, 0x76, 0x75, 0xab, 0x20, 0xb8, 0xbf,
+                    0xd0, 0x8d, 0xf7, 0xf9, 0x03, 0xf1, 0xd0, 0x5e, 0x66, 0x0d, 0x7f, 0x32, 0x24,
+                    0x5a, 0x94, 0xca, 0x69, 0xeb, 0x67, 0x3d, 0x62, 0x64, 0x09, 0xe8, 0x1a, 0x5e,
+                    0x7b, 0x30, 0x9d, 0x65, 0x27, 0xc8, 0x12, 0x84, 0xa6, 0x2d, 0x78, 0x2f, 0xe1,
+                    0x88, 0x2c, 0x80, 0xd1, 0x49, 0x90, 0x2f, 0x97, 0xfb, 0xb0, 0x6d, 0x77, 0xa3,
+                    0x9c, 0x29, 0x43, 0xfd, 0xcc, 0xde, 0xe8, 0x8e, 0x4a, 0x42, 0xa1, 0xda, 0x6f,
+                    0xa6, 0xe5, 0xb4, 0x4d, 0x75, 0x0e, 0xc3, 0xbd, 0x5a, 0x51, 0x47, 0x1c, 0x95,
+                    0xf0, 0x53, 0xe2, 0x05, 0xea, 0x53, 0x89, 0xda, 0x31, 0x7d, 0x34, 0x4c, 0x61,
+                    0x14, 0xe1, 0x04, 0x3e, 0xe8, 0x01, 0x5d, 0xe4, 0x25, 0x34, 0x25, 0xea, 0x93,
+                    0x0f, 0xc9, 0xa1, 0x63, 0x3f, 0xd9, 0xdc, 0xa4, 0x97, 0x05, 0x85, 0xaf, 0x87,
+                    0x55, 0xe8, 0xea, 0xd7, 0x1d, 0xa3, 0xd0, 0xb5, 0x83, 0x43, 0x7a, 0x14, 0x75,
+                    0x93, 0xa5, 0x91, 0xb0, 0x1b, 0x11, 0x5f, 0xda, 0x10, 0xad, 0x54, 0xbb, 0xbe,
+                    0x08, 0x5b, 0x23, 0x5c, 0x4a, 0xdf, 0xc2, 0x80, 0xa1, 0x62, 0xf2, 0x86, 0x28,
+                    0x18, 0x6c, 0xef, 0xca, 0xeb, 0x2f, 0x13, 0xa0, 0x06, 0x78, 0x79, 0x37, 0x6b,
+                    0x4a, 0xe4, 0xc5, 0x71, 0x75, 0xc7, 0x7a, 0x21, 0xd1, 0x96, 0x37, 0xce, 0xb1,
+                    0x5a, 0x99, 0x3a, 0x4d, 0x0a, 0x66, 0x94, 0x70, 0x5e, 0xce, 0xba, 0x19, 0x76,
+                    0xa8, 0xe3, 0xb0, 0xcd, 0x62, 0x55, 0xe1, 0x70, 0xe3, 0x49, 0x75, 0x3e, 0xe4,
+                    0x30, 0xd5, 0xf7, 0x77, 0x68, 0xa9, 0x1d, 0xf7, 0xb2, 0x13, 0xae, 0x78, 0xc0,
+                    0x55, 0x5c, 0x4d, 0x74, 0xf9, 0xea, 0xcc, 0x74, 0x40, 0x3b, 0x0b, 0x8d, 0xe7,
+                    0x84, 0x79, 0xf3, 0xaf, 0x49, 0x30, 0x83, 0x5f, 0xa3, 0xcc, 0x53, 0x74, 0x37,
+                    0x6f, 0xb7, 0x9f, 0xaa, 0x30, 0x83, 0x94, 0x6e, 0xec, 0x52, 0xf1, 0x21, 0x4d,
+                    0x98, 0xe7, 0xdb, 0xa4, 0x08, 0x58, 0x0f, 0x05, 0xf3, 0x98, 0xde, 0x3c, 0x1f,
+                    0xab, 0xbf, 0xee, 0xe5, 0x3b, 0x69, 0xb7, 0x38, 0xcf, 0x17, 0x0d, 0xd5, 0x24,
+                    0xb3, 0x5a, 0xd8, 0x54, 0x66, 0xf9, 0x28, 0xc9, 0x47, 0xaf, 0xd9, 0x2f, 0xbe,
+                    0xb8, 0x24, 0x7c, 0x6e, 0xd5, 0xa6, 0xc2, 0x69, 0xdb, 0xb0, 0x82, 0x90, 0x11,
+                    0xc5, 0x78, 0xa2, 0x3c, 0x41, 0xa8, 0xdc, 0x2c, 0xc8, 0xa1, 0x71, 0xc5, 0x61,
+                    0x31, 0xea, 0xe3, 0x68, 0xca, 0x84, 0x36, 0xb7, 0x8b, 0x89, 0xce, 0x35, 0x05,
+                    0x48, 0x00, 0x0d, 0xd3, 0x6b, 0xe5, 0xa6, 0xef, 0x84, 0xbb, 0xdc, 0xd9, 0xf6,
+                    0x1c, 0xf2, 0xe4, 0x63, 0x5e, 0x17, 0x59, 0x2e, 0x1e, 0x53, 0x78, 0x45, 0x7b,
+                    0xb0, 0xbf, 0xc7, 0x98, 0x31, 0xb1, 0x3e, 0xa3, 0xc7, 0x93, 0x63, 0xfd, 0x12,
+                    0x30, 0x7f, 0xf1, 0xf3, 0x46, 0x0c, 0x53, 0xc9, 0x05, 0xab, 0xd4, 0xc2, 0x0d,
+                    0x2c, 0xa1, 0x18, 0x55, 0xf4, 0x9d, 0x20, 0x75, 0x52, 0x53, 0x57, 0x24, 0x97,
+                    0xcb, 0x87, 0xf7, 0x70, 0x73, 0xe5, 0xd6, 0x13, 0x6b, 0xe2, 0xa3, 0xcf, 0x3b,
+                    0xea, 0x98, 0xa7, 0x72, 0xe8, 0x0f, 0x1e, 0x90, 0xc3, 0x39, 0x04, 0xc5, 0x09,
+                    0xb6, 0x7a, 0xfd, 0x4c, 0x3e, 0x82, 0x7c, 0x8b, 0x05, 0xcb, 0xc3, 0x4f, 0x2f,
+                    0xc2, 0x75, 0xcc, 0xfe, 0x8d, 0xdb, 0x8e, 0xd8, 0x38, 0x2c, 0x7f, 0x2f, 0x1f,
+                    0xd1, 0x9f, 0xe8, 0x7a, 0x1c, 0x76, 0x0a, 0x48, 0x9d, 0x22, 0x6e, 0x3c, 0xc1,
+                    0xa0, 0x85, 0xc6, 0x1d, 0xff, 0xdd, 0x8c, 0x4a, 0x63, 0xc4, 0xb7, 0xb3, 0x8a,
+                    0x74, 0x7a, 0x22, 0x80, 0x2a, 0x1b, 0x12, 0xfa, 0x4e, 0x74, 0xcc, 0xa6, 0xae,
+                    0x7f, 0xdc, 0xcb, 0xdb, 0x4a, 0x1e, 0xb4, 0x40, 0xe0, 0xe8, 0x10, 0x3c, 0x0e,
+                    0xb0, 0xe5, 0xb6, 0x17, 0x37, 0x80, 0xbd, 0xab, 0xf4, 0x25, 0xdb, 0x2a, 0xb0,
+                    0x99, 0x01, 0x27, 0xf8, 0x68, 0x71, 0x8a, 0x68, 0xf2, 0x18, 0x26, 0xf9, 0xf0,
+                    0x58, 0x23, 0x3d, 0x58, 0xa5, 0x7e, 0xd7, 0x56, 0xc3, 0x65, 0x2b, 0xc7, 0xe6,
+                    0x19, 0xee, 0xac, 0xa3, 0x58, 0x44, 0x12, 0xef, 0xf8, 0x5d, 0x47, 0x4a, 0x94,
+                    0x7a, 0x4c, 0xc3, 0xda, 0x7f, 0xdf, 0xc9, 0x8e, 0xf1, 0x05, 0xa4, 0x37, 0x3b,
+                    0x01, 0x1c, 0x02, 0xb7, 0x34, 0x02, 0xaf, 0xf6, 0x6a, 0xe9, 0x59, 0xdc, 0xe5,
+                    0xb4, 0x40, 0x17, 0xb9, 0x1f, 0x56, 0x38, 0xf0, 0x10, 0x25, 0x06, 0x9f, 0xbe,
+                    0x18, 0x11, 0x34, 0xbe, 0x87, 0x5d, 0x22, 0xd1, 0xc1, 0x39, 0x10, 0x60, 0xc9,
+                    0x1b, 0x0f, 0x4d, 0x9f, 0xac, 0xc0, 0x53, 0x43, 0x2d, 0x61, 0x10, 0x14, 0x39,
+                    0x82, 0x23, 0x0d, 0xaa, 0x4c, 0x96, 0x42, 0x02, 0x8d, 0xb3, 0xa5, 0x1c, 0xb2,
+                    0xa6, 0x93, 0x65, 0xe5, 0xdc, 0x70, 0x28, 0xd6, 0x7c, 0x53, 0xdf, 0x4f, 0x6b,
+                    0x4d, 0xcf, 0x13, 0x9d, 0x1d, 0x43, 0xe0, 0xd7, 0x18, 0xbe, 0xd2, 0x27, 0xb7,
+                    0x4b, 0x40, 0xba, 0x66, 0xe8, 0x14, 0x34, 0x12, 0x3e, 0x87, 0x10, 0xd9, 0xbc,
+                    0x7f, 0xd3, 0x9d, 0x61, 0xa5, 0x20, 0x52, 0xd4, 0xae, 0xd6, 0xf3, 0x61, 0xb8,
+                    0x58, 0x2e, 0xe1, 0x10, 0x2a, 0xd3, 0x77, 0xec, 0xfa, 0xd7, 0x18, 0xdf, 0xb1,
+                    0xa3, 0xad, 0xe1, 0xc1, 0x8a, 0x40, 0x58, 0x70, 0x8e, 0x9b, 0x5c, 0x6f, 0xf3,
+                    0x33, 0x5a, 0x17, 0xea, 0xd8, 0xa2, 0x46, 0x96, 0x94, 0xa0, 0x14, 0x48, 0xcb,
+                    0xe0, 0xb4, 0xaa, 0x50, 0xaf, 0x50, 0x78, 0x4e, 0x44, 0x21, 0x7f, 0x61, 0xe1,
+                    0xb1, 0x31, 0x4f, 0xa1, 0x75, 0x41, 0x5a, 0xc6, 0x31, 0x81, 0xa4, 0x61, 0x13,
+                    0x3f, 0xc3, 0xe9, 0xc7, 0xa0, 0x82, 0xca, 0xeb, 0xc8, 0x1a, 0xb4, 0xd1, 0x5a,
+                    0xf9, 0x62, 0xa7, 0x9a, 0xed, 0x93, 0xd0, 0xf7, 0xe9, 0x84, 0x56, 0xe4, 0x59,
+                    0xf7, 0xad, 0x63, 0x94, 0x9e, 0xc8, 0xce, 0x2d, 0x76, 0x11, 0x6f, 0x1e, 0xd6,
+                    0xfe, 0x10, 0xe0, 0x44, 0x9e, 0x2f, 0xa6, 0x13, 0xa9, 0xfc, 0x83, 0x53, 0xa3,
+                    0x16, 0x8b, 0x5e, 0xab, 0xe8, 0x52, 0x48, 0xed, 0x68, 0x5c, 0x75, 0x0c, 0x9c,
+                    0x31, 0xd6, 0x96, 0xfb, 0x22, 0x3f, 0x58, 0xe9, 0xee, 0x25, 0x4d, 0x2d, 0x72,
+                    0x1f, 0x9f, 0x42, 0x3e, 0xd9, 0xb9, 0x8d, 0xbe, 0xfa, 0x89, 0x38, 0xbd, 0x76,
+                    0x4c, 0xc7, 0x25, 0x0b, 0x82, 0x29, 0xfb, 0x65, 0xc5, 0x71, 0xaf, 0x2e, 0x32,
+                    0x73, 0x05, 0xd6, 0x2d, 0x7c, 0x08, 0x0b, 0x84, 0xa1, 0xf8, 0x2e, 0x43, 0x4e,
+                    0xc7, 0xae, 0x6e, 0x0a, 0xc5, 0x31, 0x95, 0x80, 0xf7, 0xce, 0xbf, 0x88, 0x0b,
+                    0x3c, 0xf5, 0xc6, 0xe7, 0xb7, 0x09, 0x67, 0x92, 0x75, 0x4c, 0x06, 0x00, 0x28,
+                    0x7e, 0x44, 0xb8, 0x41, 0xd8, 0x5b, 0x02, 0xae, 0x56, 0xdd, 0xbe, 0xd8, 0x7a,
+                    0x41, 0x50, 0x19, 0xf5, 0x23, 0xdd, 0x04, 0x65, 0x2c, 0x98, 0xc8, 0x36, 0x10,
+                    0x78, 0x0e, 0xd7, 0xa2, 0xfa, 0xae, 0x4a, 0x70, 0xdc, 0xe5, 0xe9, 0x42, 0xad,
+                    0x1b, 0x66, 0x41, 0x30, 0xf5, 0xde, 0x76, 0xc4, 0x59, 0xfa, 0x81, 0xa4, 0xb2,
+                    0xad, 0x72, 0x3d, 0x5b, 0x1d, 0x0b, 0xbc, 0xeb, 0x2a, 0x9c, 0x11, 0x01, 0x1e,
+                    0xf2, 0x36, 0xae, 0xfc, 0x3f, 0x2e, 0x8b, 0xbb, 0xd9, 0x40, 0x51, 0x28, 0xda,
+                    0x41, 0x53, 0xef, 0xda, 0xd4, 0xa7, 0x9f, 0x28, 0xf5, 0x2a, 0xc4, 0x22, 0x32,
+                    0x7d, 0xbe, 0xeb, 0x14, 0xf4, 0x6f, 0x60, 0xad, 0x37, 0xa0, 0x10, 0x20, 0x4d,
+                    0xa8, 0xc1, 0xd6, 0x07, 0xb9, 0x1b, 0xac, 0xdc, 0xb5, 0x00, 0x12, 0xc2, 0x5f,
+                    0x8b, 0xc1, 0x51, 0xfb, 0xf8, 0x06, 0x07, 0xdb, 0x90, 0x2d, 0x44, 0xa0, 0x8a,
+                    0x4c, 0x08, 0x4e, 0x00, 0x24, 0x74, 0x5e, 0xc0, 0x87, 0x78, 0xab, 0x46, 0x0f,
+                    0x01, 0x7c, 0x9a, 0x3c, 0xee, 0x30, 0x8c, 0x9a, 0xfe, 0x79, 0xf8, 0xc6, 0xb5,
+                    0xc8, 0x24, 0x65, 0x9b, 0xd0, 0x87, 0x37, 0x72, 0x07, 0x7d, 0x9e, 0x4a, 0x57,
+                    0x60, 0x7c, 0x34, 0x31, 0x0b, 0xa8, 0x99, 0x1e, 0x98, 0x22, 0x15, 0x99, 0x30,
+                    0x50, 0xc9, 0x0a, 0x8c, 0x80, 0x39, 0x03, 0x41, 0x25, 0x67, 0x66, 0xd5, 0x5c,
+                    0xfc, 0x28, 0x6b, 0x37, 0x86, 0x75, 0x76, 0xe1, 0x19, 0x7e, 0x1f, 0x1c, 0xe5,
+                    0x9a, 0xb5, 0xcb, 0x54, 0xe9, 0x39, 0x29, 0xac, 0xdb, 0x18, 0xd0, 0xda, 0xe4,
+                    0x16, 0xba, 0x07, 0x47, 0x61, 0x87, 0x77, 0x0d, 0xde, 0xd0, 0xf6, 0x47, 0xa0,
+                    0x6b, 0x32, 0x60, 0xbb, 0x2f, 0x03, 0x32, 0xc1, 0xf6, 0x88, 0x2d, 0x25, 0x04,
+                    0xba, 0x38, 0x10, 0x6f, 0xf5, 0xbb, 0xdd, 0xf3, 0x3a, 0xab, 0x76, 0x17, 0xe1,
+                    0xe0, 0xe8, 0xd1, 0x8e, 0xb7, 0xec, 0xdf, 0x5e, 0xf7, 0xb0, 0xf5, 0x3b, 0x6a,
+                    0xb7, 0xbb, 0x55, 0xb2, 0x4b, 0x51, 0x52, 0x34, 0x67, 0x9c, 0xa9, 0x62, 0x05,
+                    0x91, 0x93, 0xd2, 0xc5, 0x1a, 0xb0, 0xb8, 0x79, 0x75, 0x2a, 0x38, 0x76, 0x08,
+                    0x92, 0xf8, 0xe8, 0xb3, 0xe5, 0xfa, 0xbe, 0xe5, 0x51, 0xa3, 0x78, 0x07, 0x0a,
+                    0x2f, 0x37, 0x17, 0x59, 0x47, 0xef, 0xb5, 0x1b, 0xaf, 0xe0, 0x79, 0x58, 0xe1,
+                    0xb1, 0x77, 0xef, 0x2a, 0x65, 0xa2, 0x74, 0x02, 0xd9, 0xdc, 0x09, 0x41, 0xf4,
+                    0x75, 0x75, 0x19, 0x13, 0x0a, 0x24, 0x5e, 0x2e, 0x91, 0xb5, 0xc8, 0x7a, 0x52,
+                    0x24, 0x00, 0xb9, 0xb2, 0x07, 0x95, 0x98, 0xc4, 0xb4, 0x9e, 0x62, 0x05, 0x95,
+                    0xf0, 0xf6, 0x72, 0x79, 0xc2, 0x6e, 0x73, 0x9f, 0x87, 0xb3, 0x3d, 0x8f, 0x1e,
+                    0xad, 0xd6, 0x2f, 0xb6, 0x8f, 0x73, 0x03, 0xc0, 0xd9, 0xa7, 0x44, 0xfd, 0x4e,
+                    0x2c, 0xa3, 0x66, 0x21, 0x10, 0xfe, 0xda, 0x6d, 0xea, 0xdc, 0x16, 0x04, 0x01,
+                    0xc6, 0x57, 0x23, 0x6d, 0xc5, 0x93, 0xa5, 0x8d, 0x56, 0x31, 0xbb, 0xa3, 0x3e,
+                    0xf3, 0xe9, 0x34, 0x4c, 0x53, 0x6f, 0x3f, 0x20, 0x4c, 0xee, 0x7b, 0x5f, 0x15,
+                    0xd8, 0xfd, 0x41, 0xa4, 0xf5, 0x7c, 0x9c, 0xac, 0x57, 0xcd, 0x50, 0x17, 0xe8,
+                    0x06, 0x69, 0x5b, 0xb1, 0xa0, 0x6d, 0xe5, 0x68, 0x7c, 0x55, 0xac, 0x37, 0x3b,
+                    0xf2, 0x3f, 0xa8, 0x99, 0xe7, 0x54, 0x07, 0xb4, 0x92, 0xf8, 0x75, 0x20, 0xf5,
+                    0x7a, 0x1a, 0x6b, 0xe2, 0x5e, 0xd6, 0x91, 0x39, 0x3d, 0xbf, 0x9d, 0xa1, 0x48,
+                    0x3c, 0x28, 0x2c, 0x0c, 0x26, 0x59, 0xbd, 0x90, 0x67, 0x76, 0x35, 0x37, 0x73,
+                    0x00, 0xa1, 0x77, 0x9d, 0xea, 0x26, 0x7e, 0x72, 0x0e, 0xc7, 0xf6, 0x4d, 0x23,
+                    0x96, 0x49, 0x24, 0x85, 0x78, 0xdb, 0x66, 0x0b, 0xfb, 0xe3, 0x4a, 0xa9, 0x17,
+                    0x1a, 0x2a, 0x3a, 0x42, 0x3b, 0x5d, 0x92, 0x7b, 0x06, 0x91, 0x12, 0x01, 0xd1,
+                    0xe5, 0xfc, 0xac, 0x8d, 0x0e, 0xfa, 0x3f, 0xe4, 0x2b, 0x97, 0xe3, 0x9f, 0x3c,
+                    0xf0, 0xfd, 0x74, 0xd7, 0x45, 0x7f, 0x63, 0xed, 0xf5, 0xcd, 0xab, 0xfd, 0x83,
+                    0x78, 0x12, 0x4a, 0xe8, 0x21, 0x3f, 0x97, 0x9d, 0x35, 0xf3, 0xe7, 0xd6, 0xab,
+                    0xa4, 0x40, 0x39, 0xfb, 0xf0, 0x70, 0xc6, 0x92, 0xec, 0x0a, 0x8c, 0x85, 0x56,
+                    0xc4, 0xf5, 0xd3, 0x0a, 0xaa, 0x23, 0xe6, 0x98, 0xcc, 0xc2, 0xd0, 0x10, 0xdf,
+                    0x7e, 0x49, 0x6e, 0xc2, 0xbb, 0xf5, 0x53, 0xab, 0x38, 0xb1, 0x94, 0x0c, 0x35,
+                    0x95, 0x2e, 0xc3, 0x2b, 0x8b, 0x7e, 0xc7, 0x3f, 0xb3, 0xfb, 0x73, 0x70, 0x4d,
+                    0xaa, 0x23, 0xb1, 0xa9, 0x04, 0xbb, 0x66, 0x40, 0x07, 0x19, 0x46, 0x18, 0xf0,
+                    0x40, 0x31, 0x6e, 0x4d, 0xfd, 0x4e, 0xbc, 0x5d, 0x4f, 0x6f, 0x14, 0xa1, 0xec,
+                    0x01, 0x6b, 0xa4, 0x41, 0xf3, 0x7b, 0xff, 0xa7, 0xa1, 0x9e, 0xd6, 0x1d, 0xd3,
+                    0x59, 0xde, 0x0d, 0xc0, 0xe4, 0xd0, 0xbd, 0x8e, 0x39, 0x90, 0x2a, 0x02, 0x3a,
+                    0x6b, 0xe8, 0x08, 0x77, 0x17, 0x55, 0xf5, 0xe2, 0x51, 0xf1, 0x5d, 0x7b, 0x8c,
+                    0x1e, 0x6f, 0xd5, 0x44, 0x4e, 0x39, 0x1f, 0xe5, 0xbc, 0xeb, 0x77, 0x93, 0xdb,
+                    0xd8, 0x12, 0x5a, 0xc5, 0x29, 0xa5, 0x76, 0x1a, 0xe6, 0xdb, 0xc9, 0x6f, 0x88,
+                    0xec, 0xe7, 0x37, 0xa4, 0x84, 0x38, 0xab, 0x43, 0x12, 0x73, 0xf0, 0xdc, 0x6f,
+                    0x8c, 0x05, 0xd1, 0x8c, 0xbf, 0xcb, 0xd4, 0x55, 0xa7, 0x9d, 0x4c, 0xbe, 0x52,
+                    0x16, 0x55, 0x04, 0x55, 0x0e, 0x01, 0x4f, 0xae, 0xcb, 0x40, 0x46, 0x36, 0x57,
+                    0x9c, 0x37, 0xa0, 0x5b, 0xab, 0xad, 0xc8, 0x98, 0x6b, 0xaf, 0x81, 0xbc, 0xd9,
+                    0x38, 0x5c, 0xab, 0x7d, 0x1f, 0x89, 0x8a, 0xbd, 0x4c, 0x23, 0x01, 0x93, 0x6c,
+                    0xd9, 0xef, 0x86, 0xf9, 0x87, 0x3e, 0xd1, 0x0a, 0x6d, 0x80, 0x5b, 0x7b, 0x6f,
+                    0x6e, 0xbb, 0xaf, 0xb3, 0x0e, 0x56, 0x89, 0x44, 0xd7, 0xb0, 0xbc, 0x74, 0xd5,
+                    0xc3, 0xf6, 0xde, 0x0d, 0xdc, 0x87, 0xc0, 0xc9, 0x5f, 0xf1, 0x32, 0x16, 0x4b,
+                    0x38, 0x33, 0xe5, 0xc2, 0x46, 0x23, 0xae, 0x51, 0x18, 0xdd, 0x22, 0xe9, 0x19,
+                    0x64, 0x99, 0x0a, 0x8f, 0xae, 0x23, 0x38, 0x4e, 0x22, 0xb9, 0xa0, 0xc9, 0x99,
+                    0x00, 0x68, 0x13, 0x2d, 0xf8, 0xb2, 0x24, 0xc6, 0xd4, 0x4f, 0xca, 0x33, 0x60,
+                    0x5c, 0x83, 0x17, 0x4d, 0xb8, 0x49, 0x23, 0x9b, 0xe2, 0x99, 0x3e, 0xe6, 0xd7,
+                    0xbe, 0x08, 0xe2, 0x6f, 0x19, 0x72, 0x1f, 0x87, 0x5a, 0xcd, 0xb8, 0x7e, 0x67,
+                    0x8e, 0xea, 0x42, 0xae, 0x82, 0x3c, 0x3f, 0x01, 0x01, 0xc8, 0xad, 0x15, 0xdb,
+                    0xa5, 0xeb, 0xa5, 0x7c, 0xee, 0xae, 0x0c, 0xee, 0x51, 0x3a, 0xca, 0x02, 0x96,
+                    0x98, 0x01, 0x76, 0x15, 0xe8, 0x8b, 0x49, 0x52, 0x7f, 0x2c, 0x00, 0xf6, 0x52,
+                    0x39, 0x47, 0x78, 0x70, 0x6c, 0xdb, 0xfe, 0xd8, 0xae, 0x75, 0xa9, 0xda, 0x3b,
+                    0x70, 0x4d, 0x92, 0xaf, 0x80, 0x19, 0x56, 0xfd, 0xe0, 0x06, 0x62, 0x11, 0xf4,
+                    0xcf, 0x24, 0xa1, 0xc7, 0x96, 0xc2, 0xd5, 0x16, 0x0d, 0xc3, 0x57, 0xaa, 0xcd,
+                    0x0b, 0x87, 0xa8, 0xd3, 0x99, 0x69, 0x64, 0xad, 0x31, 0x9b, 0x06, 0x0b, 0x87,
+                    0xfb, 0x8a, 0x7e, 0xe8, 0xd3, 0x20, 0xb1, 0xdf, 0x5e, 0xcc, 0x2a, 0xf1, 0x7a,
+                    0x69, 0xb5, 0x88, 0x67, 0x22, 0xb6, 0x7a, 0x27, 0xfa, 0xce, 0x68, 0x3e, 0x63,
+                    0xd1, 0x7c, 0x41, 0xf7, 0xa3, 0xa3, 0x3a, 0x87, 0x50, 0xeb, 0xab, 0x0a, 0xc7,
+                    0xf4, 0x52, 0x13, 0x10, 0x1f, 0xf4, 0xce, 0xe2, 0xe1, 0xce, 0x3d, 0x33, 0xba,
+                    0x96, 0xcc, 0xcf, 0x72, 0x09, 0x4a, 0x73, 0xef, 0xfb, 0xb1, 0x8b, 0x39, 0x55,
+                    0x97, 0x86, 0x46, 0x75, 0x37, 0xe1, 0x27, 0xd9, 0x90, 0xab, 0x72, 0xd0, 0xbd,
+                    0xfb, 0x35, 0x34, 0x6f, 0xe4, 0x17, 0x36, 0x00, 0x10, 0xe2, 0xbe, 0x05, 0x42,
+                    0x3a, 0xe4, 0x89, 0xdb, 0xe0, 0x2d, 0x40, 0x05, 0xa0, 0x53, 0x30, 0xe5, 0x18,
+                    0x8d, 0xa0, 0x62, 0x69, 0xd5, 0xcb, 0xc2, 0xc3, 0x80, 0x4e, 0x8e, 0x55, 0x9f,
+                    0xf7, 0x2b, 0x7f, 0x2e, 0x0f, 0xec, 0x1a, 0x23, 0x4b, 0xb2, 0x25, 0x93, 0xdb,
+                    0x39, 0xd5, 0xb5, 0x75, 0x58, 0xe1, 0xed, 0x82, 0x97, 0x2c, 0x23, 0x66, 0x98,
+                    0xcf, 0xcf, 0x08, 0xc2, 0x28, 0x54, 0xd8, 0x51, 0x4d, 0x1b, 0x82, 0x4f, 0xb8,
+                    0x14, 0xa5, 0x20, 0x77, 0xeb, 0x52, 0xc2, 0x67, 0x8c, 0xb1, 0xf0, 0x55, 0x6d,
+                    0x70, 0x05, 0xc0, 0x90, 0xde, 0xce, 0x13, 0xe9, 0xc6, 0xc2, 0x55, 0x0e, 0x8f,
+                    0x02, 0x3f, 0xc8, 0x6c, 0x98, 0x00, 0x5d, 0xa4, 0x24, 0x1e, 0x6c, 0x03, 0xcf,
+                    0x3f, 0xd8, 0x0f, 0x30, 0x5d, 0xd0, 0xea, 0xe4, 0xf8, 0x83, 0xb2, 0x9d, 0x46,
+                    0x86, 0xb6, 0xab, 0x6d, 0x1a, 0x0a, 0x68, 0x22, 0x9f, 0x7e, 0x64, 0xec, 0x14,
+                    0x53, 0x7c, 0x6e, 0x3b, 0x10, 0xe0, 0xf2, 0xbb, 0xc5, 0x3e, 0xb9, 0x0c, 0x2f,
+                    0x6b, 0x56, 0xa6, 0x55, 0xb8, 0x0b, 0xfe, 0xe8, 0x51, 0x5e, 0xf5, 0x31, 0x9c,
+                    0xe8, 0x7d, 0xbb, 0x13, 0x59, 0xc2, 0x3f, 0xd6, 0x8b, 0xf9, 0x78, 0x34, 0x23,
+                    0xc7, 0xa7, 0x43, 0xd6, 0xba, 0x4c, 0x59, 0x65, 0xda, 0x59, 0x45, 0x93, 0x6c,
+                    0x9e, 0xb0, 0xf3, 0x9d, 0xd2, 0xed, 0xc0, 0x97, 0x09, 0x79, 0x82, 0x1f, 0xa3,
+                    0x45, 0x12, 0xda, 0x44, 0x1b, 0xe9, 0x04, 0xde, 0x6c, 0x4e, 0xf4, 0x16, 0xa7,
+                    0x8b, 0xe4, 0x20, 0x0e, 0x4a, 0x80, 0x75, 0xac, 0xdf, 0xaa, 0x16, 0xb4, 0x70,
+                    0x52, 0x55, 0x32, 0x48, 0x4c, 0xa3, 0x9a, 0x7e, 0x91, 0x74, 0x46, 0x28, 0xd4,
+                    0x20, 0x0b, 0xdc, 0x8b, 0x1f, 0x6e, 0x44, 0x2e, 0xf0, 0x4b, 0xdc, 0xd0, 0x7e,
+                    0xcb, 0x67, 0x2c, 0x09, 0x92, 0xc4, 0xf9, 0x46, 0xa9, 0x6d, 0x31, 0x08, 0x05,
+                    0x41, 0xf3, 0xaf, 0x18, 0xd0, 0xbf, 0x07, 0x43, 0x34, 0x03, 0xe6, 0x66, 0x7f,
+                    0x0a, 0xe8, 0x17, 0x87, 0x28, 0xa0, 0x60, 0xb7, 0x48, 0x10, 0xd1, 0x6f, 0x2a,
+                    0x7a, 0xcd, 0xdb, 0x2e, 0x50, 0x00, 0x26, 0x1a, 0xe9, 0x02, 0x22, 0xd5, 0xf7,
+                    0xcf, 0x32, 0xfc, 0x0a, 0xeb, 0x5f, 0xfc, 0x3e, 0x6e, 0x3a, 0x71, 0x4d, 0x32,
+                    0x9d, 0xa5, 0xd8, 0x95, 0xa9, 0x1f, 0x17, 0x9e, 0x6f, 0x6b, 0x18, 0xbf, 0xc2,
+                    0xdb, 0x55, 0x35, 0x0f, 0x6c, 0xb6, 0x1c, 0x0c, 0x11, 0x38, 0x86, 0x87, 0x8c,
+                    0x3e, 0x81, 0xdd, 0xb4, 0xa2, 0xf2, 0x65, 0xd9, 0x08, 0x3e, 0x9c, 0x8c, 0xb0,
+                    0x14, 0x6d, 0x16, 0x50, 0x6a, 0xf8, 0xd1, 0xdd, 0xea, 0xaf, 0xfd, 0x1a, 0x64,
+                    0x13, 0x70, 0xae, 0x87, 0x40, 0xbb, 0x62, 0x89, 0x06, 0x19, 0x70, 0xf1, 0x70,
+                    0x3b, 0x8a, 0xcf, 0x49, 0x74, 0x42, 0x5f, 0x0e, 0x38, 0x36, 0x30, 0x9d, 0x50,
+                    0xe7, 0xdd, 0x9b, 0x48, 0x51, 0x51, 0x73, 0x80, 0x2b, 0xe0, 0x74, 0x57, 0xe5,
+                    0x59, 0xa9, 0x42, 0x49, 0x1c, 0x9d, 0x03, 0xd7, 0x38, 0x1a, 0x29, 0xd8, 0x52,
+                    0x88, 0xf1, 0x28, 0xa1, 0xf6, 0xd9, 0xab, 0x6d, 0xcb, 0xf2, 0xa5, 0xb3, 0xd6,
+                    0xaf, 0x72, 0x68, 0x8a, 0x34, 0x14, 0x49, 0x6b, 0x05, 0x94, 0x27, 0x3f, 0x02,
+                    0x29, 0xb7, 0x33, 0x1b, 0x02, 0x6d, 0x03, 0x57, 0x25, 0x35, 0xbd, 0x01, 0x00,
+                    0xdb, 0xbf, 0x04, 0x41, 0x67, 0xac, 0x2b, 0x3e, 0x27, 0x31, 0x6e, 0xa0, 0x59,
+                    0x98, 0xe3, 0x3d, 0x4e, 0x30, 0x35, 0x14, 0xbb, 0xbf, 0x78, 0xa4, 0xa5, 0xdd,
+                    0x10, 0xc3, 0xae, 0x25, 0x00, 0x1b, 0x54, 0xdc, 0xcb, 0x42, 0x46, 0xac, 0x81,
+                    0x07, 0xfc, 0x66, 0xf1, 0x4f, 0x46, 0x43, 0x8d, 0x35, 0xb2, 0x47, 0xe4, 0x20,
+                    0x98, 0xb7, 0xe0, 0xc2, 0x0c, 0x46, 0xda, 0xbd, 0x9c, 0x55, 0xa8, 0x8d, 0x25,
+                    0xf0, 0xd0, 0xff, 0xb6, 0x81, 0x66, 0xa0, 0x52, 0xd7, 0x37, 0xd9, 0x25, 0xce,
+                    0x84, 0x0b, 0xd8, 0x7c, 0xba, 0x8e, 0xee, 0x8b, 0x60, 0x3e, 0x4c, 0x86, 0x22,
+                    0x2f, 0xa4, 0xd4, 0x47, 0x67, 0xb5, 0xbd, 0xb9, 0xc3, 0xa6, 0xfc, 0x35, 0x75,
+                    0x87, 0xb4, 0xfc, 0xec, 0xae, 0xe3, 0x94, 0xda, 0x14, 0x64, 0x18, 0xcb, 0xf7,
+                    0x62, 0xd7, 0x6a, 0x94, 0xf7, 0x8d, 0xe3, 0xed, 0xa2, 0x1d, 0x80, 0x15, 0x01,
+                    0x08, 0x6f, 0xc7, 0x97, 0x22, 0x5e, 0xc8, 0x47, 0x95, 0xc6, 0x2e, 0x11, 0xfc,
+                    0xc2, 0xc4, 0x46, 0x30, 0x56, 0xa2, 0xcf, 0xe3, 0x02, 0xe9, 0xfe, 0x2b, 0x47,
+                    0x9c, 0xc6, 0x31, 0xc0, 0x07, 0x18, 0x25, 0x57, 0x1a, 0xa7, 0xe7, 0x3e, 0x31,
+                    0x17, 0x47, 0xd7, 0x6e, 0x44, 0x82, 0x15, 0x35, 0x60, 0x35, 0xc2, 0x12, 0x42,
+                    0xb0, 0x75, 0xd4, 0xdb, 0xae, 0xf3, 0x70, 0xbb, 0xef, 0x08, 0x91, 0xff, 0xd8,
+                    0x12, 0xc0, 0xf1, 0xbe, 0x05, 0x00, 0xb6, 0xe9, 0xf0, 0x75, 0x23, 0xe7, 0x9b,
+                    0xde, 0x28, 0x6f, 0xfa, 0xb3, 0xf8, 0x0b, 0x29, 0xf5, 0x77, 0xbe, 0xa8, 0x35,
+                    0x4b, 0x5c, 0xd5, 0xc7, 0xc6, 0x2f, 0x75, 0x2a, 0x49, 0x97, 0x55, 0xb6, 0x49,
+                    0xc4, 0x77, 0xc7, 0x33, 0xd4, 0x2d, 0xce, 0xa1, 0xdb, 0x14, 0x3a, 0xb3, 0x28,
+                    0xbc, 0x60, 0xc3, 0x8c, 0xe1, 0xa1, 0x14, 0x42, 0x2f, 0xeb, 0x40, 0x45, 0x59,
+                    0x10, 0x4c, 0x08, 0x77, 0x54, 0x6a, 0xb1, 0x66, 0x98, 0xca, 0xd1, 0xbf, 0x85,
+                    0xc2, 0xb5, 0x20, 0x3d, 0xa9, 0xdd, 0x29, 0x5d, 0x95, 0x1f, 0x9a, 0xbd, 0xa4,
+                    0x14, 0xa2, 0x3a, 0xe8, 0xce, 0xe1, 0x32, 0x04, 0x91, 0x55, 0x24, 0x56, 0xa3,
+                    0xa2, 0xcd, 0xee, 0xdd, 0x58, 0x73, 0x62, 0x07, 0x02, 0x3f, 0x03, 0xad, 0x7a,
+                    0xdf, 0x2e, 0xba, 0xca, 0x1f, 0x4c, 0x0b, 0x58, 0xcc, 0xb8, 0x0e, 0xb7, 0x17,
+                    0x4e, 0x21, 0x12, 0x4c, 0xaa, 0xff, 0xca, 0xdd, 0xbd, 0x27, 0x45, 0x74, 0xc2,
+                    0xb3, 0x2c, 0xbc, 0x7e, 0xa3, 0xde, 0x32, 0x71, 0x8c, 0xb9, 0x86, 0x49, 0x32,
+                    0x56, 0x96, 0x96, 0x5b, 0x4c, 0x26, 0x0f, 0xde, 0xae, 0x84, 0x01, 0x3a, 0xbc,
+                    0xd1, 0x18, 0xd2, 0xc3, 0x56, 0x83, 0xfe, 0x9d, 0x11, 0xbe, 0xa0, 0xc8, 0xdf,
+                    0x03, 0x18, 0x00, 0x00,
+                ],
+                txid: [
+                    0xa3, 0x76, 0xb4, 0x07, 0xa5, 0x12, 0xfc, 0x68, 0xf9, 0xe2, 0xf7, 0x11, 0x2f,
+                    0x86, 0x04, 0x66, 0x02, 0xcd, 0x3b, 0xf7, 0x2f, 0x39, 0x9b, 0x82, 0x5b, 0x81,
+                    0x40, 0x31, 0x94, 0x1e, 0x77, 0xd8,
+                ],
+                auth_digest: [
+                    0x9f, 0xae, 0x93, 0xf7, 0x26, 0xe4, 0x96, 0x8e, 0xf5, 0x3b, 0xf8, 0xf3, 0x9a,
+                    0x88, 0xe5, 0xf8, 0x40, 0x7d, 0x47, 0x4b, 0xd1, 0x9b, 0x47, 0xfa, 0xe2, 0x15,
+                    0x94, 0x70, 0xb8, 0x83, 0xcc, 0xb9,
+                ],
+                amounts: vec![803018142857488, 559207292003968, 576242288915192],
+                zip233_amount: 26404918436030,
+                script_pubkeys: vec![
+                    vec![0x51, 0x52, 0xac, 0x52, 0x6a, 0x53],
+                    vec![0x63, 0x51, 0x53],
+                    vec![0x65, 0x51, 0x52, 0x52],
+                ],
+                transparent_input: Some(1),
+                sighash_shielded: [
+                    0xa0, 0x6f, 0xcd, 0xf1, 0x2d, 0x43, 0x7c, 0xc4, 0x3f, 0x6d, 0x0b, 0xb5, 0xf4,
+                    0x0f, 0x2c, 0xd1, 0x6f, 0x3a, 0x6a, 0x5b, 0x9b, 0x08, 0x22, 0xac, 0xbd, 0x35,
+                    0xfe, 0x0c, 0x21, 0xcc, 0xd0, 0x4c,
+                ],
+                sighash_all: Some([
+                    0x74, 0xa4, 0x82, 0x27, 0x98, 0x10, 0xf7, 0x20, 0x33, 0xb8, 0xb3, 0x75, 0x93,
+                    0x2d, 0x10, 0xe6, 0x3f, 0xef, 0x91, 0x53, 0x8c, 0x5f, 0x39, 0x6f, 0xb6, 0x61,
+                    0x42, 0xa7, 0xf8, 0xa3, 0xbc, 0x07,
+                ]),
+                sighash_none: Some([
+                    0xf8, 0x2e, 0xbb, 0xf8, 0x61, 0x27, 0xe1, 0xc1, 0xeb, 0xc7, 0x01, 0x78, 0xa1,
+                    0x8c, 0x44, 0x0a, 0x0a, 0xe6, 0x89, 0x40, 0xc8, 0xd0, 0xe9, 0x38, 0x29, 0x62,
+                    0xf5, 0xde, 0x15, 0xfe, 0x87, 0x5c,
+                ]),
+                sighash_single: Some([
+                    0x45, 0x59, 0xf4, 0xbb, 0xeb, 0xc4, 0x6f, 0xe9, 0x6e, 0xc7, 0x1a, 0x31, 0x0a,
+                    0xbc, 0x30, 0x0d, 0x2c, 0x81, 0xd1, 0xa5, 0xd6, 0xb5, 0xe4, 0x16, 0xc2, 0xec,
+                    0x69, 0x79, 0xd6, 0x13, 0x73, 0x45,
+                ]),
+                sighash_all_anyone: Some([
+                    0x31, 0x58, 0x1b, 0x8a, 0xfb, 0x92, 0x49, 0x9e, 0xd1, 0x27, 0xef, 0xb8, 0x29,
+                    0xe0, 0x1e, 0x2b, 0x50, 0xe0, 0x85, 0x8f, 0x37, 0x01, 0x69, 0x24, 0xf1, 0xf4,
+                    0x32, 0x74, 0xbe, 0x92, 0xe3, 0xdf,
+                ]),
+                sighash_none_anyone: Some([
+                    0x42, 0x2d, 0x80, 0x51, 0x17, 0xb0, 0x9c, 0x50, 0x0e, 0xc1, 0x06, 0xcb, 0xf6,
+                    0x5c, 0xae, 0xab, 0x9f, 0x88, 0x73, 0xb5, 0x26, 0x01, 0xb6, 0x30, 0x09, 0xcc,
+                    0xa7, 0xc6, 0xe0, 0x67, 0x20, 0xbd,
+                ]),
+                sighash_single_anyone: Some([
+                    0x81, 0xe4, 0x8b, 0xd0, 0x35, 0x37, 0xf7, 0xa5, 0x35, 0x99, 0x48, 0x53, 0x15,
+                    0xdd, 0xc3, 0x1f, 0x8f, 0x03, 0x2b, 0x7f, 0x51, 0xa6, 0x38, 0x96, 0xfc, 0xab,
+                    0x53, 0x4c, 0x7f, 0xd6, 0x0e, 0xdc,
+                ]),
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x4a,
+                    0x26, 0x6f, 0x12, 0x2a, 0x96, 0xcf, 0x14, 0x01, 0xfe, 0x0b, 0x71, 0x0d, 0x7f,
+                    0x06, 0x34, 0x00, 0xc4, 0xfc, 0xe9, 0x96, 0x9d, 0xc6, 0xf0, 0x12, 0xaa, 0x8d,
+                    0xaa, 0x53, 0xd8, 0x70, 0x81, 0x06, 0xef, 0xe6, 0x8f, 0xc3, 0xe1, 0x2d, 0xfe,
+                    0xc8, 0xa8, 0xe8, 0x7f, 0x53, 0x06, 0x65, 0x51, 0x6a, 0xac, 0x63, 0x6a, 0x4a,
+                    0x61, 0x92, 0xfd, 0x00, 0x00, 0x00, 0x04, 0x7f, 0x6d, 0xeb, 0x59, 0xe3, 0xfd,
+                    0x52, 0x00, 0x42, 0x65, 0xba, 0xa3, 0xf8, 0xae, 0x32, 0x26, 0x7a, 0x85, 0x00,
+                    0x5d, 0x5d, 0xda, 0xf6, 0x6c, 0x6b, 0x0b, 0x11, 0xc5, 0xbd, 0x6b, 0x45, 0x0f,
+                    0x5d, 0xda, 0xe9, 0x18, 0x7e, 0x77, 0xd7, 0xd5, 0x3c, 0xe6, 0xf9, 0x1d, 0x86,
+                    0x5d, 0x5c, 0x4d, 0x8e, 0x3a, 0xd1, 0x0c, 0x44, 0xe4, 0xc2, 0x80, 0x71, 0x0f,
+                    0xa1, 0x23, 0xaf, 0xc4, 0xa2, 0x3a, 0x96, 0x71, 0x2b, 0xe5, 0x01, 0x2f, 0xb9,
+                    0x9b, 0x72, 0xc3, 0x69, 0x54, 0x10, 0xc8, 0x91, 0xbf, 0x88, 0xcf, 0xf6, 0x08,
+                    0xcf, 0xcb, 0xf5, 0x28, 0x85, 0x9d, 0xd6, 0xa9, 0x57, 0x94, 0x79, 0x2f, 0xa5,
+                    0xe2, 0x88, 0x10, 0xc7, 0xce, 0x88, 0x0a, 0x7a, 0xb4, 0x73, 0xa1, 0xfe, 0x1c,
+                    0x20, 0x05, 0x5e, 0x27, 0x06, 0xe0, 0x2a, 0x48, 0xcb, 0x11, 0x19, 0x12, 0xec,
+                    0x92, 0x82, 0x8c, 0x12, 0x20, 0xdb, 0x89, 0x51, 0xa0, 0x7b, 0xb0, 0x91, 0x08,
+                    0x92, 0x1e, 0xc9, 0x69, 0x19, 0x7d, 0x38, 0x79, 0xc9, 0x64, 0xc3, 0xd6, 0xbc,
+                    0x1c, 0x5c, 0xcc, 0x75, 0xa3, 0x01, 0x60, 0xed, 0x60, 0x3d, 0xab, 0x85, 0xcf,
+                    0x32, 0x91, 0x71, 0xae, 0xef, 0x49, 0xf8, 0x2d, 0x54, 0x26, 0x8b, 0x99, 0xbb,
+                    0x0c, 0x0b, 0x34, 0x1f, 0x14, 0x99, 0x6a, 0xf9, 0xb3, 0x1b, 0x42, 0xd7, 0x13,
+                    0x5f, 0x1f, 0xfc, 0x79, 0x56, 0xe6, 0x45, 0x65, 0x35, 0xfb, 0x08, 0x44, 0xe7,
+                    0x9f, 0xdc, 0xd7, 0x11, 0x85, 0x08, 0x9b, 0xc2, 0xa7, 0xbc, 0xd3, 0xa6, 0xc2,
+                    0x62, 0x09, 0x88, 0x4c, 0x3f, 0x36, 0x5c, 0x77, 0x23, 0x71, 0x27, 0x55, 0x0c,
+                    0x50, 0xdd, 0x77, 0x10, 0x90, 0x53, 0x22, 0x1e, 0xf5, 0x0a, 0xc5, 0x58, 0x0a,
+                    0xd0, 0xb0, 0x7b, 0xcf, 0xb8, 0x67, 0x4c, 0x52, 0x38, 0xed, 0xa6, 0xe9, 0x68,
+                    0x78, 0x0d, 0xe5, 0xc0, 0x0d, 0x77, 0xc4, 0xbc, 0x57, 0x14, 0x2b, 0xd9, 0x14,
+                    0x30, 0x5c, 0x98, 0x9d, 0x45, 0x3a, 0x10, 0xa7, 0xbd, 0xc6, 0x52, 0x70, 0xf7,
+                    0x3d, 0xcf, 0xd4, 0x2b, 0xa7, 0x7d, 0x4f, 0x70, 0x7e, 0x11, 0x2a, 0xbd, 0x07,
+                    0x3e, 0x8c, 0xa7, 0xb4, 0x0d, 0xa7, 0x2b, 0x89, 0x9b, 0x43, 0x4f, 0xc2, 0x82,
+                    0xc0, 0x6c, 0x4d, 0x34, 0x12, 0x89, 0x08, 0x6a, 0xe6, 0xe8, 0x38, 0x56, 0xbb,
+                    0x3b, 0x31, 0x1f, 0xc8, 0xe0, 0x83, 0xc3, 0x54, 0xd8, 0x9e, 0x73, 0x54, 0xfd,
+                    0x1c, 0xb8, 0x6c, 0x73, 0x39, 0xa9, 0x47, 0x59, 0x42, 0x8c, 0xf0, 0xba, 0x40,
+                    0x64, 0x7b, 0x1b, 0x0f, 0xb3, 0x60, 0xea, 0xd5, 0x74, 0x7b, 0x73, 0xb8, 0x3d,
+                    0x97, 0xd3, 0x1a, 0x42, 0x16, 0xe6, 0x5c, 0xd0, 0x32, 0xdd, 0x07, 0x36, 0x99,
+                    0x9e, 0x93, 0x91, 0x46, 0xd6, 0x5f, 0xa7, 0xf1, 0xe8, 0x1b, 0xab, 0xb1, 0x4c,
+                    0x3e, 0x26, 0x0b, 0xa3, 0x1c, 0x2a, 0x71, 0xe6, 0x8b, 0x13, 0x27, 0xa8, 0xde,
+                    0x05, 0x98, 0x71, 0x58, 0x2e, 0x80, 0xba, 0x47, 0xe7, 0x8a, 0x06, 0x14, 0x21,
+                    0x60, 0x0c, 0x0e, 0x3f, 0x49, 0xf2, 0xc9, 0xa6, 0xae, 0xfa, 0x74, 0x3b, 0x7e,
+                    0x8a, 0xd8, 0xaa, 0x1b, 0xcb, 0xd5, 0x84, 0x31, 0x76, 0xfe, 0x9e, 0xcb, 0x33,
+                    0x28, 0x05, 0xbc, 0x39, 0x5f, 0x87, 0x7e, 0x04, 0xe0, 0x5c, 0x19, 0x6b, 0x11,
+                    0x0f, 0xec, 0xf2, 0x10, 0x5d, 0xdf, 0xb3, 0xd6, 0x62, 0xe9, 0xd3, 0x6a, 0x7a,
+                    0xe9, 0x41, 0xd0, 0xf1, 0x17, 0xf3, 0x5b, 0x36, 0xc3, 0x0a, 0x1b, 0x15, 0x1a,
+                    0xa6, 0xeb, 0x14, 0x79, 0xd9, 0x58, 0x35, 0xe1, 0x76, 0xf2, 0x3a, 0xe1, 0x08,
+                    0x20, 0x4f, 0x39, 0x70, 0x90, 0x51, 0x85, 0xe0, 0x8f, 0xf5, 0xe3, 0xbd, 0x68,
+                    0xff, 0x2b, 0x9e, 0xff, 0xd7, 0x5a, 0x1c, 0x5f, 0x48, 0x2b, 0xd2, 0x78, 0x15,
+                    0xa7, 0x33, 0x80, 0x4b, 0x55, 0x35, 0x3e, 0x1d, 0x0e, 0x98, 0x45, 0x43, 0x6b,
+                    0x9b, 0xf4, 0x00, 0x34, 0xab, 0xf1, 0xe5, 0x45, 0x6e, 0x4a, 0x88, 0x77, 0xdc,
+                    0x87, 0x4b, 0xd7, 0x72, 0x62, 0x7a, 0x65, 0x44, 0xdf, 0xd9, 0x41, 0xc6, 0x73,
+                    0x6a, 0x9d, 0x45, 0x00, 0x9f, 0x32, 0xcd, 0xf9, 0x9b, 0xaa, 0xac, 0x8c, 0x69,
+                    0x9f, 0xfa, 0xc3, 0x0a, 0x7b, 0x50, 0x9a, 0x3a, 0x3b, 0xcf, 0x2f, 0x19, 0x64,
+                    0x25, 0xdc, 0xb5, 0xed, 0xed, 0x87, 0xf9, 0xfe, 0x6a, 0xc4, 0x33, 0x5b, 0xe4,
+                    0x5d, 0xd0, 0x55, 0xf3, 0xee, 0x3c, 0xcf, 0xef, 0x45, 0x90, 0xdb, 0xa2, 0xb5,
+                    0x8c, 0xee, 0xfc, 0x7e, 0x69, 0x51, 0x4e, 0xae, 0x54, 0xa8, 0x3a, 0x95, 0xfd,
+                    0xa6, 0xc5, 0x8f, 0xaa, 0x2f, 0xa5, 0xea, 0x90, 0xcc, 0xc8, 0x7f, 0xc0, 0x8e,
+                    0x47, 0xb3, 0xd4, 0x35, 0x14, 0xb7, 0x1b, 0xf9, 0x92, 0x58, 0x4e, 0x74, 0xe0,
+                    0x55, 0x43, 0x16, 0xd1, 0x74, 0xc9, 0x05, 0x1d, 0x1d, 0x94, 0x35, 0xfe, 0x0c,
+                    0x17, 0xa5, 0x2c, 0x34, 0x0d, 0x0a, 0xab, 0xd2, 0x69, 0xc8, 0x2f, 0x76, 0xea,
+                    0xf2, 0xbf, 0x5c, 0x85, 0x56, 0x3c, 0x64, 0x5d, 0xa6, 0x38, 0x70, 0x3e, 0x95,
+                    0x98, 0xe2, 0x3d, 0xc3, 0x60, 0xb9, 0x8c, 0xde, 0x1e, 0x53, 0xf7, 0x90, 0xb4,
+                    0x98, 0x5b, 0x22, 0x99, 0x6f, 0x95, 0x9f, 0x01, 0x5c, 0x48, 0x52, 0x08, 0x60,
+                    0xb0, 0x1e, 0xc0, 0xf9, 0xd6, 0x0d, 0x0e, 0xea, 0xf7, 0x24, 0x7a, 0xe6, 0x4e,
+                    0xc5, 0xcd, 0xaf, 0x54, 0x76, 0x11, 0x98, 0xc0, 0x86, 0x0e, 0xd2, 0x19, 0xeb,
+                    0x0f, 0xf4, 0xe3, 0x11, 0xa8, 0x4c, 0xc0, 0x6f, 0xce, 0x52, 0x11, 0x6f, 0x85,
+                    0xe0, 0xbd, 0x8a, 0x30, 0x4f, 0x8f, 0x7b, 0x88, 0x99, 0x77, 0x1e, 0x94, 0x1f,
+                    0xca, 0x76, 0x69, 0x89, 0x1d, 0x8f, 0x90, 0x36, 0x0b, 0x09, 0xc1, 0xe1, 0x5e,
+                    0x61, 0x7b, 0x53, 0x21, 0x92, 0xd7, 0x6d, 0xb5, 0xaf, 0x39, 0xbc, 0x92, 0x96,
+                    0xd6, 0x5a, 0xbd, 0xe8, 0xa9, 0x35, 0x0f, 0xca, 0x91, 0x05, 0xf3, 0x5b, 0x57,
+                    0xc0, 0xff, 0x82, 0x80, 0xe5, 0xc5, 0x45, 0x01, 0xa2, 0xbe, 0x5f, 0x51, 0x1c,
+                    0xce, 0x99, 0xd8, 0x5b, 0xcf, 0x2d, 0xb7, 0x04, 0x60, 0xc4, 0x18, 0xe2, 0x2c,
+                    0x23, 0xef, 0x5f, 0x23, 0x41, 0x0d, 0x15, 0x98, 0xce, 0xfb, 0x3c, 0x7d, 0x50,
+                    0x07, 0xb9, 0xa6, 0xb9, 0x02, 0xa9, 0xcc, 0x37, 0x4f, 0xb1, 0xc6, 0xfd, 0x25,
+                    0x2f, 0xea, 0x09, 0xf0, 0x1f, 0xdc, 0x7b, 0xc3, 0x28, 0x50, 0x67, 0x38, 0x2a,
+                    0xbf, 0x23, 0x9f, 0x6f, 0x0b, 0xb9, 0x53, 0xe3, 0xb0, 0x0a, 0xfe, 0xf1, 0x62,
+                    0xc7, 0x21, 0xbe, 0xab, 0x8c, 0x63, 0x1c, 0x4d, 0x5e, 0x13, 0xd4, 0x4e, 0x44,
+                    0x5b, 0x04, 0x08, 0x1f, 0xcf, 0x53, 0x00, 0x9b, 0x60, 0x4d, 0x04, 0x08, 0x07,
+                    0x46, 0xa0, 0xcc, 0x0a, 0x69, 0x5c, 0x65, 0xe6, 0xad, 0x63, 0xa6, 0x4d, 0xaa,
+                    0x7d, 0x41, 0x03, 0xc4, 0x78, 0xbd, 0xdf, 0x9c, 0x17, 0xb0, 0xcc, 0xc4, 0x5d,
+                    0xfd, 0x3a, 0xb7, 0x39, 0x16, 0xaa, 0x9a, 0xf3, 0x5c, 0x05, 0x0c, 0xeb, 0xb9,
+                    0x5c, 0xb9, 0xcd, 0x12, 0xce, 0x28, 0x0e, 0xd4, 0x7e, 0x49, 0xa6, 0x64, 0x2f,
+                    0x32, 0xcb, 0x96, 0x0f, 0x29, 0x0c, 0x9a, 0xcc, 0xae, 0x0b, 0xea, 0xda, 0xe9,
+                    0xa5, 0xc1, 0x01, 0xa0, 0xfa, 0xbe, 0x0c, 0xba, 0xc7, 0xab, 0x79, 0x23, 0xdc,
+                    0xe0, 0xd8, 0x2b, 0xd6, 0xa1, 0xb3, 0x38, 0x74, 0x96, 0x36, 0xa2, 0x14, 0xa7,
+                    0xea, 0x31, 0x43, 0x7a, 0x1f, 0xd0, 0xc7, 0xb4, 0x3d, 0xea, 0x5f, 0xb6, 0x9f,
+                    0x93, 0x04, 0x4f, 0x9c, 0x8f, 0x70, 0xfb, 0xd2, 0x99, 0xf9, 0x6b, 0xf7, 0xce,
+                    0x7c, 0xe1, 0xd0, 0xc5, 0x3b, 0xbc, 0x99, 0x2d, 0x4f, 0x06, 0xcb, 0x52, 0xdb,
+                    0xa1, 0xc7, 0x8c, 0xd6, 0x54, 0xcc, 0xca, 0x0b, 0xd8, 0xb2, 0x72, 0x23, 0x32,
+                    0xd8, 0xbb, 0xbf, 0xf0, 0x81, 0x34, 0xdb, 0xaf, 0xf6, 0xe4, 0xfa, 0x4e, 0xe0,
+                    0x60, 0x67, 0xbc, 0xa2, 0xb7, 0x50, 0x57, 0x2c, 0x6e, 0x31, 0x40, 0xd1, 0xb6,
+                    0x69, 0xc9, 0x59, 0x92, 0x5e, 0xba, 0xb0, 0xb5, 0x24, 0x2c, 0xee, 0xb0, 0x8c,
+                    0x4f, 0x14, 0xde, 0x19, 0x02, 0x66, 0x12, 0x97, 0x20, 0x16, 0x29, 0xe0, 0x88,
+                    0xb3, 0xe5, 0x5d, 0x52, 0xc6, 0x3d, 0xca, 0xf1, 0x7d, 0x60, 0x4f, 0x6f, 0xb9,
+                    0x4a, 0x1f, 0x24, 0x25, 0x2f, 0x9f, 0x01, 0xe6, 0x4a, 0x5c, 0x94, 0x03, 0x58,
+                    0xda, 0x04, 0xc6, 0x13, 0xb4, 0x65, 0xa0, 0x0c, 0x01, 0xca, 0x06, 0xab, 0x89,
+                    0xd1, 0xbd, 0x11, 0x0e, 0xe8, 0x23, 0x91, 0x19, 0x20, 0x22, 0xa7, 0x5b, 0xe2,
+                    0xfe, 0xc8, 0xc8, 0x4e, 0x8c, 0xc7, 0xe8, 0x60, 0xa7, 0x2c, 0xfa, 0xef, 0xc0,
+                    0x86, 0xb8, 0xf4, 0x3e, 0xc6, 0x83, 0x5a, 0x40, 0x66, 0x45, 0x81, 0xcb, 0xfd,
+                    0x4b, 0xb5, 0xc6, 0x45, 0xb8, 0x35, 0x5c, 0xdf, 0xd4, 0x29, 0x23, 0x05, 0xdd,
+                    0x2d, 0x73, 0x7a, 0x68, 0x96, 0xd1, 0xa1, 0x75, 0xfc, 0x08, 0x15, 0xce, 0xe8,
+                    0x29, 0x55, 0x57, 0x53, 0x2f, 0xff, 0xef, 0x0e, 0xf3, 0x78, 0xfb, 0x26, 0xb0,
+                    0xab, 0x45, 0xe6, 0x8b, 0xad, 0xc0, 0x8c, 0x4e, 0x1c, 0xfe, 0x42, 0xe4, 0xaf,
+                    0xdd, 0xa2, 0x57, 0xba, 0x6a, 0x82, 0x17, 0xb8, 0x4a, 0x1f, 0xe2, 0xc7, 0x55,
+                    0x7b, 0xab, 0x89, 0x01, 0x68, 0x5e, 0x97, 0x89, 0x25, 0x90, 0x0e, 0x1a, 0x17,
+                    0xa8, 0x03, 0x1b, 0x23, 0x78, 0xdf, 0xb8, 0x2e, 0x9e, 0x42, 0x38, 0xaf, 0x58,
+                    0x6b, 0x30, 0x9f, 0xb0, 0x20, 0x76, 0x5e, 0x13, 0x16, 0x67, 0x56, 0x41, 0xf6,
+                    0xa8, 0x98, 0x76, 0xb9, 0x2b, 0xe8, 0x98, 0xeb, 0x65, 0x82, 0xdf, 0x85, 0x42,
+                    0x59, 0xa5, 0x03, 0xd9, 0xcb, 0x4f, 0x99, 0xe3, 0xa2, 0x95, 0x77, 0xa0, 0xee,
+                    0x91, 0x73, 0x97, 0xfb, 0xe8, 0xef, 0x5d, 0xe8, 0x9d, 0x69, 0x97, 0x43, 0x5a,
+                    0xc5, 0xe0, 0x62, 0xb1, 0x59, 0xc8, 0x27, 0xf8, 0xed, 0xc8, 0xc6, 0xf1, 0xb6,
+                    0xe6, 0x33, 0xdc, 0xe4, 0x46, 0x49, 0x3f, 0x9d, 0x33, 0x91, 0xc4, 0xde, 0x13,
+                    0xd1, 0x4e, 0x75, 0x91, 0xd5, 0x0c, 0xf8, 0x38, 0xff, 0xf9, 0x6a, 0x78, 0x82,
+                    0x7c, 0x0a, 0xb3, 0x1f, 0x77, 0xd1, 0xda, 0x33, 0x1c, 0x2c, 0x19, 0x0e, 0x8f,
+                    0x18, 0x30, 0x23, 0xff, 0x2d, 0x0e, 0x22, 0xf6, 0xb2, 0x3b, 0x92, 0xfe, 0x07,
+                    0xaa, 0x4b, 0x16, 0x57, 0xf6, 0xde, 0x97, 0x68, 0x25, 0xa3, 0x80, 0x88, 0x4f,
+                    0x63, 0xf7, 0x6a, 0x08, 0xad, 0xca, 0x9f, 0xa8, 0x94, 0x0e, 0x7a, 0x43, 0x16,
+                    0x2b, 0x42, 0x39, 0xdb, 0xd9, 0x45, 0xf2, 0x53, 0x1a, 0xab, 0x33, 0x48, 0x3f,
+                    0x52, 0x12, 0x24, 0xf7, 0xce, 0xf1, 0x31, 0x0a, 0x2e, 0xd0, 0xc1, 0x5e, 0xc4,
+                    0x8f, 0x6e, 0xe5, 0x64, 0x92, 0x59, 0x02, 0x3a, 0xe9, 0x0d, 0xc2, 0xd2, 0x9c,
+                    0x71, 0xa7, 0xbf, 0xd9, 0xcb, 0xee, 0xaa, 0xcb, 0x12, 0x08, 0x5b, 0x08, 0x52,
+                    0xe0, 0xf4, 0x70, 0xcc, 0x47, 0xba, 0x97, 0xa9, 0xca, 0x83, 0x65, 0x3f, 0xd2,
+                    0x4d, 0x43, 0x33, 0xed, 0xf1, 0xb2, 0xe9, 0x0b, 0xb4, 0xa8, 0x42, 0x66, 0x38,
+                    0x58, 0x57, 0xca, 0x25, 0xe6, 0xea, 0x49, 0x01, 0x79, 0x2d, 0x25, 0xd2, 0x01,
+                    0xff, 0x2c, 0x7c, 0x89, 0x3b, 0x19, 0x0f, 0x47, 0xf8, 0x32, 0xfd, 0xcb, 0xa8,
+                    0x7b, 0x48, 0x29, 0xd9, 0xf1, 0x05, 0x9e, 0xb6, 0x7a, 0x67, 0xc8, 0xe3, 0x6c,
+                    0xf4, 0xca, 0xe3, 0xb2, 0xac, 0xe1, 0x34, 0x87, 0x09, 0x11, 0x9d, 0xa3, 0x4a,
+                    0x7c, 0x62, 0xb3, 0xf5, 0x06, 0x6b, 0x24, 0xb9, 0x2f, 0xbb, 0x39, 0xb6, 0xc4,
+                    0x8b, 0x9d, 0x59, 0x45, 0xe2, 0x84, 0x57, 0xa3, 0xba, 0xd1, 0xef, 0xa7, 0xaf,
+                    0x62, 0x6d, 0xd7, 0x59, 0x58, 0xd0, 0xed, 0x9c, 0xa8, 0x9a, 0x2a, 0x47, 0xaf,
+                    0xc3, 0xa7, 0xa6, 0x48, 0xb2, 0x55, 0x24, 0x65, 0x8a, 0xdb, 0x3b, 0x91, 0x0a,
+                    0xec, 0x9d, 0x47, 0x4c, 0x7e, 0x88, 0x0d, 0xff, 0x8c, 0x86, 0x08, 0xd5, 0x29,
+                    0xe2, 0xeb, 0x34, 0xd2, 0xd5, 0x71, 0x47, 0xec, 0xb3, 0x7f, 0x7c, 0x6b, 0xab,
+                    0x6e, 0x07, 0x8a, 0xe4, 0x2b, 0x97, 0x5f, 0x5c, 0x3e, 0xb1, 0xaa, 0xc5, 0x74,
+                    0x19, 0xcc, 0x13, 0x96, 0xfe, 0xfd, 0x36, 0x2b, 0x35, 0xa6, 0x9d, 0xdd, 0x3d,
+                    0xe8, 0x96, 0x34, 0x31, 0xb1, 0x59, 0x50, 0x43, 0x43, 0xa1, 0xbb, 0xd4, 0xea,
+                    0x93, 0xfc, 0x34, 0xc3, 0x41, 0x38, 0xe8, 0xdc, 0x07, 0x63, 0xee, 0x6f, 0x48,
+                    0xc3, 0x2d, 0x13, 0xfc, 0x9b, 0x8b, 0xd3, 0x83, 0xaa, 0x18, 0x6f, 0x6a, 0x2c,
+                    0xc7, 0xc5, 0x79, 0xfc, 0x27, 0xca, 0x6b, 0x24, 0x6e, 0x0d, 0xd8, 0x69, 0x74,
+                    0x4e, 0xe0, 0x81, 0x34, 0x44, 0xe5, 0xc2, 0x1d, 0x53, 0xf7, 0x8b, 0x57, 0x01,
+                    0x4a, 0xc4, 0xd8, 0x55, 0xc7, 0x06, 0x7b, 0xca, 0x44, 0x1f, 0xf1, 0x19, 0x10,
+                    0x60, 0x9e, 0x4c, 0xa7, 0x83, 0xc9, 0xb4, 0x00, 0x9d, 0xd2, 0x4f, 0xce, 0xd3,
+                    0x89, 0x0a, 0xe1, 0x7c, 0x04, 0x12, 0x3f, 0x48, 0x49, 0x77, 0x33, 0xc4, 0xec,
+                    0x11, 0xa6, 0xd5, 0x55, 0x0f, 0x0c, 0x14, 0x11, 0xdb, 0x62, 0x42, 0x2d, 0xca,
+                    0x01, 0x17, 0x08, 0xe8, 0xfa, 0x86, 0x37, 0x9f, 0xde, 0x5a, 0x16, 0x5b, 0x14,
+                    0xf8, 0x24, 0x53, 0xea, 0x5c, 0x10, 0xb9, 0xe6, 0x16, 0x4d, 0xde, 0x27, 0x48,
+                    0x33, 0x02, 0x98, 0x7d, 0xa7, 0x87, 0x47, 0x0a, 0xdd, 0x2d, 0x18, 0x88, 0x0d,
+                    0xf3, 0xae, 0x74, 0xf1, 0x4f, 0xca, 0x63, 0x9a, 0x60, 0x33, 0xcb, 0x3d, 0x0f,
+                    0xb3, 0x0e, 0x8b, 0x0a, 0xdd, 0xac, 0x8c, 0x7d, 0x81, 0x6f, 0x68, 0x95, 0x9a,
+                    0x66, 0xa7, 0x00, 0x48, 0x81, 0x84, 0x39, 0x35, 0x71, 0x73, 0x16, 0xbe, 0xa7,
+                    0x7c, 0x70, 0x86, 0x1c, 0xf5, 0x47, 0xf4, 0x5b, 0x3d, 0x00, 0x1b, 0x70, 0xfa,
+                    0x58, 0xed, 0x94, 0xbc, 0x62, 0xa3, 0x6d, 0x40, 0x2b, 0x9e, 0xf2, 0x11, 0x80,
+                    0x49, 0x3d, 0x78, 0x7c, 0x71, 0x0f, 0x36, 0xfd, 0x5c, 0xf7, 0x22, 0xc9, 0x5d,
+                    0xd5, 0xa3, 0xd3, 0xa0, 0x44, 0x1e, 0x71, 0x8e, 0x1c, 0x09, 0xb4, 0xc2, 0x46,
+                    0x08, 0x8c, 0xd1, 0x67, 0xb3, 0x93, 0xcc, 0x19, 0xb8, 0x2e, 0xcb, 0x23, 0x36,
+                    0x98, 0x81, 0xb3, 0xc0, 0x91, 0xae, 0x86, 0xc3, 0x0a, 0x3c, 0xcf, 0x8f, 0x8a,
+                    0xd7, 0x96, 0x08, 0x3e, 0xb9, 0x64, 0x35, 0x9a, 0xb0, 0x30, 0xab, 0xc6, 0xfd,
+                    0x0a, 0xa0, 0x72, 0x60, 0xaa, 0xd9, 0x94, 0x3a, 0xc5, 0x6b, 0xd4, 0x63, 0x29,
+                    0x4c, 0x90, 0x0e, 0x6f, 0xaa, 0xc9, 0xf3, 0xca, 0x42, 0xe9, 0xd6, 0x2e, 0xb9,
+                    0xdf, 0xa8, 0x91, 0x95, 0xc4, 0xa0, 0xe4, 0x2d, 0xf6, 0x8b, 0x9a, 0x04, 0x24,
+                    0xbd, 0xc8, 0x00, 0x50, 0xdc, 0x7d, 0x85, 0x81, 0x72, 0x22, 0xf5, 0xd1, 0xb8,
+                    0xa6, 0x08, 0x35, 0x16, 0xae, 0x38, 0xae, 0xd9, 0x33, 0xa0, 0x5f, 0xe7, 0xae,
+                    0xf4, 0xf9, 0x30, 0xb7, 0xbd, 0x22, 0x76, 0x34, 0xe4, 0xce, 0x7b, 0xe2, 0xde,
+                    0x82, 0x96, 0x6a, 0x43, 0xa1, 0x4f, 0x92, 0x6b, 0xa9, 0x55, 0x04, 0xfe, 0x3c,
+                    0x12, 0x43, 0x62, 0xd6, 0x54, 0x88, 0xd5, 0x42, 0xa4, 0x10, 0xa0, 0xcc, 0xca,
+                    0x8f, 0xc5, 0xba, 0x96, 0x74, 0x0e, 0xb5, 0x77, 0x5d, 0x8c, 0x11, 0x4e, 0xbe,
+                    0x5a, 0x5b, 0xd4, 0x53, 0x7f, 0xe6, 0x38, 0xb8, 0xfc, 0x07, 0xf6, 0x34, 0x05,
+                    0x85, 0x04, 0x8c, 0x1a, 0x5d, 0xd6, 0xc5, 0x31, 0xf6, 0xcc, 0x2a, 0xda, 0x24,
+                    0x14, 0x84, 0x75, 0x1f, 0x96, 0x0f, 0x71, 0x5c, 0x42, 0xc5, 0xea, 0x2e, 0x49,
+                    0xb5, 0x07, 0x7e, 0x21, 0x42, 0xe4, 0x59, 0x1c, 0x43, 0x0c, 0x31, 0xb9, 0x65,
+                    0xc2, 0x29, 0xc6, 0x1e, 0x99, 0x0c, 0x19, 0xea, 0x2a, 0xb3, 0x8f, 0xcd, 0xf5,
+                    0xc2, 0xd4, 0x80, 0x5e, 0x1f, 0xb0, 0xed, 0x87, 0x39, 0xa0, 0x67, 0x72, 0x0d,
+                    0x8b, 0xa0, 0x35, 0xbd, 0x2e, 0x0d, 0x32, 0x81, 0x77, 0xa1, 0x39, 0xc8, 0x11,
+                    0x03, 0x6e, 0x34, 0x1d, 0x66, 0xac, 0x84, 0x41, 0x24, 0xda, 0xf4, 0x2e, 0x2f,
+                    0xae, 0xe0, 0x2f, 0x58, 0x8a, 0xfb, 0xd8, 0x78, 0x54, 0x07, 0xdb, 0x21, 0x73,
+                    0x02, 0xd6, 0x09, 0x4c, 0x7c, 0x2d, 0x42, 0x7e, 0x01, 0xc7, 0xd9, 0x2e, 0x68,
+                    0xf2, 0x22, 0x91, 0x7e, 0xde, 0xc8, 0x20, 0xae, 0xbe, 0x2c, 0xbe, 0xfb, 0xbd,
+                    0x13, 0x66, 0xbd, 0xde, 0xb0, 0x7e, 0xc6, 0x0b, 0xd3, 0xaf, 0xae, 0x9d, 0xfc,
+                    0xb8, 0x7a, 0x07, 0x91, 0x8b, 0xc9, 0xa4, 0x74, 0x32, 0x7a, 0xe4, 0x62, 0x44,
+                    0xde, 0x3c, 0x8d, 0xdc, 0x33, 0x18, 0x9a, 0x9a, 0x56, 0xd5, 0xb2, 0x1e, 0x13,
+                    0x74, 0x0e, 0xb5, 0x6c, 0x52, 0xfe, 0x14, 0x3e, 0xd3, 0x94, 0x64, 0xd4, 0x74,
+                    0x43, 0xed, 0x86, 0x5d, 0x56, 0x88, 0xef, 0xd3, 0xe0, 0x3c, 0x1f, 0x40, 0x2f,
+                    0x13, 0x63, 0x83, 0xe5, 0x35, 0xce, 0x33, 0xbc, 0x95, 0x57, 0x65, 0xa0, 0x77,
+                    0x83, 0xd7, 0x31, 0x36, 0x74, 0x73, 0xac, 0x8b, 0xbe, 0xc0, 0x2c, 0xa1, 0xea,
+                    0xfc, 0x52, 0xcf, 0xa0, 0xd5, 0xca, 0xd2, 0x86, 0x4b, 0xc3, 0x0a, 0x0f, 0x19,
+                    0x88, 0x5a, 0x78, 0xa3, 0x49, 0xbe, 0x5e, 0xf2, 0x8b, 0x85, 0xad, 0x35, 0xb8,
+                    0x0a, 0x7c, 0x02, 0x4b, 0x68, 0x44, 0x79, 0x4e, 0x82, 0x72, 0x2f, 0x8c, 0xf3,
+                    0xbb, 0xcc, 0x74, 0x37, 0x77, 0xde, 0xce, 0x6f, 0x56, 0xb0, 0x51, 0xe2, 0xec,
+                    0x02, 0x2c, 0x30, 0x74, 0x20, 0xf9, 0x8a, 0x30, 0x76, 0x2c, 0x0a, 0x9b, 0x40,
+                    0x01, 0xa7, 0x35, 0xa1, 0xe5, 0x89, 0xe3, 0x89, 0x7d, 0x97, 0x18, 0x82, 0x1b,
+                    0xf5, 0x08, 0xd3, 0x88, 0x0d, 0x4a, 0xf9, 0x60, 0x5d, 0x23, 0xbf, 0x81, 0xf1,
+                    0xf0, 0xb9, 0xef, 0x2f, 0x7b, 0xf6, 0xb0, 0x04, 0x6e, 0xec, 0x4b, 0xa4, 0xa4,
+                    0x06, 0x4c, 0x97, 0x55, 0x9e, 0x1e, 0x5c, 0x99, 0x2d, 0x4a, 0xb9, 0x3a, 0x12,
+                    0x0e, 0x3f, 0xb2, 0xe2, 0xcb, 0x8b, 0x02, 0x8d, 0x24, 0x61, 0x51, 0x81, 0x93,
+                    0xd6, 0x72, 0x8c, 0x33, 0x16, 0xd2, 0x86, 0xa4, 0x3b, 0x29, 0x8f, 0x05, 0xcd,
+                    0xcf, 0xd2, 0xd8, 0x23, 0xfa, 0x2a, 0x27, 0xc4, 0x84, 0x0e, 0x0e, 0x0b, 0x3c,
+                    0x49, 0xe6, 0xca, 0xe3, 0x5b, 0xba, 0x6d, 0xa4, 0x28, 0x27, 0x3f, 0xeb, 0x6a,
+                    0x7e, 0x7e, 0x92, 0xb0, 0xd8, 0xf0, 0x21, 0xeb, 0xb5, 0xc7, 0x82, 0x49, 0x54,
+                    0xdb, 0x5d, 0x43, 0x54, 0xc3, 0x39, 0x17, 0x45, 0x66, 0x2a, 0xda, 0x0c, 0x29,
+                    0x4a, 0x0f, 0x88, 0x94, 0x63, 0x3f, 0x19, 0xdf, 0x6e, 0xff, 0x93, 0xf8, 0xa2,
+                    0x0d, 0x74, 0xb3, 0x6d, 0x1e, 0xdf, 0x3d, 0x65, 0x2c, 0x69, 0xde, 0x68, 0x41,
+                    0xb5, 0x17, 0xd0, 0x96, 0x95, 0xfb, 0xdf, 0x04, 0x32, 0x6b, 0x76, 0xf3, 0x09,
+                    0x4c, 0x72, 0x72, 0x52, 0x65, 0x69, 0xf5, 0x0a, 0x3f, 0x2c, 0x3e, 0x00, 0x01,
+                    0x59, 0xe3, 0x52, 0x62, 0x87, 0xd7, 0xab, 0xc7, 0x1c, 0xa4, 0x53, 0x5e, 0x31,
+                    0xfc, 0x8e, 0x5c, 0xb4, 0xe2, 0x30, 0xea, 0xae, 0xf6, 0x2d, 0x08, 0x81, 0x27,
+                    0x41, 0x18, 0x04, 0xbd, 0x36, 0x1d, 0x82, 0x5d, 0x48, 0x33, 0x26, 0x95, 0x70,
+                    0x34, 0xb4, 0x55, 0x0d, 0x9f, 0x8b, 0x24, 0x3c, 0x71, 0x2a, 0x04, 0xfb, 0xdb,
+                    0x89, 0x59, 0x2e, 0x8f, 0xb8, 0x91, 0x55, 0x1d, 0x40, 0x00, 0x66, 0x20, 0x55,
+                    0x37, 0x04, 0xf8, 0x38, 0x89, 0x42, 0x16, 0x6e, 0xec, 0x40, 0x95, 0xfa, 0x64,
+                    0xc6, 0xf8, 0xdc, 0x49, 0x31, 0xcc, 0xb4, 0x41, 0x65, 0xa4, 0xca, 0xfb, 0xac,
+                    0x09, 0xd9, 0xed, 0xa6, 0xa0, 0x4f, 0x51, 0x17, 0x6f, 0xf3, 0xb0, 0x78, 0xa5,
+                    0xbc, 0x3d, 0x07, 0x32, 0x4d, 0x81, 0x99, 0x29, 0x9e, 0xa7, 0xbd, 0x30, 0xa8,
+                    0xf1, 0xa6, 0x2a, 0x84, 0xcd, 0x3d, 0x70, 0x12, 0x65, 0xd5, 0xfa, 0xc6, 0x94,
+                    0x05, 0x54, 0xce, 0x62, 0xda, 0x5a, 0xf3, 0x3f, 0xc4, 0x84, 0x0a, 0xb5, 0x3c,
+                    0x81, 0x95, 0x55, 0x83, 0x93, 0x7b, 0x2f, 0x75, 0x6e, 0x6a, 0xef, 0x14, 0x84,
+                    0xbc, 0x16, 0x17, 0x27, 0xea, 0xf6, 0x80, 0x7e, 0x41, 0x52, 0x2c, 0x0f, 0x84,
+                    0x9a, 0xbb, 0xd9, 0xdf, 0x92, 0xa8, 0x91, 0xa2, 0x97, 0xd8, 0xd3, 0x2d, 0x37,
+                    0xb1, 0x73, 0x17, 0x59, 0x83, 0x09, 0x42, 0x52, 0xa8, 0x85, 0x2d, 0x0c, 0x81,
+                    0x79, 0xee, 0x43, 0x36, 0x9f, 0x0d, 0x94, 0x0d, 0x40, 0x8d, 0x55, 0x4f, 0xf9,
+                    0x85, 0xa6, 0x05, 0x49, 0x9c, 0x17, 0x50, 0xd3, 0x5f, 0xe4, 0xfa, 0x1f, 0xe2,
+                    0xfd, 0xfe, 0x8f, 0x7f, 0xea, 0xf6, 0xf1, 0xba, 0xdf, 0x7d, 0x89, 0x85, 0xb0,
+                    0x03, 0x55, 0x41, 0x32, 0x4b, 0x15, 0x8c, 0x14, 0xad, 0x65, 0x56, 0x12, 0xa1,
+                    0x82, 0x5b, 0x75, 0x42, 0x00, 0x99, 0x7f, 0x14, 0x8d, 0x44, 0x3b, 0xa7, 0xa4,
+                    0x14, 0xdf, 0x79, 0x12, 0xca, 0x53, 0x6a, 0x75, 0xba, 0x5c, 0xed, 0x52, 0x66,
+                    0xef, 0x7e, 0xb9, 0x69, 0xd3, 0x13, 0xf8, 0x47, 0x52, 0x89, 0x65, 0x61, 0x2e,
+                    0x2a, 0xf2, 0x73, 0x65, 0x32, 0x00, 0x35, 0xd7, 0x0f, 0x56, 0xf9, 0x5f, 0x81,
+                    0x7f, 0xdd, 0xd8, 0xf0, 0x93, 0x0f, 0xa7, 0x1e, 0xca, 0x2c, 0xc0, 0x22, 0xad,
+                    0x94, 0x14, 0x2b, 0xf8, 0xe1, 0x44, 0xaa, 0x4f, 0x9b, 0x74, 0xef, 0xd5, 0x67,
+                    0x11, 0xf9, 0x4d, 0x9c, 0xc1, 0x6e, 0x28, 0xe8, 0xa0, 0xf2, 0x39, 0xb7, 0x97,
+                    0x33, 0xd4, 0x35, 0x94, 0xb6, 0x39, 0x30, 0x06, 0xba, 0x75, 0x94, 0x6d, 0xc2,
+                    0xdb, 0x50, 0x71, 0xaf, 0xb7, 0xe5, 0x41, 0x88, 0x1f, 0xb6, 0x13, 0x6b, 0x56,
+                    0x83, 0xe7, 0xcc, 0x4e, 0x22, 0x72, 0xfd, 0x8b, 0x55, 0x33, 0xed, 0xe5, 0x69,
+                    0xad, 0xc1, 0x26, 0xd9, 0xd9, 0x97, 0xa9, 0x03, 0xb2, 0xce, 0x63, 0x84, 0x15,
+                    0xbf, 0x4d, 0x07, 0x26, 0x64, 0x37, 0x4d, 0x9c, 0xf7, 0x7b, 0x3a, 0x76, 0x60,
+                    0x33, 0xc4, 0x74, 0x47, 0xe0, 0x07, 0x82, 0x30, 0x41, 0xef, 0x5f, 0x9c, 0x36,
+                    0xa7, 0xf9, 0x1b, 0x8e, 0xca, 0x97, 0x8f, 0x6b, 0x87, 0x77, 0x20, 0x83, 0xe5,
+                    0xc1, 0xeb, 0x04, 0x99, 0xe1, 0x14, 0xb5, 0xca, 0xcf, 0x0c, 0xd6, 0xf5, 0x16,
+                    0x5e, 0xb8, 0xc8, 0x9f, 0xcb, 0xe2, 0x8e, 0xec, 0xec, 0xd3, 0x34, 0x89, 0x35,
+                    0xf0, 0x7e, 0x22, 0x43, 0xdd, 0xbc, 0x9c, 0xb9, 0x1c, 0xc5, 0x04, 0x98, 0x1b,
+                    0x9c, 0xab, 0x78, 0x6f, 0xc7, 0x68, 0x80, 0x81, 0xff, 0x0a, 0xb4, 0x51, 0x18,
+                    0x9f, 0xa6, 0x3d, 0xa1, 0x80, 0x3b, 0xf5, 0xce, 0x59, 0x16, 0xed, 0xae, 0x6c,
+                    0x72, 0x13, 0xce, 0x39, 0xb9, 0x83, 0x42, 0x2b, 0x55, 0xc1, 0xb9, 0xf4, 0xcd,
+                    0xe9, 0xe6, 0xd0, 0xfa, 0x2b, 0xcc, 0xaa, 0xbe, 0xa3, 0x8d, 0xb2, 0xfa, 0xb7,
+                    0xff, 0xf2, 0xcf, 0xba, 0xf1, 0x2f, 0xf3, 0x8e, 0x1a, 0x5f, 0xfa, 0x74, 0x6d,
+                    0x1e, 0x40, 0x44, 0x59, 0x6f, 0x7e, 0x80, 0x46, 0xd9, 0x97, 0x1c, 0x26, 0x1a,
+                    0xb6, 0x85, 0x4d, 0x7e, 0x7e, 0xcd, 0x60, 0xa7, 0x12, 0x42, 0x28, 0x00, 0x70,
+                    0x3b, 0x6a, 0x61, 0x7b, 0x84, 0x85, 0x51, 0x5d, 0x74, 0x8c, 0xf4, 0x83, 0xcf,
+                    0x77, 0x36, 0x56, 0x3d, 0x09, 0xdf, 0x17, 0xe3, 0x12, 0xf0, 0xf0, 0x7d, 0xc7,
+                    0x96, 0x5c, 0x88, 0x55, 0xfe, 0xb9, 0xc0, 0xd2, 0x9a, 0xd2, 0x86, 0xe6, 0xd4,
+                    0x7a, 0x62, 0x08, 0x85, 0x81, 0x9b, 0xf4, 0x96, 0x32, 0x4b, 0x14, 0x63, 0x80,
+                    0x49, 0xfd, 0xe5, 0x79, 0x57, 0xf1, 0x15, 0x0a, 0x7d, 0xce, 0xaa, 0xd2, 0x1a,
+                    0x4b, 0x79, 0x8c, 0xc9, 0xcc, 0xa4, 0x32, 0xd4, 0xde, 0x2f, 0x0b, 0xfb, 0x90,
+                    0x36, 0x80, 0x30, 0xa9, 0xf7, 0xbb, 0x53, 0x0b, 0xb1, 0x9b, 0xf8, 0x98, 0x83,
+                    0xec, 0x52, 0xa3, 0x91, 0x47, 0xf8, 0x25, 0x17, 0xc4, 0x5c, 0x1f, 0x2a, 0xea,
+                    0x46, 0xe4, 0xf5, 0x9b, 0x26, 0x50, 0x14, 0x5f, 0x91, 0xce, 0x37, 0xd0, 0xa3,
+                    0x99, 0x18, 0xa9, 0x39, 0x76, 0x8b, 0xf4, 0x62, 0x9e, 0xc3, 0x1c, 0xfb, 0xb0,
+                    0x9d, 0x77, 0x7f, 0xf6, 0x8a, 0x2e, 0xc9, 0x61, 0xf6, 0x2b, 0x6b, 0x2d, 0x0e,
+                    0x6f, 0x38, 0xed, 0xd0, 0x5d, 0x43, 0x61, 0x07, 0xa2, 0x5d, 0x83, 0x9e, 0x1b,
+                    0x08, 0x77, 0xb0, 0xf1, 0xef, 0x0d, 0x6d, 0x40, 0xec, 0x80, 0x58, 0x12, 0x1b,
+                    0xf3, 0xbd, 0x46, 0x11, 0xf7, 0x6c, 0x03, 0x7b, 0x33, 0x42, 0x35, 0x1d, 0xc4,
+                    0x31, 0xed, 0xe3, 0xb5, 0xf0, 0x6b, 0xfa, 0xb6, 0xf0, 0xb7, 0xf7, 0x02, 0xeb,
+                    0x7c, 0x59, 0x06, 0x83, 0x3c, 0x01, 0x00, 0x42, 0x21, 0x06, 0x41, 0x18, 0x84,
+                    0xd3, 0x37, 0x6a, 0x0f, 0x9c, 0xe6, 0xc1, 0x80, 0x8d, 0xf4, 0x05, 0xbe, 0xa1,
+                    0x2c, 0x5f, 0xef, 0x4f, 0x37, 0xdd, 0xec, 0x93, 0x68, 0x12, 0x33, 0xff, 0x29,
+                    0xa8, 0xef, 0xae, 0xb9, 0x6c, 0xed, 0xf2, 0xb0, 0x43, 0x20, 0x2e, 0x53, 0x8d,
+                    0xe8, 0x66, 0x33, 0x59, 0xd9, 0xec, 0x01, 0xb2, 0x9b, 0x7e, 0x1e, 0x8a, 0x44,
+                    0x16, 0x44, 0x93, 0xa1, 0x37, 0x24, 0x0a, 0xee, 0x3a, 0x9f, 0x0b, 0x31, 0x57,
+                    0x0d, 0x47, 0x9f, 0x3f, 0x81, 0xbc, 0x80, 0xe7, 0xee, 0x06, 0xce, 0x4b, 0xb7,
+                    0xcf, 0x7d, 0xa0, 0xde, 0xd9, 0x28, 0xaa, 0x3f, 0x44, 0x8a, 0x56, 0x52, 0x9e,
+                    0xa6, 0x7d, 0x6e, 0xc7, 0x06, 0x9d, 0x80, 0xf9, 0xc4, 0x33, 0x4a, 0x42, 0x5f,
+                    0x33, 0xe2, 0xf1, 0x98, 0xb3, 0xf7, 0xaf, 0xc8, 0x2a, 0x22, 0xb0, 0x42, 0xc5,
+                    0xa0, 0xed, 0xcb, 0xab, 0x2f, 0xc2, 0xf9, 0x14, 0xa9, 0xb8, 0xce, 0xaf, 0x77,
+                    0x4f, 0x3b, 0xe8, 0xb1, 0xf1, 0xef, 0x71, 0x5f, 0x4e, 0xb0, 0xa7, 0x9a, 0x50,
+                    0x29, 0x82, 0x08, 0x6d, 0x04, 0x79, 0xff, 0x67, 0x37, 0xe7, 0xbe, 0x14, 0x5d,
+                    0x4c, 0xf2, 0xe4, 0x80, 0x2c, 0x34, 0x8c, 0xda, 0x39, 0x71, 0xda, 0xba, 0x14,
+                    0x6c, 0x7c, 0x3d, 0x2a, 0x7b, 0x46, 0x5f, 0x62, 0x1b, 0xab, 0xa6, 0xcf, 0x21,
+                    0xb0, 0x2c, 0x15, 0xfa, 0xa7, 0x48, 0xce, 0x8c, 0xed, 0xe5, 0xf1, 0xcd, 0x12,
+                    0xea, 0x9a, 0x85, 0x69, 0xb7, 0x9d, 0x30, 0x3e, 0x64, 0x3e, 0xe1, 0x0e, 0x18,
+                    0x9d, 0x7f, 0x82, 0x9f, 0x49, 0x47, 0xbf, 0x37, 0x39, 0x0c, 0x0c, 0x5b, 0x7b,
+                    0x1c, 0x66, 0xe4, 0x19, 0x62, 0xba, 0xca, 0x8e, 0x93, 0xce, 0xd3, 0xa6, 0xd9,
+                    0xd5, 0xe6, 0xeb, 0x63, 0x42, 0x31, 0xe1, 0x60, 0xd3, 0x37, 0xc3, 0xfd, 0xf2,
+                    0x64, 0x27, 0x2d, 0xff, 0xd1, 0x68, 0x88, 0xcf, 0x08, 0x98, 0xd8, 0x2a, 0x84,
+                    0x1e, 0xf1, 0xfd, 0x0b, 0xa7, 0x72, 0xf2, 0xd4, 0xa2, 0xa4, 0x85, 0xbf, 0xbd,
+                    0xd1, 0x05, 0xb7, 0xe5, 0xe4, 0x25, 0x73, 0xfe, 0x93, 0x46, 0x03, 0xfd, 0xc5,
+                    0x01, 0x8f, 0x45, 0xb2, 0x92, 0xbf, 0x20, 0x13, 0xa3, 0xfb, 0x36, 0x00, 0xc7,
+                    0x05, 0x77, 0xd6, 0x0b, 0x27, 0x4b, 0x73, 0x82, 0x04, 0xc4, 0x1a, 0x37, 0xd8,
+                    0x1f, 0x09, 0xc2, 0xc5, 0x35, 0x13, 0x7e, 0x9f, 0xdb, 0x19, 0x1e, 0xe6, 0x1b,
+                    0xa4, 0x79, 0xe9, 0x70, 0xe6, 0x6a, 0xf2, 0xca, 0xca, 0xaf, 0xd0, 0x49, 0x86,
+                    0xbf, 0x57, 0x57, 0x9b, 0x1d, 0x26, 0xa8, 0x7a, 0xe7, 0x03, 0x0c, 0x21, 0xe7,
+                    0x68, 0xd0, 0x9d, 0xa5, 0xdf, 0x87, 0xa1, 0x08, 0xce, 0x5a, 0x93, 0x9d, 0x31,
+                    0x00, 0x76, 0xa9, 0xeb, 0x54, 0xc7, 0xe5, 0xd8, 0x50, 0x5c, 0x76, 0x21, 0x5b,
+                    0x5d, 0xb3, 0x06, 0x4d, 0x58, 0xd2, 0x2a, 0x15, 0xc4, 0x00, 0x0f, 0xe8, 0x35,
+                    0xf0, 0xf5, 0x55, 0xa1, 0x38, 0x9d, 0xa3, 0x4c, 0x98, 0x39, 0x8e, 0xb7, 0x11,
+                    0xab, 0x61, 0x5f, 0x9a, 0x70, 0x66, 0x16, 0x99, 0xac, 0x12, 0xed, 0xe4, 0xce,
+                    0x46, 0x3f, 0x10, 0xdb, 0xa6, 0x9e, 0x6b, 0x77, 0xa6, 0xef, 0xa3, 0xbc, 0xeb,
+                    0xf8, 0xd3, 0xcd, 0x47, 0x45, 0x62, 0x96, 0x72, 0x65, 0xbf, 0xec, 0x74, 0x2c,
+                    0x06, 0x80, 0xd1, 0x4f, 0xcf, 0x59, 0x39, 0x3d, 0x04, 0xba, 0x25, 0xde, 0xf2,
+                    0x06, 0x55, 0x95, 0x6b, 0x28, 0x02, 0xfe, 0x69, 0x5e, 0x6d, 0xbc, 0xe0, 0x38,
+                    0x65, 0x43, 0x3b, 0x8d, 0x1e, 0xca, 0xa6, 0x4f, 0xce, 0x0e, 0x6c, 0x45, 0x12,
+                    0xe3, 0x97, 0x9f, 0x67, 0x4b, 0x1b, 0x78, 0xaf, 0x36, 0x3f, 0x2d, 0xe7, 0xbd,
+                    0x06, 0x16, 0x3f, 0xf9, 0xf7, 0xfc, 0xe9, 0x84, 0x65, 0x3d, 0x52, 0x13, 0xc2,
+                    0xe1, 0x00, 0xc3, 0x9c, 0xf2, 0xfc, 0x85, 0x34, 0xf2, 0x98, 0x8c, 0x31, 0x7e,
+                    0x99, 0x00, 0x00,
+                ],
+                txid: [
+                    0x14, 0xf1, 0xa2, 0x54, 0x7b, 0xa4, 0x59, 0xf1, 0xae, 0x0a, 0x76, 0x68, 0xba,
+                    0x99, 0x12, 0x21, 0x3f, 0xca, 0xe2, 0x6f, 0x42, 0x37, 0x67, 0xe0, 0xde, 0x00,
+                    0x38, 0x92, 0xe3, 0xc7, 0x6c, 0x3e,
+                ],
+                auth_digest: [
+                    0x69, 0x63, 0xfb, 0x5b, 0x19, 0xb9, 0xec, 0x9c, 0xb0, 0x06, 0x6d, 0xc1, 0x4b,
+                    0x6f, 0x20, 0x46, 0xbd, 0xd1, 0xbb, 0x20, 0x22, 0x16, 0xbe, 0x3d, 0x6b, 0xd3,
+                    0x77, 0x22, 0x81, 0xf6, 0x79, 0x29,
+                ],
+                amounts: vec![792085059419188],
+                zip233_amount: 168767276226802,
+                script_pubkeys: vec![vec![0x51, 0xac, 0x51, 0x53, 0xac, 0x65, 0x00, 0x63, 0x6a]],
+                transparent_input: Some(0),
+                sighash_shielded: [
+                    0x59, 0x38, 0x82, 0x60, 0x7e, 0x46, 0xa8, 0xa3, 0x42, 0x6f, 0x96, 0x94, 0x4f,
+                    0xf7, 0x68, 0x34, 0x70, 0x92, 0xdd, 0xdb, 0x41, 0x8a, 0x46, 0x7a, 0xbc, 0x7a,
+                    0x2f, 0x6f, 0xb3, 0x7b, 0x80, 0xba,
+                ],
+                sighash_all: Some([
+                    0x60, 0x57, 0xa4, 0x8f, 0xdc, 0x40, 0xf7, 0x31, 0xcc, 0x6e, 0xce, 0x2c, 0xd1,
+                    0x0b, 0xc4, 0x80, 0x56, 0xbf, 0x56, 0x8c, 0xf5, 0x84, 0x52, 0x15, 0x16, 0xed,
+                    0x45, 0x8e, 0xd9, 0x69, 0x21, 0xcf,
+                ]),
+                sighash_none: Some([
+                    0x95, 0xa2, 0x6e, 0xca, 0xb0, 0x82, 0xf9, 0x38, 0xf3, 0xbb, 0x8c, 0x34, 0x04,
+                    0xe0, 0x5f, 0x8a, 0xfd, 0x35, 0xe7, 0xb2, 0x7d, 0xfa, 0x43, 0x20, 0xa5, 0x7f,
+                    0x19, 0xc1, 0x3b, 0xf2, 0x27, 0xac,
+                ]),
+                sighash_single: None,
+                sighash_all_anyone: Some([
+                    0x27, 0x9a, 0x94, 0x2d, 0xbf, 0xe2, 0x20, 0xbe, 0x15, 0x87, 0xe8, 0x96, 0x24,
+                    0xe2, 0x5b, 0xc6, 0xd8, 0x9e, 0x69, 0xa9, 0xde, 0x21, 0xc5, 0x25, 0x04, 0x62,
+                    0x07, 0xa4, 0xe0, 0x7c, 0xeb, 0x66,
+                ]),
+                sighash_none_anyone: Some([
+                    0x6b, 0xde, 0xd5, 0xd1, 0x73, 0x45, 0x87, 0xb2, 0x62, 0x9d, 0x05, 0xfa, 0x4c,
+                    0x1b, 0x77, 0xff, 0x3f, 0x69, 0x03, 0x19, 0x00, 0x23, 0x3e, 0x05, 0xb9, 0x01,
+                    0x35, 0x17, 0x91, 0x4f, 0x43, 0x31,
+                ]),
+                sighash_single_anyone: None,
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x2f,
+                    0x0a, 0xe9, 0xfb, 0x15, 0x4c, 0x85, 0x09, 0x02, 0x9f, 0x3d, 0xc3, 0xd0, 0x29,
+                    0xcf, 0xae, 0xdc, 0xcd, 0x80, 0x15, 0x4a, 0x67, 0x28, 0x82, 0xea, 0x26, 0xba,
+                    0x6a, 0x9c, 0xe9, 0x02, 0x63, 0xf0, 0xac, 0xe6, 0x6f, 0x12, 0x23, 0x75, 0x0e,
+                    0x24, 0x06, 0xa1, 0xda, 0xd4, 0x00, 0x3d, 0xb6, 0x2e, 0x45, 0x50, 0xcf, 0x84,
+                    0x5e, 0x33, 0x2a, 0xb2, 0x29, 0x20, 0xcb, 0x9b, 0xce, 0x2d, 0x5e, 0x8b, 0x13,
+                    0x68, 0x0e, 0xe2, 0x3d, 0x5c, 0x77, 0x6f, 0xe1, 0x4a, 0x83, 0x94, 0xfa, 0x2d,
+                    0xe3, 0x8e, 0x78, 0x74, 0x98, 0x97, 0xe4, 0x06, 0x6a, 0x52, 0x52, 0x65, 0x6a,
+                    0x52, 0xe2, 0xf8, 0xe5, 0x04, 0x01, 0xdc, 0x03, 0x76, 0x93, 0x07, 0xc9, 0x01,
+                    0x00, 0x06, 0x00, 0x65, 0x53, 0x51, 0x63, 0x6a, 0x00, 0x00, 0x00, 0xaf, 0x8a,
+                    0x53, 0xa6, 0xba, 0x0b, 0x05, 0x00,
+                ],
+                txid: [
+                    0xee, 0x5d, 0x8a, 0x31, 0x8b, 0xd2, 0xc8, 0x6b, 0x68, 0x88, 0x31, 0x6b, 0x55,
+                    0x4d, 0xe0, 0x31, 0x50, 0x21, 0x32, 0x8b, 0x52, 0xbe, 0x1f, 0xae, 0xa3, 0xbf,
+                    0x4b, 0xef, 0x51, 0x93, 0x43, 0xdd,
+                ],
+                auth_digest: [
+                    0x15, 0x46, 0x36, 0x9f, 0xff, 0xb5, 0x43, 0xbd, 0x25, 0x93, 0x78, 0x7a, 0xe6,
+                    0xb8, 0xfb, 0x1b, 0x61, 0x89, 0xc5, 0x81, 0x7c, 0xf8, 0xa3, 0x28, 0x20, 0x4f,
+                    0xe9, 0xc0, 0xb3, 0xf7, 0xd2, 0xe3,
+                ],
+                amounts: vec![2098065188448400, 1091591811102429],
+                zip233_amount: 1420271165868719,
+                script_pubkeys: vec![
+                    vec![0x65, 0x63, 0x51, 0x65, 0x52, 0x52, 0x52],
+                    vec![0xac, 0x51, 0x53, 0x6a, 0x63, 0x65, 0x65, 0x52, 0x00],
+                ],
+                transparent_input: Some(0),
+                sighash_shielded: [
+                    0xcc, 0xb4, 0x22, 0xde, 0x6a, 0xa6, 0x07, 0x82, 0x2b, 0xdc, 0x5b, 0x16, 0x9c,
+                    0xeb, 0xf0, 0x9b, 0x02, 0xe9, 0xa5, 0x72, 0x4c, 0x04, 0x0b, 0xc4, 0xa9, 0xb7,
+                    0x69, 0xa9, 0x92, 0x5d, 0xc7, 0xd8,
+                ],
+                sighash_all: Some([
+                    0x04, 0x3d, 0x4b, 0x15, 0x6a, 0x77, 0x41, 0x3d, 0x92, 0x05, 0x95, 0xe2, 0x66,
+                    0xb8, 0xad, 0xa5, 0xed, 0x70, 0x54, 0x03, 0xcb, 0x43, 0xe4, 0x89, 0xd1, 0xc0,
+                    0x46, 0x37, 0xb1, 0x60, 0xda, 0xf6,
+                ]),
+                sighash_none: Some([
+                    0x9c, 0x47, 0x3e, 0xa0, 0xb4, 0x7e, 0xdf, 0x94, 0xce, 0x07, 0xaf, 0x23, 0xe2,
+                    0x08, 0xcb, 0xe2, 0xf6, 0xee, 0xf0, 0x87, 0x97, 0xf8, 0x3e, 0x3a, 0xb1, 0xe4,
+                    0x1f, 0x7e, 0x22, 0x63, 0x1b, 0xaa,
+                ]),
+                sighash_single: Some([
+                    0xb7, 0x24, 0x6e, 0xe9, 0x23, 0xa8, 0x34, 0xbc, 0xc1, 0x6f, 0x16, 0x38, 0xa1,
+                    0xcf, 0xc7, 0x72, 0xfb, 0xbd, 0xd1, 0x11, 0x22, 0x65, 0x80, 0x1c, 0xf1, 0x3b,
+                    0x52, 0x5f, 0x8a, 0x80, 0x2a, 0x2e,
+                ]),
+                sighash_all_anyone: Some([
+                    0xd0, 0xd8, 0x4f, 0x02, 0x0c, 0xca, 0x50, 0x20, 0x62, 0x50, 0xea, 0xef, 0x71,
+                    0x27, 0x9a, 0xda, 0xa5, 0x15, 0xf9, 0x41, 0xb9, 0x80, 0xdd, 0xe2, 0x8d, 0x15,
+                    0xc1, 0xef, 0x71, 0x02, 0xdb, 0x92,
+                ]),
+                sighash_none_anyone: Some([
+                    0x71, 0xb2, 0x23, 0x6e, 0xf6, 0xbd, 0x67, 0x3c, 0x32, 0xad, 0x09, 0x94, 0x3d,
+                    0xc6, 0x81, 0xd9, 0x28, 0xaf, 0x7b, 0x0b, 0x2a, 0x53, 0xcd, 0xc5, 0x33, 0xe0,
+                    0xcf, 0xeb, 0xde, 0xd3, 0xb0, 0x33,
+                ]),
+                sighash_single_anyone: Some([
+                    0xe9, 0xa9, 0x54, 0x5c, 0x46, 0xaf, 0x7f, 0xfe, 0xac, 0x9e, 0x69, 0x73, 0xaa,
+                    0xa0, 0x93, 0xaf, 0x1b, 0xe7, 0x2e, 0xf8, 0xc5, 0x1e, 0x59, 0x96, 0xc2, 0x95,
+                    0x4a, 0x20, 0x0a, 0x2c, 0xd5, 0x2e,
+                ]),
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0b,
+                    0x45, 0x0f, 0xd1, 0x7d, 0x9c, 0x39, 0x01, 0x03, 0xd9, 0x62, 0xe6, 0x39, 0x5e,
+                    0xbc, 0xb7, 0xc4, 0xfc, 0xcc, 0x9c, 0xed, 0x64, 0x5c, 0xe7, 0x51, 0xb8, 0x62,
+                    0xba, 0x56, 0xad, 0xcd, 0x8a, 0xa8, 0xf6, 0x11, 0xe8, 0x65, 0x88, 0x73, 0x83,
+                    0xdb, 0x7c, 0x38, 0xe8, 0x93, 0x04, 0x51, 0x52, 0x65, 0x65, 0x34, 0xbe, 0xa8,
+                    0x71, 0xa5, 0x40, 0x57, 0x32, 0x7b, 0xf1, 0xf8, 0x43, 0x11, 0x93, 0xdd, 0x68,
+                    0xfe, 0x2f, 0x5d, 0x1b, 0x73, 0xb9, 0x28, 0xc7, 0x95, 0x8e, 0xbc, 0xa2, 0x19,
+                    0x0e, 0xd8, 0x53, 0xd4, 0x99, 0x2a, 0x4f, 0x53, 0x75, 0x72, 0x00, 0x08, 0x53,
+                    0x53, 0x53, 0xac, 0x65, 0x00, 0x52, 0x65, 0xe3, 0x47, 0x39, 0x81, 0x0c, 0x43,
+                    0x31, 0x40, 0xd2, 0x0e, 0x14, 0xa5, 0x27, 0x3c, 0xda, 0xd6, 0x2c, 0x33, 0xbb,
+                    0xf9, 0xd8, 0x83, 0xb5, 0x29, 0x0b, 0x5d, 0xae, 0xcd, 0x90, 0xf3, 0x54, 0x6c,
+                    0xa4, 0x1a, 0x58, 0xcb, 0x91, 0x31, 0x8a, 0xb2, 0x07, 0x52, 0xac, 0x51, 0x51,
+                    0x53, 0x52, 0x00, 0xbc, 0xbd, 0xce, 0xb1, 0x00, 0x01, 0x5b, 0x57, 0x0c, 0xf2,
+                    0xdf, 0x73, 0xfe, 0x6a, 0xba, 0x65, 0x65, 0x3d, 0x6b, 0x0b, 0x67, 0x89, 0xed,
+                    0x4a, 0x1c, 0x12, 0xfa, 0xcf, 0x16, 0x36, 0x40, 0x32, 0x53, 0x6c, 0xb7, 0x91,
+                    0x58, 0xd6, 0xfc, 0xb4, 0xb5, 0x9d, 0xcf, 0xcc, 0x11, 0x7d, 0xe6, 0x0b, 0xf9,
+                    0xbb, 0xd5, 0x90, 0x14, 0x57, 0x4f, 0xb9, 0xf8, 0xf5, 0x10, 0x02, 0xc9, 0xe7,
+                    0x51, 0x7c, 0x36, 0x84, 0xf5, 0xcf, 0xa7, 0x13, 0xa5, 0x04, 0x7c, 0xb6, 0xdf,
+                    0x71, 0x25, 0x94, 0xa1, 0xf5, 0xd2, 0x4b, 0x79, 0x27, 0xf9, 0xab, 0x42, 0x95,
+                    0x59, 0x3b, 0x4d, 0x7e, 0xda, 0xe1, 0xc5, 0xd6, 0x77, 0xc4, 0x20, 0xc6, 0xf9,
+                    0x82, 0x01, 0xca, 0x01, 0x74, 0x01, 0x62, 0x9f, 0x7d, 0xff, 0x19, 0x6d, 0xad,
+                    0xa6, 0xe7, 0xf5, 0x75, 0xf5, 0x2f, 0x7e, 0x76, 0x0a, 0x86, 0xb3, 0x43, 0x5c,
+                    0x3a, 0x8c, 0x25, 0x88, 0x28, 0x74, 0x13, 0x6a, 0xc6, 0xf8, 0x63, 0xcb, 0x5e,
+                    0xca, 0x0c, 0xc1, 0x67, 0x2a, 0x8a, 0xa2, 0x99, 0xe4, 0xe8, 0x91, 0x6a, 0xfe,
+                    0x28, 0x12, 0x86, 0x5b, 0x36, 0x76, 0x42, 0xa5, 0x70, 0x67, 0x23, 0x89, 0x7b,
+                    0x29, 0x04, 0x10, 0x07, 0x1c, 0x4f, 0x24, 0xda, 0x24, 0xad, 0x68, 0x66, 0xa6,
+                    0x33, 0x04, 0x22, 0x59, 0xe5, 0xd8, 0xa5, 0x4d, 0xf8, 0xb7, 0xec, 0x4f, 0xce,
+                    0x84, 0x23, 0xfe, 0x5a, 0xf6, 0xa4, 0xa4, 0xec, 0xc7, 0x08, 0xf2, 0xe3, 0x8c,
+                    0xe9, 0x0d, 0x22, 0xd4, 0xd1, 0xf8, 0xea, 0x24, 0x98, 0xbb, 0xc3, 0x9a, 0xc5,
+                    0x93, 0x0b, 0x1f, 0x4f, 0xf3, 0xad, 0x2a, 0x88, 0xf3, 0xfd, 0x94, 0x38, 0x16,
+                    0x6d, 0x0f, 0x0d, 0xc6, 0x59, 0xa8, 0xc6, 0x86, 0x63, 0x3f, 0xb6, 0x2c, 0x9e,
+                    0x0e, 0x99, 0x5b, 0x68, 0x23, 0xb1, 0x75, 0xc7, 0x9d, 0xc6, 0xe1, 0xa5, 0xfd,
+                    0x97, 0x5c, 0x31, 0xa4, 0x2e, 0xf6, 0xb8, 0x46, 0x52, 0x98, 0x6b, 0x3e, 0x1b,
+                    0x5e, 0x3b, 0x20, 0x96, 0x81, 0xa3, 0x27, 0x21, 0x69, 0xd4, 0xfc, 0xae, 0xfd,
+                    0x6e, 0x0f, 0x51, 0xf7, 0x9a, 0xc1, 0xca, 0xe7, 0xee, 0x0e, 0x05, 0xe6, 0x30,
+                    0xf0, 0xe8, 0xdb, 0x27, 0xd8, 0xf5, 0xb3, 0xfb, 0xdb, 0x1c, 0xbb, 0xa2, 0xa8,
+                    0x3a, 0x0f, 0x11, 0x17, 0xd1, 0xd4, 0x73, 0x33, 0x0a, 0x46, 0x2a, 0x6b, 0x01,
+                    0xbe, 0xf1, 0xc4, 0x51, 0xf2, 0x13, 0xd1, 0x34, 0xb1, 0xa9, 0x65, 0xb0, 0x2b,
+                    0x7e, 0xf4, 0xf4, 0x9e, 0x01, 0xf7, 0x3e, 0x9e, 0xd8, 0x7c, 0x49, 0x32, 0x5e,
+                    0x41, 0xd6, 0x07, 0xa3, 0x09, 0xa2, 0xe8, 0x76, 0x04, 0x0f, 0x89, 0x31, 0x48,
+                    0x61, 0xff, 0xb1, 0x15, 0x96, 0x7c, 0xf5, 0x61, 0xb4, 0x7e, 0xaa, 0x6b, 0xd2,
+                    0x18, 0x9a, 0xa4, 0xa5, 0x8e, 0xff, 0xd4, 0x11, 0x3e, 0x43, 0x11, 0x20, 0x9a,
+                    0x7e, 0xc6, 0x13, 0x46, 0xc2, 0xc7, 0xba, 0x85, 0xe0, 0xd8, 0x4a, 0x75, 0x92,
+                    0x53, 0x34, 0xe3, 0x91, 0x7d, 0xdf, 0xe1, 0x5f, 0x1e, 0xf9, 0x30, 0x56, 0x6b,
+                    0x9e, 0x34, 0x37, 0xf3, 0x9c, 0x4b, 0x5a, 0x2e, 0x08, 0x1a, 0x49, 0x86, 0x08,
+                    0xb0, 0x0f, 0x6d, 0xec, 0x32, 0xaa, 0xdf, 0x3a, 0xdb, 0xe3, 0x5e, 0xf7, 0xb6,
+                    0x8a, 0x46, 0x32, 0xa7, 0x7c, 0x20, 0xe1, 0x6d, 0x17, 0x86, 0xe3, 0xda, 0xc3,
+                    0x73, 0xe6, 0xd4, 0xc6, 0x1a, 0xb8, 0x71, 0xc4, 0xa8, 0xad, 0xc7, 0xd0, 0x71,
+                    0x6c, 0x17, 0x5f, 0x80, 0x0a, 0x3c, 0xd2, 0xfc, 0x0a, 0x0d, 0x07, 0x07, 0x9d,
+                    0x18, 0x06, 0x1d, 0xc8, 0x03, 0x81, 0x00, 0xf7, 0xd9, 0x0c, 0x93, 0xdf, 0xcd,
+                    0x63, 0x5b, 0x13, 0xa6, 0xf0, 0x05, 0x38, 0x2a, 0x49, 0x31, 0x86, 0x9a, 0x0d,
+                    0xb3, 0xd1, 0x45, 0xc7, 0x3c, 0x8f, 0xdc, 0xc3, 0x65, 0x60, 0x90, 0xb2, 0x39,
+                    0x1f, 0xdd, 0x9d, 0x83, 0x01, 0x0c, 0x03, 0x77, 0x1f, 0xcf, 0xf5, 0x41, 0x16,
+                    0xe9, 0xe4, 0xbc, 0xc9, 0x63, 0x89, 0x1c, 0x2b, 0xbb, 0x60, 0xea, 0x2e, 0x0c,
+                    0xe2, 0xd7, 0xd1, 0x26, 0x22, 0xdc, 0x04, 0xc1, 0xe6, 0xed, 0xed, 0x3f, 0xbf,
+                    0x0d, 0x95, 0x28, 0x44, 0x24, 0x59, 0x06, 0xf5, 0xaa, 0x45, 0xc6, 0x46, 0x64,
+                    0xa8, 0x02, 0x25, 0x08, 0x93, 0xde, 0x13, 0xcc, 0xac, 0xa0, 0x1f, 0x3c, 0x23,
+                    0x8e, 0x1c, 0xd0, 0x51, 0x76, 0x89, 0xa4, 0x22, 0xeb, 0x66, 0x2b, 0x91, 0x27,
+                    0x03, 0x0c, 0xfd, 0x88, 0x92, 0xf4, 0x09, 0xf8, 0xad, 0xac, 0x8b, 0x11, 0xc3,
+                    0x91, 0x59, 0xcd, 0xb4, 0xb8, 0xfe, 0x6e, 0xfe, 0xcc, 0x6e, 0xa2, 0xef, 0xd8,
+                    0x35, 0x2e, 0xba, 0xc5, 0xcc, 0x74, 0x5f, 0x4c, 0x40, 0x47, 0xc8, 0xb1, 0x7b,
+                    0x90, 0x08, 0xd8, 0xdf, 0xc5, 0x9e, 0x63, 0x48, 0xa8, 0x54, 0x24, 0xf9, 0x7c,
+                    0x99, 0x57, 0x66, 0xdf, 0x6e, 0x96, 0xed, 0xd4, 0x48, 0x40, 0x07, 0x53, 0xac,
+                    0xd8, 0x2f, 0x0a, 0x5b, 0xbb, 0xb5, 0xaf, 0xb8, 0xb3, 0xce, 0xd8, 0xdd, 0xcf,
+                    0x91, 0xed, 0x18, 0x29, 0xa8, 0x36, 0xef, 0xc8, 0xde, 0xce, 0x72, 0x87, 0xcc,
+                    0xc3, 0xcd, 0x9f, 0x22, 0x14, 0x4f, 0xeb, 0x64, 0x25, 0x55, 0xec, 0xbd, 0x26,
+                    0xbb, 0x6d, 0x15, 0xe4, 0x96, 0xd6, 0x4c, 0xe1, 0x6e, 0x20, 0x20, 0xdc, 0x01,
+                    0x46, 0x94, 0xc8, 0x61, 0x57, 0x8a, 0x4f, 0xb4, 0x25, 0xf6, 0xed, 0xd2, 0xa1,
+                    0xc6, 0x1a, 0x1b, 0x44, 0x8c, 0xeb, 0x6f, 0x7b, 0x73, 0xb5, 0x0c, 0x69, 0x39,
+                    0xbd, 0xff, 0xdf, 0x9f, 0x93, 0x8f, 0x4a, 0x1a, 0x9c, 0xda, 0xbe, 0x08, 0x33,
+                    0x76, 0x6c, 0x94, 0xca, 0x1a, 0x96, 0x00, 0xaf, 0x25, 0xbb, 0xb8, 0x5c, 0xe4,
+                    0x7e, 0x01, 0xf8, 0xe3, 0xac, 0x7e, 0x0d, 0x6f, 0xda, 0xc5, 0xf6, 0x6a, 0x67,
+                    0xeb, 0xb7, 0x71, 0xfe, 0xcd, 0x6e, 0xe5, 0xa4, 0x9f, 0xd1, 0x1c, 0x2b, 0x68,
+                    0xf8, 0x16, 0xa0, 0x3b, 0xcd, 0x23, 0xdb, 0x60, 0x7a, 0x90, 0xc8, 0xd1, 0x6f,
+                    0x4e, 0x9b, 0xbf, 0x88, 0x96, 0xc5, 0xa8, 0xd4, 0x51, 0x2b, 0x4c, 0xb0, 0x21,
+                    0x73, 0xc8, 0x9c, 0x2c, 0x60, 0x1a, 0x54, 0x2e, 0xd7, 0x0c, 0x69, 0x99, 0xd5,
+                    0x71, 0x68, 0xa5, 0x8a, 0x78, 0xa7, 0xf8, 0x48, 0xd7, 0xd0, 0x45, 0x7b, 0x27,
+                    0x0a, 0x00, 0x7b, 0x45, 0x6d, 0xa2, 0xc0, 0x49, 0x5b, 0xbf, 0x9f, 0x2e, 0xe0,
+                    0x3c, 0x93, 0x86, 0x43, 0x82, 0xf3, 0x85, 0x39, 0x6b, 0xde, 0x00, 0x00, 0x36,
+                    0x29, 0xd7, 0x75, 0x96, 0x68, 0x10, 0x86, 0x4d, 0x4b, 0xbe, 0x0d, 0x06, 0x21,
+                    0xe2, 0x2e, 0xe2, 0x23, 0x5c, 0xc5, 0x39, 0x54, 0xf8, 0x3b, 0x59, 0x5c, 0x94,
+                    0x07, 0x66, 0x8a, 0x82, 0x0a, 0x42, 0x06, 0x68, 0xdd, 0xfb, 0x93, 0x7b, 0x31,
+                    0xfd, 0x41, 0xec, 0xc1, 0x0e, 0xf1, 0x44, 0x50, 0xa7, 0xe0, 0xe8, 0x81, 0xcd,
+                    0xcc, 0x5e, 0x5c, 0xd0, 0xfb, 0x7f, 0xe5, 0x39, 0xc3, 0x8e, 0xb8, 0xa4, 0x74,
+                    0x1c, 0x33, 0x02, 0x0b, 0x0f, 0xa1, 0x78, 0xc7, 0xb8, 0x1a, 0x8c, 0xad, 0xa3,
+                    0xbb, 0xff, 0x81, 0x8f, 0x77, 0x30, 0x83, 0x2f, 0x5d, 0x00, 0xf5, 0x9e, 0x5c,
+                    0x37, 0x16, 0x1c, 0x0f, 0x44, 0x86, 0xbd, 0x48, 0x48, 0xf2, 0xcc, 0xc6, 0x59,
+                    0x13, 0xa9, 0xca, 0xe9, 0xd4, 0xb6, 0xd6, 0xfc, 0xf3, 0x30, 0x8a, 0xcc, 0x0a,
+                    0x32, 0xfe, 0x5c, 0x8b, 0xf9, 0x36, 0x87, 0x0b, 0xd2, 0x1c, 0x74, 0xae, 0x76,
+                    0x68, 0xac, 0xf6, 0x9b, 0xb4, 0x06, 0xe5, 0x50, 0x3b, 0x87, 0x07, 0x94, 0x40,
+                    0x0e, 0x96, 0x17, 0x9c, 0xc7, 0xd3, 0x6a, 0x7a, 0x80, 0x10, 0x32, 0xef, 0xa3,
+                    0xe2, 0x09, 0x53, 0xdf, 0x92, 0x99, 0x44, 0xdf, 0x67, 0xf5, 0xba, 0x0a, 0xd2,
+                    0xf4, 0x97, 0xfb, 0xad, 0x57, 0x0a, 0xa9, 0xfc, 0xec, 0xa0, 0x62, 0x56, 0x6f,
+                    0x23, 0x65, 0xb6, 0xdc, 0xf6, 0x3c, 0xe7, 0x69, 0x52, 0xf4, 0xec, 0x7f, 0x45,
+                    0xb3, 0xfa, 0xb6, 0xa6, 0x2a, 0x35, 0x7e, 0x0a, 0x60, 0xdf, 0xd4, 0x52, 0x3d,
+                    0x24, 0x70, 0x87, 0x93, 0x6a, 0x1c, 0xe8, 0xff, 0xfe, 0xc7, 0x7e, 0xdd, 0x3f,
+                    0x84, 0x41, 0x7f, 0xb2, 0x46, 0xc7, 0x3d, 0x56, 0x3b, 0xfe, 0x72, 0xc8, 0xb4,
+                    0xb0, 0x37, 0xa7, 0x96, 0x8e, 0xcd, 0x4d, 0xa0, 0xe3, 0x41, 0x11, 0x4e, 0x8e,
+                    0x8c, 0xec, 0xf4, 0x67, 0x82, 0x14, 0x9e, 0x35, 0xce, 0x35, 0x72, 0x93, 0xbc,
+                    0x61, 0x30, 0x9a, 0xe2, 0x3d, 0x94, 0x67, 0x9a, 0x77, 0xee, 0x44, 0x99, 0x36,
+                    0x7e, 0x4b, 0x60, 0x46, 0xd8, 0xd3, 0x8e, 0x52, 0x53, 0x98, 0x33, 0x47, 0xc6,
+                    0x08, 0xdd, 0x90, 0x8b, 0x34, 0x52, 0x8c, 0x25, 0xf6, 0x39, 0x7e, 0x2c, 0x50,
+                    0x88, 0x9d, 0xd7, 0xa8, 0x9f, 0xcb, 0x29, 0x24, 0x99, 0x29, 0x55, 0x42, 0x7b,
+                    0x69, 0xe2, 0x99, 0x63, 0xe4, 0x7a, 0xe2, 0x11, 0xc5, 0xf2, 0x85, 0x30, 0x9f,
+                    0x99, 0x14, 0x98, 0x1c, 0x93, 0xb5, 0xbc, 0x88, 0xf3, 0x1e, 0xc5, 0xd3, 0x65,
+                    0x64, 0xfc, 0x4e, 0xa5, 0x8f, 0xce, 0xe6, 0xa9, 0x43, 0x58, 0x2a, 0x08, 0xa7,
+                    0x4e, 0x6c, 0xce, 0xa1, 0x5e, 0xb3, 0x5d, 0x6d, 0x7b, 0x70, 0xe7, 0x6c, 0x47,
+                    0xdd, 0x8b, 0x24, 0x26, 0x4c, 0x8c, 0x25, 0x27, 0x32, 0x5c, 0x1c, 0x8e, 0x2c,
+                    0x3c, 0x0c, 0xf9, 0x8f, 0xd8, 0x4c, 0xf9, 0xc9, 0x99, 0x77, 0x25, 0xd2, 0x96,
+                    0xcf, 0xd2, 0xf6, 0x90, 0x0c, 0x5a, 0x9d, 0xa2, 0xc9, 0x38, 0xda, 0x18, 0x53,
+                    0x09, 0xd6, 0x94, 0xc0, 0x0d, 0x8c, 0xa7, 0xc4, 0x20, 0xce, 0x19, 0x06, 0x03,
+                    0xde, 0x10, 0xcf, 0x2c, 0xd7, 0x1b, 0x5e, 0x5c, 0x2c, 0xff, 0x2a, 0x17, 0x2e,
+                    0x05, 0xf5, 0x84, 0x9f, 0x3e, 0xda, 0x92, 0x82, 0x0a, 0xc9, 0x4c, 0x67, 0xae,
+                    0xf0, 0xad, 0xaf, 0x38, 0x90, 0x84, 0x6d, 0xaf, 0xf7, 0xea, 0xba, 0x9d, 0x82,
+                    0x84, 0x86, 0x56, 0x23, 0xd8, 0x8c, 0xe3, 0x3a, 0xeb, 0x44, 0x96, 0xcc, 0xcd,
+                    0x12, 0x75, 0x9a, 0x5e, 0x1b, 0xd5, 0x44, 0xd5, 0xb7, 0x1c, 0x28, 0x61, 0x78,
+                    0x1f, 0x88, 0xe6, 0x4e, 0x7e, 0xb6, 0x27, 0x1b, 0x95, 0x41, 0x3f, 0x14, 0x39,
+                    0xdd, 0x11, 0x45, 0xb5, 0x5e, 0xdd, 0xe2, 0x34, 0x55, 0x8c, 0x7b, 0x79, 0x17,
+                    0xd9, 0x85, 0x84, 0xa1, 0x1f, 0xa6, 0xf7, 0x75, 0x52, 0xd6, 0xed, 0xf8, 0xda,
+                    0x9d, 0x29, 0x35, 0x9b, 0xdb, 0x2d, 0x9a, 0x81, 0x1b, 0x2c, 0xd5, 0x51, 0x0c,
+                    0xfb, 0x50, 0x66, 0x69, 0xc1, 0xf5, 0xd3, 0xa8, 0x3e, 0x09, 0x02, 0x24, 0x7b,
+                    0x3f, 0xee, 0xb4, 0x7e, 0x42, 0xfe, 0xd5, 0x68, 0x2f, 0x09, 0x83, 0xc8, 0x37,
+                    0x00, 0x8f, 0x3e, 0xbd, 0xc7, 0xd0, 0x75, 0x8c, 0x2d, 0xf9, 0x11, 0x44, 0x66,
+                    0x67, 0x35, 0xcc, 0x9b, 0xb0, 0x68, 0x9b, 0x40, 0x1b, 0x1b, 0x90, 0x48, 0x34,
+                    0xef, 0x38, 0x66, 0xaf, 0x49, 0x8a, 0xf8, 0x25, 0xc2, 0xc0, 0x44, 0xe6, 0x00,
+                    0xab, 0x27, 0x4f, 0x6e, 0xbc, 0x58, 0x85, 0x10, 0xaf, 0x1e, 0x87, 0x12, 0xcb,
+                    0x7d, 0xc6, 0xbe, 0xda, 0x5c, 0x37, 0xb2, 0x3e, 0x23, 0x77, 0x8a, 0xca, 0x9a,
+                    0x6e, 0x62, 0x08, 0xca, 0x3a, 0x08, 0xea, 0xa4, 0xee, 0xb7, 0xb7, 0x2c, 0xcc,
+                    0xe4, 0xbf, 0xa3, 0xa4, 0x8e, 0x2a, 0x7b, 0x3c, 0xcb, 0xee, 0x85, 0xc8, 0x1e,
+                    0xda, 0xac, 0x4d, 0xdd, 0xbf, 0x7f, 0x30, 0x27, 0x97, 0xc4, 0xa1, 0xe5, 0x1f,
+                    0xf6, 0xd8, 0x10, 0x5e, 0x9a, 0x8b, 0x16, 0x90, 0x0b, 0x0a, 0xbc, 0x3a, 0xa4,
+                    0xc5, 0x18, 0x3d, 0x49, 0x34, 0x02, 0x28, 0xa6, 0xa1, 0x24, 0x33, 0x5b, 0x4b,
+                    0x27, 0x44, 0x4b, 0x10, 0xda, 0xa1, 0xc5, 0xda, 0xa6, 0xfd, 0xb9, 0x83, 0x88,
+                    0x4f, 0x08, 0x55, 0x7d, 0x5e, 0x69, 0xaa, 0x9a, 0x59, 0x55, 0xff, 0x41, 0x1f,
+                    0xd1, 0x20, 0x92, 0x2c, 0x81, 0x3b, 0x42, 0xfb, 0x3f, 0x33, 0xc6, 0x34, 0x49,
+                    0x97, 0x23, 0xa0, 0x7d, 0xab, 0xe2, 0xf5, 0xcd, 0xa6, 0xbb, 0x7a, 0x83, 0x83,
+                    0x3a, 0xb4, 0x0b, 0x40, 0x93, 0x6f, 0xb9, 0x6c, 0xdb, 0xab, 0xd2, 0x9a, 0xda,
+                    0x4b, 0x8e, 0x47, 0x0e, 0x22, 0x9f, 0xb7, 0x41, 0xa9, 0x18, 0x31, 0x9a, 0xa8,
+                    0xb9, 0x54, 0x7b, 0x55, 0x11, 0xc7, 0x8c, 0x45, 0x92, 0xf0, 0xad, 0xa8, 0xc8,
+                    0x3f, 0x63, 0x69, 0xac, 0x8d, 0xb3, 0x3f, 0x28, 0x51, 0xa4, 0x90, 0x9b, 0x7c,
+                    0x43, 0x06, 0xac, 0x50, 0x8d, 0x2c, 0x5c, 0xfd, 0x61, 0x1e, 0xa0, 0x88, 0x73,
+                    0x53, 0x69, 0x7e, 0xe8, 0x94, 0xe9, 0x57, 0x7b, 0xe3, 0x83, 0xb1, 0xe5, 0x7e,
+                    0x41, 0x70, 0x6f, 0xeb, 0x49, 0x28, 0xe2, 0xcf, 0xfa, 0x57, 0x2a, 0x96, 0x95,
+                    0xe3, 0x8b, 0x18, 0x48, 0xe3, 0x8f, 0xdc, 0xac, 0xb8, 0x12, 0xcb, 0x78, 0x92,
+                    0xfa, 0x9e, 0x95, 0xce, 0x53, 0x8d, 0x83, 0x23, 0xb0, 0x00, 0x8b, 0xe9, 0xd6,
+                    0x31, 0xc9, 0x47, 0xc5, 0x54, 0x53, 0x33, 0x0d, 0xb8, 0x91, 0xf5, 0x86, 0x40,
+                    0xa5, 0xcb, 0x25, 0x4d, 0xfe, 0x8b, 0x6f, 0xc4, 0x3b, 0xe8, 0x4b, 0xcb, 0xd9,
+                    0xd9, 0xd7, 0x5f, 0x49, 0x75, 0x9a, 0xb7, 0xba, 0x87, 0x9a, 0x73, 0x30, 0x95,
+                    0x6c, 0x7f, 0xb8, 0x0f, 0x2e, 0x5c, 0xc2, 0xac, 0x3c, 0xc9, 0x7a, 0x43, 0x89,
+                    0x05, 0xa4, 0x76, 0xd8, 0x13, 0x88, 0x00, 0xb8, 0xb3, 0x44, 0xbf, 0x05, 0x7c,
+                    0x3f, 0x04, 0x20, 0x08, 0x38, 0xdc, 0x37, 0x7d, 0xee, 0x05, 0x10, 0x04, 0xb9,
+                    0x52, 0xd0, 0xfb, 0x3c, 0x0b, 0x8c, 0x4c, 0x15, 0x9c, 0x2b, 0xc3, 0x70, 0xee,
+                    0xf4, 0xc8, 0x68, 0x76, 0xc0, 0xc3, 0x85, 0xe2, 0x29, 0xb6, 0xfe, 0x5d, 0x7b,
+                    0x10, 0x86, 0xf5, 0x2d, 0x6d, 0x66, 0x26, 0xf5, 0xa8, 0x36, 0xff, 0x3b, 0xd8,
+                    0xb1, 0x6f, 0x92, 0x61, 0xf4, 0xf9, 0xd1, 0xc3, 0xeb, 0x4c, 0x9e, 0xc7, 0x8f,
+                    0xdd, 0x08, 0x86, 0x10, 0x22, 0x73, 0xb2, 0xda, 0x34, 0x3c, 0xcb, 0x29, 0x24,
+                    0x3d, 0x4f, 0x34, 0xe1, 0x82, 0x6f, 0xe6, 0x91, 0x2e, 0xca, 0x52, 0x2e, 0x8a,
+                    0xcd, 0xa9, 0xe5, 0x4d, 0x8f, 0x52, 0xb3, 0xf4, 0xa5, 0x13, 0xd7, 0x97, 0x4e,
+                    0x49, 0x06, 0x09, 0x01, 0x7c, 0xdc, 0x5b, 0x13, 0xcd, 0x80, 0xc7, 0xa2, 0x53,
+                    0x16, 0xde, 0x36, 0xf4, 0x5e, 0x09, 0x77, 0xa9, 0x2a, 0x31, 0xab, 0xd8, 0xca,
+                    0xd1, 0xae, 0x5d, 0x62, 0xc3, 0xa3, 0x1e, 0xe6, 0xdd, 0x1f, 0xc3, 0x9c, 0xe4,
+                    0x08, 0x8f, 0xbb, 0x22, 0x60, 0x2b, 0x4c, 0x0b, 0x84, 0x3b, 0x0c, 0x3b, 0xf7,
+                    0xcc, 0xa9, 0xbd, 0xcb, 0x52, 0x9c, 0x9d, 0x90, 0x35, 0xd6, 0x9d, 0x5d, 0x67,
+                    0x77, 0xe1, 0xe6, 0x9c, 0x64, 0x8a, 0xeb, 0xc5, 0x5d, 0xea, 0x72, 0x1e, 0x1c,
+                    0x14, 0xa1, 0x62, 0xbb, 0x3c, 0xae, 0xad, 0x30, 0x70, 0xca, 0xcf, 0x04, 0x29,
+                    0x4f, 0x7e, 0xc7, 0x16, 0x0d, 0x42, 0xcc, 0x2c, 0x74, 0xf6, 0x85, 0x61, 0x2d,
+                    0x6d, 0x5b, 0x3c, 0x2d, 0x29, 0xce, 0xa5, 0x0d, 0xad, 0xe5, 0xa7, 0xce, 0xf9,
+                    0xe0, 0x74, 0xd3, 0xba, 0xb5, 0x7d, 0x47, 0xf2, 0x23, 0x55, 0x61, 0x01, 0x85,
+                    0xd8, 0xca, 0x50, 0x8b, 0xc6, 0xd5, 0x39, 0x76, 0x6d, 0xf2, 0x5b, 0x97, 0x4e,
+                    0x12, 0xfc, 0xc6, 0x7b, 0x8f, 0xf1, 0x00, 0x09, 0x71, 0xd7, 0xee, 0x83, 0xfb,
+                    0x06, 0x0b, 0x8d, 0x94, 0xb3, 0x90, 0xe7, 0x62, 0x6f, 0x95, 0xa5, 0xf2, 0x96,
+                    0xd4, 0xbe, 0x5f, 0x42, 0xae, 0xdf, 0xa1, 0x9e, 0xff, 0x7b, 0xee, 0x19, 0x6a,
+                    0x78, 0x85, 0x2c, 0x21, 0x88, 0x6c, 0x0c, 0xc1, 0x31, 0x72, 0x77, 0x21, 0x7d,
+                    0x09, 0xee, 0x26, 0x1b, 0x7a, 0xc1, 0x7d, 0x41, 0x4b, 0x2e, 0xb5, 0x18, 0xbf,
+                    0x67, 0x49, 0x5d, 0x26, 0x9e, 0xfc, 0xbf, 0x1f, 0xe7, 0x16, 0x90, 0x6b, 0xe1,
+                    0x8b, 0x48, 0x7e, 0x56, 0x73, 0x92, 0x26, 0x72, 0x55, 0x27, 0x59, 0x28, 0x2a,
+                    0x99, 0x6c, 0x22, 0x5f, 0x3b, 0x63, 0x24, 0x49, 0xf0, 0x10, 0xc4, 0x9d, 0x54,
+                    0xd8, 0x64, 0x82, 0xa5, 0x88, 0x3a, 0x3f, 0x56, 0xb4, 0x83, 0x9d, 0xb6, 0x4d,
+                    0x7b, 0xbc, 0x3e, 0xf4, 0xb8, 0xb6, 0xd9, 0xbe, 0x24, 0x4f, 0x0b, 0x82, 0x91,
+                    0x79, 0xce, 0x78, 0x4f, 0x74, 0x34, 0x9a, 0x5d, 0x49, 0x81, 0x02, 0xfa, 0xd1,
+                    0x5d, 0x4b, 0x38, 0x1b, 0x84, 0xd9, 0x61, 0xfe, 0xcb, 0x8e, 0x8b, 0xe8, 0xfd,
+                    0xa3, 0xf6, 0xfe, 0x20, 0xa1, 0x24, 0x38, 0x80, 0x31, 0x19, 0x88, 0xfa, 0xe1,
+                    0xb9, 0xf6, 0x8b, 0x45, 0x90, 0x5b, 0xcd, 0xb0, 0xb8, 0x6e, 0x51, 0x83, 0xaf,
+                    0x2b, 0xef, 0x3b, 0x3d, 0xf3, 0x34, 0x95, 0x6e, 0x29, 0x10, 0xef, 0x29, 0xfc,
+                    0x76, 0x43, 0x8e, 0x5b, 0xd1, 0x74, 0x6a, 0x72, 0x75, 0xad, 0x4f, 0x04, 0xa5,
+                    0xe3, 0xbb, 0x7b, 0x75, 0xd6, 0xfa, 0x90, 0xb0, 0xf5, 0xf4, 0xf0, 0x7a, 0x0b,
+                    0x73, 0x37, 0x8b, 0xb6, 0xa2, 0x80, 0xd9, 0x00, 0xa3, 0x13, 0x77, 0x71, 0x45,
+                    0x7a, 0xe7, 0x11, 0x84, 0x53, 0x4d, 0xeb, 0x07, 0x51, 0xdf, 0x98, 0x9e, 0x87,
+                    0xcc, 0x0e, 0x47, 0x1b, 0x33, 0x57, 0xae, 0xb0, 0x1e, 0xf0, 0x3d, 0x89, 0xdd,
+                    0x2f, 0xa3, 0xac, 0x01, 0x2e, 0xc6, 0x10, 0x2d, 0x2a, 0xf7, 0x9e, 0xa7, 0x39,
+                    0x04, 0x00, 0xed, 0xcb, 0x88, 0x49, 0xb1, 0x84, 0x9e, 0x0d, 0x40, 0x10, 0xf3,
+                    0x9d, 0xd9, 0x10, 0x91, 0x83, 0x76, 0x20, 0x2a, 0x0e, 0x74, 0x86, 0xf9, 0xaf,
+                    0x64, 0xa0, 0x2e, 0xb9, 0x23, 0xb6, 0xf7, 0xd7, 0x8e, 0xc8, 0xad, 0x96, 0x56,
+                    0x93, 0x31, 0xc1, 0x93, 0x01, 0xc1, 0xe6, 0xfc, 0x43, 0x24, 0x92, 0x5b, 0xf1,
+                    0x34, 0x2e, 0xef, 0x6d, 0x3f, 0xb2, 0x99, 0xce, 0xd2, 0x72, 0x65, 0x6f, 0xff,
+                    0x1c, 0xbd, 0xdc, 0x26, 0x07, 0x7d, 0x82, 0xaf, 0xdb, 0xb0, 0x72, 0x29, 0x79,
+                    0x6c, 0x74, 0x89, 0x03, 0x4a, 0xd2, 0x31, 0xd6, 0xdc, 0xa6, 0x59, 0xca, 0x5d,
+                    0x60, 0x13, 0xd7, 0x62, 0x74, 0xd2, 0x21, 0x56, 0xfa, 0xb0, 0xd8, 0xab, 0x4b,
+                    0xbb, 0xa0, 0x56, 0xdf, 0x41, 0xee, 0xce, 0x4f, 0x68, 0xcb, 0x42, 0x4e, 0x08,
+                    0x5e, 0x73, 0xf5, 0xe4, 0x68, 0xcd, 0xc0, 0x13, 0xdc, 0x80, 0xd6, 0xc4, 0x82,
+                    0x27, 0xae, 0xf0, 0x8c, 0x13, 0xbb, 0x23, 0x06, 0x42, 0x45, 0xa5, 0xf0, 0x4b,
+                    0x0c, 0x7b, 0xc8, 0x70, 0x56, 0xfa, 0xbe, 0xcf, 0x44, 0x4d, 0xd0, 0x3e, 0x56,
+                    0xad, 0x26, 0xfc, 0x16, 0x3b, 0xf3, 0xaa, 0xb3, 0xc5, 0x95, 0xa6, 0xd3, 0xcb,
+                    0xae, 0x59, 0x1c, 0x32, 0xac, 0x33, 0x32, 0x40, 0xbf, 0x57, 0x1c, 0x41, 0x54,
+                    0x44, 0xf1, 0x97, 0xa0, 0x2f, 0x71, 0x3c, 0x1e, 0xad, 0x98, 0x5c, 0x4e, 0xa4,
+                    0x24, 0x0e, 0x77, 0xb0, 0x6e, 0x05, 0xe9, 0x8c, 0x23, 0x6d, 0x0d, 0x5c, 0xa0,
+                    0x89, 0x19, 0x58, 0x07, 0xce, 0x49, 0x1b, 0x38, 0x08, 0x70, 0x0f, 0xae, 0xca,
+                    0x64, 0xfe, 0x15, 0x88, 0x42, 0xf4, 0xed, 0xd4, 0x18, 0x3d, 0x38, 0xe7, 0x04,
+                    0x56, 0xfb, 0x36, 0x08, 0x90, 0x43, 0x1d, 0x92, 0x03, 0x70, 0x35, 0xe9, 0xc1,
+                    0x5c, 0x4e, 0x0b, 0x46, 0xa5, 0xe4, 0xbf, 0xdf, 0x95, 0x19, 0x05, 0x2d, 0x49,
+                    0x68, 0x66, 0x80, 0xe3, 0x94, 0xc3, 0x8e, 0x48, 0xda, 0x1d, 0x41, 0x86, 0xf7,
+                    0x8f, 0xb6, 0x85, 0x90, 0xca, 0x11, 0x53, 0xa1, 0xed, 0xfd, 0x52, 0x75, 0xce,
+                    0xa2, 0x18, 0x02, 0x46, 0xc4, 0xb4, 0x28, 0x84, 0x18, 0xd4, 0xed, 0x4e, 0x37,
+                    0xa0, 0x1e, 0x2b, 0x5b, 0xc1, 0x38, 0x86, 0xc0, 0xd1, 0xcb, 0x77, 0x16, 0xc2,
+                    0x7b, 0x6c, 0xb2, 0x2a, 0xa8, 0xd0, 0x8e, 0x14, 0xb3, 0xc2, 0x41, 0xf7, 0x82,
+                    0xca, 0x80, 0x77, 0x34, 0x99, 0x5a, 0x70, 0x0f, 0x89, 0x4f, 0xec, 0x93, 0xf4,
+                    0x36, 0x10, 0x36, 0x82, 0x2d, 0xbe, 0xdb, 0x3b, 0x83, 0x67, 0xe2, 0x12, 0xe4,
+                    0x82, 0x5a, 0xc0, 0xd9, 0x42, 0xbf, 0xa2, 0x6c, 0x07, 0xb7, 0x0e, 0x55, 0x56,
+                    0xe0, 0xaf, 0xf7, 0x46, 0x2f, 0xca, 0x70, 0x0b, 0xd0, 0x3c, 0x9b, 0x3b, 0xa9,
+                    0x31, 0x67, 0x56, 0x83, 0x9b, 0xda, 0x2a, 0x72, 0x6e, 0xa7, 0x95, 0x79, 0xa8,
+                    0x36, 0x5e, 0x2f, 0xd4, 0x2b, 0xcc, 0xad, 0x7a, 0xa5, 0xd5, 0xba, 0x89, 0x89,
+                    0x5e, 0x7a, 0xac, 0xb8, 0xcb, 0xe2, 0xd1, 0xca, 0x74, 0x70, 0xd4, 0x01, 0xbc,
+                    0xa6, 0x35, 0xd4, 0x3d, 0x6a, 0x85, 0x83, 0x2b, 0xe9, 0x8f, 0x0d, 0x1a, 0xce,
+                    0xe2, 0x52, 0x69, 0x4a, 0x55, 0xea, 0x9a, 0xec, 0xda, 0xd0, 0x3e, 0x46, 0xc7,
+                    0x52, 0x10, 0xcd, 0x55, 0x69, 0xdf, 0xc0, 0x12, 0xea, 0xeb, 0x66, 0x63, 0x73,
+                    0xe5, 0x23, 0x7b, 0x9b, 0x54, 0x9e, 0xd9, 0x7d, 0x62, 0xa4, 0x6c, 0x36, 0x9d,
+                    0xc8, 0x2c, 0xa7, 0xc5, 0x65, 0x56, 0xbb, 0x4d, 0x6b, 0x46, 0x63, 0x32, 0xb5,
+                    0x59, 0xbd, 0x4b, 0x94, 0x86, 0x0d, 0xbb, 0x8e, 0x26, 0xe9, 0xb8, 0x2b, 0xfd,
+                    0x7b, 0x0b, 0x86, 0x88, 0x24, 0x43, 0xb2, 0xb6, 0xe4, 0xd1, 0x83, 0x38, 0x0a,
+                    0xbd, 0x9f, 0xbd, 0x11, 0x16, 0x77, 0x74, 0xab, 0xbe, 0xb1, 0x6d, 0x35, 0x5d,
+                    0x1b, 0x1a, 0x85, 0x7f, 0x9f, 0xdf, 0x55, 0xa8, 0x54, 0x75, 0xec, 0xfd, 0x8c,
+                    0xb8, 0x69, 0x7d, 0x51, 0x7f, 0x98, 0xdb, 0x6f, 0x02, 0x4d, 0xa0, 0xe3, 0x58,
+                    0xaf, 0xa4, 0xda, 0xa1, 0xf8, 0x0c, 0x3e, 0x08, 0x6f, 0x1b, 0xb7, 0x3a, 0xd5,
+                    0x12, 0xeb, 0xad, 0x53, 0x4a, 0x9b, 0x9b, 0xd0, 0x23, 0xd6, 0x47, 0x98, 0xad,
+                    0x19, 0x9f, 0x73, 0x5c, 0xf0, 0x3b, 0x8f, 0x0d, 0xeb, 0x97, 0xa4, 0x42, 0xf2,
+                    0x37, 0x90, 0x5c, 0xf3, 0xf5, 0x16, 0x7c, 0x17, 0xe0, 0xca, 0x1b, 0x83, 0x7d,
+                    0xe0, 0x1e, 0x9b, 0x63, 0x92, 0x7a, 0xbb, 0xbd, 0x4a, 0x94, 0x82, 0x1f, 0xc1,
+                    0x02, 0x2f, 0x27, 0x99, 0x04, 0xb2, 0xd3, 0x44, 0xe8, 0xb7, 0x5a, 0xc6, 0x3c,
+                    0x1e, 0xea, 0x3e, 0x9b, 0x3f, 0xdc, 0x0c, 0x3f, 0xad, 0x43, 0xaf, 0xb3, 0xa4,
+                    0x9a, 0x29, 0x67, 0xbf, 0x26, 0x4e, 0xa9, 0x56, 0x53, 0xbf, 0x8f, 0x57, 0x17,
+                    0xb4, 0xca, 0xa9, 0x93, 0x5c, 0xf1, 0xc8, 0xc1, 0x4f, 0x11, 0x29, 0xda, 0x4b,
+                    0x0d, 0xb0, 0x36, 0x99, 0xad, 0xb1, 0xfc, 0x9a, 0x32, 0x70, 0x0b, 0x28, 0xd7,
+                    0x0d, 0xa0, 0x9a, 0x8c, 0xe6, 0xde, 0xc5, 0x76, 0x71, 0xb2, 0xe9, 0xb2, 0xc5,
+                    0x2a, 0xc1, 0xdb, 0xf4, 0x49, 0x9c, 0x5f, 0xa1, 0x20, 0x7b, 0x92, 0x6d, 0x3a,
+                    0x3e, 0x36, 0x05, 0xf4, 0x17, 0x69, 0x58, 0x4b, 0x7e, 0x7f, 0x82, 0x49, 0xcb,
+                    0x95, 0x6f, 0x2c, 0x2e, 0xa0, 0xc5, 0x16, 0xf2, 0x24, 0x04, 0x45, 0xdb, 0x60,
+                    0x53, 0x0d, 0x07, 0x82, 0xae, 0x6b, 0x69, 0xca, 0x8c, 0x69, 0x14, 0x8d, 0xc2,
+                    0x03, 0xbd, 0x88, 0xb0, 0x62, 0xf5, 0x69, 0x04, 0x00, 0x5f, 0xc1, 0x27, 0x41,
+                    0xdb, 0x1b, 0xb4, 0xb2, 0x1e, 0xa7, 0x45, 0x22, 0x53, 0x59, 0x00, 0x0e, 0x83,
+                    0x18, 0x72, 0x5b, 0xad, 0x8a, 0xa4, 0xa6, 0x55, 0x70, 0xb3, 0x4d, 0x97, 0xf7,
+                    0x45, 0x0d, 0xfd, 0x04, 0x01, 0xdf, 0xe2, 0x45, 0x5d, 0x9f, 0x51, 0xe0, 0xe1,
+                    0xca, 0x33, 0x3b, 0x4f, 0x37, 0xa5, 0x96, 0x66, 0x37, 0x7b, 0x6f, 0x3a, 0x45,
+                    0x67, 0xf7, 0x7c, 0x2b, 0x9f, 0xcb, 0x5b, 0x6c, 0xd3, 0x5e, 0xa5, 0xff, 0x52,
+                    0x3b, 0x88, 0xa5, 0xb8, 0x36, 0x5a, 0x5f, 0x43, 0xfc, 0xbc, 0xff, 0xdd, 0xed,
+                    0xbb, 0xd1, 0x8d, 0xcd, 0x5e, 0x98, 0x85, 0x3b, 0x1e, 0xa8, 0x9f, 0xd7, 0xcd,
+                    0x17, 0x57, 0xe0, 0xc4, 0x2c, 0x93, 0x10, 0x97, 0x00, 0x81, 0xcc, 0x32, 0x9b,
+                    0x5d, 0x2d, 0x9f, 0x64, 0x6e, 0xa4, 0xa7, 0xba, 0xa8, 0xba, 0x26, 0xd3, 0xa8,
+                    0x4f, 0x56, 0x7a, 0x68, 0x95, 0x0a, 0xbf, 0x0a, 0xcd, 0xc0, 0x9d, 0x6a, 0x97,
+                    0x95, 0xed, 0xba, 0xde, 0x4b, 0xc3, 0x17, 0xc5, 0x68, 0xd0, 0xff, 0xbd, 0xbc,
+                    0x99, 0xdc, 0x5b, 0x49, 0xb4, 0xd6, 0x14, 0x53, 0xb6, 0x7a, 0xcd, 0xb5, 0xb2,
+                    0x19, 0x7a, 0xcb, 0x7e, 0xba, 0x12, 0xe2, 0xbf, 0x0f, 0xea, 0x88, 0x0d, 0x6e,
+                    0x63, 0xf1, 0xf8, 0x8e, 0xf4, 0x21, 0x10, 0x2a, 0x1b, 0xba, 0x27, 0xd9, 0xc6,
+                    0x45, 0x4e, 0xfe, 0xe5, 0x1a, 0xfc, 0x56, 0x68, 0x6b, 0xe8, 0x9a, 0x54, 0x4a,
+                    0x7d, 0xeb, 0x62, 0x50, 0xb8, 0xf3, 0x06, 0xe2, 0x91, 0xdd, 0x53, 0x7f, 0x3c,
+                    0x5b, 0x0f, 0x76, 0x9b, 0x7e, 0x3a, 0x59, 0xda, 0xf2, 0x0f, 0xbd, 0x2e, 0x1a,
+                    0xa9, 0x2d, 0xc7, 0x46, 0x77, 0x1f, 0x55, 0xd1, 0x5d, 0x13, 0xfa, 0xc8, 0x30,
+                    0xaa, 0x73, 0x18, 0x64, 0x7d, 0xac, 0xb3, 0xf3, 0x3a, 0xa3, 0x17, 0x2c, 0xa9,
+                    0xd6, 0xb8, 0xb5, 0x71, 0x98, 0x93, 0x11, 0x85, 0xca, 0x4b, 0x8f, 0xec, 0x9e,
+                    0x95, 0xb4, 0xc3, 0x9e, 0x68, 0x9e, 0xe7, 0x0c, 0x35, 0xc3, 0x8b, 0x5a, 0xa4,
+                    0x64, 0xa9, 0x76, 0x44, 0x4a, 0x85, 0x6e, 0x38, 0xc6, 0xd3, 0xe9, 0x7a, 0x49,
+                    0x34, 0xdd, 0x05, 0xf7, 0x9f, 0xda, 0xf2, 0x5d, 0x4b, 0x93, 0xe4, 0x21, 0xd0,
+                    0x2a, 0xa1, 0x8d, 0x87, 0x0a, 0x25, 0x3a, 0x19, 0xd9, 0x54, 0x73, 0xee, 0x68,
+                    0xb3, 0xe2, 0x22, 0xc3, 0xf4, 0x56, 0x43, 0x4f, 0xff, 0x54, 0x05, 0x9d, 0x96,
+                    0xd1, 0x0b, 0x20, 0x5f, 0x0e, 0xec, 0x39, 0x60, 0x63, 0x01, 0x62, 0x48, 0xd3,
+                    0x7f, 0x19, 0xab, 0xc7, 0x4b, 0xa0, 0x68, 0xce, 0x6e, 0x62, 0xa5, 0x07, 0x28,
+                    0xc6, 0x91, 0x7e, 0x2e, 0xe1, 0xe9, 0x74, 0x03, 0x78, 0xd6, 0xd5, 0x9a, 0x40,
+                    0x72, 0x15, 0x60, 0xa2, 0xa1, 0xba, 0xea, 0xe2, 0x6a, 0x96, 0x8d, 0xeb, 0x84,
+                    0xf3, 0x94, 0x40, 0x2a, 0x5b, 0x4a, 0x75, 0xd9, 0xf0, 0x2d, 0x27, 0xa5, 0x11,
+                    0x13, 0xac, 0x71, 0xdc, 0x5d, 0x17, 0x4d, 0xb1, 0x4a, 0x85, 0xc7, 0x94, 0x39,
+                    0x73, 0xaf, 0xf5, 0x5e, 0xd8, 0x3b, 0xa0, 0xa5, 0x66, 0xfb, 0xd6, 0xc7, 0x4e,
+                    0x33, 0x70, 0x06, 0x57, 0xc1, 0x07, 0xa7, 0x0d, 0xea, 0x7e, 0xc9, 0x9c, 0xe5,
+                    0x79, 0xb0, 0x2e, 0xd7, 0x29, 0x3d, 0xf0, 0xdc, 0x57, 0xac, 0x85, 0xce, 0x32,
+                    0x26, 0xfd, 0x7b, 0xf7, 0xbf, 0xa4, 0x06, 0xd4, 0x27, 0x6e, 0xbf, 0x40, 0xcb,
+                    0xe9, 0x54, 0x7e, 0x9d, 0xac, 0xab, 0xf0, 0xfb, 0x3f, 0x92, 0x0f, 0xc5, 0xcb,
+                    0xbb, 0x30, 0x43, 0x47, 0x3c, 0x68, 0x09, 0x09, 0x2d, 0xf5, 0x37, 0x53, 0x36,
+                    0x3c, 0x0b, 0xa9, 0xaa, 0x9c, 0xe6, 0x2d, 0xb7, 0x06, 0x00,
+                ],
+                txid: [
+                    0x67, 0x21, 0x11, 0xae, 0x3b, 0x23, 0x97, 0xc0, 0xc1, 0xd4, 0xe6, 0xdd, 0xd0,
+                    0x68, 0x70, 0xbc, 0xa1, 0x12, 0xf4, 0xf2, 0xc7, 0x27, 0xcb, 0x26, 0x32, 0x33,
+                    0x18, 0x93, 0xbd, 0x54, 0x1b, 0xb0,
+                ],
+                auth_digest: [
+                    0x26, 0x92, 0x08, 0x72, 0xce, 0x92, 0x53, 0x0d, 0x61, 0x83, 0x39, 0x63, 0x6a,
+                    0x26, 0x86, 0xa7, 0x1a, 0x39, 0x77, 0x4b, 0xde, 0x70, 0x19, 0x12, 0xdd, 0x90,
+                    0x99, 0xf1, 0x42, 0x9e, 0x9c, 0xca,
+                ],
+                amounts: vec![1884422654635218, 741515226932432, 1268517997797946],
+                zip233_amount: 1890257630702249,
+                script_pubkeys: vec![
+                    vec![0x52, 0x51, 0x52, 0x63, 0x63, 0x51],
+                    vec![0x52, 0x52, 0x52, 0x52, 0x52, 0xac],
+                    vec![],
+                ],
+                transparent_input: Some(1),
+                sighash_shielded: [
+                    0xf7, 0x67, 0x7f, 0xe0, 0x6a, 0x42, 0x0a, 0xb7, 0x5e, 0xba, 0x46, 0x4c, 0x69,
+                    0xab, 0x1c, 0xb3, 0x59, 0x62, 0xad, 0x92, 0xee, 0x7c, 0x80, 0xdb, 0x7c, 0x80,
+                    0x4d, 0x86, 0xb6, 0xf8, 0x3c, 0x25,
+                ],
+                sighash_all: Some([
+                    0xb9, 0xf5, 0xf0, 0xed, 0x8d, 0x5d, 0xb5, 0xd4, 0x01, 0x26, 0x39, 0x61, 0x4b,
+                    0x1e, 0xd4, 0xae, 0x35, 0x77, 0x1b, 0x23, 0x0f, 0xb1, 0x8c, 0xa0, 0x1c, 0xf8,
+                    0xc0, 0xb1, 0x4a, 0xd7, 0x1e, 0x8a,
+                ]),
+                sighash_none: Some([
+                    0x7f, 0x96, 0x22, 0xb2, 0x0c, 0x0d, 0xf1, 0xec, 0x9a, 0x65, 0x71, 0x29, 0xf1,
+                    0x49, 0x39, 0x3c, 0xaa, 0xfe, 0xa2, 0x6b, 0x17, 0x36, 0x06, 0x31, 0xd7, 0xf8,
+                    0x01, 0xc2, 0x3c, 0xfa, 0xa9, 0x91,
+                ]),
+                sighash_single: None,
+                sighash_all_anyone: Some([
+                    0xd4, 0xe4, 0x19, 0xfd, 0xfa, 0xc5, 0x77, 0x7b, 0x0d, 0x8b, 0x30, 0xc0, 0x0c,
+                    0x14, 0x76, 0xb3, 0xd6, 0x20, 0x7e, 0xf5, 0x2b, 0x16, 0xf0, 0x62, 0xbb, 0x9e,
+                    0xdc, 0x38, 0x0f, 0xbd, 0xf7, 0xbe,
+                ]),
+                sighash_none_anyone: Some([
+                    0xe0, 0xcb, 0x35, 0xc0, 0xb3, 0xaf, 0x7a, 0x99, 0x44, 0xff, 0x21, 0x5a, 0x40,
+                    0x7c, 0x8c, 0x4e, 0x54, 0xca, 0x46, 0xaa, 0xbc, 0xfd, 0xaf, 0x6e, 0xaa, 0x22,
+                    0xff, 0x9f, 0xfd, 0x26, 0xbc, 0x8b,
+                ]),
+                sighash_single_anyone: None,
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9b,
+                    0x86, 0x41, 0xcc, 0x05, 0x31, 0x3e, 0x12, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0xff, 0xff, 0xff, 0xff, 0x06, 0x04, 0x05, 0x31, 0x3e, 0x12, 0x00, 0xff,
+                    0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x5d, 0x2f, 0xb9, 0xad, 0x70, 0x14,
+                    0x05, 0x00,
+                ],
+                txid: [
+                    0x9c, 0x42, 0x44, 0x79, 0xce, 0x97, 0x0d, 0xe8, 0xcd, 0x46, 0x21, 0x46, 0xe5,
+                    0x03, 0x23, 0xff, 0x4a, 0x36, 0xf2, 0xbe, 0x3f, 0x8e, 0x12, 0xbc, 0xd9, 0xcc,
+                    0xf3, 0x51, 0x1d, 0xf7, 0x2a, 0x40,
+                ],
+                auth_digest: [
+                    0xd2, 0x6f, 0x8a, 0xb6, 0x08, 0x78, 0x1f, 0x3c, 0x9f, 0x77, 0x89, 0x18, 0xb0,
+                    0x40, 0x88, 0xc4, 0xec, 0x31, 0x4e, 0x0a, 0xe8, 0x74, 0xf6, 0xc0, 0xa0, 0x67,
+                    0xe6, 0xfb, 0x65, 0xee, 0xb9, 0x11,
+                ],
+                amounts: vec![],
+                zip233_amount: 1429849067040605,
+                script_pubkeys: vec![],
+                transparent_input: None,
+                sighash_shielded: [
+                    0x9c, 0x42, 0x44, 0x79, 0xce, 0x97, 0x0d, 0xe8, 0xcd, 0x46, 0x21, 0x46, 0xe5,
+                    0x03, 0x23, 0xff, 0x4a, 0x36, 0xf2, 0xbe, 0x3f, 0x8e, 0x12, 0xbc, 0xd9, 0xcc,
+                    0xf3, 0x51, 0x1d, 0xf7, 0x2a, 0x40,
+                ],
+                sighash_all: None,
+                sighash_none: None,
+                sighash_single: None,
+                sighash_all_anyone: None,
+                sighash_none_anyone: None,
+                sighash_single_anyone: None,
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x76,
+                    0x77, 0x5b, 0xcb, 0x2c, 0x96, 0x0f, 0x11, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0xff, 0xff, 0xff, 0xff, 0x06, 0x04, 0x2c, 0x96, 0x0f, 0x11, 0x00, 0xff,
+                    0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x90, 0xfa, 0x30, 0x6a, 0x65, 0xe1,
+                    0xa3, 0xbb, 0xeb, 0x9e, 0xb4, 0xb5, 0x32, 0x4e, 0xf4, 0x9c, 0x4b, 0xc5, 0x6c,
+                    0xd9, 0x97, 0x8c, 0x4e, 0xe2, 0xe4, 0xa2, 0x91, 0x5a, 0x2e, 0x38, 0xe3, 0xba,
+                    0x1e, 0xf4, 0x9f, 0x08, 0x96, 0x79, 0x57, 0x06, 0x44, 0x94, 0xe9, 0x84, 0xfe,
+                    0x23, 0x7c, 0x51, 0x8b, 0xb1, 0x57, 0x8d, 0xb4, 0x14, 0x7a, 0xc3, 0x9c, 0xa3,
+                    0xf7, 0x1a, 0x27, 0xda, 0xa3, 0x1c, 0xfb, 0x92, 0xc4, 0x68, 0x19, 0x15, 0x72,
+                    0x08, 0x27, 0x59, 0xa0, 0xa4, 0xe8, 0x01, 0x68, 0xf6, 0x44, 0xf2, 0x49, 0xb9,
+                    0xa0, 0x09, 0xd2, 0xe6, 0xb6, 0xa7, 0x2e, 0x26, 0x03, 0x19, 0x54, 0xad, 0x0a,
+                    0x86, 0x3d, 0x8d, 0x26, 0x81, 0x3f, 0xa9, 0x9f, 0x8f, 0x14, 0x24, 0xe3, 0xfb,
+                    0xca, 0x1b, 0xc4, 0xe3, 0xd6, 0xfc, 0x49, 0x73, 0x6f, 0x45, 0x23, 0xf6, 0x75,
+                    0xdb, 0x7b, 0x2e, 0x11, 0x00, 0xcd, 0x9d, 0xa3, 0x2b, 0x99, 0xfb, 0x2e, 0x8c,
+                    0xd3, 0xb0, 0xa5, 0x53, 0x3d, 0x43, 0x3f, 0xfc, 0x62, 0x35, 0x18, 0x10, 0x16,
+                    0x33, 0xcb, 0x8f, 0xef, 0xe5, 0x9e, 0x8d, 0x3e, 0x90, 0x11, 0x0c, 0x01, 0x8c,
+                    0x14, 0xcf, 0xdd, 0x63, 0xd0, 0xe6, 0x0f, 0x76, 0x09, 0x73, 0xc5, 0x57, 0x6a,
+                    0x78, 0xac, 0x86, 0x20, 0x96, 0xd0, 0xae, 0x81, 0x9d, 0x7f, 0x4c, 0xd0, 0x18,
+                    0x31, 0x9d, 0xe9, 0x70, 0xd3, 0xf5, 0x75, 0x74, 0x84, 0xea, 0x59, 0x21, 0xe9,
+                    0xcd, 0x55, 0xde, 0x09, 0x97, 0x41, 0x8d, 0x61, 0x7b, 0x32, 0x86, 0x2b, 0xc6,
+                    0x28, 0xcf, 0xf3, 0xe8, 0x53, 0xf0, 0x44, 0x48, 0xc6, 0xd3, 0x5a, 0xc8, 0x91,
+                    0x85, 0x86, 0x48, 0x7c, 0x28, 0xb8, 0x9b, 0x21, 0xa9, 0x5c, 0xd6, 0x52, 0x4c,
+                    0x42, 0x2e, 0xb5, 0x27, 0xf8, 0xd3, 0xde, 0x28, 0x17, 0x2d, 0xb8, 0x3a, 0xa7,
+                    0xaf, 0x3e, 0xbb, 0xc3, 0x76, 0xaf, 0x9f, 0x06, 0xba, 0xbb, 0x95, 0xf7, 0x93,
+                    0x3b, 0xf5, 0x31, 0x02, 0x2f, 0xbe, 0x4c, 0x87, 0x4e, 0x71, 0x25, 0x29, 0x2a,
+                    0x13, 0xc3, 0x33, 0x12, 0xf2, 0x9a, 0x39, 0x8e, 0xfb, 0x98, 0x73, 0x45, 0xfb,
+                    0x71, 0x5c, 0x84, 0x0a, 0x1a, 0xb2, 0x7c, 0x6a, 0x85, 0xc1, 0x46, 0x3d, 0x0b,
+                    0x36, 0x43, 0x0f, 0x4c, 0xc8, 0xb8, 0x4d, 0xf4, 0x54, 0xef, 0x30, 0x27, 0x73,
+                    0x73, 0x6c, 0xf9, 0x6f, 0xdc, 0x20, 0x50, 0x4d, 0x37, 0x3c, 0x64, 0xcc, 0x19,
+                    0x34, 0x65, 0x09, 0xdf, 0x7d, 0x38, 0x24, 0xd8, 0x8e, 0xd5, 0x37, 0xbb, 0xdc,
+                    0xa7, 0x44, 0x03, 0xa0, 0x33, 0xf4, 0xb4, 0xb1, 0x4f, 0x5b, 0xeb, 0xac, 0x54,
+                    0x52, 0xcd, 0xe0, 0x42, 0x7e, 0x4e, 0xc2, 0xcf, 0x0f, 0x50, 0x1e, 0xb9, 0x21,
+                    0x41, 0x4f, 0x34, 0x11, 0x33, 0x5c, 0xd7, 0xae, 0xa1, 0xad, 0x49, 0xd9, 0xce,
+                    0x49, 0x67, 0x07, 0x3c, 0x8b, 0x99, 0x9f, 0xbd, 0x9c, 0x64, 0x1a, 0xb5, 0x9a,
+                    0xbd, 0x75, 0x8a, 0x39, 0x76, 0x1a, 0x1f, 0x7d, 0x73, 0x57, 0x13, 0xd7, 0x11,
+                    0x1d, 0x09, 0xcc, 0x3e, 0x98, 0xd2, 0x38, 0x4e, 0xe2, 0x25, 0x36, 0xf7, 0xc2,
+                    0xdb, 0x87, 0x02, 0x6a, 0xcf, 0x36, 0xcd, 0xad, 0xf8, 0x7b, 0xbb, 0xa9, 0x1a,
+                    0x0c, 0xab, 0x86, 0x5b, 0x8b, 0xdd, 0x1d, 0x4e, 0xac, 0xc1, 0x66, 0xde, 0x60,
+                    0x34, 0xb4, 0xc4, 0x4f, 0xc9, 0xe8, 0x01, 0x66, 0x37, 0x7c, 0x93, 0x0b, 0x3c,
+                    0x58, 0x7b, 0x33, 0x5d, 0xa0, 0x73, 0x04, 0x22, 0x7f, 0xe8, 0xf3, 0xc7, 0x0a,
+                    0x62, 0x68, 0xf5, 0x89, 0xfb, 0x01, 0xa6, 0xa2, 0xb2, 0xa1, 0x41, 0xc5, 0x5f,
+                    0x4d, 0xf3, 0xa9, 0x83, 0x2f, 0xb1, 0xb3, 0x2e, 0xce, 0xb8, 0xb5, 0x4b, 0xf8,
+                    0xbc, 0x0d, 0x36, 0xcd, 0xba, 0xb5, 0x85, 0xff, 0xb0, 0x72, 0x53, 0x54, 0x6d,
+                    0xd6, 0x90, 0x08, 0xae, 0xe6, 0xb1, 0xee, 0x9a, 0xf8, 0x85, 0x05, 0xb0, 0x84,
+                    0x1a, 0x19, 0x7f, 0x53, 0x36, 0xcd, 0x50, 0x35, 0x91, 0xa2, 0x15, 0x0f, 0xeb,
+                    0xb8, 0xbb, 0x21, 0xf6, 0xdc, 0x83, 0x0f, 0x64, 0xfa, 0x64, 0xda, 0xc1, 0x84,
+                    0x92, 0xfb, 0x53, 0x8f, 0x6c, 0x06, 0x39, 0x35, 0x0d, 0x10, 0x2d, 0xf4, 0xad,
+                    0xd6, 0x17, 0xda, 0x94, 0x28, 0x48, 0xc2, 0x2d, 0xef, 0xf1, 0x48, 0x35, 0x65,
+                    0xbd, 0x77, 0x43, 0xdc, 0x09, 0x29, 0xc6, 0xba, 0x8c, 0x86, 0xfd, 0x07, 0x8e,
+                    0xc3, 0x99, 0x34, 0x6a, 0xce, 0x6f, 0x7b, 0x06, 0x6d, 0x9f, 0xdb, 0x71, 0x87,
+                    0x12, 0x6b, 0xc7, 0xbf, 0xda, 0x0d, 0xfc, 0xa5, 0x4d, 0x1f, 0xa1, 0xd5, 0xdf,
+                    0x6c, 0x3e, 0x6b, 0x12, 0x98, 0xc5, 0x70, 0xac, 0x09, 0xb1, 0xfc, 0xde, 0xcd,
+                    0xae, 0x50, 0xb1, 0x62, 0xec, 0x46, 0x12, 0x6c, 0x9f, 0xa6, 0x70, 0x8f, 0x60,
+                    0xf5, 0x3d, 0x71, 0xdd, 0x0a, 0xf7, 0x20, 0x65, 0x51, 0xe9, 0x5c, 0x26, 0xa3,
+                    0x40, 0xd2, 0xcc, 0xdb, 0x8f, 0x01, 0xc9, 0x30, 0xc2, 0x8a, 0xee, 0x9a, 0x25,
+                    0x81, 0xb2, 0xea, 0xab, 0x79, 0x15, 0x1e, 0x6d, 0x47, 0x94, 0x3d, 0x97, 0xa0,
+                    0xa2, 0x87, 0x0d, 0x55, 0x00, 0x9a, 0xcd, 0x57, 0xc5, 0xc3, 0xf2, 0xbb, 0x50,
+                    0xc6, 0x43, 0x66, 0xa2, 0x7b, 0x56, 0xdb, 0x8d, 0xb3, 0xe7, 0xba, 0x65, 0x49,
+                    0x06, 0x5d, 0xc4, 0xc6, 0xff, 0xa1, 0x07, 0x85, 0x4a, 0x0c, 0xd7, 0xfc, 0x9d,
+                    0x39, 0x3b, 0x12, 0xdc, 0x81, 0x34, 0xd4, 0x00, 0xf5, 0x2f, 0x06, 0x87, 0xe4,
+                    0x73, 0xdc, 0x49, 0x83, 0xa9, 0x2c, 0x8b, 0x1a, 0xde, 0x3b, 0x91, 0xbb, 0xb8,
+                    0x27, 0xf9, 0xb9, 0xc0, 0xd7, 0x32, 0x27, 0xfe, 0x67, 0x02, 0xd6, 0x41, 0x28,
+                    0x9a, 0xfc, 0x1c, 0x9b, 0x92, 0x8f, 0xd8, 0x65, 0xf4, 0x76, 0x99, 0x20, 0x07,
+                    0x09, 0xfe, 0x70, 0xb4, 0x3e, 0x0e, 0x14, 0x50, 0x59, 0xd0, 0x54, 0x08, 0xfd,
+                    0xd4, 0xbe, 0xf8, 0x5e, 0xad, 0x2c, 0xe7, 0x15, 0x96, 0x89, 0xb4, 0xfb, 0xa0,
+                    0x62, 0x28, 0xf5, 0xc3, 0xb3, 0x8d, 0xf3, 0xdc, 0xc1, 0x1f, 0x9b, 0xd7, 0x9c,
+                    0x4a, 0xfc, 0xb3, 0x3b, 0x2a, 0x71, 0xf6, 0x6e, 0x02, 0x63, 0xba, 0xe5, 0x77,
+                    0x91, 0x90, 0x02, 0x00, 0x07, 0xe3, 0x9d, 0xfc, 0x35, 0x6b, 0x9f, 0x73, 0xa8,
+                    0xf4, 0x88, 0x04, 0x60, 0xef, 0xe8, 0xe6, 0x1b, 0xcb, 0x1c, 0xd3, 0x04, 0x88,
+                    0x9b, 0xc5, 0x93, 0x7b, 0x04, 0x8f, 0xef, 0x96, 0x00, 0x08, 0xe4, 0x71, 0xfb,
+                    0xf8, 0xb4, 0x91, 0x7c, 0x4b, 0x58, 0xcc, 0x7e, 0xaf, 0xd8, 0x33, 0xcd, 0x2f,
+                    0x0e, 0x04, 0x51, 0x3c, 0xa8, 0xbd, 0x08, 0x8b, 0xc4, 0xeb, 0x15, 0xdc, 0xad,
+                    0xeb, 0xf6, 0xde, 0x26, 0xa6, 0x47, 0x67, 0x90, 0x74, 0x37, 0x23, 0x57, 0x37,
+                    0x9b, 0x4a, 0xd9, 0x80, 0xa9, 0x88, 0xa1, 0x71, 0x32, 0x00, 0xff, 0xb9, 0x63,
+                    0x63, 0xef, 0x90, 0x57, 0xcc, 0x9a, 0xe9, 0xb3, 0x61, 0x18, 0xf5, 0x9f, 0x64,
+                    0x82, 0x4b, 0x8a, 0xd6, 0xc7, 0xa9, 0x76, 0xfb, 0x98, 0xcc, 0xe8, 0x87, 0x98,
+                    0x55, 0xf5, 0xb7, 0xbe, 0x6c, 0xff, 0x2f, 0x99, 0x09, 0xbb, 0x22, 0xa8, 0x92,
+                    0xc5, 0x09, 0xb0, 0x04, 0xe3, 0x6d, 0xbd, 0x84, 0xef, 0x71, 0x05, 0x73, 0x07,
+                    0xf6, 0x72, 0x09, 0xd8, 0x30, 0x8a, 0x48, 0xae, 0xce, 0x09, 0x81, 0x99, 0x0a,
+                    0x2d, 0xca, 0x26, 0xdc, 0x58, 0x17, 0x06, 0x18, 0x27, 0x67, 0x0d, 0xa8, 0xa8,
+                    0x17, 0x3f, 0x88, 0x33, 0x51, 0xd1, 0x06, 0x96, 0xb2, 0xba, 0x7f, 0xfe, 0xac,
+                    0xd3, 0x09, 0x4f, 0x86, 0x8d, 0x77, 0xf5, 0x0e, 0x77, 0x18, 0x2b, 0xd0, 0x70,
+                    0xee, 0x13, 0x2c, 0x21, 0xaf, 0xda, 0xf5, 0x2e, 0x5b, 0x2f, 0x63, 0x18, 0x8b,
+                    0x74, 0x36, 0x97, 0x06, 0x16, 0x86, 0x05, 0xbc, 0x74, 0xb4, 0x5a, 0x12, 0x60,
+                    0x3a, 0x48, 0xde, 0xe0, 0x85, 0x7b, 0xc7, 0x56, 0x8e, 0x17, 0x52, 0x37, 0x82,
+                    0x07, 0x3f, 0x4d, 0xd2, 0x01, 0x77, 0x6c, 0x74, 0xd0, 0x0a, 0x43, 0x67, 0x8f,
+                    0x33, 0xb8, 0x48, 0x14, 0xbe, 0xaa, 0xed, 0x96, 0x68, 0xeb, 0xb2, 0xf5, 0x95,
+                    0x7b, 0x53, 0x9d, 0xc0, 0x11, 0xeb, 0x8f, 0x52, 0x4c, 0xe5, 0x61, 0x7f, 0x1f,
+                    0x99, 0xa2, 0xcf, 0xda, 0xaa, 0xb4, 0x10, 0xac, 0xc8, 0x4f, 0x43, 0x45, 0xaa,
+                    0x8f, 0x4a, 0x43, 0x2e, 0xab, 0x48, 0x03, 0xa7, 0x2e, 0xd6, 0x9b, 0x50, 0x24,
+                    0x0a, 0x31, 0x16, 0x5e, 0xd9, 0xd5, 0x61, 0x77, 0x17, 0x6c, 0x87, 0xfc, 0xf9,
+                    0x7e, 0x98, 0x7b, 0x25, 0x37, 0x3a, 0x04, 0x55, 0xd1, 0xf2, 0xc7, 0xfc, 0x9f,
+                    0x55, 0x67, 0x16, 0x07, 0x63, 0xbb, 0xbb, 0x96, 0xb1, 0x43, 0x9f, 0xbf, 0x26,
+                    0xfa, 0x34, 0x7d, 0xa5, 0x16, 0xa3, 0xc8, 0xa1, 0xbe, 0xbe, 0xc0, 0x2c, 0x55,
+                    0xf0, 0xa4, 0xdf, 0x26, 0x56, 0x64, 0x6c, 0x37, 0xf4, 0x30, 0x6c, 0xa4, 0x41,
+                    0xd3, 0xd5, 0x12, 0x45, 0xd5, 0xec, 0xf1, 0x7b, 0x6a, 0xcb, 0xe7, 0x68, 0x49,
+                    0xe6, 0xcc, 0xc4, 0xde, 0x2a, 0x31, 0xbb, 0x15, 0xb2, 0x60, 0x48, 0xb1, 0x25,
+                    0x18, 0x65, 0x00, 0xb2, 0x7d, 0x25, 0x6f, 0xdd, 0xe1, 0x00, 0x00,
+                ],
+                txid: [
+                    0xe0, 0x05, 0xab, 0xb6, 0x84, 0xd9, 0x6e, 0x10, 0x07, 0x66, 0xfa, 0x32, 0x64,
+                    0x83, 0x84, 0x9b, 0x4c, 0xca, 0x7a, 0x0b, 0x91, 0x3d, 0x14, 0xc3, 0x57, 0xd8,
+                    0x84, 0xd1, 0x43, 0xa5, 0xc6, 0x85,
+                ],
+                auth_digest: [
+                    0xff, 0xf5, 0x9f, 0x98, 0xfb, 0x1a, 0xa8, 0x6c, 0xb4, 0x87, 0xfc, 0x04, 0x35,
+                    0xd3, 0xf6, 0x8d, 0x7e, 0x88, 0x1a, 0x28, 0x62, 0x13, 0xb3, 0x13, 0x0c, 0xa8,
+                    0x07, 0x61, 0x54, 0x2a, 0xa4, 0x7e,
+                ],
+                amounts: vec![],
+                zip233_amount: 248341168750002,
+                script_pubkeys: vec![],
+                transparent_input: None,
+                sighash_shielded: [
+                    0xe0, 0x05, 0xab, 0xb6, 0x84, 0xd9, 0x6e, 0x10, 0x07, 0x66, 0xfa, 0x32, 0x64,
+                    0x83, 0x84, 0x9b, 0x4c, 0xca, 0x7a, 0x0b, 0x91, 0x3d, 0x14, 0xc3, 0x57, 0xd8,
+                    0x84, 0xd1, 0x43, 0xa5, 0xc6, 0x85,
+                ],
+                sighash_all: None,
+                sighash_none: None,
+                sighash_single: None,
+                sighash_all_anyone: None,
+                sighash_none_anyone: None,
+                sighash_single_anyone: None,
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x77,
+                    0xfd, 0xb9, 0x07, 0xf7, 0x36, 0x1b, 0x02, 0x03, 0xbb, 0x85, 0x59, 0x76, 0x08,
+                    0xd6, 0x99, 0xd9, 0x16, 0x8f, 0x2b, 0x0b, 0x9a, 0xe4, 0x53, 0x5f, 0xeb, 0x0e,
+                    0xec, 0xf2, 0x0a, 0x22, 0x74, 0x1d, 0xe9, 0x1b, 0x1c, 0x9a, 0x5c, 0xab, 0x82,
+                    0x89, 0xc2, 0xff, 0x87, 0x8f, 0x09, 0x65, 0x51, 0x53, 0x53, 0x53, 0x63, 0x52,
+                    0x52, 0x00, 0x87, 0xb4, 0xa6, 0x73, 0xe7, 0x63, 0x2d, 0x4f, 0x88, 0x7c, 0xa0,
+                    0x44, 0x5f, 0x48, 0x2b, 0xd4, 0x28, 0x66, 0xb0, 0xc4, 0xe5, 0xdc, 0xc3, 0x9b,
+                    0x19, 0x95, 0x58, 0x32, 0x8b, 0x82, 0x98, 0x09, 0x9c, 0x02, 0x22, 0x1a, 0x2b,
+                    0xae, 0x12, 0x57, 0x07, 0x63, 0x53, 0x53, 0x52, 0xac, 0xac, 0x6a, 0xa7, 0x2d,
+                    0x26, 0x22, 0x72, 0x5d, 0x8a, 0xfa, 0x3b, 0xed, 0xb4, 0x20, 0x0b, 0xdd, 0x95,
+                    0xd2, 0xcf, 0x30, 0xeb, 0x5d, 0xb8, 0xda, 0xcc, 0x36, 0x60, 0xa8, 0xf0, 0xb2,
+                    0x0b, 0x31, 0x94, 0xb3, 0x75, 0x06, 0x25, 0xe9, 0x58, 0x31, 0x05, 0x4b, 0x08,
+                    0x51, 0x6a, 0x6a, 0x53, 0x6a, 0x63, 0x6a, 0xac, 0xa2, 0x45, 0xe1, 0x61, 0x00,
+                    0x02, 0xa5, 0x38, 0x8f, 0x3b, 0xe6, 0x5c, 0xe2, 0xb3, 0x73, 0x53, 0x60, 0xbc,
+                    0x47, 0x21, 0x39, 0x48, 0xf7, 0xab, 0xaa, 0x45, 0x9f, 0x4e, 0x3e, 0x3f, 0x6c,
+                    0x1f, 0x96, 0x15, 0xd1, 0x50, 0xba, 0xa2, 0x89, 0x6a, 0xec, 0xdd, 0x14, 0xc1,
+                    0x85, 0xc7, 0x07, 0x3b, 0xb7, 0xef, 0x62, 0xe4, 0x37, 0xd1, 0xea, 0x54, 0xf1,
+                    0x7d, 0xf7, 0x0d, 0x1e, 0xcd, 0x51, 0x2a, 0x92, 0xa5, 0x7d, 0x91, 0xf3, 0x86,
+                    0x14, 0xc8, 0x18, 0x60, 0xf4, 0x01, 0x32, 0xad, 0xa5, 0x44, 0x1d, 0xd9, 0x37,
+                    0x4e, 0x85, 0x41, 0xd4, 0x9d, 0x1b, 0x54, 0xbf, 0xf2, 0x1c, 0xa9, 0x64, 0x13,
+                    0x2c, 0x1c, 0x57, 0xa4, 0x4e, 0x1a, 0xf2, 0xd4, 0x78, 0xd3, 0x96, 0x53, 0x62,
+                    0x1c, 0x05, 0x18, 0x26, 0x49, 0xe8, 0x1b, 0xb4, 0x52, 0x16, 0x1f, 0x3b, 0xf9,
+                    0x49, 0x09, 0x27, 0x9c, 0x60, 0x2e, 0x35, 0x8a, 0xa0, 0x37, 0xc5, 0xa4, 0xff,
+                    0xf2, 0x57, 0xba, 0x49, 0x9e, 0x51, 0x95, 0x77, 0x04, 0x47, 0xa7, 0x72, 0xd4,
+                    0xd3, 0x07, 0xcb, 0x7b, 0x0a, 0x62, 0xab, 0x43, 0x22, 0x38, 0x3b, 0xde, 0xc1,
+                    0xfa, 0x74, 0xde, 0x68, 0x1f, 0xe6, 0x9c, 0x9e, 0x46, 0xd1, 0x7c, 0x43, 0x50,
+                    0x2f, 0xde, 0x6a, 0xe3, 0x50, 0xd1, 0x57, 0x33, 0xcb, 0x6c, 0xb3, 0x9f, 0xf9,
+                    0xee, 0x2a, 0x5d, 0x4e, 0x04, 0xda, 0xc9, 0x83, 0x37, 0xf4, 0x1a, 0x01, 0x80,
+                    0xa2, 0xcb, 0xbe, 0x28, 0x98, 0x82, 0xea, 0xac, 0x24, 0x41, 0x7a, 0x5a, 0x7d,
+                    0x31, 0x4b, 0x9c, 0x70, 0x18, 0xd6, 0x25, 0x7b, 0xe1, 0x2d, 0x04, 0xec, 0x99,
+                    0xd7, 0x27, 0x68, 0x03, 0xa2, 0x2d, 0x31, 0xce, 0x2a, 0x22, 0xd1, 0x6d, 0xb9,
+                    0xb6, 0xaa, 0xfd, 0xdc, 0x7b, 0x2c, 0xec, 0x73, 0x77, 0x3c, 0xdc, 0xa7, 0x91,
+                    0x48, 0xb7, 0x90, 0x5e, 0xc9, 0xcf, 0x7a, 0x2b, 0x8c, 0x6e, 0x59, 0x58, 0x0a,
+                    0x05, 0xa5, 0x1d, 0xb0, 0xf4, 0x8a, 0x5e, 0x51, 0x08, 0xe7, 0xb4, 0x07, 0xa1,
+                    0x65, 0xf8, 0x00, 0xdf, 0x8b, 0x2d, 0xb4, 0x7e, 0x69, 0x51, 0xcb, 0x20, 0xf1,
+                    0x90, 0xd3, 0xeb, 0x20, 0xad, 0x2e, 0xa9, 0xc8, 0xe0, 0x3d, 0x0f, 0x37, 0xb9,
+                    0xbb, 0xb4, 0x08, 0x46, 0xb2, 0x0f, 0x8e, 0xb7, 0xa1, 0x6d, 0xb2, 0x02, 0xe2,
+                    0x5c, 0x43, 0x42, 0xb2, 0x4a, 0x81, 0xde, 0x7e, 0xe6, 0x9d, 0xc7, 0x3e, 0x6e,
+                    0xb3, 0xf3, 0x75, 0xab, 0x4e, 0xd8, 0xeb, 0x1b, 0xd3, 0x22, 0xff, 0xfb, 0xf1,
+                    0xa3, 0x9f, 0xed, 0x1f, 0xd1, 0x5e, 0x1a, 0xa8, 0x07, 0x44, 0xb6, 0xa7, 0xa7,
+                    0x0b, 0x3c, 0x05, 0xcf, 0xc7, 0xe4, 0x52, 0x82, 0x54, 0x52, 0x1c, 0x1d, 0xe5,
+                    0xae, 0x0a, 0x76, 0xab, 0x39, 0xeb, 0x66, 0xf0, 0x3e, 0x18, 0x3a, 0x5f, 0x1e,
+                    0xf6, 0xce, 0xdb, 0x94, 0xeb, 0x11, 0xa3, 0xe0, 0xca, 0xf5, 0xc4, 0x4e, 0xa4,
+                    0x85, 0x33, 0x00, 0x64, 0x81, 0x08, 0x2e, 0xb8, 0x18, 0x99, 0x1e, 0x6f, 0x47,
+                    0x7d, 0x40, 0xd6, 0xb1, 0x4e, 0x23, 0x28, 0xa3, 0xae, 0xa8, 0xf2, 0x30, 0x72,
+                    0xf5, 0x65, 0x2a, 0x5f, 0xec, 0xc8, 0x13, 0xed, 0x5f, 0x0f, 0x4d, 0xb8, 0x02,
+                    0xfd, 0x84, 0xca, 0xa9, 0x40, 0x99, 0xa8, 0xfa, 0xaa, 0xab, 0xd0, 0x47, 0x1c,
+                    0x21, 0x6f, 0x50, 0x3d, 0x91, 0x02, 0x94, 0x69, 0x2d, 0xac, 0x96, 0x58, 0xee,
+                    0xce, 0xa0, 0x43, 0x75, 0xbc, 0xa9, 0xcf, 0x5c, 0x4a, 0xb4, 0xc1, 0x5d, 0xd6,
+                    0x02, 0x48, 0x90, 0x57, 0xc7, 0x8f, 0xca, 0x93, 0x78, 0xb1, 0x8f, 0xa3, 0xb8,
+                    0xe9, 0x74, 0xa3, 0x12, 0x80, 0xaf, 0x40, 0xad, 0xc8, 0x42, 0xbf, 0x59, 0x80,
+                    0xca, 0x56, 0x24, 0x21, 0x79, 0x1c, 0x0b, 0x5f, 0x85, 0x92, 0x83, 0xe3, 0xf6,
+                    0xdb, 0x5a, 0x7d, 0xb0, 0x1d, 0x4f, 0x11, 0x6f, 0x99, 0x86, 0x56, 0x17, 0xfe,
+                    0x23, 0x2e, 0x66, 0xfd, 0xac, 0x3b, 0x8d, 0x85, 0x1a, 0x39, 0x80, 0x02, 0x28,
+                    0x2b, 0xf8, 0x31, 0x85, 0x4f, 0x3c, 0xa3, 0x8b, 0xae, 0x9b, 0x00, 0xfe, 0x78,
+                    0xbc, 0xc0, 0x06, 0x18, 0xba, 0x07, 0x4c, 0x16, 0x3d, 0x50, 0x83, 0xc2, 0x9a,
+                    0xe6, 0x2d, 0x9a, 0xea, 0xaa, 0x0a, 0x18, 0x39, 0x3a, 0xa0, 0xc3, 0x15, 0x7b,
+                    0x9d, 0x55, 0xe5, 0x24, 0x56, 0xb2, 0x52, 0x29, 0x7a, 0x12, 0x6e, 0x2a, 0x45,
+                    0x44, 0x20, 0x33, 0x08, 0xa5, 0x79, 0xdd, 0xce, 0x34, 0x99, 0xfc, 0xf2, 0xb7,
+                    0x84, 0x91, 0x6b, 0x83, 0xb8, 0x79, 0x0b, 0x4a, 0xf6, 0x62, 0xd1, 0x85, 0x45,
+                    0xa0, 0xa0, 0x83, 0x36, 0x6b, 0x12, 0xdf, 0xfd, 0x7d, 0xbf, 0x81, 0x38, 0x67,
+                    0x29, 0x65, 0x8f, 0xee, 0xf7, 0x40, 0x61, 0x13, 0x88, 0x8e, 0x4d, 0x4b, 0xa7,
+                    0x68, 0x16, 0xd2, 0x2d, 0xa5, 0x5a, 0x57, 0x89, 0xf9, 0x5f, 0x11, 0x48, 0x7a,
+                    0xf5, 0x15, 0x1e, 0x24, 0x8e, 0x63, 0x42, 0x92, 0x63, 0x36, 0xb4, 0xe8, 0x3e,
+                    0x54, 0xb7, 0x62, 0x78, 0xbd, 0x5b, 0xdf, 0xbe, 0xaa, 0x9a, 0xd1, 0xf1, 0x94,
+                    0xf7, 0x9b, 0x22, 0x47, 0x24, 0x08, 0x5a, 0xd2, 0x2d, 0xea, 0xac, 0x24, 0x22,
+                    0x65, 0xc8, 0x92, 0xfe, 0xad, 0xe8, 0x8d, 0xcd, 0x8f, 0x8a, 0xc1, 0xa7, 0x14,
+                    0xbd, 0xaa, 0x1e, 0x73, 0xc9, 0x51, 0x41, 0x41, 0x4a, 0x4a, 0x5d, 0xfd, 0x71,
+                    0xb4, 0x1e, 0xa2, 0x0b, 0xd3, 0xec, 0xd7, 0xe4, 0x84, 0x30, 0x7a, 0x07, 0x78,
+                    0xc1, 0xde, 0xac, 0x89, 0xc3, 0x91, 0x53, 0x63, 0x17, 0x3b, 0x8e, 0x61, 0x0b,
+                    0x6b, 0xe1, 0xbc, 0xdf, 0x05, 0x63, 0x07, 0x08, 0x12, 0x3f, 0x83, 0x31, 0xd4,
+                    0xe0, 0x0c, 0xd1, 0x67, 0xd9, 0xaf, 0xb5, 0x40, 0xeb, 0xa1, 0x15, 0x0d, 0x14,
+                    0x13, 0xae, 0x89, 0x65, 0x80, 0x66, 0x7f, 0xf1, 0xe8, 0xa1, 0x7e, 0x3b, 0x22,
+                    0xc3, 0x34, 0xb8, 0xa5, 0xba, 0xd5, 0x1d, 0x27, 0xd0, 0xc4, 0x60, 0x63, 0xf1,
+                    0x1c, 0xbc, 0x2b, 0xc9, 0xb2, 0x24, 0xff, 0x7f, 0x26, 0xcf, 0xbc, 0x06, 0xaf,
+                    0x05, 0x67, 0xd7, 0xaf, 0x4e, 0xe8, 0x00, 0xee, 0xe7, 0xeb, 0xde, 0x99, 0xb5,
+                    0x3e, 0x7a, 0x05, 0xcb, 0x99, 0x35, 0x01, 0xf6, 0x59, 0x87, 0x58, 0x1a, 0x21,
+                    0x37, 0xa5, 0xbb, 0x12, 0xbe, 0xdd, 0xce, 0x9b, 0x53, 0xdf, 0xe9, 0xe5, 0x02,
+                    0x10, 0x51, 0xb7, 0x82, 0x1d, 0xbd, 0x2b, 0x87, 0xf0, 0xd8, 0x7b, 0x2d, 0x88,
+                    0x88, 0x53, 0x43, 0x5e, 0x60, 0x91, 0x8f, 0xfb, 0x1e, 0x74, 0x4e, 0x1b, 0x00,
+                    0xc7, 0x67, 0x51, 0xe6, 0x5b, 0xdc, 0x48, 0x20, 0x58, 0x72, 0x64, 0x4e, 0x8d,
+                    0x57, 0x9c, 0x05, 0xb8, 0x13, 0x85, 0x35, 0x44, 0x45, 0x2d, 0x0d, 0x05, 0x7f,
+                    0x3a, 0x39, 0x3a, 0x1d, 0x0b, 0xe7, 0x4a, 0x13, 0xef, 0x7c, 0x8d, 0x34, 0x2e,
+                    0x70, 0x2f, 0x57, 0xd3, 0x78, 0xa3, 0xe5, 0x45, 0x5d, 0x23, 0x60, 0x80, 0x56,
+                    0xbf, 0x73, 0x5f, 0x5d, 0xa2, 0x3c, 0x65, 0xf7, 0x1a, 0xee, 0x3f, 0x47, 0x13,
+                    0x9f, 0xee, 0x38, 0xd6, 0x0a, 0x9d, 0x34, 0xc3, 0x88, 0x3d, 0x6c, 0xa3, 0x8b,
+                    0xcb, 0x3a, 0xb3, 0x57, 0xaf, 0x4a, 0x57, 0x01, 0x00, 0x00, 0x79, 0x7d, 0x8f,
+                    0x97, 0xbd, 0x69, 0xc6, 0x72, 0x8c, 0x07, 0x0f, 0xcc, 0x83, 0x9c, 0x9d, 0x41,
+                    0x12, 0x21, 0xc3, 0x9a, 0xf0, 0x3d, 0x0e, 0x10, 0x0e, 0xcb, 0xd2, 0xf9, 0x14,
+                    0x1f, 0x0c, 0x76, 0x66, 0x1d, 0x5d, 0x55, 0x84, 0xb0, 0xea, 0x07, 0x32, 0x60,
+                    0x9a, 0x5e, 0x7e, 0x63, 0x6f, 0xe6, 0xd8, 0xb1, 0xf5, 0x42, 0x15, 0xde, 0x5a,
+                    0x5b, 0x16, 0x99, 0x41, 0x8d, 0x6d, 0xb0, 0xe1, 0xeb, 0x47, 0xd5, 0x0d, 0xe7,
+                    0x1a, 0x43, 0xe6, 0x35, 0xc1, 0xad, 0xe5, 0x0d, 0x63, 0xdf, 0x5c, 0xbc, 0x90,
+                    0x3e, 0x94, 0xfb, 0xb2, 0xc0, 0x59, 0x17, 0xff, 0x8c, 0x63, 0xfc, 0xf0, 0xbb,
+                    0x4a, 0xb8, 0x92, 0x0c, 0x21, 0x3a, 0x51, 0xea, 0x74, 0xe3, 0xb1, 0xd3, 0xe5,
+                    0x25, 0x16, 0x32, 0x9d, 0x4b, 0xae, 0x36, 0x39, 0x3a, 0xa6, 0x92, 0xe3, 0x8d,
+                    0x56, 0xef, 0x03, 0x38, 0x1f, 0x4a, 0x69, 0xee, 0x45, 0xdc, 0x87, 0x30, 0xe4,
+                    0x23, 0x69, 0x32, 0x2a, 0x3e, 0xec, 0xb9, 0x15, 0xf8, 0xdb, 0x40, 0x51, 0xaa,
+                    0x4d, 0x5d, 0x72, 0x23, 0x50, 0x99, 0x03, 0xa7, 0x49, 0x72, 0x14, 0x4e, 0xb8,
+                    0xc5, 0xb1, 0x55, 0xc5, 0x35, 0xa4, 0x4f, 0x1e, 0x5b, 0x1e, 0x0e, 0xd4, 0xdc,
+                    0x2c, 0x37, 0x99, 0x06, 0x14, 0xd0, 0xd9, 0x19, 0xf7, 0x48, 0xf6, 0x18, 0xd6,
+                    0xbb, 0x6f, 0x54, 0xf8, 0xfb, 0xb7, 0x2c, 0xf4, 0xcf, 0xb0, 0x10, 0x9a, 0x3b,
+                    0x38, 0xcd, 0x94, 0x2f, 0x4e, 0x74, 0xdc, 0xbe, 0x59, 0x99, 0xfe, 0x46, 0x62,
+                    0x2f, 0x3a, 0xab, 0xa6, 0x22, 0xbd, 0xfc, 0x5e, 0x94, 0x5f, 0x74, 0x22, 0x38,
+                    0xf2, 0xec, 0xc2, 0x6d, 0xe3, 0x6b, 0x00, 0xea, 0xc8, 0x89, 0x8e, 0x2d, 0x41,
+                    0x61, 0x23, 0xc6, 0x93, 0x33, 0x64, 0x3e, 0xca, 0xba, 0xab, 0x5a, 0x1a, 0x4e,
+                    0xd7, 0xd0, 0x88, 0xa8, 0xa3, 0xb9, 0xe0, 0xdc, 0xab, 0xfe, 0x5d, 0x97, 0x64,
+                    0x23, 0x07, 0x16, 0xce, 0x08, 0x60, 0x8b, 0x69, 0x2a, 0x9d, 0xce, 0x22, 0x1d,
+                    0x90, 0x2f, 0x8a, 0x80, 0x75, 0xa0, 0x3e, 0x56, 0xdd, 0x4b, 0x45, 0x42, 0xe4,
+                    0x32, 0x7d, 0x99, 0xc2, 0x52, 0x49, 0x05, 0xe4, 0x66, 0xa2, 0xd7, 0xbb, 0x84,
+                    0xf3, 0xec, 0x75, 0x0b, 0xe9, 0x34, 0xed, 0xb1, 0x11, 0x53, 0xe5, 0x47, 0x17,
+                    0x56, 0xd7, 0x09, 0x39, 0xdb, 0xbb, 0xfa, 0xff, 0x76, 0x49, 0x01, 0x48, 0xe6,
+                    0x9a, 0xdc, 0xfb, 0x0e, 0x38, 0x1d, 0x97, 0xe9, 0xda, 0x17, 0x5d, 0x80, 0x22,
+                    0x1e, 0x34, 0x96, 0x3d, 0xdc, 0x3e, 0xa7, 0x9d, 0xae, 0x78, 0xb0, 0x6b, 0x0d,
+                    0xe4, 0x85, 0x91, 0xb8, 0x2e, 0x4c, 0x43, 0x65, 0xd0, 0x2e, 0x4b, 0x19, 0x47,
+                    0xf0, 0x68, 0x8f, 0x8f, 0xe6, 0x90, 0x6f, 0x37, 0x5a, 0x28, 0xc8, 0xf6, 0xdb,
+                    0xba, 0xe2, 0xe4, 0x66, 0xf6, 0x56, 0x2a, 0x66, 0xcb, 0x21, 0x0b, 0xd7, 0xbd,
+                    0x10, 0xd2, 0x76, 0x44, 0x70, 0xcc, 0x82, 0x71, 0x8f, 0x7e, 0xd0, 0x83, 0x11,
+                    0x87, 0x74, 0xb8, 0x30, 0xe6, 0xdc, 0x8f, 0x4d, 0xc8, 0xb3, 0xc4, 0x83, 0xce,
+                    0x4c, 0xcd, 0xd0, 0xe6, 0x56, 0x33, 0x26, 0x34, 0x5c, 0x13, 0x87, 0x4e, 0x10,
+                    0x35, 0xf9, 0x28, 0x1d, 0x9c, 0x16, 0x47, 0xe6, 0x2e, 0xba, 0x0c, 0x91, 0xe6,
+                    0xb3, 0xb5, 0x98, 0x88, 0x9f, 0x3f, 0x22, 0x32, 0xef, 0xd3, 0xec, 0x86, 0x26,
+                    0x8d, 0xf7, 0xc2, 0x3c, 0x10, 0xc6, 0x29, 0x57, 0x1f, 0x14, 0x6e, 0xe2, 0x49,
+                    0x09, 0xd9, 0xe7, 0x72, 0x81, 0x36, 0x17, 0x09, 0xe0, 0x95, 0x7d, 0xa8, 0xa2,
+                    0x50, 0x76, 0x94, 0xf0, 0x31, 0x7a, 0xb3, 0x58, 0x32, 0xaf, 0xfd, 0xc9, 0x67,
+                    0x20, 0x9f, 0xbb, 0xb1, 0xd4, 0x30, 0x80, 0x0c, 0xf2, 0x66, 0x0d, 0x7b, 0xd4,
+                    0x46, 0x1a, 0xda, 0x11, 0x20, 0xf7, 0x2a, 0xd3, 0x7c, 0xe2, 0xab, 0x5f, 0x51,
+                    0x5d, 0xd2, 0xcd, 0x3c, 0xa5, 0xe4, 0x81, 0xe9, 0x2e, 0x77, 0x93, 0x32, 0xc2,
+                    0x75, 0x02, 0xdf, 0x7a, 0x7d, 0x64, 0x07, 0xcb, 0x07, 0xa8, 0xb6, 0xb3, 0x9a,
+                    0x0c, 0x4c, 0x7c, 0xc8, 0x03, 0x21, 0xc5, 0x5c, 0x97, 0xc4, 0x9e, 0x09, 0x66,
+                    0x1c, 0x40, 0xcb, 0xec, 0xee, 0xa5, 0x44, 0x43, 0xd2, 0x92, 0x7a, 0x05, 0xd0,
+                    0x27, 0x43, 0x0f, 0xde, 0xe3, 0xab, 0x38, 0x5d, 0xc9, 0x46, 0x10, 0x8f, 0x3b,
+                    0x35, 0xeb, 0x4f, 0x05, 0x8f, 0xaa, 0xe1, 0xb1, 0x23, 0xce, 0xaa, 0x9a, 0x21,
+                    0xc1, 0x26, 0xe3, 0xa4, 0x99, 0xdf, 0xf7, 0xb3, 0xb5, 0x6e, 0xd1, 0xf4, 0xfb,
+                    0x04, 0x03, 0xa6, 0xe8, 0x15, 0xf7, 0x65, 0x9f, 0x35, 0x37, 0x8b, 0x25, 0x19,
+                    0xf6, 0x5c, 0x25, 0x22, 0xed, 0x3b, 0xd1, 0x75, 0x46, 0xde, 0x3d, 0xb1, 0xdd,
+                    0x56, 0x2b, 0x76, 0x49, 0x22, 0x08, 0xdc, 0x7d, 0xcc, 0xf2, 0xd0, 0x4e, 0xe8,
+                    0x06, 0x6c, 0xb3, 0xe8, 0x77, 0x59, 0xbb, 0x65, 0xdc, 0x01, 0xd4, 0x3d, 0x11,
+                    0xf2, 0xd7, 0x2b, 0x3f, 0x48, 0x6a, 0x0f, 0x01, 0x84, 0x48, 0x99, 0xdd, 0x59,
+                    0x9a, 0xa7, 0xb4, 0xb8, 0xb0, 0x6c, 0x55, 0xa5, 0x98, 0x5f, 0xe3, 0x0f, 0x76,
+                    0xb5, 0xb1, 0x06, 0x9c, 0x11, 0x31, 0x35, 0xaa, 0xad, 0x87, 0xeb, 0x60, 0x81,
+                    0x64, 0xc7, 0x46, 0xac, 0xa3, 0xa2, 0x00, 0xad, 0xf4, 0xaa, 0x24, 0x38, 0x77,
+                    0x81, 0x51, 0xbd, 0x23, 0x69, 0x0d, 0xbb, 0xff, 0x2a, 0x67, 0xae, 0x1d, 0xbe,
+                    0xc7, 0xd4, 0x0f, 0x82, 0x84, 0xbf, 0x07, 0x95, 0x6c, 0x53, 0xe6, 0xcb, 0x79,
+                    0x51, 0x59, 0x7d, 0xcc, 0x37, 0xb8, 0x9c, 0x73, 0x4b, 0xdf, 0x9a, 0xb4, 0x53,
+                    0x0c, 0x4e, 0x84, 0x01, 0x59, 0x8e, 0x72, 0x3f, 0x35, 0xa0, 0x70, 0xa0, 0x7a,
+                    0x9c, 0x22, 0x10, 0x08, 0x73, 0xe5, 0xd7, 0x4d, 0x39, 0x63, 0x3e, 0x95, 0x1a,
+                    0xd8, 0x5b, 0x5b, 0x98, 0x2d, 0xf4, 0x1e, 0xcd, 0x1b, 0x77, 0xcb, 0xd7, 0xaa,
+                    0xb3, 0x25, 0x00, 0x02, 0xd4, 0x14, 0xc5, 0x05, 0x7b, 0xd1, 0xff, 0x04, 0xff,
+                    0x5d, 0xc7, 0xfe, 0xcc, 0x70, 0x98, 0x5f, 0x84, 0x88, 0x8f, 0xc6, 0x24, 0xc5,
+                    0xf7, 0xff, 0x66, 0x5f, 0xc8, 0x37, 0x88, 0x35, 0xeb, 0xb9, 0x23, 0x5d, 0x53,
+                    0xc2, 0x38, 0x47, 0x64, 0xdd, 0x1d, 0xd4, 0x4f, 0x1c, 0xe8, 0xe7, 0xc7, 0x99,
+                    0xa6, 0x48, 0x5f, 0x6c, 0xca, 0x0d, 0xbe, 0xea, 0xf2, 0x91, 0xd4, 0x96, 0x90,
+                    0x31, 0x14, 0x34, 0x61, 0x48, 0x3d, 0x14, 0x81, 0xe9, 0x21, 0xe8, 0x78, 0x47,
+                    0x6b, 0x5e, 0x87, 0xa4, 0x90, 0xd0, 0x99, 0xf9, 0xe9, 0xd6, 0xa6, 0x9e, 0x01,
+                    0xa5, 0xaa, 0x27, 0x59, 0x33, 0x01, 0x2e, 0x7c, 0x1e, 0x8c, 0x09, 0x05, 0xbd,
+                    0x99, 0xe5, 0x3d, 0x13, 0xce, 0x52, 0xb9, 0xb4, 0x45, 0xd7, 0x0e, 0xb4, 0x5a,
+                    0xf6, 0xb4, 0xa3, 0x90, 0x3a, 0xd4, 0xf8, 0x0f, 0x21, 0x92, 0xa9, 0x6d, 0xff,
+                    0xcb, 0x26, 0x04, 0xf4, 0x60, 0x6a, 0xa2, 0x37, 0xa2, 0x7c, 0x88, 0xd2, 0x8d,
+                    0x03, 0xde, 0xb1, 0xa5, 0xe7, 0xcc, 0xa2, 0x70, 0x7e, 0xa4, 0x56, 0x2e, 0xb5,
+                    0xb7, 0x48, 0x5a, 0x7a, 0x51, 0x5d, 0xbb, 0x8e, 0xea, 0x44, 0xd7, 0xb8, 0xa8,
+                    0x95, 0xfe, 0xad, 0x8e, 0x77, 0x4b, 0xfb, 0xc3, 0x3d, 0xd2, 0xcd, 0x93, 0x6b,
+                    0x78, 0x73, 0xa4, 0x78, 0x6d, 0x7c, 0x8d, 0x02, 0x0c, 0x29, 0x02, 0x3e, 0xf2,
+                    0x30, 0xc7, 0x80, 0xb9, 0x4a, 0x0d, 0x06, 0xe3, 0x83, 0x0b, 0x89, 0x09, 0x58,
+                    0x1d, 0x81, 0xb4, 0x1a, 0x6b, 0x2d, 0x52, 0x97, 0x86, 0x79, 0xcc, 0x62, 0xd4,
+                    0xb3, 0xfc, 0x3b, 0x78, 0xac, 0x7f, 0x5f, 0xdd, 0x42, 0xd1, 0xd6, 0x72, 0xfa,
+                    0xcf, 0x85, 0xc7, 0xe2, 0xb6, 0xce, 0xd2, 0x91, 0x6e, 0x9f, 0x8f, 0xcd, 0x45,
+                    0x45, 0x7a, 0xa8, 0x5c, 0x23, 0x3b, 0x1e, 0x9b, 0x56, 0xf4, 0x0c, 0xd6, 0x36,
+                    0xbd, 0xd0, 0x56, 0x3b, 0x1d, 0x2a, 0x32, 0x3c, 0xb0, 0xd9, 0xa2, 0x16, 0x1a,
+                    0x51, 0xb7, 0x3b, 0xde, 0xf0, 0x83, 0x47, 0x24, 0x00, 0xd5, 0xd8, 0xa2, 0x13,
+                    0x49, 0xf6, 0x2b, 0xd2, 0xac, 0xde, 0x33, 0x4b, 0x15, 0xc3, 0x7d, 0xf9, 0x2e,
+                    0x3e, 0x4f, 0x48, 0x4f, 0x4d, 0x62, 0xea, 0x5b, 0x2c, 0xf7, 0x29, 0x5d, 0x04,
+                    0x35, 0x1d, 0xec, 0xb8, 0x18, 0xf6, 0x8f, 0x77, 0xa6, 0x8a, 0xd1, 0xde, 0x0e,
+                    0x3d, 0x0e, 0x45, 0x18, 0x27, 0x9a, 0xbf, 0xad, 0xd3, 0x9f, 0xc7, 0x5e, 0x64,
+                    0x0f, 0xc7, 0xa5, 0x87, 0x7b, 0x0a, 0x79, 0xc4, 0x27, 0x9f, 0x27, 0x57, 0xf5,
+                    0x80, 0x1d, 0x07, 0x96, 0x55, 0x9b, 0x42, 0xa8, 0x97, 0xea, 0xb1, 0xf1, 0x1c,
+                    0x36, 0x1d, 0x3e, 0xaa, 0xca, 0x24, 0x87, 0x66, 0x83, 0x02, 0x95, 0x53, 0x9a,
+                    0x2a, 0x6d, 0xe8, 0x84, 0x4d, 0xdb, 0x0e, 0x2e, 0x6f, 0x2c, 0xc4, 0x5e, 0x8f,
+                    0x73, 0x76, 0xdc, 0x55, 0x44, 0x90, 0x66, 0x59, 0x04, 0xdb, 0xc5, 0x37, 0x66,
+                    0x66, 0x3a, 0x68, 0xf6, 0xec, 0xad, 0x18, 0xdf, 0xd8, 0x39, 0x2f, 0xb7, 0xae,
+                    0x3c, 0x81, 0x5c, 0x29, 0xf8, 0x56, 0x5c, 0x09, 0xac, 0xc2, 0x8e, 0x30, 0x4b,
+                    0x6e, 0x06, 0xf3, 0xb1, 0x60, 0xe2, 0x4e, 0x66, 0x22, 0x64, 0xa5, 0x00, 0xad,
+                    0xd4, 0x80, 0x2b, 0x26, 0x4b, 0x2e, 0xce, 0xd2, 0x55, 0xd1, 0x01, 0x37, 0xf6,
+                    0x2e, 0x81, 0x10, 0x23, 0xdc, 0xc4, 0x51, 0x60, 0x4d, 0x89, 0x14, 0xd6, 0x07,
+                    0x42, 0x18, 0x30, 0x4a, 0x4d, 0x85, 0x5e, 0xe5, 0xda, 0x1e, 0x0b, 0x42, 0x98,
+                    0x93, 0x98, 0xa7, 0xd4, 0x45, 0x9b, 0xd1, 0x7a, 0xdf, 0xb0, 0xc4, 0x28, 0x7f,
+                    0x77, 0xa9, 0x88, 0x88, 0x92, 0x28, 0x86, 0xe9, 0x18, 0x5b, 0x48, 0x99, 0xef,
+                    0xbb, 0x4f, 0xf5, 0x0d, 0xf4, 0x30, 0xfc, 0x7f, 0x52, 0x06, 0xce, 0x33, 0x8f,
+                    0x68, 0xe9, 0xbe, 0xff, 0xd0, 0x95, 0x46, 0xb4, 0x09, 0x76, 0x7e, 0xb9, 0x91,
+                    0x03, 0xca, 0xa7, 0xf6, 0xc2, 0xa1, 0xc7, 0xde, 0xba, 0xae, 0x9b, 0xbd, 0xf6,
+                    0xb7, 0xce, 0xd1, 0xc7, 0x76, 0x50, 0x3e, 0x98, 0x97, 0x2e, 0x0d, 0x3f, 0xe3,
+                    0x5a, 0x7d, 0x7a, 0x7e, 0x2d, 0x94, 0x63, 0x2d, 0x48, 0x18, 0x69, 0xd8, 0x96,
+                    0x0d, 0x0d, 0xca, 0x7c, 0x95, 0x49, 0x28, 0x31, 0xeb, 0x04, 0x17, 0xf1, 0xbf,
+                    0x75, 0x1f, 0x1a, 0x08, 0xb7, 0xd8, 0x87, 0x57, 0x2e, 0xb3, 0x68, 0x9a, 0xab,
+                    0x66, 0xec, 0x8a, 0x7e, 0x33, 0xdc, 0xac, 0x1c, 0xfe, 0xce, 0xb1, 0xa7, 0xbb,
+                    0xb7, 0x43, 0x28, 0x4e, 0x93, 0x3c, 0xca, 0xc4, 0x35, 0xa4, 0x13, 0xb8, 0x2a,
+                    0x04, 0xc4, 0x78, 0xd8, 0x3a, 0xc7, 0xa7, 0x33, 0x72, 0x64, 0x36, 0x39, 0x9c,
+                    0xf3, 0xe7, 0xca, 0xec, 0xb6, 0xcb, 0x20, 0xec, 0x35, 0xfa, 0xf8, 0x63, 0x4e,
+                    0xd1, 0x67, 0xfe, 0x56, 0x66, 0x25, 0x4b, 0xa0, 0x80, 0xcc, 0x24, 0xb3, 0x35,
+                    0x97, 0x06, 0xca, 0x36, 0x7e, 0x48, 0x0e, 0x73, 0xc6, 0x81, 0xbc, 0xe1, 0x50,
+                    0xb0, 0x6f, 0xa4, 0xaa, 0x36, 0xcb, 0xd4, 0x6a, 0xb7, 0x86, 0xe1, 0x32, 0x3c,
+                    0x7f, 0xaa, 0xd0, 0x9f, 0xeb, 0x94, 0xea, 0x0b, 0xac, 0xf9, 0x46, 0x5b, 0xe0,
+                    0x42, 0xe4, 0xbe, 0x8c, 0xa4, 0xb2, 0x43, 0xf3, 0xf9, 0x47, 0x70, 0xf8, 0x79,
+                    0x22, 0xcc, 0x4e, 0xd5, 0x2a, 0xb7, 0xad, 0x02, 0xd3, 0x14, 0x00, 0xb5, 0x30,
+                    0x33, 0x85, 0x1e, 0x1d, 0x18, 0xbb, 0x30, 0x5f, 0xe1, 0x11, 0x0d, 0x74, 0x1c,
+                    0x68, 0xed, 0x71, 0x12, 0x47, 0x03, 0x70, 0xe2, 0xa8, 0xca, 0xe1, 0xab, 0x17,
+                    0x31, 0x2c, 0x9c, 0x50, 0xfd, 0xea, 0x84, 0x31, 0x4e, 0xe4, 0xf3, 0x04, 0x8d,
+                    0x2b, 0x74, 0xb7, 0xb7, 0x1a, 0xc0, 0xa6, 0xe7, 0xcf, 0x10, 0xe6, 0xe7, 0xa7,
+                    0x0e, 0xda, 0x71, 0x02, 0x8a, 0x09, 0x4b, 0x2d, 0xec, 0x0e, 0x6c, 0x79, 0xd0,
+                    0xc0, 0x51, 0x70, 0xe3, 0x85, 0xb4, 0x0b, 0x41, 0xe9, 0x9d, 0xd9, 0xb0, 0x3e,
+                    0x5f, 0x7d, 0x39, 0x1e, 0x6d, 0x2e, 0x04, 0xf8, 0x9d, 0x37, 0xd2, 0x8c, 0x81,
+                    0x20, 0xb0, 0xc8, 0xf8, 0x9c, 0xf3, 0x89, 0x81, 0xf3, 0xf4, 0xd0, 0x72, 0xc6,
+                    0xfd, 0x1b, 0xe8, 0xe3, 0x34, 0xce, 0x11, 0x1d, 0x7b, 0x47, 0xad, 0x06, 0x56,
+                    0x85, 0x55, 0x01, 0x91, 0xea, 0xd1, 0x2a, 0x24, 0x2f, 0x2d, 0x8d, 0xc5, 0xf7,
+                    0xeb, 0x75, 0x83, 0xd9, 0x04, 0x68, 0x28, 0x8c, 0xab, 0x33, 0x8d, 0x16, 0x27,
+                    0xdc, 0x9a, 0x11, 0x30, 0xf2, 0xd5, 0xd4, 0x17, 0x71, 0x35, 0x08, 0xd5, 0x17,
+                    0x92, 0x3c, 0x2f, 0x13, 0xbc, 0x2c, 0xcd, 0xed, 0x4c, 0xcc, 0xd0, 0xe0, 0x47,
+                    0x10, 0x55, 0x13, 0xa1, 0x26, 0x03, 0x9f, 0x21, 0xb4, 0xd5, 0x45, 0x21, 0x9c,
+                    0x51, 0x7f, 0xc1, 0x43, 0x53, 0x1e, 0xab, 0x9d, 0x80, 0x8d, 0xc0, 0xe7, 0x93,
+                    0x31, 0x5d, 0xe7, 0x84, 0x35, 0xbd, 0x3d, 0xc3, 0x2f, 0xe1, 0xeb, 0x84, 0xca,
+                    0x9f, 0x4d, 0x40, 0xf3, 0x12, 0xa9, 0x96, 0x1b, 0xa0, 0x05, 0x04, 0xe7, 0x1b,
+                    0x96, 0xa0, 0x18, 0x0a, 0x18, 0xed, 0xbf, 0x94, 0x5a, 0x25, 0xe2, 0x00, 0xbb,
+                    0x20, 0x3e, 0x3d, 0x77, 0xc7, 0x46, 0x13, 0x88, 0xba, 0x74, 0x5f, 0x40, 0x96,
+                    0x6a, 0xcc, 0xd5, 0x18, 0xbd, 0xc2, 0x37, 0xd0, 0x89, 0x8f, 0x27, 0x7a, 0x82,
+                    0xf4, 0x82, 0x28, 0x72, 0x2e, 0x25, 0x9c, 0x7b, 0xa3, 0x5b, 0x49, 0xca, 0x05,
+                    0x15, 0x8c, 0x88, 0x41, 0x97, 0x6e, 0x42, 0x1a, 0x5d, 0x90, 0xa9, 0x53, 0x74,
+                    0xad, 0xe4, 0x41, 0x43, 0x2b, 0x7b, 0x79, 0xf5, 0x73, 0x9f, 0xd4, 0x11, 0xe1,
+                    0x2d, 0x00, 0xd7, 0x37, 0x74, 0xe0, 0xbe, 0xc6, 0x12, 0x89, 0xed, 0x44, 0xe2,
+                    0xa9, 0x5a, 0x81, 0x57, 0x5f, 0x55, 0xbf, 0x14, 0xa2, 0x45, 0xce, 0x51, 0x76,
+                    0x35, 0x84, 0xe8, 0xa0, 0x9c, 0x3e, 0x17, 0x07, 0x2b, 0x18, 0xc3, 0x83, 0xb1,
+                    0xed, 0xe6, 0xa7, 0x0e, 0x0a, 0x83, 0x3f, 0x76, 0x3f, 0x84, 0x6f, 0xf2, 0x4c,
+                    0xc2, 0x29, 0xb5, 0x43, 0xed, 0x94, 0xd1, 0x54, 0x73, 0x31, 0x05, 0x68, 0xcf,
+                    0xdf, 0x12, 0xe3, 0xcf, 0x21, 0x5b, 0xa6, 0x00, 0x64, 0xcd, 0xe8, 0xf6, 0xf7,
+                    0x7f, 0x67, 0x38, 0x4a, 0xa0, 0xd8, 0x77, 0x50, 0xcf, 0x02, 0x98, 0x29, 0x42,
+                    0x80, 0x8c, 0x4a, 0x85, 0xa7, 0xf6, 0x57, 0x4f, 0xb7, 0xc3, 0xbe, 0x48, 0xc6,
+                    0x63, 0xef, 0xb9, 0x39, 0xb9, 0x2f, 0x93, 0x70, 0x99, 0x7d, 0xd8, 0x47, 0xf3,
+                    0x07, 0x4b, 0x26, 0x8f, 0xdd, 0x23, 0xd7, 0x7b, 0xa5, 0x93, 0x47, 0x9d, 0x3e,
+                    0xe7, 0x0b, 0x08, 0xfc, 0x58, 0xe8, 0xc7, 0x2c, 0x79, 0x7a, 0x80, 0xdf, 0x33,
+                    0x2d, 0x1c, 0xba, 0x4e, 0xdd, 0x4c, 0x57, 0x0d, 0x0b, 0x9a, 0x17, 0xc9, 0xf8,
+                    0xf6, 0x48, 0x92, 0x80, 0x8f, 0xe2, 0xfe, 0xbb, 0xf0, 0x74, 0xff, 0x8e, 0x58,
+                    0x58, 0xf2, 0x19, 0xf1, 0xe7, 0x42, 0x09, 0x0d, 0x7e, 0x54, 0x27, 0x47, 0x46,
+                    0x22, 0x19, 0x17, 0x99, 0xc7, 0x0c, 0x79, 0xbf, 0x7f, 0x6f, 0x31, 0xf2, 0x84,
+                    0xd3, 0x26, 0xf5, 0x22, 0xb7, 0x4f, 0x50, 0x30, 0x3c, 0x9b, 0x47, 0xe3, 0xf0,
+                    0x0d, 0x99, 0xe9, 0xa2, 0xd5, 0x7a, 0x4f, 0xc2, 0xf7, 0xa2, 0xc0, 0x59, 0xab,
+                    0x71, 0xee, 0xfb, 0x98, 0x77, 0x98, 0xff, 0x5a, 0x06, 0x69, 0xbd, 0x1d, 0xd0,
+                    0xf4, 0xc6, 0x39, 0x19, 0x11, 0xb4, 0xbd, 0xb9, 0xd9, 0x9b, 0x98, 0x6a, 0x9c,
+                    0xc8, 0x33, 0xbc, 0x70, 0x4a, 0x17, 0x06, 0x14, 0x0c, 0xca, 0x60, 0xba, 0xda,
+                    0xc6, 0x0b, 0xae, 0x27, 0x36, 0xb9, 0xfd, 0x22, 0x3f, 0x2f, 0x79, 0x8f, 0x73,
+                    0x6a, 0x65, 0xec, 0xd1, 0xf2, 0x55, 0xfe, 0xc4, 0xc1, 0x6b, 0x72, 0x30, 0x76,
+                    0x15, 0x0c, 0xed, 0xf6, 0xc7, 0x20, 0x01, 0x47, 0xbb, 0x71, 0x1d, 0xe5, 0x0c,
+                    0x60, 0x8c, 0xf4, 0x71, 0x24, 0x22, 0xc5, 0x2c, 0x1d, 0xe4, 0x8c, 0xa1, 0x61,
+                    0x0c, 0x19, 0x20, 0x33, 0x1e, 0x0b, 0x07, 0xed, 0xe8, 0xc8, 0xfa, 0x6e, 0xf1,
+                    0x05, 0xb0, 0x1c, 0xdd, 0xc6, 0x2d, 0x0b, 0x36, 0x06, 0xc2, 0xb0, 0x8f, 0x15,
+                    0x61, 0xb5, 0xbd, 0x29, 0x63, 0x62, 0x1d, 0x5c, 0x6e, 0xf4, 0x9f, 0x02, 0xd1,
+                    0x5e, 0x5e, 0x6c, 0x05, 0xad, 0xf5, 0xc1, 0x17, 0x97, 0x8b, 0x75, 0x4c, 0xb9,
+                    0x82, 0xb9, 0x29, 0xab, 0xfd, 0x1e, 0x02, 0xe9, 0x97, 0xeb, 0x11, 0xcc, 0xfd,
+                    0x13, 0x27, 0xbf, 0x7e, 0x63, 0x4e, 0x7a, 0x55, 0xb9, 0x9a, 0x5e, 0xaa, 0x71,
+                    0xc8, 0x09, 0x13, 0x47, 0xac, 0xe1, 0x2f, 0xde, 0xdb, 0x2f, 0x59, 0x97, 0x37,
+                    0x36, 0x24, 0x71, 0x59, 0xd4, 0xa8, 0x10, 0x96, 0x40, 0x29, 0x16, 0xbc, 0x7e,
+                    0x8a, 0x5d, 0xc0, 0x6d, 0x31, 0x14, 0xf6, 0x8f, 0x8b, 0xa1, 0x7b, 0xad, 0xf3,
+                    0xf2, 0xd3, 0x12, 0x97, 0x78, 0xb0, 0xc9, 0xf5, 0xea, 0x2d, 0xc9, 0xbc, 0x45,
+                    0xfd, 0x1a, 0xd4, 0x7d, 0xdc, 0xe3, 0x71, 0x15, 0x24, 0xe1, 0x6e, 0x57, 0x72,
+                    0x0b, 0xba, 0xa3, 0x5d, 0x6e, 0x16, 0x01, 0xd6, 0xe0, 0xaf, 0xe6, 0x31, 0xd9,
+                    0x79, 0x0c, 0x8c, 0x14, 0x4c, 0x46, 0xa7, 0x88, 0x0b, 0x5b, 0x32, 0x75, 0xb3,
+                    0x58, 0x5c, 0x71, 0x17, 0x6e, 0x93, 0x5f, 0xec, 0x31, 0x14, 0xd3, 0x90, 0xd0,
+                    0x7c, 0x7c, 0x1f, 0xf1, 0x4d, 0xeb, 0x1d, 0x28, 0x5d, 0x53, 0xf5, 0x2e, 0xcc,
+                    0x5c, 0x70, 0xa2, 0x46, 0x86, 0xef, 0x32, 0x82, 0x5c, 0x18, 0x60, 0x65, 0xb9,
+                    0xce, 0xf1, 0x66, 0xae, 0xfb, 0x0c, 0x8e, 0x95, 0x1e, 0x3f, 0x47, 0x6b, 0x8e,
+                    0x4e, 0xae, 0x66, 0xc4, 0x86, 0xee, 0x28, 0x5b, 0x43, 0x9f, 0x7e, 0xe9, 0xc1,
+                    0xc3, 0x4b, 0x3f, 0xa0, 0x50, 0xc0, 0xd0, 0xa9, 0x7b, 0x23, 0xae, 0xb0, 0x3b,
+                    0x6f, 0x10, 0xbb, 0x9a, 0x5d, 0x73, 0x80, 0xde, 0x12, 0xff, 0x3f, 0x72, 0xeb,
+                    0x55, 0x52, 0x56, 0xf3, 0x21, 0xfa, 0x39, 0xad, 0x0c, 0x22, 0x97, 0xce, 0x53,
+                    0x4a, 0xf7, 0xd3, 0xa8, 0x3b, 0xee, 0xca, 0xb9, 0x86, 0xb6, 0xda, 0x8d, 0x0e,
+                    0xc6, 0xad, 0xb8, 0x7b, 0x76, 0x66, 0x56, 0x15, 0x64, 0x0f, 0x7d, 0x17, 0x97,
+                    0x1e, 0x8d, 0xda, 0x9d, 0xff, 0x55, 0x01, 0x5c, 0xc2, 0x2f, 0x50, 0x77, 0x6c,
+                    0x06, 0x00, 0xf9, 0xd1, 0xac, 0x26, 0x3c, 0x15, 0x19, 0xda, 0x36, 0xe2, 0x0b,
+                    0x50, 0x8c, 0xfe, 0x6b, 0x5a, 0x69, 0x57, 0xcb, 0xa2, 0x21, 0xb9, 0x44, 0xc9,
+                    0x19, 0xa4, 0x60, 0x76, 0x84, 0x2b, 0x71, 0x26, 0x62, 0xe4, 0xe2, 0x3e, 0x95,
+                    0xdd, 0x45, 0x2a, 0x5b, 0xae, 0xe7, 0x35, 0x7c, 0x3b, 0x04, 0x1c, 0xb0, 0x87,
+                    0x5b, 0x63, 0xf3, 0x4c, 0x3b, 0xaf, 0x6b, 0xac, 0x50, 0xa7, 0x41, 0x9d, 0x4f,
+                    0xd2, 0x31, 0x23, 0x10, 0x94, 0xd0, 0xa0, 0x5c, 0x80, 0x86, 0x87, 0x92, 0xa9,
+                    0x17, 0xf3, 0xc0, 0x8b, 0x3a, 0x77, 0xea, 0x9b, 0x8b, 0x3a, 0x9e, 0x8a, 0xb0,
+                    0x93, 0x7a, 0x90, 0xfc, 0x5a, 0xa5, 0xca, 0x60, 0x94, 0xa6, 0x3b, 0x37, 0x50,
+                    0x09, 0x8c, 0x00, 0xbc, 0x7e, 0x17, 0x12, 0x26, 0x6c, 0x42, 0xe1, 0x01, 0xda,
+                    0x33, 0xce, 0x56, 0x52, 0x06, 0x3a, 0xe0, 0xf0, 0x82, 0x90, 0xf0, 0x8d, 0x5b,
+                    0xa5, 0x9a, 0xc3, 0x78, 0x55, 0x7a, 0xbe, 0x62, 0x86, 0xe5, 0x66, 0x2b, 0x25,
+                    0x38, 0x72, 0x94, 0xaa, 0xc9, 0xfa, 0xdf, 0x01, 0x12, 0x29, 0xf5, 0x62, 0x78,
+                    0x80, 0x80, 0x1f, 0x19, 0x56, 0xfc, 0x25, 0x44, 0x3b, 0x60, 0xe9, 0x66, 0xa8,
+                    0xd5, 0x02, 0x0c, 0x4a, 0x34, 0xf0, 0xce, 0x80, 0x3e, 0x2d, 0x70, 0xff, 0x7c,
+                    0xc6, 0x10, 0x48, 0x46, 0x06, 0x11, 0x68, 0x17, 0x12, 0x27, 0xd9, 0xb6, 0x2d,
+                    0xbe, 0x07, 0xb3, 0x49, 0xa9, 0x47, 0x3e, 0x5d, 0x27, 0xcf, 0xb6, 0x68, 0xca,
+                    0xb2, 0x37, 0xf7, 0x75, 0x92, 0xd7, 0xc8, 0xb1, 0xe2, 0x23, 0x3c, 0xa5, 0x07,
+                    0xaf, 0xbe, 0xff, 0x9c, 0x7d, 0xb4, 0x58, 0x32, 0x3f, 0x79, 0xa5, 0x07, 0xfe,
+                    0x2f, 0xd1, 0x14, 0x80, 0xbf, 0x54, 0x74, 0x13, 0xf5, 0xf7, 0x2b, 0xb7, 0x21,
+                    0xff, 0x06, 0x8c, 0x49, 0x00, 0x37, 0x9b, 0xc3, 0x60, 0x14, 0x09, 0x0e, 0x19,
+                    0x3a, 0xf1, 0xbc, 0x2e, 0x97, 0x3e, 0x1e, 0xef, 0xe6, 0x6e, 0x99, 0x06, 0xa1,
+                    0xd1, 0xea, 0x94, 0x90, 0x2e, 0xa8, 0x8d, 0xca, 0xcc, 0x37, 0xe9, 0x78, 0x0a,
+                    0xda, 0x82, 0x18, 0x57, 0x4c, 0x1c, 0x28, 0xa6, 0xbb, 0x28, 0x5f, 0x2f, 0x7a,
+                    0xf6, 0x96, 0x60, 0x7a, 0xe6, 0x61, 0x25, 0xcc, 0x70, 0xc0, 0x52, 0x67, 0xf3,
+                    0x81, 0xee, 0xeb, 0xff, 0x1b, 0x6c, 0xe9, 0x31, 0x63, 0xdf, 0xd8, 0xb7, 0x2a,
+                    0xe4, 0x77, 0x5e, 0xd2, 0x52, 0x93, 0x00, 0x00,
+                ],
+                txid: [
+                    0xf2, 0xfb, 0x43, 0xd1, 0xa6, 0xc1, 0x01, 0xa6, 0xda, 0x3c, 0x69, 0xf8, 0x10,
+                    0x7d, 0xc8, 0x65, 0xe0, 0xb6, 0x3d, 0x74, 0xca, 0xda, 0x60, 0xc6, 0xa3, 0x7c,
+                    0x68, 0x6e, 0xb2, 0x4d, 0x57, 0x17,
+                ],
+                auth_digest: [
+                    0xf4, 0xad, 0x80, 0xab, 0xc2, 0x3a, 0x87, 0xf7, 0x09, 0xe7, 0x9e, 0x2f, 0x40,
+                    0xb9, 0xe0, 0x68, 0xec, 0x7e, 0x87, 0x2b, 0x42, 0xfc, 0xba, 0xac, 0xaf, 0x6f,
+                    0xe7, 0x75, 0x33, 0xa7, 0xd4, 0x39,
+                ],
+                amounts: vec![592562446369051, 1540420019883117, 1694211479886907],
+                zip233_amount: 161983926007780,
+                script_pubkeys: vec![
+                    vec![0x51, 0x53, 0x53, 0x51, 0xac],
+                    vec![0xac, 0x53, 0x52, 0x53, 0x52, 0x63],
+                    vec![0x51, 0xac],
+                ],
+                transparent_input: Some(2),
+                sighash_shielded: [
+                    0xd7, 0x82, 0xc1, 0x37, 0x8f, 0x01, 0x57, 0x44, 0xf1, 0x56, 0x60, 0xf1, 0x37,
+                    0xfe, 0xe2, 0x8b, 0xf1, 0x27, 0x7d, 0xb6, 0x02, 0x68, 0x66, 0x74, 0x21, 0xb8,
+                    0x15, 0xbc, 0xeb, 0xcc, 0xc5, 0x93,
+                ],
+                sighash_all: Some([
+                    0xac, 0x7b, 0xd2, 0x68, 0x8c, 0xbd, 0xd1, 0x5d, 0xae, 0xc0, 0x55, 0x61, 0x97,
+                    0xc6, 0xfd, 0x17, 0x61, 0xda, 0xc6, 0x2f, 0x97, 0x02, 0x96, 0x55, 0xac, 0x02,
+                    0x7f, 0x26, 0xa8, 0xea, 0xe6, 0xa8,
+                ]),
+                sighash_none: Some([
+                    0xbd, 0x1c, 0x57, 0x9f, 0x62, 0xad, 0x6b, 0xb0, 0xc5, 0x6c, 0xb5, 0x25, 0x60,
+                    0xfe, 0xe8, 0x7f, 0xe8, 0x3e, 0xa2, 0x36, 0x22, 0xe2, 0xc2, 0xc8, 0x56, 0x32,
+                    0x26, 0x06, 0x85, 0x35, 0xcd, 0x2f,
+                ]),
+                sighash_single: None,
+                sighash_all_anyone: Some([
+                    0x15, 0x4c, 0xed, 0xab, 0xf4, 0xb9, 0x40, 0xcf, 0x8d, 0xd4, 0x45, 0x82, 0x66,
+                    0xbc, 0xbe, 0xe1, 0x21, 0xa8, 0x02, 0x19, 0x11, 0xe9, 0xe4, 0xc5, 0x6d, 0xaa,
+                    0xef, 0xe2, 0x9a, 0x92, 0x66, 0x2b,
+                ]),
+                sighash_none_anyone: Some([
+                    0xa2, 0x07, 0x73, 0x27, 0x47, 0x88, 0x2a, 0xa7, 0x73, 0x3f, 0x4c, 0x0c, 0x13,
+                    0xbd, 0xff, 0x2b, 0x22, 0x79, 0x39, 0xb0, 0x81, 0xaa, 0x89, 0x89, 0xad, 0x8a,
+                    0x62, 0xf9, 0x36, 0x06, 0x99, 0xe2,
+                ]),
+                sighash_single_anyone: None,
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x4d,
+                    0xed, 0x2c, 0xed, 0x73, 0xdc, 0x02, 0x0f, 0x03, 0x8d, 0xce, 0xed, 0xce, 0x3c,
+                    0xd9, 0xa5, 0xaf, 0x55, 0x29, 0x81, 0xdc, 0xb6, 0x24, 0xc9, 0xea, 0x75, 0x59,
+                    0x6a, 0x2d, 0xf7, 0xd0, 0x12, 0xe5, 0x0a, 0xdc, 0x9e, 0xee, 0x81, 0x7f, 0x0d,
+                    0xe4, 0x05, 0x48, 0xf8, 0xb4, 0x01, 0xac, 0x01, 0xdd, 0xaf, 0xbd, 0xa1, 0x5a,
+                    0x3a, 0x93, 0x7a, 0x9b, 0x27, 0x6f, 0xbf, 0x88, 0xfd, 0x19, 0x62, 0x6a, 0x81,
+                    0x6d, 0xd5, 0x94, 0xbf, 0xd1, 0x9b, 0xa9, 0x86, 0xbc, 0x66, 0x4b, 0xaf, 0xcc,
+                    0x02, 0x75, 0x9a, 0x45, 0xd6, 0xa2, 0x9a, 0x8a, 0x03, 0x6a, 0x00, 0x6a, 0xd5,
+                    0xc8, 0x9f, 0x0e, 0xde, 0xb8, 0x11, 0x0f, 0x97, 0xa2, 0x1a, 0x5d, 0xb3, 0x39,
+                    0xc5, 0xc8, 0x52, 0xe9, 0x56, 0x8e, 0x55, 0xd0, 0x43, 0xe8, 0x36, 0x8a, 0x01,
+                    0xfd, 0xb7, 0xa1, 0x5a, 0xcd, 0x66, 0x47, 0x85, 0x7d, 0xb7, 0x9c, 0xcb, 0x34,
+                    0x06, 0x65, 0x6a, 0x63, 0x52, 0x63, 0xac, 0x86, 0x21, 0xd1, 0x1f, 0x02, 0xee,
+                    0xe7, 0x8d, 0xbc, 0x75, 0x52, 0x05, 0x00, 0x03, 0x00, 0x53, 0x65, 0x29, 0xc5,
+                    0xea, 0xbd, 0xf3, 0x5b, 0x06, 0x00, 0x03, 0x65, 0x51, 0x52, 0x02, 0x05, 0xed,
+                    0x41, 0x09, 0x97, 0xd2, 0xdd, 0xd0, 0x9a, 0xe7, 0x67, 0x8b, 0xf3, 0xbe, 0x9d,
+                    0x19, 0xef, 0xf6, 0xc1, 0x80, 0x37, 0xf6, 0x0e, 0x88, 0xc0, 0xd7, 0x30, 0x1f,
+                    0x21, 0x1b, 0x1f, 0x90, 0xca, 0x9b, 0x9e, 0x11, 0xc8, 0xa1, 0x2d, 0x22, 0xd3,
+                    0x36, 0x71, 0x68, 0x03, 0x35, 0x37, 0x4e, 0x87, 0xb2, 0x1d, 0xd7, 0xf9, 0xe0,
+                    0x17, 0x16, 0x89, 0xbe, 0xd2, 0xba, 0x23, 0x2b, 0x96, 0x07, 0x0d, 0x71, 0x59,
+                    0xbb, 0x48, 0xd0, 0x75, 0x68, 0x99, 0x2a, 0x5c, 0x9c, 0x99, 0x2d, 0xee, 0x4e,
+                    0xe0, 0x57, 0x7c, 0xd4, 0xfb, 0x17, 0xe3, 0x09, 0x60, 0xb4, 0x5b, 0x0a, 0xd8,
+                    0x04, 0x8f, 0x2c, 0x1c, 0x97, 0x3a, 0x74, 0x32, 0x40, 0xa1, 0x0a, 0x06, 0x09,
+                    0x82, 0x51, 0x74, 0x5c, 0x91, 0x30, 0x1c, 0xeb, 0xb9, 0xb2, 0xce, 0xb1, 0x3f,
+                    0xb7, 0xbc, 0xa3, 0x9f, 0x5f, 0xfd, 0x36, 0x0f, 0x5c, 0x9b, 0x65, 0x1c, 0xa9,
+                    0xa3, 0x51, 0x80, 0xa4, 0x77, 0xe6, 0x08, 0x41, 0x77, 0xa9, 0x4f, 0x2d, 0x23,
+                    0xb3, 0x6e, 0xe7, 0xc2, 0x81, 0x1c, 0xd1, 0xb9, 0x7d, 0x0d, 0x8d, 0xa4, 0x96,
+                    0x70, 0x21, 0x13, 0x4f, 0x2b, 0xa8, 0x7e, 0xb9, 0x65, 0xe5, 0xb9, 0x7b, 0x1a,
+                    0xd2, 0x45, 0x03, 0x50, 0x36, 0xec, 0x08, 0x5d, 0x20, 0x43, 0xac, 0x07, 0x3d,
+                    0x85, 0x06, 0xaa, 0x0a, 0x54, 0xb1, 0x56, 0x8a, 0x00, 0xf3, 0x4b, 0x38, 0x59,
+                    0xe9, 0xa8, 0x00, 0x00, 0x94, 0xa9, 0xf3, 0x4d, 0xe7, 0x2b, 0x03, 0xd3, 0x42,
+                    0x88, 0xc2, 0xbf, 0xb9, 0x52, 0x76, 0x77, 0xef, 0x10, 0xbd, 0x3c, 0xd4, 0x59,
+                    0x95, 0xa0, 0x34, 0xab, 0x39, 0xd0, 0x87, 0x16, 0x6b, 0x3e, 0xe0, 0x53, 0x6f,
+                    0x78, 0x76, 0xed, 0x6d, 0x9b, 0x9d, 0x45, 0xd0, 0xdf, 0x07, 0xe5, 0x68, 0x25,
+                    0xdd, 0xac, 0xfa, 0x9e, 0x6a, 0x6f, 0xb6, 0x56, 0x19, 0x4e, 0xe9, 0x72, 0xba,
+                    0x4f, 0x95, 0x70, 0x22, 0xad, 0xe8, 0x6b, 0xb1, 0xed, 0xd1, 0x4f, 0xb5, 0x44,
+                    0x6c, 0x9f, 0x0b, 0xfe, 0x4a, 0x04, 0xed, 0x5e, 0xbb, 0x53, 0x18, 0x3e, 0x7c,
+                    0xca, 0x89, 0x3e, 0x23, 0x5e, 0x26, 0x0c, 0xd1, 0x81, 0x6b, 0xee, 0x96, 0x0b,
+                    0xe6, 0xc0, 0x4c, 0x12, 0x1f, 0x41, 0x0c, 0xce, 0x26, 0x0f, 0xd8, 0xe7, 0xac,
+                    0x6d, 0xfb, 0x88, 0xdc, 0x09, 0x7b, 0x53, 0x56, 0xb2, 0xbe, 0x79, 0xf5, 0x70,
+                    0x8d, 0x5c, 0x68, 0xc2, 0xac, 0x65, 0xe4, 0xc6, 0xf3, 0x17, 0x76, 0xfb, 0xcb,
+                    0x55, 0x7c, 0x06, 0xe6, 0x70, 0x55, 0xbe, 0xa9, 0x58, 0xb5, 0x34, 0x39, 0x53,
+                    0x36, 0x2d, 0xa2, 0xb1, 0x96, 0xa0, 0xc7, 0x9f, 0x55, 0xc5, 0x5b, 0xc4, 0xc5,
+                    0x62, 0xe5, 0xc0, 0x7d, 0x02, 0x73, 0xc3, 0xd1, 0x3b, 0xcc, 0x36, 0x92, 0xdb,
+                    0x6b, 0xcc, 0xa7, 0xd7, 0x47, 0x1a, 0x43, 0x01, 0x12, 0x17, 0x43, 0x00, 0x98,
+                    0x13, 0x47, 0xae, 0xb4, 0xc0, 0xa5, 0xde, 0x5f, 0xac, 0x70, 0x7f, 0xef, 0x54,
+                    0x6c, 0x4d, 0xfe, 0x0b, 0x58, 0x07, 0xb7, 0xb1, 0xc6, 0x8f, 0xd0, 0xf2, 0x45,
+                    0xa7, 0xa3, 0xd7, 0x44, 0x6d, 0x22, 0x94, 0xcd, 0x44, 0xea, 0xfc, 0x03, 0x09,
+                    0xe0, 0x72, 0xb0, 0x3b, 0x42, 0x55, 0x92, 0x7a, 0xc9, 0xf9, 0x54, 0x93, 0x8f,
+                    0xa8, 0x25, 0xd7, 0x7f, 0xf5, 0x82, 0xc8, 0x04, 0x97, 0x0f, 0xf2, 0xfe, 0x1c,
+                    0xfe, 0xb7, 0x15, 0xcf, 0x84, 0x9f, 0x42, 0x76, 0x0e, 0xee, 0xa9, 0xd8, 0x4a,
+                    0xfa, 0xaf, 0x76, 0xce, 0x8f, 0xb4, 0x97, 0xd8, 0xd7, 0xff, 0x11, 0x80, 0x13,
+                    0x39, 0x32, 0xf1, 0x3f, 0x74, 0xc9, 0xc5, 0x48, 0xc4, 0x83, 0x30, 0x8e, 0xb3,
+                    0xc1, 0x7b, 0x03, 0x2b, 0xd6, 0xaf, 0xfd, 0xb7, 0x1d, 0x79, 0x0f, 0xde, 0xbb,
+                    0xa9, 0xe6, 0x37, 0xde, 0x51, 0x68, 0x32, 0xf9, 0x61, 0x72, 0x61, 0xb8, 0x3e,
+                    0xfb, 0xa3, 0x7d, 0x33, 0x0b, 0x26, 0xa8, 0x15, 0x28, 0x6b, 0xf2, 0xb9, 0xe5,
+                    0xa5, 0xc2, 0xc9, 0x42, 0x0e, 0x63, 0x83, 0xfb, 0xff, 0x0d, 0xeb, 0x8c, 0x46,
+                    0x43, 0x09, 0x85, 0x03, 0xf6, 0xa1, 0x49, 0xa9, 0x48, 0x9b, 0x1a, 0x1a, 0x6c,
+                    0x86, 0xa2, 0x3f, 0x92, 0x8f, 0xf6, 0x2b, 0x40, 0xbe, 0x82, 0xd3, 0xd3, 0xeb,
+                    0xeb, 0x21, 0xb8, 0xfc, 0x40, 0xf6, 0xdc, 0x1f, 0x53, 0xa1, 0x85, 0x0a, 0x63,
+                    0x88, 0xc0, 0xc0, 0x1a, 0x9b, 0x91, 0x33, 0x2c, 0x07, 0x9d, 0xef, 0x58, 0x25,
+                    0x43, 0x33, 0xf3, 0xfd, 0xf8, 0x47, 0xb0, 0x09, 0x6a, 0xae, 0xb5, 0x0c, 0x7d,
+                    0xe7, 0x29, 0xfe, 0x28, 0x0f, 0x59, 0x1b, 0xaa, 0x3d, 0x60, 0x75, 0x1a, 0x77,
+                    0x15, 0xac, 0xe7, 0x37, 0xea, 0x7a, 0x9e, 0xa0, 0xa7, 0xa7, 0xe7, 0x5b, 0xca,
+                    0x55, 0x43, 0x27, 0x77, 0xef, 0x79, 0xec, 0x52, 0x49, 0x81, 0x5a, 0x16, 0x18,
+                    0x10, 0x9b, 0xd3, 0xbd, 0x3d, 0xf1, 0xc9, 0x72, 0x4d, 0xdb, 0x44, 0x8c, 0xea,
+                    0x9c, 0xfa, 0x09, 0xba, 0x4f, 0xf0, 0x4b, 0x63, 0x59, 0x77, 0x85, 0x41, 0x44,
+                    0x9f, 0x6e, 0x02, 0x0f, 0x4c, 0x1d, 0x94, 0xa9, 0x54, 0x68, 0x6d, 0x78, 0x26,
+                    0xcb, 0x7a, 0xb0, 0x3e, 0x0a, 0x18, 0x2a, 0x72, 0x65, 0xe7, 0x98, 0xbb, 0x3d,
+                    0x4b, 0xe8, 0xd9, 0x01, 0x09, 0x6d, 0x6b, 0x05, 0x64, 0x1d, 0x25, 0x7f, 0xac,
+                    0xc1, 0x2a, 0x96, 0xdd, 0xe5, 0xed, 0xab, 0xb3, 0x1e, 0x8f, 0xbf, 0x45, 0x32,
+                    0x7d, 0x88, 0x00, 0xac, 0xfc, 0x5b, 0xdc, 0x6a, 0xf9, 0xa3, 0x0e, 0x52, 0x85,
+                    0xd9, 0x0a, 0x79, 0x6b, 0x51, 0xa2, 0x08, 0x78, 0xf3, 0xe3, 0x3d, 0x70, 0xfb,
+                    0x3b, 0x00, 0x65, 0x8d, 0x10, 0x0f, 0xae, 0x9e, 0xf2, 0x72, 0x4a, 0xc1, 0xdf,
+                    0x4a, 0x42, 0x16, 0xf8, 0x87, 0xd8, 0x3b, 0x30, 0x73, 0x8c, 0x09, 0x3b, 0x7a,
+                    0x86, 0x05, 0x93, 0x86, 0x5d, 0xb7, 0x9e, 0xaa, 0x08, 0x1f, 0x0a, 0xe4, 0x35,
+                    0xe7, 0xd4, 0x7a, 0xc2, 0x52, 0x07, 0x3c, 0xb5, 0x92, 0x2b, 0x80, 0xb0, 0xdd,
+                    0x01, 0x01, 0xdc, 0x1d, 0xc0, 0x21, 0xe4, 0x01, 0x70, 0x22, 0x76, 0x68, 0x1d,
+                    0x08, 0x98, 0x31, 0x7b, 0x02, 0xd0, 0x49, 0x13, 0x14, 0x9f, 0x07, 0xda, 0x45,
+                    0x13, 0x5b, 0x3b, 0x87, 0x25, 0xb9, 0x04, 0xbd, 0x4b, 0x48, 0xae, 0x70, 0xc3,
+                    0xa6, 0xe5, 0x59, 0x50, 0x90, 0x4e, 0x85, 0x26, 0x23, 0x31, 0x76, 0x84, 0x2b,
+                    0x9d, 0x70, 0x54, 0x6e, 0x9a, 0xab, 0x4c, 0xe8, 0xfb, 0x48, 0xaa, 0xe4, 0xf5,
+                    0x28, 0x25, 0x7e, 0x3f, 0x77, 0x10, 0x71, 0x86, 0xb3, 0x0b, 0x38, 0x87, 0x41,
+                    0x63, 0x24, 0xcb, 0xf5, 0x5d, 0x27, 0xad, 0xaa, 0xc1, 0x2b, 0x50, 0xde, 0x2e,
+                    0x70, 0x32, 0xdb, 0x7a, 0x46, 0x8e, 0x10, 0xdd, 0x0e, 0x31, 0x23, 0x57, 0x8e,
+                    0xd7, 0x5f, 0x5b, 0x8b, 0xb5, 0xf6, 0xcc, 0xfb, 0xe8, 0x97, 0xe7, 0xcd, 0x8b,
+                    0x8a, 0xcd, 0x94, 0x46, 0x35, 0xcc, 0x3e, 0xce, 0x40, 0x67, 0x5f, 0x1e, 0x23,
+                    0x02, 0xab, 0x9a, 0xe3, 0x76, 0x79, 0x27, 0x12, 0x3f, 0x7c, 0xf0, 0xb8, 0x88,
+                    0x24, 0x2d, 0xd6, 0x82, 0x00, 0x8c, 0x32, 0x56, 0x31, 0x3b, 0x8d, 0xbb, 0xb6,
+                    0x39, 0xd4, 0xc6, 0x93, 0x74, 0x39, 0x92, 0xc8, 0xb6, 0x2c, 0x98, 0xc5, 0x3c,
+                    0x8d, 0x43, 0x95, 0x94, 0x6b, 0xb0, 0x67, 0xaf, 0x38, 0xa8, 0x1b, 0xfe, 0x97,
+                    0xf1, 0xe2, 0x71, 0xe0, 0x6a, 0x81, 0x0c, 0x4e, 0xa1, 0x4d, 0x8b, 0x5a, 0xf0,
+                    0x38, 0xb0, 0x0b, 0x50, 0xca, 0x56, 0x2d, 0xbe, 0xf1, 0x23, 0xb8, 0xe2, 0x82,
+                    0x73, 0x60, 0x9a, 0xa1, 0x7a, 0xb3, 0x89, 0x40, 0x17, 0x7c, 0xcc, 0x9c, 0xe8,
+                    0x81, 0x0a, 0x24, 0xc2, 0x39, 0x4e, 0x89, 0x34, 0x12, 0x85, 0x33, 0x6a, 0xfa,
+                    0xc2, 0x46, 0xb7, 0xd9, 0x46, 0x87, 0x90, 0x06, 0x99, 0xdd, 0xd7, 0x56, 0xfa,
+                    0x96, 0x74, 0x79, 0x01, 0xf5, 0x38, 0x14, 0x5e, 0xf3, 0xc6, 0x2d, 0x28, 0xba,
+                    0x1b, 0x43, 0x74, 0x6b, 0x48, 0x16, 0xb3, 0xd9, 0xca, 0xbc, 0x84, 0x4b, 0x98,
+                    0x84, 0xe8, 0x59, 0x17, 0x99, 0x3a, 0x5c, 0x7a, 0xe2, 0xa6, 0x70, 0xd0, 0x86,
+                    0xb1, 0xe8, 0xea, 0x4b, 0xbd, 0xcc, 0xa0, 0x8a, 0xa4, 0x56, 0xe3, 0x5e, 0xba,
+                    0xf2, 0x25, 0xd6, 0x83, 0x9e, 0xe5, 0xaf, 0x88, 0x0b, 0x57, 0xbe, 0x69, 0x67,
+                    0x54, 0xed, 0x1d, 0x09, 0x00, 0x97, 0x38, 0xf3, 0xe9, 0x8b, 0x07, 0xc4, 0x85,
+                    0x5b, 0x9c, 0xcc, 0xda, 0xf7, 0x00, 0xcc, 0xb3, 0x5c, 0x27, 0x01, 0x13, 0xc5,
+                    0x0b, 0x6f, 0xbb, 0xc4, 0x88, 0xc7, 0x6d, 0xf9, 0x67, 0x1a, 0x29, 0x51, 0x99,
+                    0x10, 0xb2, 0xbf, 0x69, 0x97, 0x25, 0x24, 0x65, 0x15, 0xc1, 0x5d, 0x31, 0x72,
+                    0xc4, 0x14, 0x86, 0xea, 0xac, 0x85, 0xa8, 0xb2, 0xd9, 0xf4, 0x2f, 0x59, 0xdb,
+                    0x42, 0xfc, 0x5d, 0xaf, 0x38, 0x00, 0xc2, 0x4d, 0x61, 0xb0, 0x61, 0xa9, 0x10,
+                    0x34, 0x99, 0xa7, 0x25, 0x70, 0xbe, 0x68, 0x56, 0xd2, 0x53, 0xf6, 0xee, 0x48,
+                    0xc3, 0xd3, 0xc9, 0x23, 0x5c, 0x0f, 0xbe, 0x8d, 0x69, 0x3d, 0x07, 0x5b, 0x64,
+                    0x0b, 0x61, 0x48, 0xb1, 0xb4, 0x8b, 0x94, 0x9b, 0x08, 0xbe, 0x60, 0xa4, 0x2a,
+                    0xb0, 0x32, 0x42, 0xc5, 0xad, 0xa7, 0x6e, 0x11, 0x29, 0x51, 0x47, 0x63, 0x45,
+                    0x53, 0xe8, 0xc3, 0x02, 0xd8, 0xe4, 0xa9, 0x80, 0x48, 0x01, 0x44, 0x12, 0xd4,
+                    0x4e, 0x0c, 0x3e, 0xf7, 0x7b, 0x65, 0xb0, 0x3a, 0xe9, 0x82, 0x71, 0x40, 0x52,
+                    0xbc, 0xe8, 0xf0, 0x43, 0xb5, 0xdf, 0xae, 0x86, 0xa0, 0x30, 0x63, 0x58, 0xb4,
+                    0x96, 0xf4, 0x5c, 0xec, 0x2f, 0x1c, 0x7b, 0x68, 0x02, 0x9b, 0x75, 0x35, 0x42,
+                    0x36, 0x33, 0xd6, 0x3a, 0xe5, 0x7f, 0x00, 0xc8, 0x5b, 0xf7, 0x79, 0x0d, 0x3f,
+                    0xe1, 0x58, 0x92, 0x00, 0xfb, 0xb8, 0x31, 0xe8, 0x47, 0xca, 0x51, 0xcb, 0xbf,
+                    0x50, 0x9d, 0xe9, 0xb9, 0xfc, 0xf4, 0xed, 0x99, 0x7d, 0xb6, 0x81, 0x42, 0x20,
+                    0x30, 0x36, 0x07, 0xbf, 0x4a, 0x59, 0xab, 0x5d, 0xd5, 0x95, 0x5c, 0xef, 0x08,
+                    0xb6, 0xc9, 0x02, 0xad, 0x7f, 0x17, 0xfc, 0xf0, 0xc1, 0x96, 0x04, 0xcb, 0x0f,
+                    0xd9, 0x34, 0xe0, 0x57, 0x6e, 0x69, 0xe3, 0x33, 0xd9, 0x17, 0x4e, 0xed, 0x15,
+                    0xb9, 0x10, 0x77, 0xcb, 0x82, 0xb1, 0x66, 0xb9, 0x73, 0xe0, 0xd3, 0x7d, 0xfa,
+                    0xf7, 0xe5, 0x4a, 0xe6, 0x27, 0x11, 0xa5, 0x34, 0xfe, 0x5a, 0x81, 0x9d, 0x59,
+                    0x40, 0x78, 0x90, 0xb4, 0x41, 0x1a, 0x2b, 0x74, 0x65, 0x6a, 0xb6, 0x22, 0x84,
+                    0x65, 0xc4, 0xa5, 0x93, 0x9c, 0x38, 0xc7, 0xe4, 0x49, 0x32, 0xff, 0x97, 0xe8,
+                    0xd5, 0xc7, 0xcb, 0x50, 0xef, 0xe9, 0x11, 0x2f, 0x3c, 0xe1, 0x92, 0x05, 0x60,
+                    0xce, 0x0e, 0x4c, 0x46, 0xa2, 0xbc, 0xff, 0x7e, 0x0c, 0x76, 0xb8, 0xe9, 0x32,
+                    0xe3, 0x84, 0x29, 0x56, 0xe5, 0xb9, 0xcc, 0x93, 0x28, 0x07, 0x95, 0xc3, 0x31,
+                    0xea, 0x77, 0x9e, 0x97, 0x03, 0x02, 0x7a, 0x32, 0x89, 0x14, 0xca, 0xfe, 0x98,
+                    0x21, 0x28, 0x94, 0x4d, 0xbd, 0x54, 0x5f, 0xb4, 0x3c, 0xcd, 0x9b, 0xbe, 0x17,
+                    0x45, 0x16, 0xb1, 0x6a, 0xe6, 0xc4, 0x1b, 0x48, 0xe2, 0x9b, 0xc6, 0x09, 0xec,
+                    0x8d, 0xf3, 0x19, 0xd1, 0x56, 0xda, 0xec, 0xb1, 0x0f, 0xfd, 0xab, 0x6b, 0x53,
+                    0xf5, 0x0d, 0xef, 0x18, 0x05, 0xf0, 0x02, 0x90, 0xc3, 0x37, 0x81, 0x4d, 0x7c,
+                    0xfa, 0x5f, 0xe5, 0x92, 0xa1, 0xf6, 0x10, 0xfb, 0xe1, 0x75, 0x34, 0x82, 0x1b,
+                    0xc2, 0x23, 0xe0, 0x34, 0xbe, 0x3d, 0xcd, 0x57, 0xab, 0x57, 0xe3, 0xda, 0x7a,
+                    0x94, 0xfa, 0xce, 0xc1, 0x23, 0x57, 0x4f, 0x14, 0xf6, 0xb4, 0x8f, 0x33, 0x7b,
+                    0x07, 0xe7, 0xbb, 0xf1, 0x96, 0x68, 0x8c, 0xea, 0xed, 0x24, 0x8c, 0x34, 0xdd,
+                    0xaf, 0x3f, 0xc8, 0xdb, 0x75, 0xf2, 0x40, 0x71, 0x1a, 0x69, 0x82, 0xe1, 0x2d,
+                    0x0d, 0x83, 0xfd, 0xcf, 0x7a, 0x0a, 0x66, 0x8d, 0x42, 0x0d, 0x22, 0xbd, 0xa0,
+                    0xf1, 0xed, 0x6e, 0x63, 0xb6, 0xa5, 0xc2, 0x28, 0x47, 0x94, 0xcd, 0x81, 0x09,
+                    0x9c, 0xca, 0x73, 0x02, 0xeb, 0x31, 0x1e, 0xb6, 0x31, 0xfe, 0x02, 0x00, 0xbd,
+                    0xb5, 0x31, 0x4c, 0x09, 0x54, 0x71, 0x2f, 0x05, 0xef, 0x38, 0x37, 0x2a, 0x98,
+                    0xfb, 0xa6, 0xd7, 0xf2, 0x1b, 0x6f, 0xf5, 0x97, 0x9d, 0x80, 0x1a, 0x41, 0x90,
+                    0xf2, 0xad, 0xef, 0x9e, 0x15, 0xfd, 0x1a, 0x01, 0x40, 0xc9, 0x3e, 0xa1, 0xaf,
+                    0xf3, 0x4a, 0x08, 0x9b, 0x62, 0x83, 0x79, 0xc8, 0x17, 0x70, 0x7b, 0x8b, 0x04,
+                    0xb1, 0x3b, 0x96, 0xaa, 0x8f, 0x24, 0x2c, 0xe1, 0xf0, 0x0f, 0x0c, 0x00, 0x91,
+                    0x04, 0xa3, 0x23, 0xf1, 0x79, 0x6f, 0x2e, 0x45, 0x78, 0x25, 0x6d, 0x7c, 0xca,
+                    0xa4, 0xe9, 0x51, 0x00, 0x37, 0xeb, 0x8b, 0xdc, 0x38, 0x53, 0x9d, 0x00, 0x2f,
+                    0xed, 0xa9, 0x5e, 0x25, 0x98, 0x99, 0x47, 0x37, 0x55, 0xa2, 0xad, 0xf9, 0xd9,
+                    0x65, 0xde, 0x22, 0xa5, 0xd0, 0x78, 0xdb, 0xdb, 0x0d, 0xcf, 0x25, 0xf6, 0xe2,
+                    0x0c, 0x7e, 0x0a, 0xc6, 0x46, 0x08, 0x7b, 0xfe, 0x95, 0xd9, 0xca, 0x1c, 0x55,
+                    0x80, 0x57, 0x33, 0x9b, 0xe3, 0x1e, 0xdf, 0xdf, 0x7e, 0x32, 0xf9, 0x55, 0xcc,
+                    0x74, 0x60, 0xf3, 0xbf, 0x64, 0x0a, 0x19, 0x08, 0x68, 0x87, 0x17, 0xab, 0x43,
+                    0x0c, 0x9b, 0xa0, 0x97, 0xe7, 0x55, 0x4d, 0x26, 0x83, 0xd6, 0xd7, 0x18, 0x7c,
+                    0x88, 0x38, 0x71, 0xb2, 0x22, 0x09, 0xbd, 0x5c, 0x2d, 0xa7, 0x8f, 0x22, 0xfa,
+                    0xd3, 0x1e, 0xc7, 0x7c, 0xee, 0x80, 0x3a, 0xd7, 0xf1, 0x24, 0xda, 0x3f, 0x78,
+                    0xb8, 0x7c, 0xa7, 0xa8, 0xe5, 0x39, 0x84, 0x74, 0xda, 0x58, 0x56, 0xe3, 0x69,
+                    0xb9, 0x92, 0xf3, 0xca, 0x0d, 0x75, 0xa7, 0x6b, 0x65, 0xf8, 0x60, 0xde, 0x7c,
+                    0x2b, 0x40, 0x2d, 0xac, 0x10, 0x4b, 0x2e, 0xed, 0x29, 0x6a, 0xaa, 0xc4, 0x38,
+                    0xc8, 0x02, 0x75, 0x71, 0xcc, 0x3a, 0xf4, 0x3e, 0x2f, 0x59, 0xd0, 0x03, 0x6c,
+                    0x31, 0x12, 0x6e, 0x88, 0x0c, 0x0c, 0xfa, 0xda, 0xa7, 0x15, 0x05, 0x52, 0x47,
+                    0x34, 0x32, 0x6a, 0xc6, 0x93, 0x9f, 0x84, 0x19, 0x82, 0xd5, 0x60, 0x3e, 0x79,
+                    0x58, 0x41, 0x0e, 0xb0, 0x76, 0xc8, 0x04, 0x63, 0x39, 0x63, 0x0b, 0x0d, 0xd2,
+                    0xe8, 0x0f, 0xc4, 0x63, 0x3a, 0x3a, 0xc7, 0x59, 0x25, 0x59, 0x99, 0xe7, 0x93,
+                    0x93, 0xa3, 0xb4, 0x5e, 0xeb, 0x2e, 0x7e, 0xc5, 0x2c, 0x76, 0x62, 0x73, 0x5e,
+                    0xfe, 0x53, 0x2a, 0x69, 0xce, 0xb1, 0xd1, 0xde, 0x8c, 0x49, 0x6d, 0x33, 0x8a,
+                    0x3b, 0x02, 0xbe, 0x23, 0xc4, 0xfe, 0xe9, 0x1f, 0x3b, 0xb5, 0xf4, 0x60, 0x08,
+                    0xe9, 0x4c, 0x22, 0x38, 0xad, 0x4b, 0x66, 0x77, 0xe9, 0x01, 0x42, 0x94, 0x2b,
+                    0x78, 0x8f, 0x03, 0xe4, 0x16, 0x28, 0xe7, 0x25, 0xbd, 0x86, 0xa5, 0xb8, 0xa9,
+                    0x03, 0x50, 0x84, 0xd5, 0x74, 0x2e, 0x86, 0xe7, 0x52, 0xb0, 0x51, 0xab, 0x91,
+                    0xbe, 0xc7, 0x3a, 0x88, 0x8e, 0xb2, 0x8c, 0xd3, 0x32, 0x34, 0xba, 0x32, 0xd4,
+                    0x6b, 0x03, 0xc9, 0x98, 0xea, 0x20, 0x3d, 0x86, 0x75, 0xd3, 0x62, 0x42, 0xfa,
+                    0xea, 0x91, 0x5b, 0x97, 0x88, 0x21, 0x49, 0x8e, 0xaf, 0x5f, 0x9f, 0x72, 0x3c,
+                    0x61, 0x38, 0x63, 0xfa, 0xeb, 0x47, 0x62, 0x8f, 0xc2, 0x5f, 0x89, 0x0e, 0xff,
+                    0x58, 0x84, 0xa8, 0x2e, 0xeb, 0x07, 0xeb, 0xdf, 0xc9, 0x3c, 0x70, 0x7d, 0x65,
+                    0x7e, 0x0c, 0x52, 0x5b, 0x88, 0xf6, 0xe1, 0x7e, 0x05, 0x00,
+                ],
+                txid: [
+                    0x59, 0xfc, 0x4e, 0x55, 0xb1, 0xde, 0x07, 0x52, 0xc8, 0x7c, 0xde, 0x3b, 0x78,
+                    0xc6, 0xb2, 0xfb, 0x49, 0x76, 0xd4, 0x6b, 0xe9, 0x67, 0x59, 0x48, 0xd2, 0xf8,
+                    0x11, 0x5b, 0x02, 0x47, 0x03, 0xa9,
+                ],
+                auth_digest: [
+                    0xe3, 0x08, 0xad, 0x3a, 0xc8, 0x0d, 0xb0, 0x43, 0x17, 0x82, 0x10, 0x9d, 0xa9,
+                    0xf3, 0xe9, 0x03, 0x4a, 0xc1, 0x45, 0x58, 0x7f, 0x1b, 0x8b, 0x32, 0x9c, 0x4b,
+                    0x02, 0xc3, 0xae, 0x1d, 0x7b, 0xea,
+                ],
+                amounts: vec![1681482385057857, 1329715149379892, 1641775598464284],
+                zip233_amount: 1546883852426066,
+                script_pubkeys: vec![
+                    vec![0x51, 0x6a, 0xac, 0xac, 0x51, 0x63],
+                    vec![],
+                    vec![0x53, 0x53, 0x65],
+                ],
+                transparent_input: Some(1),
+                sighash_shielded: [
+                    0xf9, 0xac, 0x27, 0x75, 0x52, 0x7a, 0xdd, 0xee, 0x46, 0xe5, 0x62, 0xf0, 0xbf,
+                    0x1e, 0x46, 0x55, 0xfe, 0x2a, 0xb2, 0x72, 0x0f, 0x69, 0xfa, 0xcc, 0xee, 0x5d,
+                    0x5e, 0xea, 0xc1, 0xce, 0x0d, 0x11,
+                ],
+                sighash_all: Some([
+                    0x8b, 0xeb, 0x43, 0x06, 0xbe, 0x96, 0x10, 0xda, 0x7f, 0x3e, 0x30, 0x12, 0x32,
+                    0x50, 0x54, 0xcc, 0xdf, 0xd7, 0xec, 0x30, 0x10, 0x5e, 0xbd, 0x8a, 0xaf, 0x8e,
+                    0x3e, 0xb4, 0x5d, 0x46, 0x1c, 0x30,
+                ]),
+                sighash_none: Some([
+                    0x50, 0x3a, 0xf0, 0x99, 0xfb, 0x50, 0xc2, 0xe6, 0xc6, 0x15, 0x8a, 0xcd, 0x10,
+                    0xbe, 0x5c, 0xa7, 0x44, 0xe2, 0x9d, 0x59, 0x21, 0x9a, 0xa0, 0x5e, 0x21, 0x6d,
+                    0x8b, 0xb8, 0xf1, 0x8a, 0x33, 0xc2,
+                ]),
+                sighash_single: Some([
+                    0xe1, 0x28, 0xc6, 0x6d, 0x4f, 0x7c, 0x76, 0x04, 0x18, 0x9d, 0xeb, 0x15, 0x70,
+                    0xc0, 0x22, 0x7d, 0xc6, 0x62, 0x23, 0x5c, 0xf8, 0xba, 0x6c, 0x16, 0x0e, 0xa4,
+                    0xfa, 0xee, 0x0c, 0x73, 0xb0, 0x30,
+                ]),
+                sighash_all_anyone: Some([
+                    0x86, 0x33, 0xd1, 0x71, 0xcd, 0x1a, 0xa2, 0x15, 0x74, 0xd7, 0xaa, 0x5a, 0x43,
+                    0x80, 0x20, 0x6a, 0xb1, 0x60, 0x95, 0x7f, 0xd9, 0x47, 0x40, 0xe6, 0xe3, 0x52,
+                    0xfb, 0x65, 0x51, 0x13, 0x29, 0x92,
+                ]),
+                sighash_none_anyone: Some([
+                    0x99, 0x8d, 0xa2, 0x7e, 0x3a, 0xe1, 0xa2, 0x21, 0x59, 0xe8, 0xcf, 0x5b, 0xb4,
+                    0x8d, 0x44, 0x2e, 0xab, 0xfb, 0x5a, 0xde, 0x7f, 0x5c, 0x8b, 0x4c, 0xcc, 0xe0,
+                    0xff, 0xbe, 0xc9, 0x71, 0xfb, 0xde,
+                ]),
+                sighash_single_anyone: Some([
+                    0xfd, 0xa3, 0x08, 0x72, 0xa1, 0xce, 0x90, 0xbe, 0xb9, 0xe6, 0xe0, 0xd2, 0x76,
+                    0xc3, 0x86, 0x63, 0xc1, 0xf8, 0xd2, 0xf9, 0x57, 0x68, 0x95, 0xf6, 0x48, 0x91,
+                    0xd5, 0x5a, 0x54, 0x73, 0x5c, 0xee,
+                ]),
+            },
+            TestVector {
+                tx: vec![
+                    0x06, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc5,
+                    0x18, 0x33, 0xc2, 0xbd, 0xf9, 0x6e, 0x17, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                    0x00, 0xff, 0xff, 0xff, 0xff, 0x06, 0x04, 0xbd, 0xf9, 0x6e, 0x17, 0x00, 0xff,
+                    0xff, 0xff, 0xff, 0x03, 0x00, 0x4c, 0xf0, 0xf0, 0x85, 0x1e, 0x04, 0x00, 0x07,
+                    0x53, 0x51, 0x63, 0x63, 0xac, 0x63, 0xac, 0xab, 0x94, 0xda, 0x86, 0x8f, 0x65,
+                    0x05, 0x00, 0x06, 0x00, 0x52, 0x00, 0x52, 0x53, 0x52, 0x80, 0x86, 0x84, 0x40,
+                    0x8c, 0x1a, 0x03, 0x00, 0x03, 0x6a, 0x65, 0x6a, 0x00, 0x01, 0xbe, 0xba, 0x29,
+                    0xa5, 0xca, 0x86, 0x4c, 0x09, 0x94, 0x07, 0xa7, 0x15, 0x2d, 0xe4, 0xe6, 0x57,
+                    0x50, 0xf9, 0x3f, 0xd5, 0x0b, 0xfe, 0x8f, 0x46, 0x3c, 0x01, 0x29, 0xb4, 0xd7,
+                    0x4f, 0x6a, 0xe3, 0x36, 0x7d, 0xdc, 0xa7, 0x32, 0x04, 0x76, 0xae, 0xf5, 0x8d,
+                    0x8f, 0xaf, 0x80, 0x26, 0xe8, 0xdf, 0x38, 0xe3, 0xa0, 0x54, 0x78, 0xfb, 0x17,
+                    0x07, 0x63, 0x59, 0xc6, 0x4a, 0xd4, 0xe3, 0x60, 0x1b, 0x60, 0x86, 0x04, 0xa8,
+                    0x8f, 0x3a, 0xb3, 0x45, 0xb1, 0xf7, 0x43, 0x88, 0xa6, 0xa3, 0xbc, 0x01, 0x2f,
+                    0x02, 0xa0, 0xd2, 0x35, 0x88, 0x1d, 0x5a, 0x2b, 0xca, 0xeb, 0x8c, 0x6d, 0x64,
+                    0x03, 0x06, 0x3c, 0xa9, 0x50, 0xac, 0x18, 0xec, 0xdd, 0x34, 0xe4, 0x80, 0x88,
+                    0xc3, 0xba, 0xad, 0xbf, 0xb1, 0x7e, 0xf8, 0x43, 0x1b, 0x70, 0x13, 0x65, 0xcf,
+                    0xb9, 0x3f, 0xb3, 0x12, 0xff, 0xcf, 0xd9, 0xaa, 0x40, 0x33, 0x1d, 0x51, 0xa1,
+                    0xe2, 0xca, 0x36, 0x9b, 0x71, 0xcb, 0x87, 0x95, 0x0d, 0x5d, 0xa0, 0x50, 0xaa,
+                    0x36, 0x01, 0x76, 0x31, 0xbc, 0x6f, 0xda, 0x86, 0xe6, 0x50, 0xbd, 0x36, 0x69,
+                    0x78, 0x6f, 0x9c, 0x71, 0xf0, 0x04, 0x15, 0xd0, 0xfa, 0x64, 0xd3, 0x4b, 0x9b,
+                    0xad, 0x9a, 0xa2, 0xce, 0xf8, 0x00, 0xe2, 0x25, 0x35, 0x4f, 0xb8, 0xb9, 0xf1,
+                    0x91, 0x02, 0x63, 0x01, 0x10, 0xca, 0xf8, 0x81, 0xaa, 0x42, 0x35, 0xe9, 0x0d,
+                    0xd1, 0x84, 0x06, 0x02, 0x08, 0xa2, 0x83, 0xec, 0x0d, 0x17, 0xae, 0xdf, 0x4e,
+                    0xb3, 0x4b, 0xe3, 0xa1, 0x3a, 0x23, 0x95, 0x98, 0xb7, 0x26, 0x4c, 0x87, 0x06,
+                    0x92, 0x50, 0x65, 0x60, 0x7b, 0xcf, 0xe9, 0xf9, 0x9e, 0xd3, 0xc0, 0xd9, 0xad,
+                    0xed, 0x59, 0x40, 0x08, 0x6f, 0xde, 0xc7, 0x0b, 0xab, 0xba, 0x27, 0x2a, 0x2f,
+                    0x51, 0x9d, 0xe7, 0x1a, 0x01, 0xc0, 0xbe, 0x36, 0x1e, 0x4b, 0xa5, 0x68, 0xca,
+                    0x01, 0x8f, 0xe4, 0x0d, 0x6e, 0x57, 0xc2, 0xd4, 0x26, 0xd5, 0xd3, 0x2a, 0x4b,
+                    0xb8, 0xc4, 0x1a, 0x60, 0x19, 0xbd, 0xf3, 0x35, 0x51, 0x30, 0xf1, 0x78, 0x16,
+                    0x91, 0xa8, 0xfc, 0xc1, 0xf6, 0xef, 0xaa, 0x9a, 0xaa, 0x69, 0x80, 0xba, 0xf8,
+                    0x31, 0x60, 0x17, 0xc0, 0x48, 0xa8, 0x83, 0x2c, 0xbc, 0x4f, 0xa3, 0x1a, 0x3d,
+                    0xf4, 0xe1, 0x1d, 0xa7, 0x59, 0x96, 0x2a, 0x4f, 0x9a, 0xdf, 0x65, 0xf4, 0x04,
+                    0x8b, 0xf6, 0xac, 0x73, 0x21, 0x16, 0x27, 0x58, 0x8f, 0x7a, 0xcd, 0xf3, 0x39,
+                    0xe4, 0x51, 0xf1, 0x9e, 0xca, 0x44, 0xdd, 0x55, 0x9d, 0xe4, 0x08, 0x07, 0xc9,
+                    0x16, 0xb3, 0xc6, 0x2c, 0x55, 0x8f, 0x06, 0xa8, 0x11, 0x76, 0x8c, 0x14, 0xc2,
+                    0xcf, 0xaa, 0xbd, 0x1a, 0x10, 0xb6, 0x33, 0x05, 0xa6, 0x8c, 0x96, 0x81, 0xbf,
+                    0x0e, 0x14, 0x4d, 0x32, 0x04, 0x84, 0x56, 0xf4, 0xdf, 0x5f, 0x7f, 0x2c, 0xb3,
+                    0xd5, 0xa0, 0x52, 0x7e, 0x1f, 0x91, 0x5f, 0xdd, 0xa4, 0x99, 0x52, 0xf7, 0x93,
+                    0x8f, 0x08, 0xc0, 0xd4, 0x81, 0x85, 0x99, 0xbd, 0xe6, 0x30, 0x3a, 0x2a, 0xd7,
+                    0xc5, 0xc1, 0x78, 0xe3, 0x1a, 0xb3, 0x09, 0x5e, 0x24, 0x5b, 0x80, 0x41, 0xb3,
+                    0x92, 0xfa, 0xe0, 0x37, 0xea, 0xa4, 0xae, 0x19, 0x09, 0x2c, 0xa7, 0xce, 0x82,
+                    0x49, 0xbe, 0x71, 0x9b, 0x52, 0xbd, 0xfd, 0xa7, 0x41, 0xf0, 0x74, 0xe0, 0x84,
+                    0xff, 0xa8, 0x6c, 0x15, 0xa3, 0xe5, 0xbe, 0x33, 0x92, 0x50, 0xf9, 0xca, 0x6b,
+                    0x7e, 0xc1, 0x6e, 0x66, 0x27, 0xb5, 0x74, 0x18, 0x90, 0x62, 0x07, 0xd5, 0xf8,
+                    0x42, 0x9d, 0x79, 0xe5, 0x38, 0x3d, 0x1b, 0x34, 0xc3, 0xa2, 0x79, 0xbf, 0x90,
+                    0x1b, 0x07, 0x45, 0xd0, 0x3b, 0x75, 0xd4, 0x61, 0xda, 0x61, 0x98, 0x0b, 0x88,
+                    0xdd, 0x1d, 0x04, 0xba, 0x89, 0xa6, 0x26, 0xcb, 0x21, 0x51, 0x92, 0x03, 0x30,
+                    0x2d, 0xf6, 0x02, 0x0e, 0x91, 0x38, 0xd3, 0x47, 0xbd, 0x12, 0x11, 0xbd, 0xce,
+                    0xac, 0x7d, 0x28, 0xc8, 0xa9, 0x6c, 0x58, 0x54, 0x06, 0xd4, 0xdc, 0xdf, 0x92,
+                    0x3f, 0x1a, 0x30, 0x79, 0xe5, 0x98, 0xcd, 0xae, 0x47, 0x7f, 0xa7, 0x98, 0x83,
+                    0xe9, 0x30, 0xc8, 0x93, 0x11, 0xe5, 0xbe, 0xe4, 0x76, 0x3c, 0xc8, 0xe5, 0x6b,
+                    0xab, 0xd3, 0x7f, 0xf4, 0x44, 0x92, 0x23, 0x8c, 0x60, 0xa9, 0x97, 0x8e, 0x2c,
+                    0x65, 0xbe, 0x11, 0x3b, 0xea, 0x2d, 0xfe, 0x80, 0x51, 0xe6, 0x21, 0x5b, 0xf4,
+                    0xdc, 0x89, 0xf9, 0x6c, 0x5a, 0xd1, 0x4b, 0xdc, 0x39, 0x3c, 0x65, 0x98, 0xe6,
+                    0xf6, 0xe1, 0x57, 0x43, 0x14, 0x33, 0x93, 0x75, 0x8d, 0xf3, 0x35, 0xc6, 0x92,
+                    0x13, 0x5d, 0xaa, 0xf4, 0xa2, 0xd0, 0xac, 0x5f, 0x23, 0xbb, 0xcc, 0x17, 0x5e,
+                    0xf5, 0xce, 0x7a, 0x3b, 0x62, 0xc9, 0x3e, 0x37, 0xa9, 0x77, 0x41, 0xa8, 0xc5,
+                    0xfd, 0xf8, 0x34, 0x50, 0x9e, 0xc5, 0xd2, 0x9d, 0x02, 0x5b, 0xfa, 0x8b, 0x5e,
+                    0x95, 0x32, 0xb7, 0x5d, 0xb3, 0x2a, 0x6a, 0xe7, 0xda, 0xce, 0x87, 0x67, 0x0d,
+                    0x84, 0xfa, 0xab, 0xdf, 0xee, 0x7d, 0x62, 0xf1, 0x19, 0xd2, 0xfc, 0x42, 0xc9,
+                    0xd4, 0x5c, 0x80, 0x70, 0x16, 0x18, 0x6e, 0xdb, 0xfa, 0xb9, 0x34, 0xf2, 0x54,
+                    0x56, 0x6b, 0xf6, 0x50, 0xd4, 0x77, 0x62, 0x11, 0xf4, 0xac, 0x2f, 0x6e, 0x06,
+                    0x0e, 0xd2, 0xba, 0xbf, 0x36, 0x79, 0xde, 0xbf, 0xd4, 0x00, 0x31, 0xe4, 0x3e,
+                    0xca, 0xfe, 0x1b, 0xbd, 0xd6, 0x7f, 0x15, 0xe7, 0xe4, 0x04, 0xfb, 0xfe, 0xad,
+                    0x74, 0x4f, 0xf1, 0x27, 0xa3, 0xde, 0xfe, 0x0d, 0x1c, 0xb4, 0x02, 0xe4, 0x4c,
+                    0x6a, 0x0e, 0x08, 0xc0, 0x6d, 0x05, 0x00, 0x17, 0x45, 0x94, 0xbf, 0xc3, 0xec,
+                    0xaf, 0x0b, 0x99, 0x7f, 0xf1, 0xbb, 0x0d, 0x3e, 0x0d, 0x5a, 0x68, 0x8d, 0x70,
+                    0xe4, 0x64, 0xd0, 0x55, 0xad, 0x82, 0x0f, 0x4c, 0x75, 0x6b, 0xbe, 0x08, 0x3e,
+                    0x83, 0x85, 0x40, 0xd5, 0xdf, 0x91, 0x9c, 0xba, 0xee, 0x1b, 0xd2, 0xe6, 0xa7,
+                    0xa1, 0xad, 0x83, 0x59, 0xf5, 0x27, 0x21, 0x8c, 0xf4, 0x8a, 0xff, 0x5c, 0xdd,
+                    0xe7, 0xf5, 0x7f, 0xa7, 0x15, 0x03, 0x3e, 0x92, 0xff, 0xcf, 0xc9, 0x33, 0x58,
+                    0xd2, 0xe1, 0x57, 0xad, 0x87, 0xe6, 0xd6, 0x73, 0xc5, 0x8e, 0x38, 0x1c, 0xdc,
+                    0x3b, 0x64, 0x51, 0xc7, 0xb6, 0x07, 0x06, 0x7f, 0xb3, 0x97, 0xcf, 0xad, 0x6a,
+                    0x3f, 0x2b, 0xe5, 0x54, 0x96, 0x14, 0x7e, 0xd9, 0xa1, 0x35, 0x8f, 0xaa, 0x99,
+                    0x2d, 0x0c, 0xac, 0xc6, 0x6d, 0x26, 0xd8, 0xbd, 0xd6, 0xfb, 0x4b, 0x68, 0x71,
+                    0x9b, 0x7d, 0x62, 0xc2, 0xf1, 0x88, 0xca, 0x0f, 0x49, 0x06, 0x96, 0x29, 0xc6,
+                    0x94, 0x29, 0xc3, 0x23, 0x61, 0x3c, 0x24, 0xe9, 0x89, 0x0c, 0x35, 0x74, 0x79,
+                    0x7e, 0x6a, 0x44, 0x71, 0xf8, 0x13, 0xa5, 0xf9, 0x98, 0x21, 0x8d, 0x73, 0x62,
+                    0x1f, 0x56, 0x55, 0x9b, 0xf5, 0x51, 0x02, 0x8f, 0x99, 0xfd, 0xb9, 0x78, 0xfd,
+                    0xa1, 0x90, 0x46, 0x63, 0x60, 0x70, 0x63, 0x72, 0x39, 0x7e, 0xc7, 0xc0, 0x83,
+                    0x3a, 0x4e, 0x57, 0x4c, 0xfc, 0x00, 0x51, 0xdc, 0x0e, 0x4f, 0xb3, 0x12, 0x7b,
+                    0x19, 0x68, 0xb0, 0x74, 0xb7, 0xcf, 0x00, 0xe8, 0x22, 0x80, 0x13, 0xa2, 0xb9,
+                    0x85, 0x70, 0x75, 0xcc, 0xc0, 0x23, 0x62, 0xef, 0xf0, 0x54, 0x67, 0x7b, 0x16,
+                    0x19, 0x8b, 0x2e, 0x04, 0xb5, 0x55, 0xec, 0x51, 0xc8, 0x50, 0xe4, 0x00, 0x83,
+                    0x2c, 0x2f, 0x8d, 0xbb, 0x02, 0x50, 0x73, 0x40, 0x65, 0x25, 0xbc, 0x7a, 0x3f,
+                    0x62, 0x7b, 0x08, 0x00, 0x4a, 0xbb, 0x39, 0xd3, 0x88, 0x0c, 0x03, 0x00,
+                ],
+                txid: [
+                    0x9d, 0xf3, 0xcf, 0xed, 0x9b, 0x4c, 0x24, 0x46, 0xbf, 0x83, 0x2e, 0xbc, 0x4d,
+                    0xe7, 0xd2, 0x80, 0x99, 0x48, 0xde, 0x76, 0x9b, 0x9c, 0xd7, 0xbe, 0x11, 0x8c,
+                    0xe0, 0xfc, 0xef, 0x06, 0xa0, 0xdc,
+                ],
+                auth_digest: [
+                    0xde, 0x86, 0xe0, 0x86, 0x2c, 0x1e, 0x61, 0x02, 0x57, 0xe7, 0x80, 0x96, 0x13,
+                    0x6c, 0x4d, 0x4b, 0xb1, 0x79, 0xc5, 0xdc, 0xca, 0x8d, 0x00, 0x72, 0x29, 0xe7,
+                    0x89, 0xf4, 0xac, 0x61, 0x1a, 0x79,
+                ],
+                amounts: vec![],
+                zip233_amount: 858206728993610,
+                script_pubkeys: vec![],
+                transparent_input: None,
+                sighash_shielded: [
+                    0x9d, 0xf3, 0xcf, 0xed, 0x9b, 0x4c, 0x24, 0x46, 0xbf, 0x83, 0x2e, 0xbc, 0x4d,
+                    0xe7, 0xd2, 0x80, 0x99, 0x48, 0xde, 0x76, 0x9b, 0x9c, 0xd7, 0xbe, 0x11, 0x8c,
+                    0xe0, 0xfc, 0xef, 0x06, 0xa0, 0xdc,
+                ],
+                sighash_all: None,
+                sighash_none: None,
+                sighash_single: None,
+                sighash_all_anyone: None,
+                sighash_none_anyone: None,
+                sighash_single_anyone: None,
+            },
+        ]
+    }
+}
diff --git a/zcash_primitives/src/transaction/txid.rs b/zcash_primitives/src/transaction/txid.rs
index c58e22ea21..fd92d6401b 100644
--- a/zcash_primitives/src/transaction/txid.rs
+++ b/zcash_primitives/src/transaction/txid.rs
@@ -7,18 +7,25 @@ use byteorder::{LittleEndian, WriteBytesExt};
 use ff::PrimeField;
 use orchard::bundle::{self as orchard};
 
-use crate::consensus::{BlockHeight, BranchId};
+use crate::{
+    consensus::{BlockHeight, BranchId},
+    sapling::{
+        self,
+        bundle::{OutputDescription, SpendDescription},
+    },
+};
 
 use super::{
     components::{
         amount::Amount,
-        sapling::{self, OutputDescription, SpendDescription},
         transparent::{self, TxIn, TxOut},
     },
     Authorization, Authorized, TransactionDigest, TransparentDigests, TxDigests, TxId, TxVersion,
 };
 
-#[cfg(feature = "zfuture")]
+use super::components::amount::NonNegativeAmount;
+
+#[cfg(zcash_unstable = "tze")]
 use super::{
     components::tze::{self, TzeIn, TzeOut},
     TzeDigests,
@@ -31,7 +38,7 @@ const ZCASH_TX_PERSONALIZATION_PREFIX: &[u8; 12] = b"ZcashTxHash_";
 const ZCASH_HEADERS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdHeadersHash";
 pub(crate) const ZCASH_TRANSPARENT_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdTranspaHash";
 const ZCASH_SAPLING_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdSaplingHash";
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 const ZCASH_TZE_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdTZE____Hash";
 
 // TxId transparent level 2 node personalization
@@ -40,9 +47,9 @@ const ZCASH_SEQUENCE_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdSequencHash";
 const ZCASH_OUTPUTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdOutputsHash";
 
 // TxId tze level 2 node personalization
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 const ZCASH_TZE_INPUTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdTZEIns_Hash";
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 const ZCASH_TZE_OUTPUTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxIdTZEOutsHash";
 
 // TxId sapling level 2 node personalization
@@ -58,7 +65,7 @@ const ZCASH_SAPLING_OUTPUTS_NONCOMPACT_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxId
 const ZCASH_AUTH_PERSONALIZATION_PREFIX: &[u8; 12] = b"ZTxAuthHash_";
 const ZCASH_TRANSPARENT_SCRIPTS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxAuthTransHash";
 const ZCASH_SAPLING_SIGS_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxAuthSapliHash";
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 const ZCASH_TZE_WITNESSES_HASH_PERSONALIZATION: &[u8; 16] = b"ZTxAuthTZE__Hash";
 
 fn hasher(personal: &[u8; 16]) -> State {
@@ -107,7 +114,7 @@ pub(crate) fn transparent_outputs_hash<T: Borrow<TxOut>>(vout: &[T]) -> Blake2bH
 /// witness data, to a hash personalized by ZCASH_TZE_INPUTS_HASH_PERSONALIZATION.
 /// In the case that no inputs are provided, this produces a default
 /// hash from just the personalization string.
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 pub(crate) fn hash_tze_inputs<A>(tze_inputs: &[TzeIn<A>]) -> Blake2bHash {
     let mut h = hasher(ZCASH_TZE_INPUTS_HASH_PERSONALIZATION);
     for tzein in tze_inputs {
@@ -120,7 +127,7 @@ pub(crate) fn hash_tze_inputs<A>(tze_inputs: &[TzeIn<A>]) -> Blake2bHash {
 /// to a hash personalized by ZCASH_TZE_OUTPUTS_HASH_PERSONALIZATION.
 /// In the case that no outputs are provided, this produces a default
 /// hash from just the personalization string.
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 pub(crate) fn hash_tze_outputs(tze_outputs: &[TzeOut]) -> Blake2bHash {
     let mut h = hasher(ZCASH_TZE_OUTPUTS_HASH_PERSONALIZATION);
     for tzeout in tze_outputs {
@@ -136,7 +143,7 @@ pub(crate) fn hash_tze_outputs(tze_outputs: &[TzeOut]) -> Blake2bHash {
 /// * \[(cv, anchor, rk, zkproof)*\] - personalized with ZCASH_SAPLING_SPENDS_NONCOMPACT_HASH_PERSONALIZATION
 ///
 /// Then, hash these together personalized by ZCASH_SAPLING_SPENDS_HASH_PERSONALIZATION
-pub(crate) fn hash_sapling_spends<A: sapling::Authorization>(
+pub(crate) fn hash_sapling_spends<A: sapling::bundle::Authorization>(
     shielded_spends: &[SpendDescription<A>],
 ) -> Blake2bHash {
     let mut h = hasher(ZCASH_SAPLING_SPENDS_HASH_PERSONALIZATION);
@@ -149,7 +156,7 @@ pub(crate) fn hash_sapling_spends<A: sapling::Authorization>(
 
             nh.write_all(&s_spend.cv().to_bytes()).unwrap();
             nh.write_all(&s_spend.anchor().to_repr()).unwrap();
-            s_spend.rk().write(&mut nh).unwrap();
+            nh.write_all(&<[u8; 32]>::from(*s_spend.rk())).unwrap();
         }
 
         let compact_digest = ch.finalize();
@@ -205,7 +212,7 @@ fn transparent_digests<A: transparent::Authorization>(
     }
 }
 
-#[cfg(feature = "zfuture")]
+#[cfg(zcash_unstable = "tze")]
 fn tze_digests<A: tze::Authorization>(bundle: &tze::Bundle<A>) -> TzeDigests<Blake2bHash> {
     // The txid commits to the hash for all outputs.
     TzeDigests {
@@ -222,6 +229,7 @@ fn hash_header_txid_data(
     consensus_branch_id: BranchId,
     lock_time: u32,
     expiry_height: BlockHeight,
+    zip233_amount: Option<&NonNegativeAmount>,
 ) -> Blake2bHash {
     let mut h = hasher(ZCASH_HEADERS_HASH_PERSONALIZATION);
 
@@ -233,6 +241,10 @@ fn hash_header_txid_data(
     h.write_u32::<LittleEndian>(lock_time).unwrap();
     h.write_u32::<LittleEndian>(expiry_height.into()).unwrap();
 
+    if let Some(&zip233_amount) = zip233_amount {
+        h.write_u64::<LittleEndian>(zip233_amount.into()).unwrap();
+    }
+
     h.finalize()
 }
 
@@ -250,7 +262,9 @@ pub(crate) fn hash_transparent_txid_data(
 }
 
 /// Implements [ZIP 244 section T.3](https://zips.z.cash/zip-0244#t-3-sapling-digest)
-fn hash_sapling_txid_data<A: sapling::Authorization>(bundle: &sapling::Bundle<A>) -> Blake2bHash {
+fn hash_sapling_txid_data<A: sapling::bundle::Authorization>(
+    bundle: &sapling::Bundle<A, Amount>,
+) -> Blake2bHash {
     let mut h = hasher(ZCASH_SAPLING_HASH_PERSONALIZATION);
     if !(bundle.shielded_spends().is_empty() && bundle.shielded_outputs().is_empty()) {
         h.write_all(hash_sapling_spends(bundle.shielded_spends()).as_bytes())
@@ -269,15 +283,13 @@ fn hash_sapling_txid_empty() -> Blake2bHash {
     hasher(ZCASH_SAPLING_HASH_PERSONALIZATION).finalize()
 }
 
-#[cfg(feature = "zfuture")]
-fn hash_tze_txid_data(tze_digests: Option<&TzeDigests<Blake2bHash>>) -> Blake2bHash {
+#[cfg(zcash_unstable = "tze")]
+fn hash_tze_txid_data(tze_digests: &TzeDigests<Blake2bHash>) -> Blake2bHash {
     let mut h = hasher(ZCASH_TZE_HASH_PERSONALIZATION);
-    if let Some(d) = tze_digests {
-        h.write_all(d.inputs_digest.as_bytes()).unwrap();
-        h.write_all(d.outputs_digest.as_bytes()).unwrap();
-        if let Some(s) = d.per_input_digest {
-            h.write_all(s.as_bytes()).unwrap();
-        }
+    h.write_all(tze_digests.inputs_digest.as_bytes()).unwrap();
+    h.write_all(tze_digests.outputs_digest.as_bytes()).unwrap();
+    if let Some(s) = tze_digests.per_input_digest {
+        h.write_all(s.as_bytes()).unwrap();
     }
     h.finalize()
 }
@@ -297,7 +309,7 @@ impl<A: Authorization> TransactionDigest<A> for TxIdDigester {
     type SaplingDigest = Option<Blake2bHash>;
     type OrchardDigest = Option<Blake2bHash>;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeDigest = Option<TzeDigests<Blake2bHash>>;
 
     type Digest = TxDigests<Blake2bHash>;
@@ -308,8 +320,15 @@ impl<A: Authorization> TransactionDigest<A> for TxIdDigester {
         consensus_branch_id: BranchId,
         lock_time: u32,
         expiry_height: BlockHeight,
+        zip233_amount: Option<&NonNegativeAmount>,
     ) -> Self::HeaderDigest {
-        hash_header_txid_data(version, consensus_branch_id, lock_time, expiry_height)
+        hash_header_txid_data(
+            version,
+            consensus_branch_id,
+            lock_time,
+            expiry_height,
+            zip233_amount,
+        )
     }
 
     fn digest_transparent(
@@ -321,7 +340,7 @@ impl<A: Authorization> TransactionDigest<A> for TxIdDigester {
 
     fn digest_sapling(
         &self,
-        sapling_bundle: Option<&sapling::Bundle<A::SaplingAuth>>,
+        sapling_bundle: Option<&sapling::Bundle<A::SaplingAuth, Amount>>,
     ) -> Self::SaplingDigest {
         sapling_bundle.map(hash_sapling_txid_data)
     }
@@ -333,7 +352,7 @@ impl<A: Authorization> TransactionDigest<A> for TxIdDigester {
         orchard_bundle.map(|b| b.commitment().0)
     }
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     fn digest_tze(&self, tze_bundle: Option<&tze::Bundle<A::TzeAuth>>) -> Self::TzeDigest {
         tze_bundle.map(tze_digests)
     }
@@ -344,14 +363,14 @@ impl<A: Authorization> TransactionDigest<A> for TxIdDigester {
         transparent_digests: Self::TransparentDigest,
         sapling_digest: Self::SaplingDigest,
         orchard_digest: Self::OrchardDigest,
-        #[cfg(feature = "zfuture")] tze_digests: Self::TzeDigest,
+        #[cfg(zcash_unstable = "tze")] tze_digests: Self::TzeDigest,
     ) -> Self::Digest {
         TxDigests {
             header_digest,
             transparent_digests,
             sapling_digest,
             orchard_digest,
-            #[cfg(feature = "zfuture")]
+            #[cfg(zcash_unstable = "tze")]
             tze_digests,
         }
     }
@@ -364,7 +383,7 @@ pub(crate) fn to_hash(
     transparent_digest: Blake2bHash,
     sapling_digest: Option<Blake2bHash>,
     orchard_digest: Option<Blake2bHash>,
-    #[cfg(feature = "zfuture")] tze_digests: Option<&TzeDigests<Blake2bHash>>,
+    #[cfg(zcash_unstable = "tze")] tze_digests: Option<&TzeDigests<Blake2bHash>>,
 ) -> Blake2bHash {
     let mut personal = [0; 16];
     personal[..12].copy_from_slice(ZCASH_TX_PERSONALIZATION_PREFIX);
@@ -388,8 +407,8 @@ pub(crate) fn to_hash(
     )
     .unwrap();
 
-    #[cfg(feature = "zfuture")]
-    if _txversion.has_tze() {
+    #[cfg(zcash_unstable = "tze")]
+    if let Some(tze_digests) = tze_digests {
         h.write_all(hash_tze_txid_data(tze_digests).as_bytes())
             .unwrap();
     }
@@ -409,7 +428,7 @@ pub fn to_txid(
         hash_transparent_txid_data(digests.transparent_digests.as_ref()),
         digests.sapling_digest,
         digests.orchard_digest,
-        #[cfg(feature = "zfuture")]
+        #[cfg(zcash_unstable = "tze")]
         digests.tze_digests.as_ref(),
     );
 
@@ -430,7 +449,7 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
     type SaplingDigest = Blake2bHash;
     type OrchardDigest = Blake2bHash;
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     type TzeDigest = Blake2bHash;
 
     type Digest = Blake2bHash;
@@ -441,6 +460,7 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
         consensus_branch_id: BranchId,
         _lock_time: u32,
         _expiry_height: BlockHeight,
+        _zip233_amount: Option<&NonNegativeAmount>,
     ) -> Self::HeaderDigest {
         consensus_branch_id
     }
@@ -460,7 +480,7 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
 
     fn digest_sapling(
         &self,
-        sapling_bundle: Option<&sapling::Bundle<sapling::Authorized>>,
+        sapling_bundle: Option<&sapling::Bundle<sapling::bundle::Authorized, Amount>>,
     ) -> Blake2bHash {
         let mut h = hasher(ZCASH_SAPLING_SIGS_HASH_PERSONALIZATION);
         if let Some(bundle) = sapling_bundle {
@@ -469,14 +489,16 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
             }
 
             for spend in bundle.shielded_spends() {
-                spend.spend_auth_sig().write(&mut h).unwrap();
+                h.write_all(&<[u8; 64]>::from(*spend.spend_auth_sig()))
+                    .unwrap();
             }
 
             for output in bundle.shielded_outputs() {
                 h.write_all(output.zkproof()).unwrap();
             }
 
-            bundle.authorization().binding_sig.write(&mut h).unwrap();
+            h.write_all(&<[u8; 64]>::from(bundle.authorization().binding_sig))
+                .unwrap();
         }
         h.finalize()
     }
@@ -490,7 +512,7 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
         })
     }
 
-    #[cfg(feature = "zfuture")]
+    #[cfg(zcash_unstable = "tze")]
     fn digest_tze(&self, tze_bundle: Option<&tze::Bundle<tze::Authorized>>) -> Blake2bHash {
         let mut h = hasher(ZCASH_TZE_WITNESSES_HASH_PERSONALIZATION);
         if let Some(bundle) = tze_bundle {
@@ -507,7 +529,7 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
         transparent_digest: Self::TransparentDigest,
         sapling_digest: Self::SaplingDigest,
         orchard_digest: Self::OrchardDigest,
-        #[cfg(feature = "zfuture")] tze_digest: Self::TzeDigest,
+        #[cfg(zcash_unstable = "tze")] tze_digest: Self::TzeDigest,
     ) -> Self::Digest {
         let digests = [transparent_digest, sapling_digest, orchard_digest];
 
@@ -522,7 +544,7 @@ impl TransactionDigest<Authorized> for BlockTxCommitmentDigester {
             h.write_all(digest.as_bytes()).unwrap();
         }
 
-        #[cfg(feature = "zfuture")]
+        #[cfg(zcash_unstable = "tze")]
         if TxVersion::suggested_for_branch(consensus_branch_id).has_tze() {
             h.write_all(tze_digest.as_bytes()).unwrap();
         }
diff --git a/zcash_primitives/src/zip32.rs b/zcash_primitives/src/zip32.rs
deleted file mode 100644
index 8e60ac6292..0000000000
--- a/zcash_primitives/src/zip32.rs
+++ /dev/null
@@ -1,180 +0,0 @@
-//! Implementation of [ZIP 32] for hierarchical deterministic key management.
-//!
-//! [ZIP 32]: https://zips.z.cash/zip-0032
-
-use memuse::{self, DynamicUsage};
-use subtle::{Choice, ConditionallySelectable};
-
-use crate::sapling::{Diversifier, NullifierDerivingKey, PaymentAddress, ViewingKey};
-pub mod fingerprint;
-pub mod sapling;
-
-#[deprecated(note = "Please use the types exported from the `zip32::sapling` module instead.")]
-pub use sapling::{
-    sapling_address, sapling_default_address, sapling_derive_internal_fvk, sapling_find_address,
-    DiversifiableFullViewingKey, ExtendedFullViewingKey, ExtendedSpendingKey,
-    ZIP32_SAPLING_FVFP_PERSONALIZATION, ZIP32_SAPLING_INT_PERSONALIZATION,
-    ZIP32_SAPLING_MASTER_PERSONALIZATION,
-};
-
-/// A type-safe wrapper for account identifiers.
-#[derive(Debug, Default, Copy, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
-pub struct AccountId(u32);
-
-memuse::impl_no_dynamic_usage!(AccountId);
-
-impl From<u32> for AccountId {
-    fn from(id: u32) -> Self {
-        Self(id)
-    }
-}
-
-impl From<AccountId> for u32 {
-    fn from(id: AccountId) -> Self {
-        id.0
-    }
-}
-
-impl ConditionallySelectable for AccountId {
-    fn conditional_select(a0: &Self, a1: &Self, c: Choice) -> Self {
-        AccountId(u32::conditional_select(&a0.0, &a1.0, c))
-    }
-}
-
-// ZIP 32 structures
-
-/// A child index for a derived key
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum ChildIndex {
-    NonHardened(u32),
-    Hardened(u32), // Hardened(n) == n + (1 << 31) == n' in path notation
-}
-
-impl ChildIndex {
-    pub fn from_index(i: u32) -> Self {
-        match i {
-            n if n >= (1 << 31) => ChildIndex::Hardened(n - (1 << 31)),
-            n => ChildIndex::NonHardened(n),
-        }
-    }
-
-    fn master() -> Self {
-        ChildIndex::from_index(0)
-    }
-
-    fn value(&self) -> u32 {
-        match *self {
-            ChildIndex::Hardened(i) => i + (1 << 31),
-            ChildIndex::NonHardened(i) => i,
-        }
-    }
-}
-
-/// A BIP-32 chain code
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct ChainCode([u8; 32]);
-
-impl ChainCode {
-    /// Returns byte representation of the chain code, as required for
-    /// [ZIP 32](https://zips.z.cash/zip-0032) encoding.
-    fn as_bytes(&self) -> &[u8; 32] {
-        &self.0
-    }
-}
-
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct DiversifierIndex(pub [u8; 11]);
-
-impl Default for DiversifierIndex {
-    fn default() -> Self {
-        DiversifierIndex::new()
-    }
-}
-
-impl From<u32> for DiversifierIndex {
-    fn from(i: u32) -> Self {
-        u64::from(i).into()
-    }
-}
-
-impl From<u64> for DiversifierIndex {
-    fn from(i: u64) -> Self {
-        let mut result = DiversifierIndex([0; 11]);
-        result.0[..8].copy_from_slice(&i.to_le_bytes());
-        result
-    }
-}
-
-impl TryFrom<DiversifierIndex> for u32 {
-    type Error = std::num::TryFromIntError;
-
-    fn try_from(di: DiversifierIndex) -> Result<u32, Self::Error> {
-        let mut u128_bytes = [0u8; 16];
-        u128_bytes[0..11].copy_from_slice(&di.0[..]);
-        u128::from_le_bytes(u128_bytes).try_into()
-    }
-}
-
-impl DiversifierIndex {
-    pub fn new() -> Self {
-        DiversifierIndex([0; 11])
-    }
-
-    pub fn increment(&mut self) -> Result<(), ()> {
-        for k in 0..11 {
-            self.0[k] = self.0[k].wrapping_add(1);
-            if self.0[k] != 0 {
-                // No overflow
-                return Ok(());
-            }
-        }
-        // Overflow
-        Err(())
-    }
-}
-
-/// The scope of a viewing key or address.
-///
-/// A "scope" narrows the visibility or usage to a level below "full".
-///
-/// Consistent usage of `Scope` enables the user to provide consistent views over a wallet
-/// to other people. For example, a user can give an external [SaplingIvk] to a merchant
-/// terminal, enabling it to only detect "real" transactions from customers and not
-/// internal transactions from the wallet.
-///
-/// [SaplingIvk]: crate::sapling::SaplingIvk
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
-pub enum Scope {
-    /// A scope used for wallet-external operations, namely deriving addresses to give to
-    /// other users in order to receive funds.
-    External,
-    /// A scope used for wallet-internal operations, such as creating change notes,
-    /// auto-shielding, and note management.
-    Internal,
-}
-
-memuse::impl_no_dynamic_usage!(Scope);
-
-#[cfg(test)]
-mod tests {
-    use super::DiversifierIndex;
-    use assert_matches::assert_matches;
-
-    #[test]
-    fn diversifier_index_to_u32() {
-        let two = DiversifierIndex([
-            0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        ]);
-        assert_eq!(u32::try_from(two), Ok(2));
-
-        let max_u32 = DiversifierIndex([
-            0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        ]);
-        assert_eq!(u32::try_from(max_u32), Ok(u32::MAX));
-
-        let too_big = DiversifierIndex([
-            0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        ]);
-        assert_matches!(u32::try_from(too_big), Err(_));
-    }
-}
diff --git a/zcash_primitives/src/zip32/fingerprint.rs b/zcash_primitives/src/zip32/fingerprint.rs
deleted file mode 100644
index 8c4cffb9a9..0000000000
--- a/zcash_primitives/src/zip32/fingerprint.rs
+++ /dev/null
@@ -1,80 +0,0 @@
-//! Seed Fingerprints according to ZIP 32
-//!
-//! Implements section `Seed Fingerprints` of Shielded Hierarchical Deterministic Wallets (ZIP 32)
-//!
-//! [Section Seed Fingerprints]: https://zips.z.cash/zip-0032#seed-fingerprints
-use blake2b_simd::Params as Blake2bParams;
-
-pub const ZIP32_SEED_FP_PERSONALIZATION: &[u8; 16] = b"Zcash_HD_Seed_FP";
-pub struct SeedFingerprint([u8; 32]);
-
-impl SeedFingerprint {
-    /// Return the seed fingerprint of the wallet as defined in
-    /// <https://zips.z.cash/zip-0032#seed-fingerprints> or None
-    /// if the length of `seed_bytes` is less than 32 or
-    /// greater than 252.
-    pub fn from_seed(seed_bytes: &[u8]) -> Option<SeedFingerprint> {
-        let seed_len = seed_bytes.len();
-
-        if (32..=252).contains(&seed_len) {
-            let seed_len: u8 = seed_len.try_into().unwrap();
-            Some(SeedFingerprint(
-                Blake2bParams::new()
-                    .hash_length(32)
-                    .personal(ZIP32_SEED_FP_PERSONALIZATION)
-                    .to_state()
-                    .update(&[seed_len])
-                    .update(seed_bytes)
-                    .finalize()
-                    .as_bytes()
-                    .try_into()
-                    .expect("hash length should be 32 bytes"),
-            ))
-        } else {
-            None
-        }
-    }
-
-    /// Returns the fingerprint as a byte array.
-    pub fn to_bytes(&self) -> [u8; 32] {
-        self.0
-    }
-}
-
-#[test]
-fn test_seed_fingerprint() {
-    struct TestVector {
-        root_seed: Vec<u8>,
-        fingerprint: Vec<u8>,
-    }
-
-    let test_vectors = vec![TestVector {
-        root_seed: vec![
-            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d,
-            0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b,
-            0x1c, 0x1d, 0x1e, 0x1f,
-        ],
-        fingerprint: vec![
-            0xde, 0xff, 0x60, 0x4c, 0x24, 0x67, 0x10, 0xf7, 0x17, 0x6d, 0xea, 0xd0, 0x2a, 0xa7,
-            0x46, 0xf2, 0xfd, 0x8d, 0x53, 0x89, 0xf7, 0x7, 0x25, 0x56, 0xdc, 0xb5, 0x55, 0xfd,
-            0xbe, 0x5e, 0x3a, 0xe3,
-        ],
-    }];
-
-    for tv in test_vectors {
-        let fp = SeedFingerprint::from_seed(&tv.root_seed).expect("root_seed has valid length");
-        assert_eq!(&fp.to_bytes(), &tv.fingerprint[..]);
-    }
-}
-#[test]
-fn test_seed_fingerprint_is_none() {
-    let odd_seed = vec![
-        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e,
-        0x0f,
-    ];
-
-    assert!(
-        SeedFingerprint::from_seed(&odd_seed).is_none(),
-        "fingerprint from short seed should be `None`"
-    );
-}
diff --git a/zcash_primitives/src/zip32/sapling.rs b/zcash_primitives/src/zip32/sapling.rs
deleted file mode 100644
index 2ce8127591..0000000000
--- a/zcash_primitives/src/zip32/sapling.rs
+++ /dev/null
@@ -1,1829 +0,0 @@
-//! Sapling key derivation according to ZIP 32 and ZIP 316
-//!
-//! Implements [section 4.2.2] of the Zcash Protocol Specification.
-//!
-//! [section 4.2.2]: https://zips.z.cash/protocol/protocol.pdf#saplingkeycomponents
-
-use aes::Aes256;
-use blake2b_simd::Params as Blake2bParams;
-use byteorder::{ByteOrder, LittleEndian, ReadBytesExt, WriteBytesExt};
-use fpe::ff1::{BinaryNumeralString, FF1};
-use std::io::{self, Read, Write};
-use std::ops::AddAssign;
-
-use super::{
-    ChainCode, ChildIndex, Diversifier, DiversifierIndex, NullifierDerivingKey, PaymentAddress,
-    Scope, ViewingKey,
-};
-use crate::{
-    constants::{PROOF_GENERATION_KEY_GENERATOR, SPENDING_KEY_GENERATOR},
-    keys::{prf_expand, prf_expand_vec},
-    sapling::keys::{DecodingError, ExpandedSpendingKey, FullViewingKey, OutgoingViewingKey},
-    sapling::SaplingIvk,
-};
-
-pub const ZIP32_SAPLING_MASTER_PERSONALIZATION: &[u8; 16] = b"ZcashIP32Sapling";
-pub const ZIP32_SAPLING_FVFP_PERSONALIZATION: &[u8; 16] = b"ZcashSaplingFVFP";
-pub const ZIP32_SAPLING_INT_PERSONALIZATION: &[u8; 16] = b"Zcash_SaplingInt";
-
-/// Attempt to produce a payment address given the specified diversifier
-/// index, and return None if the specified index does not produce a valid
-/// diversifier.
-pub fn sapling_address(
-    fvk: &FullViewingKey,
-    dk: &DiversifierKey,
-    j: DiversifierIndex,
-) -> Option<PaymentAddress> {
-    dk.diversifier(j)
-        .and_then(|d_j| fvk.vk.to_payment_address(d_j))
-}
-
-/// Search the diversifier space starting at diversifier index `j` for
-/// one which will produce a valid diversifier, and return the payment address
-/// constructed using that diversifier along with the index at which the
-/// valid diversifier was found.
-pub fn sapling_find_address(
-    fvk: &FullViewingKey,
-    dk: &DiversifierKey,
-    j: DiversifierIndex,
-) -> Option<(DiversifierIndex, PaymentAddress)> {
-    let (j, d_j) = dk.find_diversifier(j)?;
-    fvk.vk.to_payment_address(d_j).map(|addr| (j, addr))
-}
-
-/// Returns the payment address corresponding to the smallest valid diversifier
-/// index, along with that index.
-pub fn sapling_default_address(
-    fvk: &FullViewingKey,
-    dk: &DiversifierKey,
-) -> (DiversifierIndex, PaymentAddress) {
-    // This unwrap is safe, if you have to search the 2^88 space of
-    // diversifiers it'll never return anyway.
-    sapling_find_address(fvk, dk, DiversifierIndex::new()).unwrap()
-}
-
-/// Convenience function for child OVK derivation
-fn derive_child_ovk(parent: &OutgoingViewingKey, i_l: &[u8]) -> OutgoingViewingKey {
-    let mut ovk = [0u8; 32];
-    ovk.copy_from_slice(&prf_expand_vec(i_l, &[&[0x15], &parent.0]).as_bytes()[..32]);
-    OutgoingViewingKey(ovk)
-}
-
-/// Returns the internal full viewing key and diversifier key
-/// for the provided external FVK = (ak, nk, ovk) and dk encoded
-/// in a [Unified FVK].
-///
-/// [Unified FVK]: https://zips.z.cash/zip-0316#encoding-of-unified-full-incoming-viewing-keys
-pub fn sapling_derive_internal_fvk(
-    fvk: &FullViewingKey,
-    dk: &DiversifierKey,
-) -> (FullViewingKey, DiversifierKey) {
-    let i = {
-        let mut h = Blake2bParams::new()
-            .hash_length(32)
-            .personal(ZIP32_SAPLING_INT_PERSONALIZATION)
-            .to_state();
-        h.update(&fvk.to_bytes());
-        h.update(&dk.0);
-        h.finalize()
-    };
-    let i_nsk = jubjub::Fr::from_bytes_wide(prf_expand(i.as_bytes(), &[0x17]).as_array());
-    let r = prf_expand(i.as_bytes(), &[0x18]);
-    let r = r.as_bytes();
-    // PROOF_GENERATION_KEY_GENERATOR = \mathcal{H}^Sapling
-    let nk_internal = NullifierDerivingKey(PROOF_GENERATION_KEY_GENERATOR * i_nsk + fvk.vk.nk.0);
-    let dk_internal = DiversifierKey(r[..32].try_into().unwrap());
-    let ovk_internal = OutgoingViewingKey(r[32..].try_into().unwrap());
-
-    (
-        FullViewingKey {
-            vk: ViewingKey {
-                ak: fvk.vk.ak,
-                nk: nk_internal,
-            },
-            ovk: ovk_internal,
-        },
-        dk_internal,
-    )
-}
-
-/// A Sapling full viewing key fingerprint
-struct FvkFingerprint([u8; 32]);
-
-impl From<&FullViewingKey> for FvkFingerprint {
-    fn from(fvk: &FullViewingKey) -> Self {
-        let mut h = Blake2bParams::new()
-            .hash_length(32)
-            .personal(ZIP32_SAPLING_FVFP_PERSONALIZATION)
-            .to_state();
-        h.update(&fvk.to_bytes());
-        let mut fvfp = [0u8; 32];
-        fvfp.copy_from_slice(h.finalize().as_bytes());
-        FvkFingerprint(fvfp)
-    }
-}
-
-impl FvkFingerprint {
-    fn tag(&self) -> FvkTag {
-        let mut tag = [0u8; 4];
-        tag.copy_from_slice(&self.0[..4]);
-        FvkTag(tag)
-    }
-}
-
-/// A Sapling full viewing key tag
-#[derive(Clone, Copy, Debug, PartialEq)]
-struct FvkTag([u8; 4]);
-
-impl FvkTag {
-    fn master() -> Self {
-        FvkTag([0u8; 4])
-    }
-
-    fn as_bytes(&self) -> &[u8; 4] {
-        &self.0
-    }
-}
-
-/// A key used to derive diversifiers for a particular child key
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub struct DiversifierKey([u8; 32]);
-
-impl DiversifierKey {
-    pub fn master(sk_m: &[u8]) -> Self {
-        let mut dk_m = [0u8; 32];
-        dk_m.copy_from_slice(&prf_expand(sk_m, &[0x10]).as_bytes()[..32]);
-        DiversifierKey(dk_m)
-    }
-
-    /// Constructs the diversifier key from its constituent bytes.
-    pub fn from_bytes(key: [u8; 32]) -> Self {
-        DiversifierKey(key)
-    }
-
-    /// Returns the byte representation of the diversifier key.
-    pub fn as_bytes(&self) -> &[u8; 32] {
-        &self.0
-    }
-
-    fn derive_child(&self, i_l: &[u8]) -> Self {
-        let mut dk = [0u8; 32];
-        dk.copy_from_slice(&prf_expand_vec(i_l, &[&[0x16], &self.0]).as_bytes()[..32]);
-        DiversifierKey(dk)
-    }
-
-    fn try_diversifier_internal(ff: &FF1<Aes256>, j: DiversifierIndex) -> Option<Diversifier> {
-        // Generate d_j
-        let enc = ff
-            .encrypt(&[], &BinaryNumeralString::from_bytes_le(&j.0[..]))
-            .unwrap();
-        let mut d_j = [0; 11];
-        d_j.copy_from_slice(&enc.to_bytes_le());
-        let diversifier = Diversifier(d_j);
-
-        // validate that the generated diversifier maps to a jubjub subgroup point.
-        diversifier.g_d().map(|_| diversifier)
-    }
-
-    /// Attempts to produce a diversifier at the given index. Returns None
-    /// if the index does not produce a valid diversifier.
-    pub fn diversifier(&self, j: DiversifierIndex) -> Option<Diversifier> {
-        let ff = FF1::<Aes256>::new(&self.0, 2).unwrap();
-        Self::try_diversifier_internal(&ff, j)
-    }
-
-    /// Returns the diversifier index to which this key maps the given diversifier.
-    ///
-    /// This method cannot be used to verify whether the diversifier was originally
-    /// generated with this diversifier key, because all valid diversifiers can be
-    /// produced by all diversifier keys.
-    pub fn diversifier_index(&self, d: &Diversifier) -> DiversifierIndex {
-        let ff = FF1::<Aes256>::new(&self.0, 2).unwrap();
-        let dec = ff
-            .decrypt(&[], &BinaryNumeralString::from_bytes_le(&d.0[..]))
-            .unwrap();
-        let mut j = DiversifierIndex::new();
-        j.0.copy_from_slice(&dec.to_bytes_le());
-        j
-    }
-
-    /// Returns the first index starting from j that generates a valid
-    /// diversifier, along with the corresponding diversifier. Returns
-    /// `None` if the diversifier space contains no valid diversifiers
-    /// at or above the specified diversifier index.
-    pub fn find_diversifier(
-        &self,
-        mut j: DiversifierIndex,
-    ) -> Option<(DiversifierIndex, Diversifier)> {
-        let ff = FF1::<Aes256>::new(&self.0, 2).unwrap();
-        loop {
-            match Self::try_diversifier_internal(&ff, j) {
-                Some(d_j) => return Some((j, d_j)),
-                None => {
-                    if j.increment().is_err() {
-                        return None;
-                    }
-                }
-            }
-        }
-    }
-}
-
-/// A Sapling extended spending key
-#[derive(Clone)]
-pub struct ExtendedSpendingKey {
-    depth: u8,
-    parent_fvk_tag: FvkTag,
-    child_index: ChildIndex,
-    chain_code: ChainCode,
-    pub expsk: ExpandedSpendingKey,
-    dk: DiversifierKey,
-}
-
-impl std::cmp::PartialEq for ExtendedSpendingKey {
-    fn eq(&self, rhs: &ExtendedSpendingKey) -> bool {
-        self.depth == rhs.depth
-            && self.parent_fvk_tag == rhs.parent_fvk_tag
-            && self.child_index == rhs.child_index
-            && self.chain_code == rhs.chain_code
-            && self.expsk.ask == rhs.expsk.ask
-            && self.expsk.nsk == rhs.expsk.nsk
-            && self.expsk.ovk == rhs.expsk.ovk
-            && self.dk == rhs.dk
-    }
-}
-
-impl std::fmt::Debug for ExtendedSpendingKey {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
-        write!(
-            f,
-            "ExtendedSpendingKey(d = {}, tag_p = {:?}, i = {:?})",
-            self.depth, self.parent_fvk_tag, self.child_index
-        )
-    }
-}
-
-impl ExtendedSpendingKey {
-    pub fn master(seed: &[u8]) -> Self {
-        let i = Blake2bParams::new()
-            .hash_length(64)
-            .personal(ZIP32_SAPLING_MASTER_PERSONALIZATION)
-            .hash(seed);
-
-        let sk_m = &i.as_bytes()[..32];
-        let mut c_m = [0u8; 32];
-        c_m.copy_from_slice(&i.as_bytes()[32..]);
-
-        ExtendedSpendingKey {
-            depth: 0,
-            parent_fvk_tag: FvkTag::master(),
-            child_index: ChildIndex::master(),
-            chain_code: ChainCode(c_m),
-            expsk: ExpandedSpendingKey::from_spending_key(sk_m),
-            dk: DiversifierKey::master(sk_m),
-        }
-    }
-
-    /// Decodes the extended spending key from its serialized representation as defined in
-    /// [ZIP 32](https://zips.z.cash/zip-0032)
-    pub fn from_bytes(b: &[u8]) -> Result<Self, DecodingError> {
-        if b.len() != 169 {
-            return Err(DecodingError::LengthInvalid {
-                expected: 169,
-                actual: b.len(),
-            });
-        }
-
-        let depth = b[0];
-
-        let mut parent_fvk_tag = FvkTag([0; 4]);
-        parent_fvk_tag.0[..].copy_from_slice(&b[1..5]);
-
-        let mut ci_bytes = [0u8; 4];
-        ci_bytes[..].copy_from_slice(&b[5..9]);
-        let child_index = ChildIndex::from_index(u32::from_le_bytes(ci_bytes));
-
-        let mut chain_code = ChainCode([0u8; 32]);
-        chain_code.0[..].copy_from_slice(&b[9..41]);
-
-        let expsk = ExpandedSpendingKey::from_bytes(&b[41..137])?;
-
-        let mut dk = DiversifierKey([0u8; 32]);
-        dk.0[..].copy_from_slice(&b[137..169]);
-
-        Ok(ExtendedSpendingKey {
-            depth,
-            parent_fvk_tag,
-            child_index,
-            chain_code,
-            expsk,
-            dk,
-        })
-    }
-
-    /// Reads and decodes the encoded form of the extended spending key as define in
-    /// [ZIP 32](https://zips.z.cash/zip-0032) from the provided reader.
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let depth = reader.read_u8()?;
-        let mut tag = [0; 4];
-        reader.read_exact(&mut tag)?;
-        let i = reader.read_u32::<LittleEndian>()?;
-        let mut c = [0; 32];
-        reader.read_exact(&mut c)?;
-        let expsk = ExpandedSpendingKey::read(&mut reader)?;
-        let mut dk = [0; 32];
-        reader.read_exact(&mut dk)?;
-
-        Ok(ExtendedSpendingKey {
-            depth,
-            parent_fvk_tag: FvkTag(tag),
-            child_index: ChildIndex::from_index(i),
-            chain_code: ChainCode(c),
-            expsk,
-            dk: DiversifierKey(dk),
-        })
-    }
-
-    /// Encodes the extended spending key to the its seralized representation as defined in
-    /// [ZIP 32](https://zips.z.cash/zip-0032)
-    pub fn to_bytes(&self) -> [u8; 169] {
-        let mut result = [0u8; 169];
-        result[0] = self.depth;
-        result[1..5].copy_from_slice(&self.parent_fvk_tag.as_bytes()[..]);
-        result[5..9].copy_from_slice(&self.child_index.value().to_le_bytes()[..]);
-        result[9..41].copy_from_slice(&self.chain_code.as_bytes()[..]);
-        result[41..137].copy_from_slice(&self.expsk.to_bytes()[..]);
-        result[137..169].copy_from_slice(&self.dk.as_bytes()[..]);
-        result
-    }
-
-    /// Writes the encoded form of the extended spending key as defined in
-    /// [ZIP 32](https://zips.z.cash/zip-0032) to the provided writer.
-    pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_all(&self.to_bytes())
-    }
-
-    /// Returns the child key corresponding to the path derived from the master key
-    pub fn from_path(master: &ExtendedSpendingKey, path: &[ChildIndex]) -> Self {
-        let mut xsk = master.clone();
-        for &i in path.iter() {
-            xsk = xsk.derive_child(i);
-        }
-        xsk
-    }
-
-    #[must_use]
-    pub fn derive_child(&self, i: ChildIndex) -> Self {
-        let fvk = FullViewingKey::from_expanded_spending_key(&self.expsk);
-        let tmp = match i {
-            ChildIndex::Hardened(i) => {
-                let mut le_i = [0; 4];
-                LittleEndian::write_u32(&mut le_i, i + (1 << 31));
-                prf_expand_vec(
-                    &self.chain_code.0,
-                    &[&[0x11], &self.expsk.to_bytes(), &self.dk.0, &le_i],
-                )
-            }
-            ChildIndex::NonHardened(i) => {
-                let mut le_i = [0; 4];
-                LittleEndian::write_u32(&mut le_i, i);
-                prf_expand_vec(
-                    &self.chain_code.0,
-                    &[&[0x12], &fvk.to_bytes(), &self.dk.0, &le_i],
-                )
-            }
-        };
-        let i_l = &tmp.as_bytes()[..32];
-        let mut c_i = [0u8; 32];
-        c_i.copy_from_slice(&tmp.as_bytes()[32..]);
-
-        ExtendedSpendingKey {
-            depth: self.depth + 1,
-            parent_fvk_tag: FvkFingerprint::from(&fvk).tag(),
-            child_index: i,
-            chain_code: ChainCode(c_i),
-            expsk: {
-                let mut ask = jubjub::Fr::from_bytes_wide(prf_expand(i_l, &[0x13]).as_array());
-                let mut nsk = jubjub::Fr::from_bytes_wide(prf_expand(i_l, &[0x14]).as_array());
-                ask.add_assign(&self.expsk.ask);
-                nsk.add_assign(&self.expsk.nsk);
-                let ovk = derive_child_ovk(&self.expsk.ovk, i_l);
-                ExpandedSpendingKey { ask, nsk, ovk }
-            },
-            dk: self.dk.derive_child(i_l),
-        }
-    }
-
-    /// Returns the address with the lowest valid diversifier index, along with
-    /// the diversifier index that generated that address.
-    pub fn default_address(&self) -> (DiversifierIndex, PaymentAddress) {
-        self.to_diversifiable_full_viewing_key().default_address()
-    }
-
-    /// Derives an internal spending key given an external spending key.
-    ///
-    /// Specified in [ZIP 32](https://zips.z.cash/zip-0032#deriving-a-sapling-internal-spending-key).
-    #[must_use]
-    pub fn derive_internal(&self) -> Self {
-        let i = {
-            let fvk = FullViewingKey::from_expanded_spending_key(&self.expsk);
-            let mut h = Blake2bParams::new()
-                .hash_length(32)
-                .personal(ZIP32_SAPLING_INT_PERSONALIZATION)
-                .to_state();
-            h.update(&fvk.to_bytes());
-            h.update(&self.dk.0);
-            h.finalize()
-        };
-        let i_nsk = jubjub::Fr::from_bytes_wide(prf_expand(i.as_bytes(), &[0x17]).as_array());
-        let r = prf_expand(i.as_bytes(), &[0x18]);
-        let r = r.as_bytes();
-        let nsk_internal = i_nsk + self.expsk.nsk;
-        let dk_internal = DiversifierKey(r[..32].try_into().unwrap());
-        let ovk_internal = OutgoingViewingKey(r[32..].try_into().unwrap());
-
-        ExtendedSpendingKey {
-            depth: self.depth,
-            parent_fvk_tag: self.parent_fvk_tag,
-            child_index: self.child_index,
-            chain_code: self.chain_code,
-            expsk: ExpandedSpendingKey {
-                ask: self.expsk.ask,
-                nsk: nsk_internal,
-                ovk: ovk_internal,
-            },
-            dk: dk_internal,
-        }
-    }
-
-    #[deprecated(note = "Use `to_diversifiable_full_viewing_key` instead.")]
-    pub fn to_extended_full_viewing_key(&self) -> ExtendedFullViewingKey {
-        ExtendedFullViewingKey {
-            depth: self.depth,
-            parent_fvk_tag: self.parent_fvk_tag,
-            child_index: self.child_index,
-            chain_code: self.chain_code,
-            fvk: FullViewingKey::from_expanded_spending_key(&self.expsk),
-            dk: self.dk,
-        }
-    }
-
-    pub fn to_diversifiable_full_viewing_key(&self) -> DiversifiableFullViewingKey {
-        DiversifiableFullViewingKey {
-            fvk: FullViewingKey::from_expanded_spending_key(&self.expsk),
-            dk: self.dk,
-        }
-    }
-}
-
-// A Sapling extended full viewing key
-#[derive(Clone)]
-pub struct ExtendedFullViewingKey {
-    depth: u8,
-    parent_fvk_tag: FvkTag,
-    child_index: ChildIndex,
-    chain_code: ChainCode,
-    pub fvk: FullViewingKey,
-    pub(crate) dk: DiversifierKey,
-}
-
-impl std::cmp::PartialEq for ExtendedFullViewingKey {
-    fn eq(&self, rhs: &ExtendedFullViewingKey) -> bool {
-        self.depth == rhs.depth
-            && self.parent_fvk_tag == rhs.parent_fvk_tag
-            && self.child_index == rhs.child_index
-            && self.chain_code == rhs.chain_code
-            && self.fvk.vk.ak == rhs.fvk.vk.ak
-            && self.fvk.vk.nk == rhs.fvk.vk.nk
-            && self.fvk.ovk == rhs.fvk.ovk
-            && self.dk == rhs.dk
-    }
-}
-
-impl std::fmt::Debug for ExtendedFullViewingKey {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
-        write!(
-            f,
-            "ExtendedFullViewingKey(d = {}, tag_p = {:?}, i = {:?})",
-            self.depth, self.parent_fvk_tag, self.child_index
-        )
-    }
-}
-
-impl ExtendedFullViewingKey {
-    pub fn read<R: Read>(mut reader: R) -> io::Result<Self> {
-        let depth = reader.read_u8()?;
-        let mut tag = [0; 4];
-        reader.read_exact(&mut tag)?;
-        let i = reader.read_u32::<LittleEndian>()?;
-        let mut c = [0; 32];
-        reader.read_exact(&mut c)?;
-        let fvk = FullViewingKey::read(&mut reader)?;
-        let mut dk = [0; 32];
-        reader.read_exact(&mut dk)?;
-
-        Ok(ExtendedFullViewingKey {
-            depth,
-            parent_fvk_tag: FvkTag(tag),
-            child_index: ChildIndex::from_index(i),
-            chain_code: ChainCode(c),
-            fvk,
-            dk: DiversifierKey(dk),
-        })
-    }
-
-    pub fn write<W: Write>(&self, mut writer: W) -> io::Result<()> {
-        writer.write_u8(self.depth)?;
-        writer.write_all(&self.parent_fvk_tag.0)?;
-        writer.write_u32::<LittleEndian>(self.child_index.value())?;
-        writer.write_all(&self.chain_code.0)?;
-        writer.write_all(&self.fvk.to_bytes())?;
-        writer.write_all(&self.dk.0)?;
-
-        Ok(())
-    }
-
-    pub fn derive_child(&self, i: ChildIndex) -> Result<Self, ()> {
-        let tmp = match i {
-            ChildIndex::Hardened(_) => return Err(()),
-            ChildIndex::NonHardened(i) => {
-                let mut le_i = [0; 4];
-                LittleEndian::write_u32(&mut le_i, i);
-                prf_expand_vec(
-                    &self.chain_code.0,
-                    &[&[0x12], &self.fvk.to_bytes(), &self.dk.0, &le_i],
-                )
-            }
-        };
-        let i_l = &tmp.as_bytes()[..32];
-        let mut c_i = [0u8; 32];
-        c_i.copy_from_slice(&tmp.as_bytes()[32..]);
-
-        Ok(ExtendedFullViewingKey {
-            depth: self.depth + 1,
-            parent_fvk_tag: FvkFingerprint::from(&self.fvk).tag(),
-            child_index: i,
-            chain_code: ChainCode(c_i),
-            fvk: {
-                let i_ask = jubjub::Fr::from_bytes_wide(prf_expand(i_l, &[0x13]).as_array());
-                let i_nsk = jubjub::Fr::from_bytes_wide(prf_expand(i_l, &[0x14]).as_array());
-                let ak = (SPENDING_KEY_GENERATOR * i_ask) + self.fvk.vk.ak;
-                let nk = NullifierDerivingKey(
-                    (PROOF_GENERATION_KEY_GENERATOR * i_nsk) + self.fvk.vk.nk.0,
-                );
-
-                FullViewingKey {
-                    vk: ViewingKey { ak, nk },
-                    ovk: derive_child_ovk(&self.fvk.ovk, i_l),
-                }
-            },
-            dk: self.dk.derive_child(i_l),
-        })
-    }
-
-    /// Attempt to produce a payment address given the specified diversifier
-    /// index, and return None if the specified index does not produce a valid
-    /// diversifier.
-    pub fn address(&self, j: DiversifierIndex) -> Option<PaymentAddress> {
-        sapling_address(&self.fvk, &self.dk, j)
-    }
-
-    /// Search the diversifier space starting at diversifier index `j` for
-    /// one which will produce a valid diversifier, and return the payment address
-    /// constructed using that diversifier along with the index at which the
-    /// valid diversifier was found.
-    pub fn find_address(&self, j: DiversifierIndex) -> Option<(DiversifierIndex, PaymentAddress)> {
-        sapling_find_address(&self.fvk, &self.dk, j)
-    }
-
-    /// Returns the payment address corresponding to the smallest valid diversifier
-    /// index, along with that index.
-    pub fn default_address(&self) -> (DiversifierIndex, PaymentAddress) {
-        sapling_default_address(&self.fvk, &self.dk)
-    }
-
-    /// Derives an internal full viewing key used for internal operations such
-    /// as change and auto-shielding. The internal FVK has the same spend authority
-    /// (the private key corresponding to ak) as the original, but viewing authority
-    /// only for internal transfers.
-    ///
-    /// Specified in [ZIP 32](https://zips.z.cash/zip-0032#deriving-a-sapling-internal-full-viewing-key).
-    #[must_use]
-    pub fn derive_internal(&self) -> Self {
-        let (fvk_internal, dk_internal) = sapling_derive_internal_fvk(&self.fvk, &self.dk);
-
-        ExtendedFullViewingKey {
-            depth: self.depth,
-            parent_fvk_tag: self.parent_fvk_tag,
-            child_index: self.child_index,
-            chain_code: self.chain_code,
-            fvk: fvk_internal,
-            dk: dk_internal,
-        }
-    }
-
-    pub fn to_diversifiable_full_viewing_key(&self) -> DiversifiableFullViewingKey {
-        DiversifiableFullViewingKey {
-            fvk: self.fvk.clone(),
-            dk: self.dk,
-        }
-    }
-}
-
-/// A Sapling key that provides the capability to view incoming and outgoing transactions.
-///
-/// This key is useful anywhere you need to maintain accurate balance, but do not want the
-/// ability to spend funds (such as a view-only wallet).
-///
-/// It comprises the subset of the ZIP 32 extended full viewing key that is used for the
-/// Sapling item in a [ZIP 316 Unified Full Viewing Key][zip-0316-ufvk].
-///
-/// [zip-0316-ufvk]: https://zips.z.cash/zip-0316#encoding-of-unified-full-incoming-viewing-keys
-#[derive(Clone, Debug)]
-pub struct DiversifiableFullViewingKey {
-    fvk: FullViewingKey,
-    dk: DiversifierKey,
-}
-
-impl From<ExtendedFullViewingKey> for DiversifiableFullViewingKey {
-    fn from(extfvk: ExtendedFullViewingKey) -> Self {
-        DiversifiableFullViewingKey {
-            fvk: extfvk.fvk,
-            dk: extfvk.dk,
-        }
-    }
-}
-
-impl From<&ExtendedFullViewingKey> for DiversifiableFullViewingKey {
-    fn from(extfvk: &ExtendedFullViewingKey) -> Self {
-        extfvk.to_diversifiable_full_viewing_key()
-    }
-}
-
-impl DiversifiableFullViewingKey {
-    /// Parses a `DiversifiableFullViewingKey` from its raw byte encoding.
-    ///
-    /// Returns `None` if the bytes do not contain a valid encoding of a diversifiable
-    /// Sapling full viewing key.
-    pub fn from_bytes(bytes: &[u8; 128]) -> Option<Self> {
-        FullViewingKey::read(&bytes[..96]).ok().map(|fvk| Self {
-            fvk,
-            dk: DiversifierKey::from_bytes(bytes[96..].try_into().unwrap()),
-        })
-    }
-
-    /// Returns the raw encoding of this `DiversifiableFullViewingKey`.
-    pub fn to_bytes(&self) -> [u8; 128] {
-        let mut bytes = [0; 128];
-        self.fvk
-            .write(&mut bytes[..96])
-            .expect("slice should be the correct length");
-        bytes[96..].copy_from_slice(&self.dk.as_bytes()[..]);
-        bytes
-    }
-
-    /// Derives the internal `DiversifiableFullViewingKey` corresponding to `self` (which
-    /// is assumed here to be an external DFVK).
-    fn derive_internal(&self) -> Self {
-        let (fvk, dk) = sapling_derive_internal_fvk(&self.fvk, &self.dk);
-        Self { fvk, dk }
-    }
-
-    /// Exposes the external [`FullViewingKey`] component of this diversifiable full viewing key.
-    pub fn fvk(&self) -> &FullViewingKey {
-        &self.fvk
-    }
-
-    /// Derives a nullifier-deriving key for the provided scope.
-    ///
-    /// This API is provided so that nullifiers for change notes can be correctly computed.
-    pub fn to_nk(&self, scope: Scope) -> NullifierDerivingKey {
-        match scope {
-            Scope::External => self.fvk.vk.nk,
-            Scope::Internal => self.derive_internal().fvk.vk.nk,
-        }
-    }
-
-    /// Derives an incoming viewing key corresponding to this full viewing key.
-    pub fn to_ivk(&self, scope: Scope) -> SaplingIvk {
-        match scope {
-            Scope::External => self.fvk.vk.ivk(),
-            Scope::Internal => self.derive_internal().fvk.vk.ivk(),
-        }
-    }
-
-    /// Derives an outgoing viewing key corresponding to this full viewing key.
-    pub fn to_ovk(&self, scope: Scope) -> OutgoingViewingKey {
-        match scope {
-            Scope::External => self.fvk.ovk,
-            Scope::Internal => self.derive_internal().fvk.ovk,
-        }
-    }
-
-    /// Attempts to produce a valid payment address for the given diversifier index.
-    ///
-    /// Returns `None` if the diversifier index does not produce a valid diversifier for
-    /// this `DiversifiableFullViewingKey`.
-    pub fn address(&self, j: DiversifierIndex) -> Option<PaymentAddress> {
-        sapling_address(&self.fvk, &self.dk, j)
-    }
-
-    /// Finds the next valid payment address starting from the given diversifier index.
-    ///
-    /// This searches the diversifier space starting at `j` and incrementing, to find an
-    /// index which will produce a valid diversifier (a 50% probability for each index).
-    ///
-    /// Returns the index at which the valid diversifier was found along with the payment
-    /// address constructed using that diversifier, or `None` if the maximum index was
-    /// reached and no valid diversifier was found.
-    pub fn find_address(&self, j: DiversifierIndex) -> Option<(DiversifierIndex, PaymentAddress)> {
-        sapling_find_address(&self.fvk, &self.dk, j)
-    }
-
-    /// Returns the payment address corresponding to the smallest valid diversifier index,
-    /// along with that index.
-    pub fn default_address(&self) -> (DiversifierIndex, PaymentAddress) {
-        sapling_default_address(&self.fvk, &self.dk)
-    }
-
-    /// Returns the payment address corresponding to the specified diversifier, if any.
-    ///
-    /// In general, it is preferable to use `find_address` instead, but this method is
-    /// useful in some cases for matching keys to existing payment addresses.
-    pub fn diversified_address(&self, diversifier: Diversifier) -> Option<PaymentAddress> {
-        self.fvk.vk.to_payment_address(diversifier)
-    }
-
-    /// Returns the internal address corresponding to the smallest valid diversifier index,
-    /// along with that index.
-    ///
-    /// This address **MUST NOT** be encoded and exposed to end users. User interfaces
-    /// should instead mark these notes as "change notes" or "internal wallet operations".
-    pub fn change_address(&self) -> (DiversifierIndex, PaymentAddress) {
-        let internal_dfvk = self.derive_internal();
-        sapling_default_address(&internal_dfvk.fvk, &internal_dfvk.dk)
-    }
-
-    /// Returns the change address corresponding to the specified diversifier, if any.
-    ///
-    /// In general, it is preferable to use `change_address` instead, but this method is
-    /// useful in some cases for matching keys to existing payment addresses.
-    pub fn diversified_change_address(&self, diversifier: Diversifier) -> Option<PaymentAddress> {
-        self.derive_internal()
-            .fvk
-            .vk
-            .to_payment_address(diversifier)
-    }
-
-    /// Attempts to decrypt the given address's diversifier with this full viewing key.
-    ///
-    /// This method extracts the diversifier from the given address and decrypts it as a
-    /// diversifier index, then verifies that this diversifier index produces the same
-    /// address. Decryption is attempted using both the internal and external parts of the
-    /// full viewing key.
-    ///
-    /// Returns the decrypted diversifier index and its scope, or `None` if the address
-    /// was not generated from this key.
-    pub fn decrypt_diversifier(&self, addr: &PaymentAddress) -> Option<(DiversifierIndex, Scope)> {
-        let j_external = self.dk.diversifier_index(addr.diversifier());
-        if self.address(j_external).as_ref() == Some(addr) {
-            return Some((j_external, Scope::External));
-        }
-
-        let j_internal = self
-            .derive_internal()
-            .dk
-            .diversifier_index(addr.diversifier());
-        if self.address(j_internal).as_ref() == Some(addr) {
-            return Some((j_internal, Scope::Internal));
-        }
-
-        None
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use super::{DiversifiableFullViewingKey, ExtendedSpendingKey};
-    use ff::PrimeField;
-    use group::GroupEncoding;
-
-    #[test]
-    #[allow(deprecated)]
-    fn derive_nonhardened_child() {
-        let seed = [0; 32];
-        let xsk_m = ExtendedSpendingKey::master(&seed);
-        let xfvk_m = xsk_m.to_extended_full_viewing_key();
-
-        let i_5 = ChildIndex::NonHardened(5);
-        let xsk_5 = xsk_m.derive_child(i_5);
-        let xfvk_5 = xfvk_m.derive_child(i_5);
-
-        assert!(xfvk_5.is_ok());
-        assert_eq!(xsk_5.to_extended_full_viewing_key(), xfvk_5.unwrap());
-    }
-
-    #[test]
-    #[allow(deprecated)]
-    fn derive_hardened_child() {
-        let seed = [0; 32];
-        let xsk_m = ExtendedSpendingKey::master(&seed);
-        let xfvk_m = xsk_m.to_extended_full_viewing_key();
-
-        let i_5h = ChildIndex::Hardened(5);
-        let xsk_5h = xsk_m.derive_child(i_5h);
-        let xfvk_5h = xfvk_m.derive_child(i_5h);
-
-        // Cannot derive a hardened child from an ExtendedFullViewingKey
-        assert!(xfvk_5h.is_err());
-        let xfvk_5h = xsk_5h.to_extended_full_viewing_key();
-
-        let i_7 = ChildIndex::NonHardened(7);
-        let xsk_5h_7 = xsk_5h.derive_child(i_7);
-        let xfvk_5h_7 = xfvk_5h.derive_child(i_7);
-
-        // But we *can* derive a non-hardened child from a hardened parent
-        assert!(xfvk_5h_7.is_ok());
-        assert_eq!(xsk_5h_7.to_extended_full_viewing_key(), xfvk_5h_7.unwrap());
-    }
-
-    #[test]
-    fn path() {
-        let seed = [0; 32];
-        let xsk_m = ExtendedSpendingKey::master(&seed);
-
-        let xsk_5h = xsk_m.derive_child(ChildIndex::Hardened(5));
-        assert_eq!(
-            ExtendedSpendingKey::from_path(&xsk_m, &[ChildIndex::Hardened(5)]),
-            xsk_5h
-        );
-
-        let xsk_5h_7 = xsk_5h.derive_child(ChildIndex::NonHardened(7));
-        assert_eq!(
-            ExtendedSpendingKey::from_path(
-                &xsk_m,
-                &[ChildIndex::Hardened(5), ChildIndex::NonHardened(7)]
-            ),
-            xsk_5h_7
-        );
-    }
-
-    #[test]
-    fn diversifier() {
-        let dk = DiversifierKey([0; 32]);
-        let j_0 = DiversifierIndex::new();
-        let j_1 = DiversifierIndex([1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        let j_2 = DiversifierIndex([2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        let j_3 = DiversifierIndex([3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        // Computed using this Rust implementation
-        let d_0 = [220, 231, 126, 188, 236, 10, 38, 175, 214, 153, 140];
-        let d_3 = [60, 253, 170, 8, 171, 147, 220, 31, 3, 144, 34];
-
-        // j = 0
-        let d_j = dk.diversifier(j_0).unwrap();
-        assert_eq!(d_j.0, d_0);
-        assert_eq!(dk.diversifier_index(&Diversifier(d_0)), j_0);
-
-        // j = 1
-        assert_eq!(dk.diversifier(j_1), None);
-
-        // j = 2
-        assert_eq!(dk.diversifier(j_2), None);
-
-        // j = 3
-        let d_j = dk.diversifier(j_3).unwrap();
-        assert_eq!(d_j.0, d_3);
-        assert_eq!(dk.diversifier_index(&Diversifier(d_3)), j_3);
-    }
-
-    #[test]
-    fn diversifier_index_from() {
-        let di32: u32 = 0xa0b0c0d0;
-        assert_eq!(
-            DiversifierIndex::from(di32),
-            DiversifierIndex([0xd0, 0xc0, 0xb0, 0xa0, 0, 0, 0, 0, 0, 0, 0])
-        );
-        let di64: u64 = 0x0102030405060708;
-        assert_eq!(
-            DiversifierIndex::from(di64),
-            DiversifierIndex([8, 7, 6, 5, 4, 3, 2, 1, 0, 0, 0])
-        );
-    }
-
-    #[test]
-    fn find_diversifier() {
-        let dk = DiversifierKey([0; 32]);
-        let j_0 = DiversifierIndex::new();
-        let j_1 = DiversifierIndex([1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        let j_2 = DiversifierIndex([2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        let j_3 = DiversifierIndex([3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        // Computed using this Rust implementation
-        let d_0 = [220, 231, 126, 188, 236, 10, 38, 175, 214, 153, 140];
-        let d_3 = [60, 253, 170, 8, 171, 147, 220, 31, 3, 144, 34];
-
-        // j = 0
-        let (j, d_j) = dk.find_diversifier(j_0).unwrap();
-        assert_eq!(j, j_0);
-        assert_eq!(d_j.0, d_0);
-
-        // j = 1
-        let (j, d_j) = dk.find_diversifier(j_1).unwrap();
-        assert_eq!(j, j_3);
-        assert_eq!(d_j.0, d_3);
-
-        // j = 2
-        let (j, d_j) = dk.find_diversifier(j_2).unwrap();
-        assert_eq!(j, j_3);
-        assert_eq!(d_j.0, d_3);
-
-        // j = 3
-        let (j, d_j) = dk.find_diversifier(j_3).unwrap();
-        assert_eq!(j, j_3);
-        assert_eq!(d_j.0, d_3);
-    }
-
-    #[test]
-    fn dfvk_round_trip() {
-        let dfvk = {
-            let extsk = ExtendedSpendingKey::master(&[]);
-            #[allow(deprecated)]
-            let extfvk = extsk.to_extended_full_viewing_key();
-            DiversifiableFullViewingKey::from(extfvk)
-        };
-
-        // Check value -> bytes -> parsed round trip.
-        let dfvk_bytes = dfvk.to_bytes();
-        let dfvk_parsed = DiversifiableFullViewingKey::from_bytes(&dfvk_bytes).unwrap();
-        assert_eq!(dfvk_parsed.fvk.vk.ak, dfvk.fvk.vk.ak);
-        assert_eq!(dfvk_parsed.fvk.vk.nk, dfvk.fvk.vk.nk);
-        assert_eq!(dfvk_parsed.fvk.ovk, dfvk.fvk.ovk);
-        assert_eq!(dfvk_parsed.dk, dfvk.dk);
-
-        // Check bytes -> parsed -> bytes round trip.
-        assert_eq!(dfvk_parsed.to_bytes(), dfvk_bytes);
-    }
-
-    #[test]
-    fn address() {
-        let seed = [0; 32];
-        let xsk_m = ExtendedSpendingKey::master(&seed);
-        let xfvk_m = xsk_m.to_diversifiable_full_viewing_key();
-        let j_0 = DiversifierIndex::new();
-        let addr_m = xfvk_m.address(j_0).unwrap();
-        assert_eq!(
-            addr_m.diversifier().0,
-            // Computed using this Rust implementation
-            [59, 246, 250, 31, 131, 191, 69, 99, 200, 167, 19]
-        );
-
-        let j_1 = DiversifierIndex([1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
-        assert_eq!(xfvk_m.address(j_1), None);
-    }
-
-    #[test]
-    fn default_address() {
-        let seed = [0; 32];
-        let xsk_m = ExtendedSpendingKey::master(&seed);
-        let (j_m, addr_m) = xsk_m.default_address();
-        assert_eq!(j_m.0, [0; 11]);
-        assert_eq!(
-            addr_m.diversifier().0,
-            // Computed using this Rust implementation
-            [59, 246, 250, 31, 131, 191, 69, 99, 200, 167, 19]
-        );
-    }
-
-    #[test]
-    #[allow(deprecated)]
-    fn read_write() {
-        let seed = [0; 32];
-        let xsk = ExtendedSpendingKey::master(&seed);
-        let fvk = xsk.to_extended_full_viewing_key();
-
-        let mut ser = vec![];
-        xsk.write(&mut ser).unwrap();
-        let xsk2 = ExtendedSpendingKey::read(&ser[..]).unwrap();
-        assert_eq!(xsk2, xsk);
-
-        let mut ser = vec![];
-        fvk.write(&mut ser).unwrap();
-        let fvk2 = ExtendedFullViewingKey::read(&ser[..]).unwrap();
-        assert_eq!(fvk2, fvk);
-    }
-
-    #[test]
-    #[allow(deprecated)]
-    fn test_vectors() {
-        struct TestVector {
-            ask: Option<[u8; 32]>,
-            nsk: Option<[u8; 32]>,
-            ovk: [u8; 32],
-            dk: [u8; 32],
-            c: [u8; 32],
-            ak: [u8; 32],
-            nk: [u8; 32],
-            ivk: [u8; 32],
-            xsk: Option<[u8; 169]>,
-            xfvk: [u8; 169],
-            fp: [u8; 32],
-            d0: Option<[u8; 11]>,
-            d1: Option<[u8; 11]>,
-            d2: Option<[u8; 11]>,
-            dmax: Option<[u8; 11]>,
-            internal_nsk: Option<[u8; 32]>,
-            internal_ovk: [u8; 32],
-            internal_dk: [u8; 32],
-            internal_nk: [u8; 32],
-            internal_ivk: [u8; 32],
-            internal_xsk: Option<[u8; 169]>,
-            internal_xfvk: [u8; 169],
-            internal_fp: [u8; 32],
-        }
-
-        // From https://github.com/zcash-hackworks/zcash-test-vectors/blob/master/sapling_zip32.py
-        let test_vectors = vec![
-            TestVector {
-                ask: Some([
-                    0xb6, 0xc0, 0x0c, 0x93, 0xd3, 0x60, 0x32, 0xb9, 0xa2, 0x68, 0xe9, 0x9e, 0x86,
-                    0xa8, 0x60, 0x77, 0x65, 0x60, 0xbf, 0x0e, 0x83, 0xc1, 0xa1, 0x0b, 0x51, 0xf6,
-                    0x07, 0xc9, 0x54, 0x74, 0x25, 0x06,
-                ]),
-                nsk: Some([
-                    0x82, 0x04, 0xed, 0xe8, 0x3b, 0x2f, 0x1f, 0xbd, 0x84, 0xf9, 0xb4, 0x5d, 0x7f,
-                    0x99, 0x6e, 0x2e, 0xbd, 0x0a, 0x03, 0x0a, 0xd2, 0x43, 0xb4, 0x8e, 0xd3, 0x9f,
-                    0x74, 0x8a, 0x88, 0x21, 0xea, 0x06,
-                ]),
-                ovk: [
-                    0x39, 0x58, 0x84, 0x89, 0x03, 0x23, 0xb9, 0xd4, 0x93, 0x3c, 0x02, 0x1d, 0xb8,
-                    0x9b, 0xcf, 0x76, 0x7d, 0xf2, 0x19, 0x77, 0xb2, 0xff, 0x06, 0x83, 0x84, 0x83,
-                    0x21, 0xa4, 0xdf, 0x4a, 0xfb, 0x21,
-                ],
-                dk: [
-                    0x77, 0xc1, 0x7c, 0xb7, 0x5b, 0x77, 0x96, 0xaf, 0xb3, 0x9f, 0x0f, 0x3e, 0x91,
-                    0xc9, 0x24, 0x60, 0x7d, 0xa5, 0x6f, 0xa9, 0xa2, 0x0e, 0x28, 0x35, 0x09, 0xbc,
-                    0x8a, 0x3e, 0xf9, 0x96, 0xa1, 0x72,
-                ],
-                c: [
-                    0xd0, 0x94, 0x7c, 0x4b, 0x03, 0xbf, 0x72, 0xa3, 0x7a, 0xb4, 0x4f, 0x72, 0x27,
-                    0x6d, 0x1c, 0xf3, 0xfd, 0xcd, 0x7e, 0xbf, 0x3e, 0x73, 0x34, 0x8b, 0x7e, 0x55,
-                    0x0d, 0x75, 0x20, 0x18, 0x66, 0x8e,
-                ],
-                ak: [
-                    0x93, 0x44, 0x2e, 0x5f, 0xef, 0xfb, 0xff, 0x16, 0xe7, 0x21, 0x72, 0x02, 0xdc,
-                    0x73, 0x06, 0x72, 0x9f, 0xff, 0xfe, 0x85, 0xaf, 0x56, 0x83, 0xbc, 0xe2, 0x64,
-                    0x2e, 0x3e, 0xeb, 0x5d, 0x38, 0x71,
-                ],
-                nk: [
-                    0xdc, 0xe8, 0xe7, 0xed, 0xec, 0xe0, 0x4b, 0x89, 0x50, 0x41, 0x7f, 0x85, 0xba,
-                    0x57, 0x69, 0x1b, 0x78, 0x3c, 0x45, 0xb1, 0xa2, 0x74, 0x22, 0xdb, 0x16, 0x93,
-                    0xdc, 0xeb, 0x67, 0xb1, 0x01, 0x06,
-                ],
-                ivk: [
-                    0x48, 0x47, 0xa1, 0x30, 0xe7, 0x99, 0xd3, 0xdb, 0xea, 0x36, 0xa1, 0xc1, 0x64,
-                    0x67, 0xd6, 0x21, 0xfb, 0x2d, 0x80, 0xe3, 0x0b, 0x3b, 0x1d, 0x1a, 0x42, 0x68,
-                    0x93, 0x41, 0x5d, 0xad, 0x66, 0x01,
-                ],
-                xsk: Some([
-                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x94, 0x7c, 0x4b,
-                    0x03, 0xbf, 0x72, 0xa3, 0x7a, 0xb4, 0x4f, 0x72, 0x27, 0x6d, 0x1c, 0xf3, 0xfd,
-                    0xcd, 0x7e, 0xbf, 0x3e, 0x73, 0x34, 0x8b, 0x7e, 0x55, 0x0d, 0x75, 0x20, 0x18,
-                    0x66, 0x8e, 0xb6, 0xc0, 0x0c, 0x93, 0xd3, 0x60, 0x32, 0xb9, 0xa2, 0x68, 0xe9,
-                    0x9e, 0x86, 0xa8, 0x60, 0x77, 0x65, 0x60, 0xbf, 0x0e, 0x83, 0xc1, 0xa1, 0x0b,
-                    0x51, 0xf6, 0x07, 0xc9, 0x54, 0x74, 0x25, 0x06, 0x82, 0x04, 0xed, 0xe8, 0x3b,
-                    0x2f, 0x1f, 0xbd, 0x84, 0xf9, 0xb4, 0x5d, 0x7f, 0x99, 0x6e, 0x2e, 0xbd, 0x0a,
-                    0x03, 0x0a, 0xd2, 0x43, 0xb4, 0x8e, 0xd3, 0x9f, 0x74, 0x8a, 0x88, 0x21, 0xea,
-                    0x06, 0x39, 0x58, 0x84, 0x89, 0x03, 0x23, 0xb9, 0xd4, 0x93, 0x3c, 0x02, 0x1d,
-                    0xb8, 0x9b, 0xcf, 0x76, 0x7d, 0xf2, 0x19, 0x77, 0xb2, 0xff, 0x06, 0x83, 0x84,
-                    0x83, 0x21, 0xa4, 0xdf, 0x4a, 0xfb, 0x21, 0x77, 0xc1, 0x7c, 0xb7, 0x5b, 0x77,
-                    0x96, 0xaf, 0xb3, 0x9f, 0x0f, 0x3e, 0x91, 0xc9, 0x24, 0x60, 0x7d, 0xa5, 0x6f,
-                    0xa9, 0xa2, 0x0e, 0x28, 0x35, 0x09, 0xbc, 0x8a, 0x3e, 0xf9, 0x96, 0xa1, 0x72,
-                ]),
-                xfvk: [
-                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x94, 0x7c, 0x4b,
-                    0x03, 0xbf, 0x72, 0xa3, 0x7a, 0xb4, 0x4f, 0x72, 0x27, 0x6d, 0x1c, 0xf3, 0xfd,
-                    0xcd, 0x7e, 0xbf, 0x3e, 0x73, 0x34, 0x8b, 0x7e, 0x55, 0x0d, 0x75, 0x20, 0x18,
-                    0x66, 0x8e, 0x93, 0x44, 0x2e, 0x5f, 0xef, 0xfb, 0xff, 0x16, 0xe7, 0x21, 0x72,
-                    0x02, 0xdc, 0x73, 0x06, 0x72, 0x9f, 0xff, 0xfe, 0x85, 0xaf, 0x56, 0x83, 0xbc,
-                    0xe2, 0x64, 0x2e, 0x3e, 0xeb, 0x5d, 0x38, 0x71, 0xdc, 0xe8, 0xe7, 0xed, 0xec,
-                    0xe0, 0x4b, 0x89, 0x50, 0x41, 0x7f, 0x85, 0xba, 0x57, 0x69, 0x1b, 0x78, 0x3c,
-                    0x45, 0xb1, 0xa2, 0x74, 0x22, 0xdb, 0x16, 0x93, 0xdc, 0xeb, 0x67, 0xb1, 0x01,
-                    0x06, 0x39, 0x58, 0x84, 0x89, 0x03, 0x23, 0xb9, 0xd4, 0x93, 0x3c, 0x02, 0x1d,
-                    0xb8, 0x9b, 0xcf, 0x76, 0x7d, 0xf2, 0x19, 0x77, 0xb2, 0xff, 0x06, 0x83, 0x84,
-                    0x83, 0x21, 0xa4, 0xdf, 0x4a, 0xfb, 0x21, 0x77, 0xc1, 0x7c, 0xb7, 0x5b, 0x77,
-                    0x96, 0xaf, 0xb3, 0x9f, 0x0f, 0x3e, 0x91, 0xc9, 0x24, 0x60, 0x7d, 0xa5, 0x6f,
-                    0xa9, 0xa2, 0x0e, 0x28, 0x35, 0x09, 0xbc, 0x8a, 0x3e, 0xf9, 0x96, 0xa1, 0x72,
-                ],
-                fp: [
-                    0x14, 0xc2, 0x71, 0x3a, 0xdc, 0xe9, 0x3a, 0x83, 0x0e, 0xa8, 0x3a, 0x05, 0x19,
-                    0x08, 0xb7, 0x44, 0x77, 0x83, 0xf5, 0xd1, 0x06, 0xc0, 0x98, 0x5e, 0x02, 0x55,
-                    0x0e, 0x42, 0x6f, 0x27, 0x59, 0x7c,
-                ],
-                d0: Some([
-                    0xd8, 0x62, 0x1b, 0x98, 0x1c, 0xf3, 0x00, 0xe9, 0xd4, 0xcc, 0x89,
-                ]),
-                d1: Some([
-                    0x48, 0xea, 0x17, 0xa1, 0x99, 0xc8, 0x4b, 0xd1, 0xba, 0xa5, 0xd4,
-                ]),
-                d2: None,
-                dmax: None,
-                internal_nsk: Some([
-                    0x51, 0x12, 0x33, 0x63, 0x6b, 0x95, 0xfd, 0x0a, 0xfb, 0x6b, 0xf8, 0x19, 0x3a,
-                    0x7d, 0x8f, 0x49, 0xef, 0xd7, 0x36, 0xa9, 0x88, 0x77, 0x5c, 0x54, 0xf9, 0x56,
-                    0x68, 0x76, 0x46, 0xea, 0xab, 0x07,
-                ]),
-                internal_ovk: [
-                    0x9d, 0xc4, 0x77, 0xfe, 0x1e, 0x7d, 0x28, 0x29, 0x13, 0xf6, 0x51, 0x65, 0x4d,
-                    0x39, 0x85, 0xf0, 0x9d, 0x53, 0xc2, 0xd3, 0xb5, 0x76, 0x3d, 0x7a, 0x72, 0x3b,
-                    0xcb, 0xd6, 0xee, 0x05, 0x3d, 0x5a,
-                ],
-                internal_dk: [
-                    0x40, 0xdd, 0xc5, 0x6e, 0x69, 0x75, 0x13, 0x8c, 0x08, 0x39, 0xe5, 0x80, 0xb5,
-                    0x4d, 0x6d, 0x99, 0x9d, 0xc6, 0x16, 0x84, 0x3c, 0xfe, 0x04, 0x1e, 0x8f, 0x38,
-                    0x8b, 0x12, 0x4e, 0xf7, 0xb5, 0xed,
-                ],
-                internal_nk: [
-                    0xa3, 0x83, 0x1a, 0x5c, 0x69, 0x33, 0xf8, 0xec, 0x6a, 0xa5, 0xce, 0x31, 0x6c,
-                    0x50, 0x8b, 0x79, 0x91, 0xcd, 0x94, 0xd3, 0xbd, 0xb7, 0x00, 0xa1, 0xc4, 0x27,
-                    0xa6, 0xae, 0x15, 0xe7, 0x2f, 0xb5,
-                ],
-                internal_ivk: [
-                    0x79, 0x05, 0x77, 0x32, 0x1c, 0x51, 0x18, 0x04, 0x63, 0x6e, 0xe6, 0xba, 0xa4,
-                    0xee, 0xa7, 0x79, 0xb4, 0xa4, 0x6a, 0x5a, 0x12, 0xf8, 0x5d, 0x36, 0x50, 0x74,
-                    0xa0, 0x9d, 0x05, 0x4f, 0x34, 0x01,
-                ],
-                internal_xsk: Some([
-                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x94, 0x7c, 0x4b,
-                    0x03, 0xbf, 0x72, 0xa3, 0x7a, 0xb4, 0x4f, 0x72, 0x27, 0x6d, 0x1c, 0xf3, 0xfd,
-                    0xcd, 0x7e, 0xbf, 0x3e, 0x73, 0x34, 0x8b, 0x7e, 0x55, 0x0d, 0x75, 0x20, 0x18,
-                    0x66, 0x8e, 0xb6, 0xc0, 0x0c, 0x93, 0xd3, 0x60, 0x32, 0xb9, 0xa2, 0x68, 0xe9,
-                    0x9e, 0x86, 0xa8, 0x60, 0x77, 0x65, 0x60, 0xbf, 0x0e, 0x83, 0xc1, 0xa1, 0x0b,
-                    0x51, 0xf6, 0x07, 0xc9, 0x54, 0x74, 0x25, 0x06, 0x51, 0x12, 0x33, 0x63, 0x6b,
-                    0x95, 0xfd, 0x0a, 0xfb, 0x6b, 0xf8, 0x19, 0x3a, 0x7d, 0x8f, 0x49, 0xef, 0xd7,
-                    0x36, 0xa9, 0x88, 0x77, 0x5c, 0x54, 0xf9, 0x56, 0x68, 0x76, 0x46, 0xea, 0xab,
-                    0x07, 0x9d, 0xc4, 0x77, 0xfe, 0x1e, 0x7d, 0x28, 0x29, 0x13, 0xf6, 0x51, 0x65,
-                    0x4d, 0x39, 0x85, 0xf0, 0x9d, 0x53, 0xc2, 0xd3, 0xb5, 0x76, 0x3d, 0x7a, 0x72,
-                    0x3b, 0xcb, 0xd6, 0xee, 0x05, 0x3d, 0x5a, 0x40, 0xdd, 0xc5, 0x6e, 0x69, 0x75,
-                    0x13, 0x8c, 0x08, 0x39, 0xe5, 0x80, 0xb5, 0x4d, 0x6d, 0x99, 0x9d, 0xc6, 0x16,
-                    0x84, 0x3c, 0xfe, 0x04, 0x1e, 0x8f, 0x38, 0x8b, 0x12, 0x4e, 0xf7, 0xb5, 0xed,
-                ]),
-                internal_xfvk: [
-                    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x94, 0x7c, 0x4b,
-                    0x03, 0xbf, 0x72, 0xa3, 0x7a, 0xb4, 0x4f, 0x72, 0x27, 0x6d, 0x1c, 0xf3, 0xfd,
-                    0xcd, 0x7e, 0xbf, 0x3e, 0x73, 0x34, 0x8b, 0x7e, 0x55, 0x0d, 0x75, 0x20, 0x18,
-                    0x66, 0x8e, 0x93, 0x44, 0x2e, 0x5f, 0xef, 0xfb, 0xff, 0x16, 0xe7, 0x21, 0x72,
-                    0x02, 0xdc, 0x73, 0x06, 0x72, 0x9f, 0xff, 0xfe, 0x85, 0xaf, 0x56, 0x83, 0xbc,
-                    0xe2, 0x64, 0x2e, 0x3e, 0xeb, 0x5d, 0x38, 0x71, 0xa3, 0x83, 0x1a, 0x5c, 0x69,
-                    0x33, 0xf8, 0xec, 0x6a, 0xa5, 0xce, 0x31, 0x6c, 0x50, 0x8b, 0x79, 0x91, 0xcd,
-                    0x94, 0xd3, 0xbd, 0xb7, 0x00, 0xa1, 0xc4, 0x27, 0xa6, 0xae, 0x15, 0xe7, 0x2f,
-                    0xb5, 0x9d, 0xc4, 0x77, 0xfe, 0x1e, 0x7d, 0x28, 0x29, 0x13, 0xf6, 0x51, 0x65,
-                    0x4d, 0x39, 0x85, 0xf0, 0x9d, 0x53, 0xc2, 0xd3, 0xb5, 0x76, 0x3d, 0x7a, 0x72,
-                    0x3b, 0xcb, 0xd6, 0xee, 0x05, 0x3d, 0x5a, 0x40, 0xdd, 0xc5, 0x6e, 0x69, 0x75,
-                    0x13, 0x8c, 0x08, 0x39, 0xe5, 0x80, 0xb5, 0x4d, 0x6d, 0x99, 0x9d, 0xc6, 0x16,
-                    0x84, 0x3c, 0xfe, 0x04, 0x1e, 0x8f, 0x38, 0x8b, 0x12, 0x4e, 0xf7, 0xb5, 0xed,
-                ],
-                internal_fp: [
-                    0x82, 0x64, 0xed, 0xec, 0x63, 0xb1, 0x55, 0x00, 0x1d, 0x84, 0x96, 0x68, 0x5c,
-                    0xc7, 0xc2, 0x1e, 0xa9, 0x57, 0xc6, 0xf5, 0x91, 0x09, 0x0a, 0x1c, 0x20, 0xe5,
-                    0x2a, 0x41, 0x89, 0xb8, 0xbb, 0x96,
-                ],
-            },
-            TestVector {
-                ask: Some([
-                    0x28, 0x2b, 0xc1, 0x97, 0xa5, 0x16, 0x28, 0x7c, 0x8e, 0xa8, 0xf6, 0x8c, 0x42,
-                    0x4a, 0xba, 0xd3, 0x02, 0xb4, 0x5c, 0xdf, 0x95, 0x40, 0x79, 0x61, 0xd7, 0xb8,
-                    0xb4, 0x55, 0x26, 0x7a, 0x35, 0x0c,
-                ]),
-                nsk: Some([
-                    0xe7, 0xa3, 0x29, 0x88, 0xfd, 0xca, 0x1e, 0xfc, 0xd6, 0xd1, 0xc4, 0xc5, 0x62,
-                    0xe6, 0x29, 0xc2, 0xe9, 0x6b, 0x2c, 0x3f, 0x7e, 0xda, 0x04, 0xac, 0x4e, 0xfd,
-                    0x18, 0x10, 0xff, 0x6b, 0xba, 0x01,
-                ]),
-                ovk: [
-                    0x5f, 0x13, 0x81, 0xfc, 0x88, 0x86, 0xda, 0x6a, 0x02, 0xdf, 0xfe, 0xef, 0xcf,
-                    0x50, 0x3c, 0x40, 0xfa, 0x8f, 0x5a, 0x36, 0xf7, 0xa7, 0x14, 0x2f, 0xd8, 0x1b,
-                    0x55, 0x18, 0xc5, 0xa4, 0x74, 0x74,
-                ],
-                dk: [
-                    0xe0, 0x4d, 0xe8, 0x32, 0xa2, 0xd7, 0x91, 0xec, 0x12, 0x9a, 0xb9, 0x00, 0x2b,
-                    0x91, 0xc9, 0xe9, 0xcd, 0xee, 0xd7, 0x92, 0x41, 0xa7, 0xc4, 0x96, 0x0e, 0x51,
-                    0x78, 0xd8, 0x70, 0xc1, 0xb4, 0xdc,
-                ],
-                c: [
-                    0x01, 0x47, 0x11, 0x0c, 0x69, 0x1a, 0x03, 0xb9, 0xd9, 0xf0, 0xba, 0x90, 0x05,
-                    0xc5, 0xe7, 0x90, 0xa5, 0x95, 0xb7, 0xf0, 0x4e, 0x33, 0x29, 0xd2, 0xfa, 0x43,
-                    0x8a, 0x67, 0x05, 0xda, 0xbc, 0xe6,
-                ],
-                ak: [
-                    0xdc, 0x14, 0xb5, 0x14, 0xd3, 0xa9, 0x25, 0x94, 0xc2, 0x19, 0x25, 0xaf, 0x2f,
-                    0x77, 0x65, 0xa5, 0x47, 0xb3, 0x0e, 0x73, 0xfa, 0x7b, 0x70, 0x0e, 0xa1, 0xbf,
-                    0xf2, 0xe5, 0xef, 0xaa, 0xa8, 0x8b,
-                ],
-                nk: [
-                    0x61, 0x52, 0xeb, 0x7f, 0xdb, 0x25, 0x27, 0x79, 0xdd, 0xcb, 0x95, 0xd2, 0x17,
-                    0xea, 0x4b, 0x6f, 0xd3, 0x40, 0x36, 0xe9, 0xad, 0xad, 0xb3, 0xb5, 0xc9, 0xcb,
-                    0xec, 0xeb, 0x41, 0xba, 0x45, 0x2a,
-                ],
-                ivk: [
-                    0x15, 0x5a, 0x8e, 0xe2, 0x05, 0xd3, 0x87, 0x2d, 0x12, 0xf8, 0xa3, 0xe6, 0x39,
-                    0x91, 0x46, 0x33, 0xc2, 0x3c, 0xde, 0x1f, 0x30, 0xed, 0x50, 0x51, 0xe5, 0x21,
-                    0x30, 0xb1, 0xd0, 0x10, 0x4c, 0x06,
-                ],
-                xsk: Some([
-                    0x01, 0x14, 0xc2, 0x71, 0x3a, 0x01, 0x00, 0x00, 0x00, 0x01, 0x47, 0x11, 0x0c,
-                    0x69, 0x1a, 0x03, 0xb9, 0xd9, 0xf0, 0xba, 0x90, 0x05, 0xc5, 0xe7, 0x90, 0xa5,
-                    0x95, 0xb7, 0xf0, 0x4e, 0x33, 0x29, 0xd2, 0xfa, 0x43, 0x8a, 0x67, 0x05, 0xda,
-                    0xbc, 0xe6, 0x28, 0x2b, 0xc1, 0x97, 0xa5, 0x16, 0x28, 0x7c, 0x8e, 0xa8, 0xf6,
-                    0x8c, 0x42, 0x4a, 0xba, 0xd3, 0x02, 0xb4, 0x5c, 0xdf, 0x95, 0x40, 0x79, 0x61,
-                    0xd7, 0xb8, 0xb4, 0x55, 0x26, 0x7a, 0x35, 0x0c, 0xe7, 0xa3, 0x29, 0x88, 0xfd,
-                    0xca, 0x1e, 0xfc, 0xd6, 0xd1, 0xc4, 0xc5, 0x62, 0xe6, 0x29, 0xc2, 0xe9, 0x6b,
-                    0x2c, 0x3f, 0x7e, 0xda, 0x04, 0xac, 0x4e, 0xfd, 0x18, 0x10, 0xff, 0x6b, 0xba,
-                    0x01, 0x5f, 0x13, 0x81, 0xfc, 0x88, 0x86, 0xda, 0x6a, 0x02, 0xdf, 0xfe, 0xef,
-                    0xcf, 0x50, 0x3c, 0x40, 0xfa, 0x8f, 0x5a, 0x36, 0xf7, 0xa7, 0x14, 0x2f, 0xd8,
-                    0x1b, 0x55, 0x18, 0xc5, 0xa4, 0x74, 0x74, 0xe0, 0x4d, 0xe8, 0x32, 0xa2, 0xd7,
-                    0x91, 0xec, 0x12, 0x9a, 0xb9, 0x00, 0x2b, 0x91, 0xc9, 0xe9, 0xcd, 0xee, 0xd7,
-                    0x92, 0x41, 0xa7, 0xc4, 0x96, 0x0e, 0x51, 0x78, 0xd8, 0x70, 0xc1, 0xb4, 0xdc,
-                ]),
-                xfvk: [
-                    0x01, 0x14, 0xc2, 0x71, 0x3a, 0x01, 0x00, 0x00, 0x00, 0x01, 0x47, 0x11, 0x0c,
-                    0x69, 0x1a, 0x03, 0xb9, 0xd9, 0xf0, 0xba, 0x90, 0x05, 0xc5, 0xe7, 0x90, 0xa5,
-                    0x95, 0xb7, 0xf0, 0x4e, 0x33, 0x29, 0xd2, 0xfa, 0x43, 0x8a, 0x67, 0x05, 0xda,
-                    0xbc, 0xe6, 0xdc, 0x14, 0xb5, 0x14, 0xd3, 0xa9, 0x25, 0x94, 0xc2, 0x19, 0x25,
-                    0xaf, 0x2f, 0x77, 0x65, 0xa5, 0x47, 0xb3, 0x0e, 0x73, 0xfa, 0x7b, 0x70, 0x0e,
-                    0xa1, 0xbf, 0xf2, 0xe5, 0xef, 0xaa, 0xa8, 0x8b, 0x61, 0x52, 0xeb, 0x7f, 0xdb,
-                    0x25, 0x27, 0x79, 0xdd, 0xcb, 0x95, 0xd2, 0x17, 0xea, 0x4b, 0x6f, 0xd3, 0x40,
-                    0x36, 0xe9, 0xad, 0xad, 0xb3, 0xb5, 0xc9, 0xcb, 0xec, 0xeb, 0x41, 0xba, 0x45,
-                    0x2a, 0x5f, 0x13, 0x81, 0xfc, 0x88, 0x86, 0xda, 0x6a, 0x02, 0xdf, 0xfe, 0xef,
-                    0xcf, 0x50, 0x3c, 0x40, 0xfa, 0x8f, 0x5a, 0x36, 0xf7, 0xa7, 0x14, 0x2f, 0xd8,
-                    0x1b, 0x55, 0x18, 0xc5, 0xa4, 0x74, 0x74, 0xe0, 0x4d, 0xe8, 0x32, 0xa2, 0xd7,
-                    0x91, 0xec, 0x12, 0x9a, 0xb9, 0x00, 0x2b, 0x91, 0xc9, 0xe9, 0xcd, 0xee, 0xd7,
-                    0x92, 0x41, 0xa7, 0xc4, 0x96, 0x0e, 0x51, 0x78, 0xd8, 0x70, 0xc1, 0xb4, 0xdc,
-                ],
-                fp: [
-                    0xdb, 0x99, 0x9e, 0x07, 0x1d, 0xcb, 0x58, 0xdd, 0x93, 0x02, 0x9a, 0xe6, 0x97,
-                    0x05, 0x3e, 0x90, 0xed, 0xb3, 0x59, 0xd1, 0xa1, 0xb7, 0xa1, 0x25, 0x16, 0x7e,
-                    0xfb, 0xe9, 0x28, 0x06, 0x84, 0x23,
-                ],
-                d0: Some([
-                    0x8b, 0x41, 0x38, 0x32, 0x0d, 0xfa, 0xfd, 0x7b, 0x39, 0x97, 0x81,
-                ]),
-                d1: None,
-                d2: Some([
-                    0x57, 0x49, 0xa1, 0x33, 0x52, 0xbc, 0x22, 0x3e, 0x30, 0x80, 0x78,
-                ]),
-                dmax: Some([
-                    0x63, 0x89, 0x57, 0x4c, 0xde, 0x0f, 0xbb, 0xc6, 0x36, 0x81, 0x31,
-                ]),
-                internal_nsk: Some([
-                    0x74, 0x92, 0x9f, 0x79, 0x0c, 0x11, 0xdc, 0xab, 0x3a, 0x2f, 0x93, 0x12, 0x35,
-                    0xcd, 0xb2, 0x67, 0xf5, 0xa3, 0x1b, 0x9f, 0x13, 0x9f, 0x2c, 0x9f, 0xd8, 0x16,
-                    0xb0, 0x44, 0x4f, 0xb8, 0x05, 0x05,
-                ]),
-                internal_ovk: [
-                    0x0c, 0xd4, 0xd7, 0xc5, 0xcc, 0x7f, 0x53, 0x4b, 0x96, 0xd2, 0x41, 0x82, 0xa3,
-                    0x14, 0x65, 0xb4, 0x78, 0x11, 0x05, 0x48, 0x9c, 0xd1, 0x0d, 0x50, 0x0c, 0xf5,
-                    0x29, 0x5a, 0x6f, 0xd8, 0x18, 0xcc,
-                ],
-                internal_dk: [
-                    0xd2, 0x78, 0xb7, 0x2c, 0x62, 0x1d, 0x19, 0xcb, 0x00, 0xf9, 0x70, 0x07, 0x9c,
-                    0x89, 0x22, 0x76, 0x1c, 0xdd, 0x3a, 0xe7, 0xf2, 0x7b, 0x18, 0x47, 0xc5, 0x53,
-                    0x60, 0xdb, 0xeb, 0xf6, 0x54, 0x92,
-                ],
-                internal_nk: [
-                    0x2b, 0x5c, 0x78, 0xa2, 0xfb, 0xa5, 0x01, 0x9c, 0x15, 0xa7, 0x51, 0x50, 0x2b,
-                    0xa9, 0x91, 0x6f, 0xae, 0xda, 0xe1, 0xfc, 0x14, 0xdc, 0x81, 0xb0, 0xb8, 0x35,
-                    0xf2, 0xbf, 0x95, 0xc0, 0x68, 0xe8,
-                ],
-                internal_ivk: [
-                    0xdf, 0x44, 0x54, 0xa6, 0x76, 0xd1, 0xde, 0x32, 0xe2, 0x0a, 0xe6, 0x28, 0x7a,
-                    0x92, 0xfa, 0xfe, 0xfb, 0xbb, 0x3e, 0x54, 0xb5, 0x88, 0xc8, 0xda, 0x28, 0x07,
-                    0xec, 0x43, 0x68, 0x2c, 0x85, 0x00,
-                ],
-                internal_xsk: Some([
-                    0x01, 0x14, 0xc2, 0x71, 0x3a, 0x01, 0x00, 0x00, 0x00, 0x01, 0x47, 0x11, 0x0c,
-                    0x69, 0x1a, 0x03, 0xb9, 0xd9, 0xf0, 0xba, 0x90, 0x05, 0xc5, 0xe7, 0x90, 0xa5,
-                    0x95, 0xb7, 0xf0, 0x4e, 0x33, 0x29, 0xd2, 0xfa, 0x43, 0x8a, 0x67, 0x05, 0xda,
-                    0xbc, 0xe6, 0x28, 0x2b, 0xc1, 0x97, 0xa5, 0x16, 0x28, 0x7c, 0x8e, 0xa8, 0xf6,
-                    0x8c, 0x42, 0x4a, 0xba, 0xd3, 0x02, 0xb4, 0x5c, 0xdf, 0x95, 0x40, 0x79, 0x61,
-                    0xd7, 0xb8, 0xb4, 0x55, 0x26, 0x7a, 0x35, 0x0c, 0x74, 0x92, 0x9f, 0x79, 0x0c,
-                    0x11, 0xdc, 0xab, 0x3a, 0x2f, 0x93, 0x12, 0x35, 0xcd, 0xb2, 0x67, 0xf5, 0xa3,
-                    0x1b, 0x9f, 0x13, 0x9f, 0x2c, 0x9f, 0xd8, 0x16, 0xb0, 0x44, 0x4f, 0xb8, 0x05,
-                    0x05, 0x0c, 0xd4, 0xd7, 0xc5, 0xcc, 0x7f, 0x53, 0x4b, 0x96, 0xd2, 0x41, 0x82,
-                    0xa3, 0x14, 0x65, 0xb4, 0x78, 0x11, 0x05, 0x48, 0x9c, 0xd1, 0x0d, 0x50, 0x0c,
-                    0xf5, 0x29, 0x5a, 0x6f, 0xd8, 0x18, 0xcc, 0xd2, 0x78, 0xb7, 0x2c, 0x62, 0x1d,
-                    0x19, 0xcb, 0x00, 0xf9, 0x70, 0x07, 0x9c, 0x89, 0x22, 0x76, 0x1c, 0xdd, 0x3a,
-                    0xe7, 0xf2, 0x7b, 0x18, 0x47, 0xc5, 0x53, 0x60, 0xdb, 0xeb, 0xf6, 0x54, 0x92,
-                ]),
-                internal_xfvk: [
-                    0x01, 0x14, 0xc2, 0x71, 0x3a, 0x01, 0x00, 0x00, 0x00, 0x01, 0x47, 0x11, 0x0c,
-                    0x69, 0x1a, 0x03, 0xb9, 0xd9, 0xf0, 0xba, 0x90, 0x05, 0xc5, 0xe7, 0x90, 0xa5,
-                    0x95, 0xb7, 0xf0, 0x4e, 0x33, 0x29, 0xd2, 0xfa, 0x43, 0x8a, 0x67, 0x05, 0xda,
-                    0xbc, 0xe6, 0xdc, 0x14, 0xb5, 0x14, 0xd3, 0xa9, 0x25, 0x94, 0xc2, 0x19, 0x25,
-                    0xaf, 0x2f, 0x77, 0x65, 0xa5, 0x47, 0xb3, 0x0e, 0x73, 0xfa, 0x7b, 0x70, 0x0e,
-                    0xa1, 0xbf, 0xf2, 0xe5, 0xef, 0xaa, 0xa8, 0x8b, 0x2b, 0x5c, 0x78, 0xa2, 0xfb,
-                    0xa5, 0x01, 0x9c, 0x15, 0xa7, 0x51, 0x50, 0x2b, 0xa9, 0x91, 0x6f, 0xae, 0xda,
-                    0xe1, 0xfc, 0x14, 0xdc, 0x81, 0xb0, 0xb8, 0x35, 0xf2, 0xbf, 0x95, 0xc0, 0x68,
-                    0xe8, 0x0c, 0xd4, 0xd7, 0xc5, 0xcc, 0x7f, 0x53, 0x4b, 0x96, 0xd2, 0x41, 0x82,
-                    0xa3, 0x14, 0x65, 0xb4, 0x78, 0x11, 0x05, 0x48, 0x9c, 0xd1, 0x0d, 0x50, 0x0c,
-                    0xf5, 0x29, 0x5a, 0x6f, 0xd8, 0x18, 0xcc, 0xd2, 0x78, 0xb7, 0x2c, 0x62, 0x1d,
-                    0x19, 0xcb, 0x00, 0xf9, 0x70, 0x07, 0x9c, 0x89, 0x22, 0x76, 0x1c, 0xdd, 0x3a,
-                    0xe7, 0xf2, 0x7b, 0x18, 0x47, 0xc5, 0x53, 0x60, 0xdb, 0xeb, 0xf6, 0x54, 0x92,
-                ],
-                internal_fp: [
-                    0x0d, 0xe5, 0x83, 0xca, 0x50, 0x2b, 0x1c, 0x4b, 0x87, 0xca, 0xc8, 0xc9, 0x78,
-                    0x6c, 0x61, 0x9b, 0x79, 0xe1, 0x69, 0xb4, 0x15, 0x61, 0xf2, 0x44, 0xee, 0xec,
-                    0x86, 0x86, 0xb8, 0xdb, 0xc4, 0xe1,
-                ],
-            },
-            TestVector {
-                ask: Some([
-                    0x8b, 0xe8, 0x11, 0x3c, 0xee, 0x34, 0x13, 0xa7, 0x1f, 0x82, 0xc4, 0x1f, 0xc8,
-                    0xda, 0x51, 0x7b, 0xe1, 0x34, 0x04, 0x98, 0x32, 0xe6, 0x82, 0x5c, 0x92, 0xda,
-                    0x6b, 0x84, 0xfe, 0xe4, 0xc6, 0x0d,
-                ]),
-                nsk: Some([
-                    0x37, 0x78, 0x05, 0x9d, 0xc5, 0x69, 0xe7, 0xd0, 0xd3, 0x23, 0x91, 0x57, 0x3f,
-                    0x95, 0x1b, 0xbd, 0xe9, 0x2f, 0xc6, 0xb9, 0xcf, 0x61, 0x47, 0x73, 0x66, 0x1c,
-                    0x5c, 0x27, 0x3a, 0xa6, 0x99, 0x0c,
-                ]),
-                ovk: [
-                    0xcf, 0x81, 0x18, 0x2e, 0x96, 0x22, 0x3c, 0x02, 0x8c, 0xe3, 0xd6, 0xeb, 0x47,
-                    0x94, 0xd3, 0x11, 0x3b, 0x95, 0x06, 0x9d, 0x14, 0xc5, 0x75, 0x88, 0xe1, 0x93,
-                    0xb6, 0x5e, 0xfc, 0x28, 0x13, 0xbc,
-                ],
-                dk: [
-                    0xa3, 0xed, 0xa1, 0x9f, 0x9e, 0xff, 0x46, 0xca, 0x12, 0xdf, 0xa1, 0xbf, 0x10,
-                    0x37, 0x1b, 0x48, 0xd1, 0xb4, 0xa4, 0x0c, 0x4d, 0x05, 0xa0, 0xd8, 0xdc, 0xe0,
-                    0xe7, 0xdc, 0x62, 0xb0, 0x7b, 0x37,
-                ],
-                c: [
-                    0x97, 0xce, 0x15, 0xf4, 0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b,
-                    0xcb, 0x3d, 0xc9, 0xb3, 0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42,
-                    0x77, 0x73, 0x83, 0xa8, 0xd4, 0x35,
-                ],
-                ak: [
-                    0xa6, 0xc5, 0x92, 0x5a, 0x0f, 0x85, 0xfa, 0x4f, 0x1e, 0x40, 0x5e, 0x3a, 0x49,
-                    0x70, 0xd0, 0xc4, 0xa4, 0xb4, 0x81, 0x44, 0x38, 0xf4, 0xe9, 0xd4, 0x52, 0x0e,
-                    0x20, 0xf7, 0xfd, 0xcf, 0x38, 0x41,
-                ],
-                nk: [
-                    0x30, 0x4e, 0x30, 0x59, 0x16, 0x21, 0x6b, 0xeb, 0x7b, 0x65, 0x4d, 0x8a, 0xae,
-                    0x50, 0xec, 0xd1, 0x88, 0xfc, 0xb3, 0x84, 0xbc, 0x36, 0xc0, 0x0c, 0x66, 0x4f,
-                    0x30, 0x77, 0x25, 0xe2, 0xee, 0x11,
-                ],
-                ivk: [
-                    0xa2, 0xa1, 0x3c, 0x1e, 0x38, 0xb4, 0x59, 0x84, 0x44, 0x58, 0x03, 0xe4, 0x30,
-                    0xa6, 0x83, 0xc9, 0x0b, 0xb2, 0xe1, 0x4d, 0x4c, 0x86, 0x92, 0xff, 0x25, 0x3a,
-                    0x64, 0x84, 0xdd, 0x9b, 0xb5, 0x04,
-                ],
-                xsk: Some([
-                    0x02, 0xdb, 0x99, 0x9e, 0x07, 0x02, 0x00, 0x00, 0x80, 0x97, 0xce, 0x15, 0xf4,
-                    0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b, 0xcb, 0x3d, 0xc9, 0xb3,
-                    0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42, 0x77, 0x73, 0x83, 0xa8,
-                    0xd4, 0x35, 0x8b, 0xe8, 0x11, 0x3c, 0xee, 0x34, 0x13, 0xa7, 0x1f, 0x82, 0xc4,
-                    0x1f, 0xc8, 0xda, 0x51, 0x7b, 0xe1, 0x34, 0x04, 0x98, 0x32, 0xe6, 0x82, 0x5c,
-                    0x92, 0xda, 0x6b, 0x84, 0xfe, 0xe4, 0xc6, 0x0d, 0x37, 0x78, 0x05, 0x9d, 0xc5,
-                    0x69, 0xe7, 0xd0, 0xd3, 0x23, 0x91, 0x57, 0x3f, 0x95, 0x1b, 0xbd, 0xe9, 0x2f,
-                    0xc6, 0xb9, 0xcf, 0x61, 0x47, 0x73, 0x66, 0x1c, 0x5c, 0x27, 0x3a, 0xa6, 0x99,
-                    0x0c, 0xcf, 0x81, 0x18, 0x2e, 0x96, 0x22, 0x3c, 0x02, 0x8c, 0xe3, 0xd6, 0xeb,
-                    0x47, 0x94, 0xd3, 0x11, 0x3b, 0x95, 0x06, 0x9d, 0x14, 0xc5, 0x75, 0x88, 0xe1,
-                    0x93, 0xb6, 0x5e, 0xfc, 0x28, 0x13, 0xbc, 0xa3, 0xed, 0xa1, 0x9f, 0x9e, 0xff,
-                    0x46, 0xca, 0x12, 0xdf, 0xa1, 0xbf, 0x10, 0x37, 0x1b, 0x48, 0xd1, 0xb4, 0xa4,
-                    0x0c, 0x4d, 0x05, 0xa0, 0xd8, 0xdc, 0xe0, 0xe7, 0xdc, 0x62, 0xb0, 0x7b, 0x37,
-                ]),
-                xfvk: [
-                    0x02, 0xdb, 0x99, 0x9e, 0x07, 0x02, 0x00, 0x00, 0x80, 0x97, 0xce, 0x15, 0xf4,
-                    0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b, 0xcb, 0x3d, 0xc9, 0xb3,
-                    0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42, 0x77, 0x73, 0x83, 0xa8,
-                    0xd4, 0x35, 0xa6, 0xc5, 0x92, 0x5a, 0x0f, 0x85, 0xfa, 0x4f, 0x1e, 0x40, 0x5e,
-                    0x3a, 0x49, 0x70, 0xd0, 0xc4, 0xa4, 0xb4, 0x81, 0x44, 0x38, 0xf4, 0xe9, 0xd4,
-                    0x52, 0x0e, 0x20, 0xf7, 0xfd, 0xcf, 0x38, 0x41, 0x30, 0x4e, 0x30, 0x59, 0x16,
-                    0x21, 0x6b, 0xeb, 0x7b, 0x65, 0x4d, 0x8a, 0xae, 0x50, 0xec, 0xd1, 0x88, 0xfc,
-                    0xb3, 0x84, 0xbc, 0x36, 0xc0, 0x0c, 0x66, 0x4f, 0x30, 0x77, 0x25, 0xe2, 0xee,
-                    0x11, 0xcf, 0x81, 0x18, 0x2e, 0x96, 0x22, 0x3c, 0x02, 0x8c, 0xe3, 0xd6, 0xeb,
-                    0x47, 0x94, 0xd3, 0x11, 0x3b, 0x95, 0x06, 0x9d, 0x14, 0xc5, 0x75, 0x88, 0xe1,
-                    0x93, 0xb6, 0x5e, 0xfc, 0x28, 0x13, 0xbc, 0xa3, 0xed, 0xa1, 0x9f, 0x9e, 0xff,
-                    0x46, 0xca, 0x12, 0xdf, 0xa1, 0xbf, 0x10, 0x37, 0x1b, 0x48, 0xd1, 0xb4, 0xa4,
-                    0x0c, 0x4d, 0x05, 0xa0, 0xd8, 0xdc, 0xe0, 0xe7, 0xdc, 0x62, 0xb0, 0x7b, 0x37,
-                ],
-                fp: [
-                    0x48, 0xc1, 0x83, 0x75, 0x7b, 0x5d, 0xa6, 0x61, 0x2a, 0x81, 0xb3, 0x0e, 0x40,
-                    0xb4, 0xac, 0xaa, 0x2d, 0x9e, 0x73, 0x95, 0x12, 0xe1, 0xd2, 0xd0, 0x01, 0x0e,
-                    0x92, 0xa7, 0xf7, 0xf2, 0xfc, 0xdf,
-                ],
-                d0: Some([
-                    0xe8, 0xd0, 0x37, 0x93, 0xcd, 0xd2, 0xba, 0xcc, 0x9c, 0x70, 0x41,
-                ]),
-                d1: Some([
-                    0x02, 0x0a, 0x7a, 0x6b, 0x0b, 0xf8, 0x4d, 0x3e, 0x89, 0x9f, 0x68,
-                ]),
-                d2: None,
-                dmax: None,
-                internal_nsk: Some([
-                    0x34, 0x78, 0x65, 0xac, 0xf4, 0x7e, 0x50, 0x45, 0x38, 0xf5, 0xef, 0x8b, 0x04,
-                    0x70, 0x20, 0x80, 0xe6, 0x09, 0x1c, 0xda, 0x57, 0x97, 0xcd, 0x7d, 0x23, 0x5a,
-                    0x54, 0x6e, 0xb1, 0x0f, 0x55, 0x08,
-                ]),
-                internal_ovk: [
-                    0xdd, 0xba, 0xc2, 0xa4, 0x93, 0xf5, 0x3c, 0x3b, 0x09, 0x33, 0xd9, 0x13, 0xde,
-                    0xf8, 0x88, 0x48, 0x65, 0x4c, 0x08, 0x7c, 0x12, 0x60, 0x9d, 0xf0, 0x1b, 0xaf,
-                    0x94, 0x05, 0xce, 0x78, 0x04, 0xfd,
-                ],
-                internal_dk: [
-                    0x60, 0x2c, 0xd3, 0x17, 0xb7, 0xce, 0xa1, 0x1e, 0x8c, 0xc7, 0xae, 0x2e, 0xa4,
-                    0x05, 0xb4, 0x0d, 0x46, 0xb1, 0x59, 0x2a, 0x30, 0xf0, 0xcb, 0x6e, 0x8c, 0x4f,
-                    0x17, 0xd7, 0xf7, 0xc4, 0x7f, 0xeb,
-                ],
-                internal_nk: [
-                    0xf9, 0x12, 0x87, 0xc0, 0x6e, 0x30, 0xb6, 0x5e, 0xa1, 0xbd, 0xb7, 0x16, 0xb2,
-                    0x31, 0xde, 0x67, 0x78, 0xa5, 0xd8, 0x0e, 0xe5, 0xcd, 0x9c, 0x06, 0x0d, 0x1a,
-                    0xba, 0xca, 0xe0, 0xaa, 0xe2, 0x3b,
-                ],
-                internal_ivk: [
-                    0x1d, 0x59, 0xea, 0x20, 0x17, 0x88, 0x18, 0x64, 0xd2, 0x4e, 0xad, 0xb5, 0xcf,
-                    0x34, 0x68, 0xa4, 0x1a, 0x1b, 0x2a, 0xaa, 0x0d, 0x1b, 0x3a, 0x72, 0xc6, 0xda,
-                    0x9c, 0xe6, 0x50, 0x2a, 0x0a, 0x05,
-                ],
-                internal_xsk: Some([
-                    0x02, 0xdb, 0x99, 0x9e, 0x07, 0x02, 0x00, 0x00, 0x80, 0x97, 0xce, 0x15, 0xf4,
-                    0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b, 0xcb, 0x3d, 0xc9, 0xb3,
-                    0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42, 0x77, 0x73, 0x83, 0xa8,
-                    0xd4, 0x35, 0x8b, 0xe8, 0x11, 0x3c, 0xee, 0x34, 0x13, 0xa7, 0x1f, 0x82, 0xc4,
-                    0x1f, 0xc8, 0xda, 0x51, 0x7b, 0xe1, 0x34, 0x04, 0x98, 0x32, 0xe6, 0x82, 0x5c,
-                    0x92, 0xda, 0x6b, 0x84, 0xfe, 0xe4, 0xc6, 0x0d, 0x34, 0x78, 0x65, 0xac, 0xf4,
-                    0x7e, 0x50, 0x45, 0x38, 0xf5, 0xef, 0x8b, 0x04, 0x70, 0x20, 0x80, 0xe6, 0x09,
-                    0x1c, 0xda, 0x57, 0x97, 0xcd, 0x7d, 0x23, 0x5a, 0x54, 0x6e, 0xb1, 0x0f, 0x55,
-                    0x08, 0xdd, 0xba, 0xc2, 0xa4, 0x93, 0xf5, 0x3c, 0x3b, 0x09, 0x33, 0xd9, 0x13,
-                    0xde, 0xf8, 0x88, 0x48, 0x65, 0x4c, 0x08, 0x7c, 0x12, 0x60, 0x9d, 0xf0, 0x1b,
-                    0xaf, 0x94, 0x05, 0xce, 0x78, 0x04, 0xfd, 0x60, 0x2c, 0xd3, 0x17, 0xb7, 0xce,
-                    0xa1, 0x1e, 0x8c, 0xc7, 0xae, 0x2e, 0xa4, 0x05, 0xb4, 0x0d, 0x46, 0xb1, 0x59,
-                    0x2a, 0x30, 0xf0, 0xcb, 0x6e, 0x8c, 0x4f, 0x17, 0xd7, 0xf7, 0xc4, 0x7f, 0xeb,
-                ]),
-                internal_xfvk: [
-                    0x02, 0xdb, 0x99, 0x9e, 0x07, 0x02, 0x00, 0x00, 0x80, 0x97, 0xce, 0x15, 0xf4,
-                    0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b, 0xcb, 0x3d, 0xc9, 0xb3,
-                    0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42, 0x77, 0x73, 0x83, 0xa8,
-                    0xd4, 0x35, 0xa6, 0xc5, 0x92, 0x5a, 0x0f, 0x85, 0xfa, 0x4f, 0x1e, 0x40, 0x5e,
-                    0x3a, 0x49, 0x70, 0xd0, 0xc4, 0xa4, 0xb4, 0x81, 0x44, 0x38, 0xf4, 0xe9, 0xd4,
-                    0x52, 0x0e, 0x20, 0xf7, 0xfd, 0xcf, 0x38, 0x41, 0xf9, 0x12, 0x87, 0xc0, 0x6e,
-                    0x30, 0xb6, 0x5e, 0xa1, 0xbd, 0xb7, 0x16, 0xb2, 0x31, 0xde, 0x67, 0x78, 0xa5,
-                    0xd8, 0x0e, 0xe5, 0xcd, 0x9c, 0x06, 0x0d, 0x1a, 0xba, 0xca, 0xe0, 0xaa, 0xe2,
-                    0x3b, 0xdd, 0xba, 0xc2, 0xa4, 0x93, 0xf5, 0x3c, 0x3b, 0x09, 0x33, 0xd9, 0x13,
-                    0xde, 0xf8, 0x88, 0x48, 0x65, 0x4c, 0x08, 0x7c, 0x12, 0x60, 0x9d, 0xf0, 0x1b,
-                    0xaf, 0x94, 0x05, 0xce, 0x78, 0x04, 0xfd, 0x60, 0x2c, 0xd3, 0x17, 0xb7, 0xce,
-                    0xa1, 0x1e, 0x8c, 0xc7, 0xae, 0x2e, 0xa4, 0x05, 0xb4, 0x0d, 0x46, 0xb1, 0x59,
-                    0x2a, 0x30, 0xf0, 0xcb, 0x6e, 0x8c, 0x4f, 0x17, 0xd7, 0xf7, 0xc4, 0x7f, 0xeb,
-                ],
-                internal_fp: [
-                    0x30, 0xfe, 0x0d, 0x61, 0x0f, 0x94, 0x7b, 0x2c, 0x26, 0x0e, 0x7b, 0x29, 0xe7,
-                    0x9e, 0x5c, 0x2e, 0x7d, 0x3e, 0x14, 0xab, 0xf9, 0x79, 0xf6, 0x40, 0x6d, 0x07,
-                    0xba, 0xf8, 0xfa, 0xdd, 0xf4, 0x95,
-                ],
-            },
-            TestVector {
-                ask: None,
-                nsk: None,
-                ovk: [
-                    0xcf, 0x81, 0x18, 0x2e, 0x96, 0x22, 0x3c, 0x02, 0x8c, 0xe3, 0xd6, 0xeb, 0x47,
-                    0x94, 0xd3, 0x11, 0x3b, 0x95, 0x06, 0x9d, 0x14, 0xc5, 0x75, 0x88, 0xe1, 0x93,
-                    0xb6, 0x5e, 0xfc, 0x28, 0x13, 0xbc,
-                ],
-                dk: [
-                    0xa3, 0xed, 0xa1, 0x9f, 0x9e, 0xff, 0x46, 0xca, 0x12, 0xdf, 0xa1, 0xbf, 0x10,
-                    0x37, 0x1b, 0x48, 0xd1, 0xb4, 0xa4, 0x0c, 0x4d, 0x05, 0xa0, 0xd8, 0xdc, 0xe0,
-                    0xe7, 0xdc, 0x62, 0xb0, 0x7b, 0x37,
-                ],
-                c: [
-                    0x97, 0xce, 0x15, 0xf4, 0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b,
-                    0xcb, 0x3d, 0xc9, 0xb3, 0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42,
-                    0x77, 0x73, 0x83, 0xa8, 0xd4, 0x35,
-                ],
-                ak: [
-                    0xa6, 0xc5, 0x92, 0x5a, 0x0f, 0x85, 0xfa, 0x4f, 0x1e, 0x40, 0x5e, 0x3a, 0x49,
-                    0x70, 0xd0, 0xc4, 0xa4, 0xb4, 0x81, 0x44, 0x38, 0xf4, 0xe9, 0xd4, 0x52, 0x0e,
-                    0x20, 0xf7, 0xfd, 0xcf, 0x38, 0x41,
-                ],
-                nk: [
-                    0x30, 0x4e, 0x30, 0x59, 0x16, 0x21, 0x6b, 0xeb, 0x7b, 0x65, 0x4d, 0x8a, 0xae,
-                    0x50, 0xec, 0xd1, 0x88, 0xfc, 0xb3, 0x84, 0xbc, 0x36, 0xc0, 0x0c, 0x66, 0x4f,
-                    0x30, 0x77, 0x25, 0xe2, 0xee, 0x11,
-                ],
-                ivk: [
-                    0xa2, 0xa1, 0x3c, 0x1e, 0x38, 0xb4, 0x59, 0x84, 0x44, 0x58, 0x03, 0xe4, 0x30,
-                    0xa6, 0x83, 0xc9, 0x0b, 0xb2, 0xe1, 0x4d, 0x4c, 0x86, 0x92, 0xff, 0x25, 0x3a,
-                    0x64, 0x84, 0xdd, 0x9b, 0xb5, 0x04,
-                ],
-                xsk: None,
-                xfvk: [
-                    0x02, 0xdb, 0x99, 0x9e, 0x07, 0x02, 0x00, 0x00, 0x80, 0x97, 0xce, 0x15, 0xf4,
-                    0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b, 0xcb, 0x3d, 0xc9, 0xb3,
-                    0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42, 0x77, 0x73, 0x83, 0xa8,
-                    0xd4, 0x35, 0xa6, 0xc5, 0x92, 0x5a, 0x0f, 0x85, 0xfa, 0x4f, 0x1e, 0x40, 0x5e,
-                    0x3a, 0x49, 0x70, 0xd0, 0xc4, 0xa4, 0xb4, 0x81, 0x44, 0x38, 0xf4, 0xe9, 0xd4,
-                    0x52, 0x0e, 0x20, 0xf7, 0xfd, 0xcf, 0x38, 0x41, 0x30, 0x4e, 0x30, 0x59, 0x16,
-                    0x21, 0x6b, 0xeb, 0x7b, 0x65, 0x4d, 0x8a, 0xae, 0x50, 0xec, 0xd1, 0x88, 0xfc,
-                    0xb3, 0x84, 0xbc, 0x36, 0xc0, 0x0c, 0x66, 0x4f, 0x30, 0x77, 0x25, 0xe2, 0xee,
-                    0x11, 0xcf, 0x81, 0x18, 0x2e, 0x96, 0x22, 0x3c, 0x02, 0x8c, 0xe3, 0xd6, 0xeb,
-                    0x47, 0x94, 0xd3, 0x11, 0x3b, 0x95, 0x06, 0x9d, 0x14, 0xc5, 0x75, 0x88, 0xe1,
-                    0x93, 0xb6, 0x5e, 0xfc, 0x28, 0x13, 0xbc, 0xa3, 0xed, 0xa1, 0x9f, 0x9e, 0xff,
-                    0x46, 0xca, 0x12, 0xdf, 0xa1, 0xbf, 0x10, 0x37, 0x1b, 0x48, 0xd1, 0xb4, 0xa4,
-                    0x0c, 0x4d, 0x05, 0xa0, 0xd8, 0xdc, 0xe0, 0xe7, 0xdc, 0x62, 0xb0, 0x7b, 0x37,
-                ],
-                fp: [
-                    0x48, 0xc1, 0x83, 0x75, 0x7b, 0x5d, 0xa6, 0x61, 0x2a, 0x81, 0xb3, 0x0e, 0x40,
-                    0xb4, 0xac, 0xaa, 0x2d, 0x9e, 0x73, 0x95, 0x12, 0xe1, 0xd2, 0xd0, 0x01, 0x0e,
-                    0x92, 0xa7, 0xf7, 0xf2, 0xfc, 0xdf,
-                ],
-                d0: Some([
-                    0xe8, 0xd0, 0x37, 0x93, 0xcd, 0xd2, 0xba, 0xcc, 0x9c, 0x70, 0x41,
-                ]),
-                d1: Some([
-                    0x02, 0x0a, 0x7a, 0x6b, 0x0b, 0xf8, 0x4d, 0x3e, 0x89, 0x9f, 0x68,
-                ]),
-                d2: None,
-                dmax: None,
-                internal_nsk: None,
-                internal_ovk: [
-                    0xdd, 0xba, 0xc2, 0xa4, 0x93, 0xf5, 0x3c, 0x3b, 0x09, 0x33, 0xd9, 0x13, 0xde,
-                    0xf8, 0x88, 0x48, 0x65, 0x4c, 0x08, 0x7c, 0x12, 0x60, 0x9d, 0xf0, 0x1b, 0xaf,
-                    0x94, 0x05, 0xce, 0x78, 0x04, 0xfd,
-                ],
-                internal_dk: [
-                    0x60, 0x2c, 0xd3, 0x17, 0xb7, 0xce, 0xa1, 0x1e, 0x8c, 0xc7, 0xae, 0x2e, 0xa4,
-                    0x05, 0xb4, 0x0d, 0x46, 0xb1, 0x59, 0x2a, 0x30, 0xf0, 0xcb, 0x6e, 0x8c, 0x4f,
-                    0x17, 0xd7, 0xf7, 0xc4, 0x7f, 0xeb,
-                ],
-                internal_nk: [
-                    0xf9, 0x12, 0x87, 0xc0, 0x6e, 0x30, 0xb6, 0x5e, 0xa1, 0xbd, 0xb7, 0x16, 0xb2,
-                    0x31, 0xde, 0x67, 0x78, 0xa5, 0xd8, 0x0e, 0xe5, 0xcd, 0x9c, 0x06, 0x0d, 0x1a,
-                    0xba, 0xca, 0xe0, 0xaa, 0xe2, 0x3b,
-                ],
-                internal_ivk: [
-                    0x1d, 0x59, 0xea, 0x20, 0x17, 0x88, 0x18, 0x64, 0xd2, 0x4e, 0xad, 0xb5, 0xcf,
-                    0x34, 0x68, 0xa4, 0x1a, 0x1b, 0x2a, 0xaa, 0x0d, 0x1b, 0x3a, 0x72, 0xc6, 0xda,
-                    0x9c, 0xe6, 0x50, 0x2a, 0x0a, 0x05,
-                ],
-                internal_xsk: None,
-                internal_xfvk: [
-                    0x02, 0xdb, 0x99, 0x9e, 0x07, 0x02, 0x00, 0x00, 0x80, 0x97, 0xce, 0x15, 0xf4,
-                    0xed, 0x1b, 0x97, 0x39, 0xb0, 0x26, 0x2a, 0x46, 0x3b, 0xcb, 0x3d, 0xc9, 0xb3,
-                    0xbd, 0x23, 0x23, 0xa9, 0xba, 0xa4, 0x41, 0xca, 0x42, 0x77, 0x73, 0x83, 0xa8,
-                    0xd4, 0x35, 0xa6, 0xc5, 0x92, 0x5a, 0x0f, 0x85, 0xfa, 0x4f, 0x1e, 0x40, 0x5e,
-                    0x3a, 0x49, 0x70, 0xd0, 0xc4, 0xa4, 0xb4, 0x81, 0x44, 0x38, 0xf4, 0xe9, 0xd4,
-                    0x52, 0x0e, 0x20, 0xf7, 0xfd, 0xcf, 0x38, 0x41, 0xf9, 0x12, 0x87, 0xc0, 0x6e,
-                    0x30, 0xb6, 0x5e, 0xa1, 0xbd, 0xb7, 0x16, 0xb2, 0x31, 0xde, 0x67, 0x78, 0xa5,
-                    0xd8, 0x0e, 0xe5, 0xcd, 0x9c, 0x06, 0x0d, 0x1a, 0xba, 0xca, 0xe0, 0xaa, 0xe2,
-                    0x3b, 0xdd, 0xba, 0xc2, 0xa4, 0x93, 0xf5, 0x3c, 0x3b, 0x09, 0x33, 0xd9, 0x13,
-                    0xde, 0xf8, 0x88, 0x48, 0x65, 0x4c, 0x08, 0x7c, 0x12, 0x60, 0x9d, 0xf0, 0x1b,
-                    0xaf, 0x94, 0x05, 0xce, 0x78, 0x04, 0xfd, 0x60, 0x2c, 0xd3, 0x17, 0xb7, 0xce,
-                    0xa1, 0x1e, 0x8c, 0xc7, 0xae, 0x2e, 0xa4, 0x05, 0xb4, 0x0d, 0x46, 0xb1, 0x59,
-                    0x2a, 0x30, 0xf0, 0xcb, 0x6e, 0x8c, 0x4f, 0x17, 0xd7, 0xf7, 0xc4, 0x7f, 0xeb,
-                ],
-                internal_fp: [
-                    0x30, 0xfe, 0x0d, 0x61, 0x0f, 0x94, 0x7b, 0x2c, 0x26, 0x0e, 0x7b, 0x29, 0xe7,
-                    0x9e, 0x5c, 0x2e, 0x7d, 0x3e, 0x14, 0xab, 0xf9, 0x79, 0xf6, 0x40, 0x6d, 0x07,
-                    0xba, 0xf8, 0xfa, 0xdd, 0xf4, 0x95,
-                ],
-            },
-            TestVector {
-                ask: None,
-                nsk: None,
-                ovk: [
-                    0x69, 0xb9, 0xe0, 0xfa, 0x1c, 0x4b, 0x3d, 0xeb, 0x91, 0xd5, 0x3b, 0xee, 0xe8,
-                    0x71, 0x15, 0x61, 0x21, 0x47, 0x4b, 0x8b, 0x62, 0xef, 0x24, 0x13, 0x44, 0x78,
-                    0xdc, 0x34, 0x99, 0x69, 0x1a, 0xf6,
-                ],
-                dk: [
-                    0xbe, 0xcb, 0x50, 0xc3, 0x63, 0xbb, 0x2e, 0xd9, 0xda, 0x5c, 0x30, 0x43, 0xce,
-                    0xb0, 0xf1, 0xa0, 0x52, 0x7b, 0xf8, 0x36, 0xb2, 0x9a, 0x35, 0xf7, 0xc0, 0xc9,
-                    0xf2, 0x61, 0x12, 0x3b, 0xe5, 0x6e,
-                ],
-                c: [
-                    0x8d, 0x93, 0x7b, 0xcf, 0x81, 0xba, 0x43, 0x0d, 0x5b, 0x49, 0xaf, 0xc0, 0xa4,
-                    0x03, 0x36, 0x7b, 0x1f, 0xd9, 0x98, 0x79, 0xec, 0xba, 0x41, 0xbe, 0x05, 0x1c,
-                    0x5a, 0x4a, 0xa7, 0xd6, 0xe7, 0xe8,
-                ],
-                ak: [
-                    0xb1, 0x85, 0xc5, 0x7b, 0x50, 0x9c, 0x25, 0x36, 0xc4, 0xf2, 0xd3, 0x26, 0xd7,
-                    0x66, 0xc8, 0xfa, 0xb2, 0x54, 0x47, 0xde, 0x53, 0x75, 0xa9, 0x32, 0x8d, 0x64,
-                    0x9d, 0xda, 0xbd, 0x97, 0xa6, 0xa3,
-                ],
-                nk: [
-                    0xdb, 0x88, 0x04, 0x9e, 0x02, 0xd2, 0x07, 0x56, 0x8a, 0xfc, 0x42, 0xe0, 0x7d,
-                    0xb2, 0xab, 0xed, 0x50, 0x0b, 0x27, 0x01, 0xc0, 0x1b, 0xbf, 0xf3, 0x63, 0x99,
-                    0x76, 0x4b, 0x81, 0xc0, 0x66, 0x4f,
-                ],
-                ivk: [
-                    0xb0, 0xa5, 0xf3, 0x37, 0x23, 0x2f, 0x2c, 0x3d, 0xac, 0x70, 0xc2, 0xa4, 0x10,
-                    0xfa, 0x56, 0x1f, 0xc4, 0x5d, 0x8c, 0xc5, 0x9c, 0xda, 0x24, 0x6d, 0x31, 0xc8,
-                    0xb1, 0x71, 0x5a, 0x57, 0xd9, 0x00,
-                ],
-                xsk: None,
-                xfvk: [
-                    0x03, 0x48, 0xc1, 0x83, 0x75, 0x03, 0x00, 0x00, 0x00, 0x8d, 0x93, 0x7b, 0xcf,
-                    0x81, 0xba, 0x43, 0x0d, 0x5b, 0x49, 0xaf, 0xc0, 0xa4, 0x03, 0x36, 0x7b, 0x1f,
-                    0xd9, 0x98, 0x79, 0xec, 0xba, 0x41, 0xbe, 0x05, 0x1c, 0x5a, 0x4a, 0xa7, 0xd6,
-                    0xe7, 0xe8, 0xb1, 0x85, 0xc5, 0x7b, 0x50, 0x9c, 0x25, 0x36, 0xc4, 0xf2, 0xd3,
-                    0x26, 0xd7, 0x66, 0xc8, 0xfa, 0xb2, 0x54, 0x47, 0xde, 0x53, 0x75, 0xa9, 0x32,
-                    0x8d, 0x64, 0x9d, 0xda, 0xbd, 0x97, 0xa6, 0xa3, 0xdb, 0x88, 0x04, 0x9e, 0x02,
-                    0xd2, 0x07, 0x56, 0x8a, 0xfc, 0x42, 0xe0, 0x7d, 0xb2, 0xab, 0xed, 0x50, 0x0b,
-                    0x27, 0x01, 0xc0, 0x1b, 0xbf, 0xf3, 0x63, 0x99, 0x76, 0x4b, 0x81, 0xc0, 0x66,
-                    0x4f, 0x69, 0xb9, 0xe0, 0xfa, 0x1c, 0x4b, 0x3d, 0xeb, 0x91, 0xd5, 0x3b, 0xee,
-                    0xe8, 0x71, 0x15, 0x61, 0x21, 0x47, 0x4b, 0x8b, 0x62, 0xef, 0x24, 0x13, 0x44,
-                    0x78, 0xdc, 0x34, 0x99, 0x69, 0x1a, 0xf6, 0xbe, 0xcb, 0x50, 0xc3, 0x63, 0xbb,
-                    0x2e, 0xd9, 0xda, 0x5c, 0x30, 0x43, 0xce, 0xb0, 0xf1, 0xa0, 0x52, 0x7b, 0xf8,
-                    0x36, 0xb2, 0x9a, 0x35, 0xf7, 0xc0, 0xc9, 0xf2, 0x61, 0x12, 0x3b, 0xe5, 0x6e,
-                ],
-                fp: [
-                    0x2e, 0x08, 0x15, 0x6d, 0xf8, 0xdf, 0xa2, 0x5b, 0x50, 0x55, 0xfc, 0x06, 0x3c,
-                    0x67, 0x15, 0x35, 0xa6, 0xa6, 0x5a, 0x60, 0x43, 0x7d, 0x96, 0xe7, 0x93, 0x08,
-                    0x15, 0xd0, 0x90, 0xf6, 0x2d, 0x67,
-                ],
-                d0: None,
-                d1: Some([
-                    0x03, 0x0f, 0xfb, 0x26, 0x3a, 0x93, 0x9e, 0x23, 0x0e, 0x96, 0xdd,
-                ]),
-                d2: Some([
-                    0x7b, 0xbf, 0x63, 0x93, 0x4c, 0x7e, 0x92, 0x67, 0x0c, 0xdb, 0x55,
-                ]),
-                dmax: Some([
-                    0x1a, 0x73, 0x0f, 0xeb, 0x00, 0x59, 0xcf, 0x1f, 0x5b, 0xde, 0xa8,
-                ]),
-                internal_nsk: None,
-                internal_ovk: [
-                    0xbf, 0x19, 0xe2, 0x57, 0xdd, 0x83, 0x3e, 0x02, 0x94, 0xec, 0x2a, 0xcb, 0xdf,
-                    0xa4, 0x0e, 0x14, 0x52, 0xf8, 0xe6, 0xa1, 0xf0, 0xc7, 0xf6, 0xf3, 0xab, 0xe5,
-                    0x6a, 0xfd, 0x5f, 0x6e, 0x26, 0x18,
-                ],
-                internal_dk: [
-                    0x1f, 0xfd, 0x6f, 0x81, 0xfe, 0x85, 0xc4, 0x9f, 0xe3, 0xe7, 0x3e, 0xf7, 0x3e,
-                    0x50, 0x11, 0x38, 0x22, 0xca, 0x62, 0x67, 0x31, 0x2b, 0x7a, 0xce, 0xd0, 0xc1,
-                    0x56, 0xa3, 0x2b, 0x3f, 0x24, 0x38,
-                ],
-                internal_nk: [
-                    0x82, 0x2f, 0x2f, 0x70, 0x96, 0x0f, 0x05, 0xd6, 0x96, 0x74, 0x58, 0xe3, 0x92,
-                    0x10, 0xd5, 0x77, 0x1f, 0x98, 0x47, 0xae, 0xf9, 0xe3, 0x4d, 0x94, 0xb8, 0xaf,
-                    0xbf, 0x95, 0xbb, 0xc4, 0xd2, 0x27,
-                ],
-                internal_ivk: [
-                    0xf9, 0x8a, 0x76, 0x09, 0x8e, 0x91, 0x05, 0x03, 0xe8, 0x02, 0x77, 0x52, 0x04,
-                    0x2d, 0xe8, 0x7e, 0x7d, 0x89, 0x3a, 0xb0, 0x14, 0x5e, 0xbc, 0x3b, 0x05, 0x97,
-                    0xc2, 0x39, 0x7f, 0x69, 0xd2, 0x01,
-                ],
-                internal_xsk: None,
-                internal_xfvk: [
-                    0x03, 0x48, 0xc1, 0x83, 0x75, 0x03, 0x00, 0x00, 0x00, 0x8d, 0x93, 0x7b, 0xcf,
-                    0x81, 0xba, 0x43, 0x0d, 0x5b, 0x49, 0xaf, 0xc0, 0xa4, 0x03, 0x36, 0x7b, 0x1f,
-                    0xd9, 0x98, 0x79, 0xec, 0xba, 0x41, 0xbe, 0x05, 0x1c, 0x5a, 0x4a, 0xa7, 0xd6,
-                    0xe7, 0xe8, 0xb1, 0x85, 0xc5, 0x7b, 0x50, 0x9c, 0x25, 0x36, 0xc4, 0xf2, 0xd3,
-                    0x26, 0xd7, 0x66, 0xc8, 0xfa, 0xb2, 0x54, 0x47, 0xde, 0x53, 0x75, 0xa9, 0x32,
-                    0x8d, 0x64, 0x9d, 0xda, 0xbd, 0x97, 0xa6, 0xa3, 0x82, 0x2f, 0x2f, 0x70, 0x96,
-                    0x0f, 0x05, 0xd6, 0x96, 0x74, 0x58, 0xe3, 0x92, 0x10, 0xd5, 0x77, 0x1f, 0x98,
-                    0x47, 0xae, 0xf9, 0xe3, 0x4d, 0x94, 0xb8, 0xaf, 0xbf, 0x95, 0xbb, 0xc4, 0xd2,
-                    0x27, 0xbf, 0x19, 0xe2, 0x57, 0xdd, 0x83, 0x3e, 0x02, 0x94, 0xec, 0x2a, 0xcb,
-                    0xdf, 0xa4, 0x0e, 0x14, 0x52, 0xf8, 0xe6, 0xa1, 0xf0, 0xc7, 0xf6, 0xf3, 0xab,
-                    0xe5, 0x6a, 0xfd, 0x5f, 0x6e, 0x26, 0x18, 0x1f, 0xfd, 0x6f, 0x81, 0xfe, 0x85,
-                    0xc4, 0x9f, 0xe3, 0xe7, 0x3e, 0xf7, 0x3e, 0x50, 0x11, 0x38, 0x22, 0xca, 0x62,
-                    0x67, 0x31, 0x2b, 0x7a, 0xce, 0xd0, 0xc1, 0x56, 0xa3, 0x2b, 0x3f, 0x24, 0x38,
-                ],
-                internal_fp: [
-                    0xba, 0x64, 0xe4, 0x0d, 0x08, 0x6d, 0x36, 0x2c, 0xa5, 0xa1, 0x7f, 0x5e, 0x3b,
-                    0x1b, 0xee, 0x63, 0x24, 0xc8, 0x4f, 0x10, 0x12, 0x44, 0xa4, 0x00, 0x2a, 0x2e,
-                    0xca, 0xaf, 0x05, 0xbd, 0xd9, 0x81,
-                ],
-            },
-        ];
-
-        let seed = [
-            0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23,
-            24, 25, 26, 27, 28, 29, 30, 31,
-        ];
-
-        let i1 = ChildIndex::NonHardened(1);
-        let i2h = ChildIndex::Hardened(2);
-        let i3 = ChildIndex::NonHardened(3);
-
-        let m = ExtendedSpendingKey::master(&seed);
-        let m_1 = m.derive_child(i1);
-        let m_1_2h = ExtendedSpendingKey::from_path(&m, &[i1, i2h]);
-        let m_1_2hv = m_1_2h.to_extended_full_viewing_key();
-        let m_1_2hv_3 = m_1_2hv.derive_child(i3).unwrap();
-
-        let xfvks = [
-            m.to_extended_full_viewing_key(),
-            m_1.to_extended_full_viewing_key(),
-            m_1_2h.to_extended_full_viewing_key(),
-            m_1_2hv, // Appears twice so we can de-duplicate test code below
-            m_1_2hv_3,
-        ];
-        assert_eq!(test_vectors.len(), xfvks.len());
-
-        let xsks = [m, m_1, m_1_2h];
-
-        for (xsk, tv) in xsks.iter().zip(test_vectors.iter()) {
-            assert_eq!(xsk.expsk.ask.to_repr().as_ref(), tv.ask.unwrap());
-            assert_eq!(xsk.expsk.nsk.to_repr().as_ref(), tv.nsk.unwrap());
-
-            assert_eq!(xsk.expsk.ovk.0, tv.ovk);
-            assert_eq!(xsk.dk.0, tv.dk);
-            assert_eq!(xsk.chain_code.0, tv.c);
-
-            let mut ser = vec![];
-            xsk.write(&mut ser).unwrap();
-            assert_eq!(&ser[..], &tv.xsk.unwrap()[..]);
-
-            let internal_xsk = xsk.derive_internal();
-            assert_eq!(internal_xsk.expsk.ask.to_repr().as_ref(), tv.ask.unwrap());
-            assert_eq!(
-                internal_xsk.expsk.nsk.to_repr().as_ref(),
-                tv.internal_nsk.unwrap()
-            );
-
-            assert_eq!(internal_xsk.expsk.ovk.0, tv.internal_ovk);
-            assert_eq!(internal_xsk.dk.0, tv.internal_dk);
-            assert_eq!(internal_xsk.chain_code.0, tv.c);
-
-            let mut ser = vec![];
-            internal_xsk.write(&mut ser).unwrap();
-            assert_eq!(&ser[..], &tv.internal_xsk.unwrap()[..]);
-        }
-
-        for (xfvk, tv) in xfvks.iter().zip(test_vectors.iter()) {
-            assert_eq!(xfvk.fvk.vk.ak.to_bytes(), tv.ak);
-            assert_eq!(xfvk.fvk.vk.nk.0.to_bytes(), tv.nk);
-
-            assert_eq!(xfvk.fvk.ovk.0, tv.ovk);
-            assert_eq!(xfvk.dk.0, tv.dk);
-            assert_eq!(xfvk.chain_code.0, tv.c);
-
-            assert_eq!(xfvk.fvk.vk.ivk().to_repr().as_ref(), tv.ivk);
-
-            let mut ser = vec![];
-            xfvk.write(&mut ser).unwrap();
-            assert_eq!(&ser[..], &tv.xfvk[..]);
-            assert_eq!(FvkFingerprint::from(&xfvk.fvk).0, tv.fp);
-
-            // d0
-            let mut di = DiversifierIndex::new();
-            match xfvk.dk.find_diversifier(di).unwrap() {
-                (l, d) if l == di => assert_eq!(d.0, tv.d0.unwrap()),
-                (_, _) => assert!(tv.d0.is_none()),
-            }
-
-            // d1
-            di.increment().unwrap();
-            match xfvk.dk.find_diversifier(di).unwrap() {
-                (l, d) if l == di => assert_eq!(d.0, tv.d1.unwrap()),
-                (_, _) => assert!(tv.d1.is_none()),
-            }
-
-            // d2
-            di.increment().unwrap();
-            match xfvk.dk.find_diversifier(di).unwrap() {
-                (l, d) if l == di => assert_eq!(d.0, tv.d2.unwrap()),
-                (_, _) => assert!(tv.d2.is_none()),
-            }
-
-            // dmax
-            let dmax = DiversifierIndex([0xff; 11]);
-            match xfvk.dk.find_diversifier(dmax) {
-                Some((l, d)) if l == dmax => assert_eq!(d.0, tv.dmax.unwrap()),
-                Some((_, _)) => panic!(),
-                None => assert!(tv.dmax.is_none()),
-            }
-
-            let internal_xfvk = xfvk.derive_internal();
-            assert_eq!(internal_xfvk.fvk.vk.ak.to_bytes(), tv.ak);
-            assert_eq!(internal_xfvk.fvk.vk.nk.0.to_bytes(), tv.internal_nk);
-
-            assert_eq!(internal_xfvk.fvk.ovk.0, tv.internal_ovk);
-            assert_eq!(internal_xfvk.dk.0, tv.internal_dk);
-            assert_eq!(internal_xfvk.chain_code.0, tv.c);
-
-            assert_eq!(
-                internal_xfvk.fvk.vk.ivk().to_repr().as_ref(),
-                tv.internal_ivk
-            );
-
-            let mut ser = vec![];
-            internal_xfvk.write(&mut ser).unwrap();
-            assert_eq!(&ser[..], &tv.internal_xfvk[..]);
-            assert_eq!(FvkFingerprint::from(&internal_xfvk.fvk).0, tv.internal_fp);
-        }
-    }
-}
-
-#[cfg(any(test, feature = "test-dependencies"))]
-pub mod testing {
-    use proptest::collection::vec;
-    use proptest::prelude::{any, prop_compose};
-
-    use super::ExtendedSpendingKey;
-
-    prop_compose! {
-        pub fn arb_extended_spending_key()(v in vec(any::<u8>(), 32..252)) -> ExtendedSpendingKey {
-            ExtendedSpendingKey::master(&v)
-        }
-    }
-}
diff --git a/zcash_primitives/src/zip339.rs b/zcash_primitives/src/zip339.rs
deleted file mode 100644
index 3fcf2e6102..0000000000
--- a/zcash_primitives/src/zip339.rs
+++ /dev/null
@@ -1,5 +0,0 @@
-//! [ZIP 339] for seed phrase support.
-//!
-//! [ZIP 339]: https://zips.z.cash/zip-0339
-
-pub use bip0039::{Count, Error, Language, Mnemonic};
diff --git a/zcash_proofs/CHANGELOG.md b/zcash_proofs/CHANGELOG.md
index f44adad6b0..30f75ab68a 100644
--- a/zcash_proofs/CHANGELOG.md
+++ b/zcash_proofs/CHANGELOG.md
@@ -7,6 +7,75 @@ and this library adheres to Rust's notion of
 
 ## [Unreleased]
 
+## [0.20.0] - 2024-11-14
+
+### Changed
+- Migrated to `zcash_primitives 0.20`.
+- MSRV is now 1.77.0.
+
+## [0.19.0] - 2024-10-02
+
+### Changed
+- Migrated to `zcash_primitives 0.19`.
+
+### Fixed
+- The previous release of `zcash_primitives` did not bump `zcash_address` and
+  ended up depending on multiple versions of `zcash_protocol`, which didn't
+  cause a code conflict but results in two different consensus protocol states
+  being present in the dependency tree.
+
+## [0.18.0] - 2024-10-02
+
+### Changed
+- Migrated to `sapling-crypto 0.3`, `zcash_primitives 0.18`.
+
+## [0.17.0] - 2024-08-26
+
+### Changed
+- Migrated to `zcash_primitives 0.17`.
+
+## [0.16.0] - 2024-08-19
+
+### Changed
+- MSRV is now 1.70.0.
+- Migrated to `zcash_primitives 0.16`.
+
+## [0.15.0] - 2024-03-25
+
+### Changed
+- Migrated to `zcash_primitives 0.15`.
+
+## [0.14.0] - 2024-03-01
+### Added
+- `impl zcash_primitives::sapling::prover::{SpendProver, OutputProver}` for
+  `zcash_proofs::prover::LocalTxProver`
+
+### Changed
+- Migrated to `zcash_primitives 0.14`.
+- The `zcash_proofs::ZcashParameters` Sapling fields now use the parameter and
+  viewing key newtypes defined in `zcash_primitives::sapling::circuit`.
+
+### Removed
+- `zcash_proofs::circuit::sapling` (moved to `zcash_primitives::sapling::circuit`).
+- `zcash_proofs::circuit::{ecc, pedersen_hash}`
+- `zcash_proofs::constants`
+- `zcash_proofs::sapling`:
+  - `BatchValidator` (moved to `zcash_primitives::sapling`).
+  - `SaplingProvingContext`
+  - `SaplingVerificationContext` (moved to `zcash_primitives::sapling`).
+
+## [0.13.0] - 2023-09-25
+### Changed
+- Bumped dependencies to `zcash_primitives 0.13`.
+
+### Removed
+- Unused `incrementalmerkletree` dependency.
+
+## [0.12.1] - 2023-06-28
+### Changed
+- Replaced internal `directories` dependency which now transitively depends on
+  MPL-licensed code.
+
 ## [0.12.0] - 2023-06-06
 ### Changed
 - Bumped dependencies to `incrementalmerkletree 0.4`, `zcash_primitives 0.12`
@@ -79,7 +148,7 @@ and this library adheres to Rust's notion of
 ### Added
 - `zcash_proofs::ZcashParameters`
 - `zcash_proofs::parse_parameters`
-- `zcash_proofs::prover::LocalProver::from_bytes`
+- `zcash_proofs::prover::LocalTxProver::from_bytes`
 - The `zcash_proofs::constants` module, containing constants and helpers used by
   the `zcash_proofs::circuit::ecc::fixed_base_multiplication` gadget:
   - The `FixedGeneratorOwned` type alias.
diff --git a/zcash_proofs/Cargo.toml b/zcash_proofs/Cargo.toml
index 9930080d1f..a2589034af 100644
--- a/zcash_proofs/Cargo.toml
+++ b/zcash_proofs/Cargo.toml
@@ -1,77 +1,77 @@
 [package]
 name = "zcash_proofs"
 description = "Zcash zk-SNARK circuits and proving APIs"
-version = "0.12.0"
+version = "0.20.0"
 authors = [
     "Jack Grigg <jack@z.cash>",
 ]
 homepage = "https://github.com/zcash/librustzcash"
-repository = "https://github.com/zcash/librustzcash"
+repository.workspace = true
 readme = "README.md"
-license = "MIT OR Apache-2.0"
-edition = "2021"
-rust-version = "1.65"
-categories = ["cryptography::cryptocurrencies"]
+license.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+categories.workspace = true
 
 [package.metadata.docs.rs]
 all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
 
 [dependencies]
-zcash_primitives = { version = "0.12", path = "../zcash_primitives", default-features = false }
+zcash_primitives.workspace = true
 
 # Dependencies exposed in a public API:
 # (Breaking upgrades to these require a breaking upgrade to this crate.)
-bellman = { version = "0.14", default-features = false, features = ["groth16"] }
-bls12_381 = "0.8"
-group = "0.13"
-incrementalmerkletree = { version = "0.4", features = ["legacy-api"] }
-jubjub = "0.10"
-lazy_static = "1"
+bellman.workspace = true
+bls12_381.workspace = true
+group.workspace = true
+jubjub.workspace = true
+lazy_static.workspace = true
 minreq = { version = "2", features = ["https"], optional = true }
-rand_core = "0.6"
-tracing = "0.1"
+rand_core.workspace = true
+sapling.workspace = true
+tracing.workspace = true
 
 # Dependencies used internally:
 # (Breaking upgrades to these are usually backwards-compatible, but check MSRVs.)
-blake2b_simd = "1"
-directories = { version = "5", optional = true }
+blake2b_simd.workspace = true
+document-features.workspace = true
+home = { version = "0.5", optional = true }
+known-folders = { version = "1", optional = true }
 redjubjub = "0.7"
 wagyu-zcash-parameters = { version = "0.2", optional = true }
+xdg = { version = "2.5", optional = true }
 
 [dev-dependencies]
-byteorder = "1"
-criterion = "0.4"
-rand_xorshift = "0.3"
-
-[target.'cfg(unix)'.dev-dependencies]
-pprof = { version = "0.11", features = ["criterion", "flamegraph"] } # MSRV 1.56
+byteorder.workspace = true
 
 [features]
 default = ["local-prover", "multicore"]
-bundled-prover = ["wagyu-zcash-parameters"]
-download-params = ["minreq", "directories"]
-local-prover = ["directories"]
-multicore = ["bellman/multicore", "zcash_primitives/multicore"]
 
-[lib]
-bench = false
+## Bundles the Sapling proving parameters inside the binary, which will increase its size
+## by around 50 MiB.
+bundled-prover = ["dep:wagyu-zcash-parameters"]
 
-[[bench]]
-name = "sapling"
-harness = false
-required-features = ["local-prover"]
+## Enables APIs for determining the default location on the local filesystem for storing
+## the Sprout and Sapling proving parameters.
+directories = ["dep:home", "dep:known-folders", "dep:xdg"]
 
-[[example]]
-name = "get-params-path"
-required-features = ["directories"]
+## Enables APIs for downloading the Sprout and Sapling proving parameters to the default
+## location on the local filesystem.
+download-params = ["dep:minreq", "directories"]
 
-[[example]]
-name = "download-params"
-required-features = ["download-params"]
+## Enables APIs for loading the Sapling proving parameters from the default location on
+## the local filesystem.
+local-prover = ["directories"]
 
-[[example]]
-name = "download-sprout-and-sapling-params"
-required-features = ["download-params"]
+## Enables multithreading support for creating proofs.
+multicore = ["bellman/multicore", "zcash_primitives/multicore"]
+
+## A feature used to isolate tests that are expensive to run. Test-only.
+expensive-tests = []
+
+[lib]
+bench = false
 
 [badges]
 maintenance = { status = "actively-developed" }
diff --git a/zcash_proofs/README.md b/zcash_proofs/README.md
index ccbdcfd73f..f365c5a38c 100644
--- a/zcash_proofs/README.md
+++ b/zcash_proofs/README.md
@@ -13,16 +13,6 @@ Licensed under either of
 
 at your option.
 
-Downstream code forks should note that 'zcash_proofs' depends on the
-'orchard' crate, which is licensed under the
-[Bootstrap Open Source License](https://github.com/zcash/orchard/blob/main/LICENSE-BOSL).
-A license exception is provided allowing some derived works that are linked or
-combined with the 'orchard' crate to be copied or distributed under the original
-licenses (in this case MIT / Apache 2.0), provided that the included portions of
-the 'orchard' code remain subject to BOSL.
-See https://github.com/zcash/orchard/blob/main/COPYING for details of which
-derived works can make use of this exception.
-
 ### Contribution
 
 Unless you explicitly state otherwise, any contribution intentionally
diff --git a/zcash_proofs/benches/sapling.rs b/zcash_proofs/benches/sapling.rs
deleted file mode 100644
index 1a1592bfd6..0000000000
--- a/zcash_proofs/benches/sapling.rs
+++ /dev/null
@@ -1,104 +0,0 @@
-#[macro_use]
-extern crate criterion;
-
-use bellman::groth16::*;
-use bls12_381::Bls12;
-use criterion::Criterion;
-use group::{ff::Field, Group};
-use rand_core::{RngCore, SeedableRng};
-use rand_xorshift::XorShiftRng;
-use zcash_primitives::sapling::{Diversifier, ProofGenerationKey};
-use zcash_proofs::circuit::sapling::{Spend, ValueCommitmentOpening};
-
-#[cfg(unix)]
-use pprof::criterion::{Output, PProfProfiler};
-
-const TREE_DEPTH: usize = 32;
-
-fn criterion_benchmark(c: &mut Criterion) {
-    let mut rng = XorShiftRng::from_seed([
-        0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
-        0xe5,
-    ]);
-
-    let groth_params = generate_random_parameters::<Bls12, _, _>(
-        Spend {
-            value_commitment_opening: None,
-            proof_generation_key: None,
-            payment_address: None,
-            commitment_randomness: None,
-            ar: None,
-            auth_path: vec![None; TREE_DEPTH],
-            anchor: None,
-        },
-        &mut rng,
-    )
-    .unwrap();
-
-    c.bench_function("sapling-spend-prove", |b| {
-        let value_commitment = ValueCommitmentOpening {
-            value: 1,
-            randomness: jubjub::Fr::random(&mut rng),
-        };
-
-        let proof_generation_key = ProofGenerationKey {
-            ak: jubjub::SubgroupPoint::random(&mut rng),
-            nsk: jubjub::Fr::random(&mut rng),
-        };
-
-        let viewing_key = proof_generation_key.to_viewing_key();
-
-        let payment_address;
-
-        loop {
-            let diversifier = {
-                let mut d = [0; 11];
-                rng.fill_bytes(&mut d);
-                Diversifier(d)
-            };
-
-            if let Some(p) = viewing_key.to_payment_address(diversifier) {
-                payment_address = p;
-                break;
-            }
-        }
-
-        let commitment_randomness = jubjub::Fr::random(&mut rng);
-        let auth_path =
-            vec![Some((bls12_381::Scalar::random(&mut rng), rng.next_u32() % 2 != 0)); TREE_DEPTH];
-        let ar = jubjub::Fr::random(&mut rng);
-        let anchor = bls12_381::Scalar::random(&mut rng);
-
-        b.iter(|| {
-            create_random_proof(
-                Spend {
-                    value_commitment_opening: Some(value_commitment.clone()),
-                    proof_generation_key: Some(proof_generation_key.clone()),
-                    payment_address: Some(payment_address),
-                    commitment_randomness: Some(commitment_randomness),
-                    ar: Some(ar),
-                    auth_path: auth_path.clone(),
-                    anchor: Some(anchor),
-                },
-                &groth_params,
-                &mut rng,
-            )
-        });
-    });
-}
-
-#[cfg(unix)]
-criterion_group! {
-    name = benches;
-    config = Criterion::default()
-        .sample_size(10)
-        .with_profiler(PProfProfiler::new(100, Output::Flamegraph(None)));
-    targets = criterion_benchmark
-}
-#[cfg(windows)]
-criterion_group! {
-    name = benches;
-    config = Criterion::default().sample_size(10);
-    targets = criterion_benchmark
-}
-criterion_main!(benches);
diff --git a/zcash_proofs/examples/download-params.rs b/zcash_proofs/examples/download-params.rs
deleted file mode 100644
index 6c9d97754d..0000000000
--- a/zcash_proofs/examples/download-params.rs
+++ /dev/null
@@ -1,4 +0,0 @@
-fn main() -> Result<(), minreq::Error> {
-    #[allow(deprecated)]
-    zcash_proofs::download_parameters()
-}
diff --git a/zcash_proofs/examples/download-sprout-and-sapling-params.rs b/zcash_proofs/examples/download-sprout-and-sapling-params.rs
deleted file mode 100644
index ec4cdb5f11..0000000000
--- a/zcash_proofs/examples/download-sprout-and-sapling-params.rs
+++ /dev/null
@@ -1,26 +0,0 @@
-fn main() -> Result<(), minreq::Error> {
-    const DOWNLOAD_TIMEOUT_SECONDS: u64 = 3600;
-
-    #[allow(unused_mut, unused_assignments)]
-    let mut params_folder =
-        zcash_proofs::default_params_folder().expect("unexpected missing HOME env var");
-
-    // Always do a download to /tmp, if compiled with `RUSTFLAGS="--cfg always_download"`
-    #[cfg(always_download)]
-    {
-        std::env::set_var("HOME", "/tmp");
-        params_folder =
-            zcash_proofs::default_params_folder().expect("unexpected missing HOME env var");
-
-        println!("removing temporary parameters folder: {:?}", params_folder);
-        let _ = std::fs::remove_dir_all(&params_folder);
-    }
-
-    println!("downloading sapling parameters to: {:?}", params_folder);
-    zcash_proofs::download_sapling_parameters(Some(DOWNLOAD_TIMEOUT_SECONDS))?;
-
-    println!("downloading sprout parameters to: {:?}", params_folder);
-    zcash_proofs::download_sprout_parameters(Some(DOWNLOAD_TIMEOUT_SECONDS))?;
-
-    Ok(())
-}
diff --git a/zcash_proofs/examples/get-params-path.rs b/zcash_proofs/examples/get-params-path.rs
deleted file mode 100644
index 224b2f5ead..0000000000
--- a/zcash_proofs/examples/get-params-path.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-fn main() {
-    if let Some(path) = zcash_proofs::default_params_folder() {
-        if let Some(path) = path.to_str() {
-            println!("{}", path);
-        }
-    }
-}
diff --git a/zcash_proofs/src/circuit.rs b/zcash_proofs/src/circuit.rs
index 6d26fa485e..0897b120d4 100644
--- a/zcash_proofs/src/circuit.rs
+++ b/zcash_proofs/src/circuit.rs
@@ -1,7 +1,3 @@
 //! Implementations of the Zcash circuits and Zcash-specific gadgets.
 
-pub mod ecc;
-pub mod pedersen_hash;
-
-pub mod sapling;
 pub mod sprout;
diff --git a/zcash_proofs/src/circuit/ecc.rs b/zcash_proofs/src/circuit/ecc.rs
deleted file mode 100644
index ca797b3bff..0000000000
--- a/zcash_proofs/src/circuit/ecc.rs
+++ /dev/null
@@ -1,1114 +0,0 @@
-//! Gadgets implementing Jubjub elliptic curve operations.
-
-use std::ops::{AddAssign, MulAssign, Neg, SubAssign};
-
-use bellman::{ConstraintSystem, SynthesisError};
-
-use bellman::gadgets::Assignment;
-
-use bellman::gadgets::num::{AllocatedNum, Num};
-
-use bellman::gadgets::lookup::lookup3_xy;
-
-use bellman::gadgets::boolean::Boolean;
-
-use group::Curve;
-
-use crate::constants::{FixedGenerator, EDWARDS_D, MONTGOMERY_A, MONTGOMERY_SCALE};
-
-#[derive(Clone)]
-pub struct EdwardsPoint {
-    u: AllocatedNum<bls12_381::Scalar>,
-    v: AllocatedNum<bls12_381::Scalar>,
-}
-
-/// Perform a fixed-base scalar multiplication with
-/// `by` being in little-endian bit order.
-pub fn fixed_base_multiplication<CS>(
-    mut cs: CS,
-    base: FixedGenerator,
-    by: &[Boolean],
-) -> Result<EdwardsPoint, SynthesisError>
-where
-    CS: ConstraintSystem<bls12_381::Scalar>,
-{
-    // Represents the result of the multiplication
-    let mut result = None;
-
-    for (i, (chunk, window)) in by.chunks(3).zip(base.iter()).enumerate() {
-        let chunk_a = chunk
-            .get(0)
-            .cloned()
-            .unwrap_or_else(|| Boolean::constant(false));
-        let chunk_b = chunk
-            .get(1)
-            .cloned()
-            .unwrap_or_else(|| Boolean::constant(false));
-        let chunk_c = chunk
-            .get(2)
-            .cloned()
-            .unwrap_or_else(|| Boolean::constant(false));
-
-        // TODO: rename to lookup3_uv
-        let (u, v) = lookup3_xy(
-            cs.namespace(|| format!("window table lookup {}", i)),
-            &[chunk_a, chunk_b, chunk_c],
-            window,
-        )?;
-
-        let p = EdwardsPoint { u, v };
-
-        if result.is_none() {
-            result = Some(p);
-        } else {
-            result = Some(
-                result
-                    .unwrap()
-                    .add(cs.namespace(|| format!("addition {}", i)), &p)?,
-            );
-        }
-    }
-
-    Ok(result.get()?.clone())
-}
-
-impl EdwardsPoint {
-    pub fn get_u(&self) -> &AllocatedNum<bls12_381::Scalar> {
-        &self.u
-    }
-
-    pub fn get_v(&self) -> &AllocatedNum<bls12_381::Scalar> {
-        &self.v
-    }
-
-    pub fn assert_not_small_order<CS>(&self, mut cs: CS) -> Result<(), SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        let tmp = self.double(cs.namespace(|| "first doubling"))?;
-        let tmp = tmp.double(cs.namespace(|| "second doubling"))?;
-        let tmp = tmp.double(cs.namespace(|| "third doubling"))?;
-
-        // (0, -1) is a small order point, but won't ever appear here
-        // because cofactor is 2^3, and we performed three doublings.
-        // (0, 1) is the neutral element, so checking if u is nonzero
-        // is sufficient to prevent small order points here.
-        tmp.u.assert_nonzero(cs.namespace(|| "check u != 0"))?;
-
-        Ok(())
-    }
-
-    pub fn inputize<CS>(&self, mut cs: CS) -> Result<(), SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        self.u.inputize(cs.namespace(|| "u"))?;
-        self.v.inputize(cs.namespace(|| "v"))?;
-
-        Ok(())
-    }
-
-    /// This converts the point into a representation.
-    pub fn repr<CS>(&self, mut cs: CS) -> Result<Vec<Boolean>, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        let mut tmp = vec![];
-
-        let u = self.u.to_bits_le_strict(cs.namespace(|| "unpack u"))?;
-
-        let v = self.v.to_bits_le_strict(cs.namespace(|| "unpack v"))?;
-
-        tmp.extend(v);
-        tmp.push(u[0].clone());
-
-        Ok(tmp)
-    }
-
-    /// This 'witnesses' a point inside the constraint system.
-    /// It guarantees the point is on the curve.
-    pub fn witness<CS>(mut cs: CS, p: Option<jubjub::ExtendedPoint>) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        let p = p.map(|p| p.to_affine());
-
-        // Allocate u
-        let u = AllocatedNum::alloc(cs.namespace(|| "u"), || Ok(p.get()?.get_u()))?;
-
-        // Allocate v
-        let v = AllocatedNum::alloc(cs.namespace(|| "v"), || Ok(p.get()?.get_v()))?;
-
-        Self::interpret(cs.namespace(|| "point interpretation"), &u, &v)
-    }
-
-    /// Returns `self` if condition is true, and the neutral
-    /// element (0, 1) otherwise.
-    pub fn conditionally_select<CS>(
-        &self,
-        mut cs: CS,
-        condition: &Boolean,
-    ) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // Compute u' = self.u if condition, and 0 otherwise
-        let u_prime = AllocatedNum::alloc(cs.namespace(|| "u'"), || {
-            if *condition.get_value().get()? {
-                Ok(*self.u.get_value().get()?)
-            } else {
-                Ok(bls12_381::Scalar::zero())
-            }
-        })?;
-
-        // condition * u = u'
-        // if condition is 0, u' must be 0
-        // if condition is 1, u' must be u
-        let one = CS::one();
-        cs.enforce(
-            || "u' computation",
-            |lc| lc + self.u.get_variable(),
-            |_| condition.lc(one, bls12_381::Scalar::one()),
-            |lc| lc + u_prime.get_variable(),
-        );
-
-        // Compute v' = self.v if condition, and 1 otherwise
-        let v_prime = AllocatedNum::alloc(cs.namespace(|| "v'"), || {
-            if *condition.get_value().get()? {
-                Ok(*self.v.get_value().get()?)
-            } else {
-                Ok(bls12_381::Scalar::one())
-            }
-        })?;
-
-        // condition * v = v' - (1 - condition)
-        // if condition is 0, v' must be 1
-        // if condition is 1, v' must be v
-        cs.enforce(
-            || "v' computation",
-            |lc| lc + self.v.get_variable(),
-            |_| condition.lc(one, bls12_381::Scalar::one()),
-            |lc| lc + v_prime.get_variable() - &condition.not().lc(one, bls12_381::Scalar::one()),
-        );
-
-        Ok(EdwardsPoint {
-            u: u_prime,
-            v: v_prime,
-        })
-    }
-
-    /// Performs a scalar multiplication of this twisted Edwards
-    /// point by a scalar represented as a sequence of booleans
-    /// in little-endian bit order.
-    pub fn mul<CS>(&self, mut cs: CS, by: &[Boolean]) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // Represents the current "magnitude" of the base
-        // that we're operating over. Starts at self,
-        // then 2*self, then 4*self, ...
-        let mut curbase = None;
-
-        // Represents the result of the multiplication
-        let mut result = None;
-
-        for (i, bit) in by.iter().enumerate() {
-            if curbase.is_none() {
-                curbase = Some(self.clone());
-            } else {
-                // Double the previous value
-                curbase = Some(
-                    curbase
-                        .unwrap()
-                        .double(cs.namespace(|| format!("doubling {}", i)))?,
-                );
-            }
-
-            // Represents the select base. If the bit for this magnitude
-            // is true, this will return `curbase`. Otherwise it will
-            // return the neutral element, which will have no effect on
-            // the result.
-            let thisbase = curbase
-                .as_ref()
-                .unwrap()
-                .conditionally_select(cs.namespace(|| format!("selection {}", i)), bit)?;
-
-            if result.is_none() {
-                result = Some(thisbase);
-            } else {
-                result = Some(
-                    result
-                        .unwrap()
-                        .add(cs.namespace(|| format!("addition {}", i)), &thisbase)?,
-                );
-            }
-        }
-
-        Ok(result.get()?.clone())
-    }
-
-    pub fn interpret<CS>(
-        mut cs: CS,
-        u: &AllocatedNum<bls12_381::Scalar>,
-        v: &AllocatedNum<bls12_381::Scalar>,
-    ) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // -u^2 + v^2 = 1 + du^2v^2
-
-        let u2 = u.square(cs.namespace(|| "u^2"))?;
-        let v2 = v.square(cs.namespace(|| "v^2"))?;
-        let u2v2 = u2.mul(cs.namespace(|| "u^2 v^2"), &v2)?;
-
-        let one = CS::one();
-        cs.enforce(
-            || "on curve check",
-            |lc| lc - u2.get_variable() + v2.get_variable(),
-            |lc| lc + one,
-            |lc| lc + one + (EDWARDS_D, u2v2.get_variable()),
-        );
-
-        Ok(EdwardsPoint {
-            u: u.clone(),
-            v: v.clone(),
-        })
-    }
-
-    pub fn double<CS>(&self, mut cs: CS) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // Compute T = (u + v) * (v - EDWARDS_A*u)
-        //           = (u + v) * (u + v)
-        let t = AllocatedNum::alloc(cs.namespace(|| "T"), || {
-            let mut t0 = *self.u.get_value().get()?;
-            t0.add_assign(self.v.get_value().get()?);
-
-            let mut t1 = *self.u.get_value().get()?;
-            t1.add_assign(self.v.get_value().get()?);
-
-            t0.mul_assign(&t1);
-
-            Ok(t0)
-        })?;
-
-        cs.enforce(
-            || "T computation",
-            |lc| lc + self.u.get_variable() + self.v.get_variable(),
-            |lc| lc + self.u.get_variable() + self.v.get_variable(),
-            |lc| lc + t.get_variable(),
-        );
-
-        // Compute A = u * v
-        let a = self.u.mul(cs.namespace(|| "A computation"), &self.v)?;
-
-        // Compute C = d*A*A
-        let c = AllocatedNum::alloc(cs.namespace(|| "C"), || {
-            let mut t0 = a.get_value().get()?.square();
-            t0.mul_assign(EDWARDS_D);
-
-            Ok(t0)
-        })?;
-
-        cs.enforce(
-            || "C computation",
-            |lc| lc + (EDWARDS_D, a.get_variable()),
-            |lc| lc + a.get_variable(),
-            |lc| lc + c.get_variable(),
-        );
-
-        // Compute u3 = (2.A) / (1 + C)
-        let u3 = AllocatedNum::alloc(cs.namespace(|| "u3"), || {
-            let mut t0 = *a.get_value().get()?;
-            t0 = t0.double();
-
-            let mut t1 = bls12_381::Scalar::one();
-            t1.add_assign(c.get_value().get()?);
-
-            let res = t1.invert().map(|t1| t0 * t1);
-            if bool::from(res.is_some()) {
-                Ok(res.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        let one = CS::one();
-        cs.enforce(
-            || "u3 computation",
-            |lc| lc + one + c.get_variable(),
-            |lc| lc + u3.get_variable(),
-            |lc| lc + a.get_variable() + a.get_variable(),
-        );
-
-        // Compute v3 = (T + (EDWARDS_A-1)*A) / (1 - C)
-        //            = (T - 2.A) / (1 - C)
-        let v3 = AllocatedNum::alloc(cs.namespace(|| "v3"), || {
-            let mut t0 = *a.get_value().get()?;
-            t0 = t0.double().neg();
-            t0.add_assign(t.get_value().get()?);
-
-            let mut t1 = bls12_381::Scalar::one();
-            t1.sub_assign(c.get_value().get()?);
-
-            let res = t1.invert().map(|t1| t0 * t1);
-            if bool::from(res.is_some()) {
-                Ok(res.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        cs.enforce(
-            || "v3 computation",
-            |lc| lc + one - c.get_variable(),
-            |lc| lc + v3.get_variable(),
-            |lc| lc + t.get_variable() - a.get_variable() - a.get_variable(),
-        );
-
-        Ok(EdwardsPoint { u: u3, v: v3 })
-    }
-
-    /// Perform addition between any two points
-    pub fn add<CS>(&self, mut cs: CS, other: &Self) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // Compute U = (u1 + v1) * (v2 - EDWARDS_A*u2)
-        //           = (u1 + v1) * (u2 + v2)
-        // (In hindsight, U was a poor choice of name.)
-        let uppercase_u = AllocatedNum::alloc(cs.namespace(|| "U"), || {
-            let mut t0 = *self.u.get_value().get()?;
-            t0.add_assign(self.v.get_value().get()?);
-
-            let mut t1 = *other.u.get_value().get()?;
-            t1.add_assign(other.v.get_value().get()?);
-
-            t0.mul_assign(&t1);
-
-            Ok(t0)
-        })?;
-
-        cs.enforce(
-            || "U computation",
-            |lc| lc + self.u.get_variable() + self.v.get_variable(),
-            |lc| lc + other.u.get_variable() + other.v.get_variable(),
-            |lc| lc + uppercase_u.get_variable(),
-        );
-
-        // Compute A = v2 * u1
-        let a = other.v.mul(cs.namespace(|| "A computation"), &self.u)?;
-
-        // Compute B = u2 * v1
-        let b = other.u.mul(cs.namespace(|| "B computation"), &self.v)?;
-
-        // Compute C = d*A*B
-        let c = AllocatedNum::alloc(cs.namespace(|| "C"), || {
-            let mut t0 = *a.get_value().get()?;
-            t0.mul_assign(b.get_value().get()?);
-            t0.mul_assign(EDWARDS_D);
-
-            Ok(t0)
-        })?;
-
-        cs.enforce(
-            || "C computation",
-            |lc| lc + (EDWARDS_D, a.get_variable()),
-            |lc| lc + b.get_variable(),
-            |lc| lc + c.get_variable(),
-        );
-
-        // Compute u3 = (A + B) / (1 + C)
-        let u3 = AllocatedNum::alloc(cs.namespace(|| "u3"), || {
-            let mut t0 = *a.get_value().get()?;
-            t0.add_assign(b.get_value().get()?);
-
-            let mut t1 = bls12_381::Scalar::one();
-            t1.add_assign(c.get_value().get()?);
-
-            let ret = t1.invert().map(|t1| t0 * t1);
-            if bool::from(ret.is_some()) {
-                Ok(ret.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        let one = CS::one();
-        cs.enforce(
-            || "u3 computation",
-            |lc| lc + one + c.get_variable(),
-            |lc| lc + u3.get_variable(),
-            |lc| lc + a.get_variable() + b.get_variable(),
-        );
-
-        // Compute v3 = (U - A - B) / (1 - C)
-        let v3 = AllocatedNum::alloc(cs.namespace(|| "v3"), || {
-            let mut t0 = *uppercase_u.get_value().get()?;
-            t0.sub_assign(a.get_value().get()?);
-            t0.sub_assign(b.get_value().get()?);
-
-            let mut t1 = bls12_381::Scalar::one();
-            t1.sub_assign(c.get_value().get()?);
-
-            let ret = t1.invert().map(|t1| t0 * t1);
-            if bool::from(ret.is_some()) {
-                Ok(ret.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        cs.enforce(
-            || "v3 computation",
-            |lc| lc + one - c.get_variable(),
-            |lc| lc + v3.get_variable(),
-            |lc| lc + uppercase_u.get_variable() - a.get_variable() - b.get_variable(),
-        );
-
-        Ok(EdwardsPoint { u: u3, v: v3 })
-    }
-}
-
-pub struct MontgomeryPoint {
-    x: Num<bls12_381::Scalar>,
-    y: Num<bls12_381::Scalar>,
-}
-
-impl MontgomeryPoint {
-    /// Converts an element in the prime order subgroup into
-    /// a point in the birationally equivalent twisted
-    /// Edwards curve.
-    pub fn into_edwards<CS>(self, mut cs: CS) -> Result<EdwardsPoint, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // Compute u = (scale*x) / y
-        let u = AllocatedNum::alloc(cs.namespace(|| "u"), || {
-            let mut t0 = *self.x.get_value().get()?;
-            t0.mul_assign(MONTGOMERY_SCALE);
-
-            let ret = self.y.get_value().get()?.invert().map(|invy| t0 * invy);
-            if bool::from(ret.is_some()) {
-                Ok(ret.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        cs.enforce(
-            || "u computation",
-            |lc| lc + &self.y.lc(bls12_381::Scalar::one()),
-            |lc| lc + u.get_variable(),
-            |lc| lc + &self.x.lc(MONTGOMERY_SCALE),
-        );
-
-        // Compute v = (x - 1) / (x + 1)
-        let v = AllocatedNum::alloc(cs.namespace(|| "v"), || {
-            let mut t0 = *self.x.get_value().get()?;
-            let mut t1 = t0;
-            t0.sub_assign(&bls12_381::Scalar::one());
-            t1.add_assign(&bls12_381::Scalar::one());
-
-            let ret = t1.invert().map(|t1| t0 * t1);
-            if bool::from(ret.is_some()) {
-                Ok(ret.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        let one = CS::one();
-        cs.enforce(
-            || "v computation",
-            |lc| lc + &self.x.lc(bls12_381::Scalar::one()) + one,
-            |lc| lc + v.get_variable(),
-            |lc| lc + &self.x.lc(bls12_381::Scalar::one()) - one,
-        );
-
-        Ok(EdwardsPoint { u, v })
-    }
-
-    /// Interprets an (x, y) pair as a point
-    /// in Montgomery, does not check that it's
-    /// on the curve. Useful for constants and
-    /// window table lookups.
-    pub fn interpret_unchecked(x: Num<bls12_381::Scalar>, y: Num<bls12_381::Scalar>) -> Self {
-        MontgomeryPoint { x, y }
-    }
-
-    /// Performs an affine point addition, not defined for
-    /// points with the same x-coordinate.
-    pub fn add<CS>(&self, mut cs: CS, other: &Self) -> Result<Self, SynthesisError>
-    where
-        CS: ConstraintSystem<bls12_381::Scalar>,
-    {
-        // Compute lambda = (y' - y) / (x' - x)
-        let lambda = AllocatedNum::alloc(cs.namespace(|| "lambda"), || {
-            let mut n = *other.y.get_value().get()?;
-            n.sub_assign(self.y.get_value().get()?);
-
-            let mut d = *other.x.get_value().get()?;
-            d.sub_assign(self.x.get_value().get()?);
-
-            let ret = d.invert().map(|d| n * d);
-            if bool::from(ret.is_some()) {
-                Ok(ret.unwrap())
-            } else {
-                Err(SynthesisError::DivisionByZero)
-            }
-        })?;
-
-        cs.enforce(
-            || "evaluate lambda",
-            |lc| lc + &other.x.lc(bls12_381::Scalar::one()) - &self.x.lc(bls12_381::Scalar::one()),
-            |lc| lc + lambda.get_variable(),
-            |lc| lc + &other.y.lc(bls12_381::Scalar::one()) - &self.y.lc(bls12_381::Scalar::one()),
-        );
-
-        // Compute x'' = lambda^2 - A - x - x'
-        let xprime = AllocatedNum::alloc(cs.namespace(|| "xprime"), || {
-            let mut t0 = lambda.get_value().get()?.square();
-            t0.sub_assign(MONTGOMERY_A);
-            t0.sub_assign(self.x.get_value().get()?);
-            t0.sub_assign(other.x.get_value().get()?);
-
-            Ok(t0)
-        })?;
-
-        // (lambda) * (lambda) = (A + x + x' + x'')
-        let one = CS::one();
-        cs.enforce(
-            || "evaluate xprime",
-            |lc| lc + lambda.get_variable(),
-            |lc| lc + lambda.get_variable(),
-            |lc| {
-                lc + (MONTGOMERY_A, one)
-                    + &self.x.lc(bls12_381::Scalar::one())
-                    + &other.x.lc(bls12_381::Scalar::one())
-                    + xprime.get_variable()
-            },
-        );
-
-        // Compute y' = -(y + lambda(x' - x))
-        let yprime = AllocatedNum::alloc(cs.namespace(|| "yprime"), || {
-            let mut t0 = *xprime.get_value().get()?;
-            t0.sub_assign(self.x.get_value().get()?);
-            t0.mul_assign(lambda.get_value().get()?);
-            t0.add_assign(self.y.get_value().get()?);
-            t0 = t0.neg();
-
-            Ok(t0)
-        })?;
-
-        // y' + y = lambda(x - x')
-        cs.enforce(
-            || "evaluate yprime",
-            |lc| lc + &self.x.lc(bls12_381::Scalar::one()) - xprime.get_variable(),
-            |lc| lc + lambda.get_variable(),
-            |lc| lc + yprime.get_variable() + &self.y.lc(bls12_381::Scalar::one()),
-        );
-
-        Ok(MontgomeryPoint {
-            x: xprime.into(),
-            y: yprime.into(),
-        })
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use bellman::ConstraintSystem;
-    use group::{
-        ff::{Field, PrimeField, PrimeFieldBits},
-        Curve, Group,
-    };
-    use rand_core::{RngCore, SeedableRng};
-    use rand_xorshift::XorShiftRng;
-
-    use bellman::gadgets::test::*;
-
-    use super::{fixed_base_multiplication, AllocatedNum, EdwardsPoint, MontgomeryPoint};
-    use crate::constants::{to_montgomery_coords, NOTE_COMMITMENT_RANDOMNESS_GENERATOR};
-    use bellman::gadgets::boolean::{AllocatedBit, Boolean};
-
-    #[test]
-    #[allow(clippy::many_single_char_names)]
-    fn test_into_edwards() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let mut cs = TestConstraintSystem::new();
-
-            let p = jubjub::ExtendedPoint::random(&mut rng);
-            let (x, y) = to_montgomery_coords(p).unwrap();
-            let p = p.to_affine();
-            let (u, v) = (p.get_u(), p.get_v());
-
-            let numx = AllocatedNum::alloc(cs.namespace(|| "mont x"), || Ok(x)).unwrap();
-            let numy = AllocatedNum::alloc(cs.namespace(|| "mont y"), || Ok(y)).unwrap();
-
-            let p = MontgomeryPoint::interpret_unchecked(numx.into(), numy.into());
-
-            let q = p.into_edwards(&mut cs).unwrap();
-
-            assert!(cs.is_satisfied());
-            assert!(q.u.get_value().unwrap() == u);
-            assert!(q.v.get_value().unwrap() == v);
-
-            cs.set("u/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied().unwrap(), "u computation");
-            cs.set("u/num", u);
-            assert!(cs.is_satisfied());
-
-            cs.set("v/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied().unwrap(), "v computation");
-            cs.set("v/num", v);
-            assert!(cs.is_satisfied());
-        }
-    }
-
-    #[test]
-    fn test_interpret() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let p = jubjub::ExtendedPoint::random(&mut rng);
-
-            let mut cs = TestConstraintSystem::new();
-            let q = EdwardsPoint::witness(&mut cs, Some(p)).unwrap();
-
-            let p = p.to_affine();
-
-            assert!(cs.is_satisfied());
-            assert_eq!(q.u.get_value().unwrap(), p.get_u());
-            assert_eq!(q.v.get_value().unwrap(), p.get_v());
-        }
-
-        for _ in 0..100 {
-            let p = jubjub::ExtendedPoint::random(&mut rng).to_affine();
-            let (u, v) = (p.get_u(), p.get_v());
-
-            let mut cs = TestConstraintSystem::new();
-            let numu = AllocatedNum::alloc(cs.namespace(|| "u"), || Ok(u)).unwrap();
-            let numv = AllocatedNum::alloc(cs.namespace(|| "v"), || Ok(v)).unwrap();
-
-            let p = EdwardsPoint::interpret(&mut cs, &numu, &numv).unwrap();
-
-            assert!(cs.is_satisfied());
-            assert_eq!(p.u.get_value().unwrap(), u);
-            assert_eq!(p.v.get_value().unwrap(), v);
-        }
-
-        // Random (u, v) are unlikely to be on the curve.
-        for _ in 0..100 {
-            let u = bls12_381::Scalar::random(&mut rng);
-            let v = bls12_381::Scalar::random(&mut rng);
-
-            let mut cs = TestConstraintSystem::new();
-            let numu = AllocatedNum::alloc(cs.namespace(|| "u"), || Ok(u)).unwrap();
-            let numv = AllocatedNum::alloc(cs.namespace(|| "v"), || Ok(v)).unwrap();
-
-            EdwardsPoint::interpret(&mut cs, &numu, &numv).unwrap();
-
-            assert_eq!(cs.which_is_unsatisfied().unwrap(), "on curve check");
-        }
-    }
-
-    #[test]
-    fn test_edwards_fixed_base_multiplication() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let mut cs = TestConstraintSystem::<bls12_381::Scalar>::new();
-
-            let p = zcash_primitives::constants::NOTE_COMMITMENT_RANDOMNESS_GENERATOR;
-            let s = jubjub::Fr::random(&mut rng);
-            let q = jubjub::ExtendedPoint::from(p * s).to_affine();
-            let (u1, v1) = (q.get_u(), q.get_v());
-
-            let s_bits = s
-                .to_le_bits()
-                .iter()
-                .by_vals()
-                .take(jubjub::Fr::NUM_BITS as usize)
-                .enumerate()
-                .map(|(i, b)| {
-                    AllocatedBit::alloc(cs.namespace(|| format!("scalar bit {}", i)), Some(b))
-                        .unwrap()
-                })
-                .map(Boolean::from)
-                .collect::<Vec<_>>();
-
-            let q = fixed_base_multiplication(
-                cs.namespace(|| "multiplication"),
-                &NOTE_COMMITMENT_RANDOMNESS_GENERATOR,
-                &s_bits,
-            )
-            .unwrap();
-
-            assert_eq!(q.u.get_value().unwrap(), u1);
-            assert_eq!(q.v.get_value().unwrap(), v1);
-        }
-    }
-
-    #[test]
-    fn test_edwards_multiplication() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let mut cs = TestConstraintSystem::new();
-
-            let p = jubjub::ExtendedPoint::random(&mut rng);
-            let s = jubjub::Fr::random(&mut rng);
-            let q = (p * s).to_affine();
-            let p = p.to_affine();
-
-            let (u0, v0) = (p.get_u(), p.get_v());
-            let (u1, v1) = (q.get_u(), q.get_v());
-
-            let num_u0 = AllocatedNum::alloc(cs.namespace(|| "u0"), || Ok(u0)).unwrap();
-            let num_v0 = AllocatedNum::alloc(cs.namespace(|| "v0"), || Ok(v0)).unwrap();
-
-            let p = EdwardsPoint {
-                u: num_u0,
-                v: num_v0,
-            };
-
-            let s_bits = s
-                .to_le_bits()
-                .iter()
-                .by_vals()
-                .take(jubjub::Fr::NUM_BITS as usize)
-                .enumerate()
-                .map(|(i, b)| {
-                    AllocatedBit::alloc(cs.namespace(|| format!("scalar bit {}", i)), Some(b))
-                        .unwrap()
-                })
-                .map(Boolean::from)
-                .collect::<Vec<_>>();
-
-            let q = p.mul(cs.namespace(|| "scalar mul"), &s_bits).unwrap();
-
-            assert!(cs.is_satisfied());
-
-            assert_eq!(q.u.get_value().unwrap(), u1);
-
-            assert_eq!(q.v.get_value().unwrap(), v1);
-        }
-    }
-
-    #[test]
-    fn test_conditionally_select() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..1000 {
-            let mut cs = TestConstraintSystem::new();
-
-            let p = jubjub::ExtendedPoint::random(&mut rng).to_affine();
-
-            let (u0, v0) = (p.get_u(), p.get_v());
-
-            let num_u0 = AllocatedNum::alloc(cs.namespace(|| "u0"), || Ok(u0)).unwrap();
-            let num_v0 = AllocatedNum::alloc(cs.namespace(|| "v0"), || Ok(v0)).unwrap();
-
-            let p = EdwardsPoint {
-                u: num_u0,
-                v: num_v0,
-            };
-
-            let mut should_we_select = rng.next_u32() % 2 != 0;
-
-            // Conditionally allocate
-            let mut b = if rng.next_u32() % 2 != 0 {
-                Boolean::from(
-                    AllocatedBit::alloc(cs.namespace(|| "condition"), Some(should_we_select))
-                        .unwrap(),
-                )
-            } else {
-                Boolean::constant(should_we_select)
-            };
-
-            // Conditionally negate
-            if rng.next_u32() % 2 != 0 {
-                b = b.not();
-                should_we_select = !should_we_select;
-            }
-
-            let q = p
-                .conditionally_select(cs.namespace(|| "select"), &b)
-                .unwrap();
-
-            assert!(cs.is_satisfied());
-
-            #[allow(clippy::branches_sharing_code)]
-            if should_we_select {
-                assert_eq!(q.u.get_value().unwrap(), u0);
-                assert_eq!(q.v.get_value().unwrap(), v0);
-
-                cs.set("select/v'/num", bls12_381::Scalar::one());
-                assert_eq!(cs.which_is_unsatisfied().unwrap(), "select/v' computation");
-                cs.set("select/u'/num", bls12_381::Scalar::zero());
-                assert_eq!(cs.which_is_unsatisfied().unwrap(), "select/u' computation");
-            } else {
-                assert_eq!(q.u.get_value().unwrap(), bls12_381::Scalar::zero());
-                assert_eq!(q.v.get_value().unwrap(), bls12_381::Scalar::one());
-
-                cs.set("select/v'/num", u0);
-                assert_eq!(cs.which_is_unsatisfied().unwrap(), "select/v' computation");
-                cs.set("select/u'/num", v0);
-                assert_eq!(cs.which_is_unsatisfied().unwrap(), "select/u' computation");
-            }
-        }
-    }
-
-    #[test]
-    fn test_edwards_addition() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let p1 = jubjub::ExtendedPoint::random(&mut rng);
-            let p2 = jubjub::ExtendedPoint::random(&mut rng);
-
-            let p3 = p1 + p2;
-
-            let p1 = p1.to_affine();
-            let p2 = p2.to_affine();
-            let p3 = p3.to_affine();
-
-            let (u0, v0) = (p1.get_u(), p1.get_v());
-            let (u1, v1) = (p2.get_u(), p2.get_v());
-            let (u2, v2) = (p3.get_u(), p3.get_v());
-
-            let mut cs = TestConstraintSystem::new();
-
-            let num_u0 = AllocatedNum::alloc(cs.namespace(|| "u0"), || Ok(u0)).unwrap();
-            let num_v0 = AllocatedNum::alloc(cs.namespace(|| "v0"), || Ok(v0)).unwrap();
-
-            let num_u1 = AllocatedNum::alloc(cs.namespace(|| "u1"), || Ok(u1)).unwrap();
-            let num_v1 = AllocatedNum::alloc(cs.namespace(|| "v1"), || Ok(v1)).unwrap();
-
-            let p1 = EdwardsPoint {
-                u: num_u0,
-                v: num_v0,
-            };
-
-            let p2 = EdwardsPoint {
-                u: num_u1,
-                v: num_v1,
-            };
-
-            let p3 = p1.add(cs.namespace(|| "addition"), &p2).unwrap();
-
-            assert!(cs.is_satisfied());
-
-            assert!(p3.u.get_value().unwrap() == u2);
-            assert!(p3.v.get_value().unwrap() == v2);
-
-            let uppercase_u = cs.get("addition/U/num");
-            cs.set("addition/U/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied(), Some("addition/U computation"));
-            cs.set("addition/U/num", uppercase_u);
-            assert!(cs.is_satisfied());
-
-            let u3 = cs.get("addition/u3/num");
-            cs.set("addition/u3/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied(), Some("addition/u3 computation"));
-            cs.set("addition/u3/num", u3);
-            assert!(cs.is_satisfied());
-
-            let v3 = cs.get("addition/v3/num");
-            cs.set("addition/v3/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied(), Some("addition/v3 computation"));
-            cs.set("addition/v3/num", v3);
-            assert!(cs.is_satisfied());
-        }
-    }
-
-    #[test]
-    fn test_edwards_doubling() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let p1 = jubjub::ExtendedPoint::random(&mut rng);
-            let p2 = p1.double();
-
-            let p1 = p1.to_affine();
-            let p2 = p2.to_affine();
-
-            let (u0, v0) = (p1.get_u(), p1.get_v());
-            let (u1, v1) = (p2.get_u(), p2.get_v());
-
-            let mut cs = TestConstraintSystem::new();
-
-            let num_u0 = AllocatedNum::alloc(cs.namespace(|| "u0"), || Ok(u0)).unwrap();
-            let num_v0 = AllocatedNum::alloc(cs.namespace(|| "v0"), || Ok(v0)).unwrap();
-
-            let p1 = EdwardsPoint {
-                u: num_u0,
-                v: num_v0,
-            };
-
-            let p2 = p1.double(cs.namespace(|| "doubling")).unwrap();
-
-            assert!(cs.is_satisfied());
-
-            assert!(p2.u.get_value().unwrap() == u1);
-            assert!(p2.v.get_value().unwrap() == v1);
-        }
-    }
-
-    #[test]
-    fn test_montgomery_addition() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x5d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for _ in 0..100 {
-            let p1 = jubjub::ExtendedPoint::random(&mut rng);
-            let p2 = jubjub::ExtendedPoint::random(&mut rng);
-            let p3 = p1 + p2;
-
-            let (x0, y0) = to_montgomery_coords(p1).unwrap();
-            let (x1, y1) = to_montgomery_coords(p2).unwrap();
-            let (x2, y2) = to_montgomery_coords(p3).unwrap();
-
-            let mut cs = TestConstraintSystem::new();
-
-            let num_x0 = AllocatedNum::alloc(cs.namespace(|| "x0"), || Ok(x0)).unwrap();
-            let num_y0 = AllocatedNum::alloc(cs.namespace(|| "y0"), || Ok(y0)).unwrap();
-
-            let num_x1 = AllocatedNum::alloc(cs.namespace(|| "x1"), || Ok(x1)).unwrap();
-            let num_y1 = AllocatedNum::alloc(cs.namespace(|| "y1"), || Ok(y1)).unwrap();
-
-            let p1 = MontgomeryPoint {
-                x: num_x0.into(),
-                y: num_y0.into(),
-            };
-
-            let p2 = MontgomeryPoint {
-                x: num_x1.into(),
-                y: num_y1.into(),
-            };
-
-            let p3 = p1.add(cs.namespace(|| "addition"), &p2).unwrap();
-
-            assert!(cs.is_satisfied());
-
-            assert!(p3.x.get_value().unwrap() == x2);
-            assert!(p3.y.get_value().unwrap() == y2);
-
-            cs.set("addition/yprime/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied(), Some("addition/evaluate yprime"));
-            cs.set("addition/yprime/num", y2);
-            assert!(cs.is_satisfied());
-
-            cs.set("addition/xprime/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied(), Some("addition/evaluate xprime"));
-            cs.set("addition/xprime/num", x2);
-            assert!(cs.is_satisfied());
-
-            cs.set("addition/lambda/num", bls12_381::Scalar::random(&mut rng));
-            assert_eq!(cs.which_is_unsatisfied(), Some("addition/evaluate lambda"));
-        }
-    }
-
-    #[test]
-    fn test_assert_not_small_order() {
-        let check_small_order_from_p = |p: jubjub::ExtendedPoint, is_small_order| {
-            let mut cs = TestConstraintSystem::new();
-
-            let p = EdwardsPoint::witness(&mut cs, Some(p)).unwrap();
-            assert!(cs.is_satisfied());
-            assert!(p.assert_not_small_order(&mut cs).is_err() == is_small_order);
-        };
-
-        let check_small_order_from_u64s = |u, v| {
-            let (u, v) = (bls12_381::Scalar::from(u), bls12_381::Scalar::from(v));
-            let p = jubjub::AffinePoint::from_raw_unchecked(u, v);
-
-            check_small_order_from_p(p.into(), true);
-        };
-
-        // zero has low order
-        check_small_order_from_u64s(0, 1);
-
-        // prime subgroup order
-        let prime_subgroup_order = jubjub::Fr::from_str_vartime(
-            "6554484396890773809930967563523245729705921265872317281365359162392183254199",
-        )
-        .unwrap();
-        let largest_small_subgroup_order = jubjub::Fr::from(8);
-
-        let (zero_u, zero_v) = (bls12_381::Scalar::zero(), bls12_381::Scalar::one());
-
-        // generator for jubjub
-        let (u, v) = (
-            bls12_381::Scalar::from_str_vartime(
-                "11076627216317271660298050606127911965867021807910416450833192264015104452986",
-            )
-            .unwrap(),
-            bls12_381::Scalar::from_str_vartime(
-                "44412834903739585386157632289020980010620626017712148233229312325549216099227",
-            )
-            .unwrap(),
-        );
-        let g = jubjub::AffinePoint::from_raw_unchecked(u, v).into();
-        check_small_order_from_p(g, false);
-
-        // generator for the prime subgroup
-        let g_prime = g * largest_small_subgroup_order;
-        check_small_order_from_p(g_prime, false);
-        let prime_subgroup_order_minus_1 = prime_subgroup_order - jubjub::Fr::one();
-
-        let should_not_be_zero = g_prime * prime_subgroup_order_minus_1;
-        assert_ne!(zero_u, should_not_be_zero.to_affine().get_u());
-        assert_ne!(zero_v, should_not_be_zero.to_affine().get_v());
-        let should_be_zero = should_not_be_zero + g_prime;
-        assert_eq!(zero_u, should_be_zero.to_affine().get_u());
-        assert_eq!(zero_v, should_be_zero.to_affine().get_v());
-
-        // generator for the small order subgroup
-        let g_small = g * prime_subgroup_order_minus_1;
-        let g_small = g_small + g;
-        check_small_order_from_p(g_small, true);
-
-        // g_small does have order 8
-        let largest_small_subgroup_order_minus_1 = largest_small_subgroup_order - jubjub::Fr::one();
-
-        let should_not_be_zero = g_small * largest_small_subgroup_order_minus_1;
-        assert_ne!(zero_u, should_not_be_zero.to_affine().get_u());
-        assert_ne!(zero_v, should_not_be_zero.to_affine().get_v());
-
-        let should_be_zero = should_not_be_zero + g_small;
-        assert_eq!(zero_u, should_be_zero.to_affine().get_u());
-        assert_eq!(zero_v, should_be_zero.to_affine().get_v());
-
-        // take all the points from the script
-        // assert should be different than multiplying by cofactor, which is the solution
-        // is user input verified? https://github.com/zcash/librustzcash/blob/f5d2afb4eabac29b1b1cc860d66e45a5b48b4f88/src/rustzcash.rs#L299
-    }
-}
diff --git a/zcash_proofs/src/circuit/pedersen_hash.rs b/zcash_proofs/src/circuit/pedersen_hash.rs
deleted file mode 100644
index 44f2923aa4..0000000000
--- a/zcash_proofs/src/circuit/pedersen_hash.rs
+++ /dev/null
@@ -1,302 +0,0 @@
-//! Gadget for Zcash's Pedersen hash.
-
-use super::ecc::{EdwardsPoint, MontgomeryPoint};
-use bellman::gadgets::boolean::Boolean;
-use bellman::gadgets::lookup::*;
-use bellman::{ConstraintSystem, SynthesisError};
-pub use zcash_primitives::sapling::pedersen_hash::Personalization;
-
-use crate::constants::PEDERSEN_CIRCUIT_GENERATORS;
-
-fn get_constant_bools(person: &Personalization) -> Vec<Boolean> {
-    person
-        .get_bits()
-        .into_iter()
-        .map(Boolean::constant)
-        .collect()
-}
-
-pub fn pedersen_hash<CS>(
-    mut cs: CS,
-    personalization: Personalization,
-    bits: &[Boolean],
-) -> Result<EdwardsPoint, SynthesisError>
-where
-    CS: ConstraintSystem<bls12_381::Scalar>,
-{
-    let personalization = get_constant_bools(&personalization);
-    assert_eq!(personalization.len(), 6);
-
-    let mut edwards_result = None;
-    let mut bits = personalization.iter().chain(bits.iter()).peekable();
-    let mut segment_generators = PEDERSEN_CIRCUIT_GENERATORS.iter();
-    let boolean_false = Boolean::constant(false);
-
-    let mut segment_i = 0;
-    while bits.peek().is_some() {
-        let mut segment_result = None;
-        let mut segment_windows = &segment_generators.next().expect("enough segments")[..];
-
-        let mut window_i = 0;
-        while let Some(a) = bits.next() {
-            let b = bits.next().unwrap_or(&boolean_false);
-            let c = bits.next().unwrap_or(&boolean_false);
-
-            let tmp = lookup3_xy_with_conditional_negation(
-                cs.namespace(|| format!("segment {}, window {}", segment_i, window_i)),
-                &[a.clone(), b.clone(), c.clone()],
-                &segment_windows[0],
-            )?;
-
-            let tmp = MontgomeryPoint::interpret_unchecked(tmp.0, tmp.1);
-
-            match segment_result {
-                None => {
-                    segment_result = Some(tmp);
-                }
-                Some(ref mut segment_result) => {
-                    *segment_result = tmp.add(
-                        cs.namespace(|| {
-                            format!("addition of segment {}, window {}", segment_i, window_i)
-                        }),
-                        segment_result,
-                    )?;
-                }
-            }
-
-            segment_windows = &segment_windows[1..];
-
-            if segment_windows.is_empty() {
-                break;
-            }
-
-            window_i += 1;
-        }
-
-        let segment_result = segment_result.expect(
-            "bits is not exhausted due to while condition;
-                    thus there must be a segment window;
-                    thus there must be a segment result",
-        );
-
-        // Convert this segment into twisted Edwards form.
-        let segment_result = segment_result.into_edwards(
-            cs.namespace(|| format!("conversion of segment {} into edwards", segment_i)),
-        )?;
-
-        match edwards_result {
-            Some(ref mut edwards_result) => {
-                *edwards_result = segment_result.add(
-                    cs.namespace(|| format!("addition of segment {} to accumulator", segment_i)),
-                    edwards_result,
-                )?;
-            }
-            None => {
-                edwards_result = Some(segment_result);
-            }
-        }
-
-        segment_i += 1;
-    }
-
-    Ok(edwards_result.unwrap())
-}
-
-#[cfg(test)]
-mod test {
-    use super::*;
-    use bellman::gadgets::boolean::{AllocatedBit, Boolean};
-    use bellman::gadgets::test::*;
-    use group::{ff::PrimeField, Curve};
-    use rand_core::{RngCore, SeedableRng};
-    use rand_xorshift::XorShiftRng;
-    use zcash_primitives::sapling::pedersen_hash;
-
-    /// Predict the number of constraints of a Pedersen hash
-    fn ph_num_constraints(input_bits: usize) -> usize {
-        // Account for the 6 personalization bits.
-        let personalized_bits = 6 + input_bits;
-        // Constant booleans in the personalization and padding don't need lookup "precomp" constraints.
-        let precomputed_booleans = 2 + (personalized_bits % 3 == 1) as usize;
-
-        // Count chunks and segments with ceiling division
-        let chunks = (personalized_bits + 3 - 1) / 3;
-        let segments = (chunks + 63 - 1) / 63;
-        let all_but_last_segments = segments - 1;
-        let last_chunks = chunks - all_but_last_segments * 63;
-
-        // Constraints per operation
-        let lookup_chunk = 2;
-        let add_chunks = 3; // Montgomery addition
-        let convert_segment = 2; // Conversion to Edwards
-        let add_segments = 6; // Edwards addition
-
-        (chunks) * lookup_chunk - precomputed_booleans
-            + segments * convert_segment
-            + all_but_last_segments * ((63 - 1) * add_chunks + add_segments)
-            + (last_chunks - 1) * add_chunks
-    }
-
-    #[test]
-    fn test_pedersen_hash_constraints() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        let leaves_len = 2 * 255;
-        let note_len = 64 + 256 + 256;
-
-        for &n_bits in [
-            0,
-            3 * 63 - 6,
-            3 * 63 - 6 + 1,
-            3 * 63 - 6 + 2,
-            leaves_len,
-            note_len,
-        ]
-        .iter()
-        {
-            let mut cs = TestConstraintSystem::new();
-
-            let input: Vec<bool> = (0..n_bits).map(|_| rng.next_u32() % 2 != 0).collect();
-
-            let input_bools: Vec<Boolean> = input
-                .iter()
-                .enumerate()
-                .map(|(i, b)| {
-                    Boolean::from(
-                        AllocatedBit::alloc(cs.namespace(|| format!("input {}", i)), Some(*b))
-                            .unwrap(),
-                    )
-                })
-                .collect();
-
-            pedersen_hash(
-                cs.namespace(|| "pedersen hash"),
-                Personalization::NoteCommitment,
-                &input_bools,
-            )
-            .unwrap();
-
-            assert!(cs.is_satisfied());
-
-            let bitness_constraints = n_bits;
-            let ph_constraints = ph_num_constraints(n_bits);
-            assert_eq!(cs.num_constraints(), bitness_constraints + ph_constraints);
-            // The actual usages
-            if n_bits == leaves_len {
-                assert_eq!(cs.num_constraints(), leaves_len + 867)
-            };
-            if n_bits == note_len {
-                assert_eq!(cs.num_constraints(), note_len + 982)
-            };
-        }
-    }
-
-    #[test]
-    fn test_pedersen_hash() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        for length in 0..751 {
-            for _ in 0..5 {
-                let input: Vec<bool> = (0..length).map(|_| rng.next_u32() % 2 != 0).collect();
-
-                let mut cs = TestConstraintSystem::new();
-
-                let input_bools: Vec<Boolean> = input
-                    .iter()
-                    .enumerate()
-                    .map(|(i, b)| {
-                        Boolean::from(
-                            AllocatedBit::alloc(cs.namespace(|| format!("input {}", i)), Some(*b))
-                                .unwrap(),
-                        )
-                    })
-                    .collect();
-
-                let res = pedersen_hash(
-                    cs.namespace(|| "pedersen hash"),
-                    Personalization::MerkleTree(1),
-                    &input_bools,
-                )
-                .unwrap();
-
-                assert!(cs.is_satisfied());
-
-                let expected = jubjub::ExtendedPoint::from(pedersen_hash::pedersen_hash(
-                    Personalization::MerkleTree(1),
-                    input.clone().into_iter(),
-                ))
-                .to_affine();
-
-                assert_eq!(res.get_u().get_value().unwrap(), expected.get_u());
-                assert_eq!(res.get_v().get_value().unwrap(), expected.get_v());
-
-                // Test against the output of a different personalization
-                let unexpected = jubjub::ExtendedPoint::from(pedersen_hash::pedersen_hash(
-                    Personalization::MerkleTree(0),
-                    input.into_iter(),
-                ))
-                .to_affine();
-
-                assert!(res.get_u().get_value().unwrap() != unexpected.get_u());
-                assert!(res.get_v().get_value().unwrap() != unexpected.get_v());
-            }
-        }
-    }
-
-    #[test]
-    fn test_pedersen_hash_external_test_vectors() {
-        let mut rng = XorShiftRng::from_seed([
-            0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06,
-            0xbc, 0xe5,
-        ]);
-
-        let expected_us = [
-            "28161926966428986673895580777285905189725480206811328272001879986576840909576",
-            "39669831794597628158501766225645040955899576179071014703006420393381978263045",
-        ];
-        let expected_vs = [
-            "26869991781071974894722407757894142583682396277979904369818887810555917099932",
-            "2112827187110048608327330788910224944044097981650120385961435904443901436107",
-        ];
-        for length in 300..302 {
-            let input: Vec<bool> = (0..length).map(|_| rng.next_u32() % 2 != 0).collect();
-
-            let mut cs = TestConstraintSystem::new();
-
-            let input_bools: Vec<Boolean> = input
-                .iter()
-                .enumerate()
-                .map(|(i, b)| {
-                    Boolean::from(
-                        AllocatedBit::alloc(cs.namespace(|| format!("input {}", i)), Some(*b))
-                            .unwrap(),
-                    )
-                })
-                .collect();
-
-            let res = pedersen_hash(
-                cs.namespace(|| "pedersen hash"),
-                Personalization::MerkleTree(1),
-                &input_bools,
-            )
-            .unwrap();
-
-            assert!(cs.is_satisfied());
-
-            assert_eq!(
-                res.get_u().get_value().unwrap(),
-                bls12_381::Scalar::from_str_vartime(expected_us[length - 300]).unwrap()
-            );
-            assert_eq!(
-                res.get_v().get_value().unwrap(),
-                bls12_381::Scalar::from_str_vartime(expected_vs[length - 300]).unwrap()
-            );
-        }
-    }
-}
diff --git a/zcash_proofs/src/circuit/sapling.rs b/zcash_proofs/src/circuit/sapling.rs
deleted file mode 100644
index fddbaae073..0000000000
--- a/zcash_proofs/src/circuit/sapling.rs
+++ /dev/null
@@ -1,968 +0,0 @@
-//! The Sapling circuits.
-
-use group::{ff::PrimeField, Curve};
-
-use bellman::{Circuit, ConstraintSystem, SynthesisError};
-
-use zcash_primitives::constants;
-
-use zcash_primitives::sapling::{PaymentAddress, ProofGenerationKey};
-
-use super::ecc;
-use super::pedersen_hash;
-use crate::constants::{
-    NOTE_COMMITMENT_RANDOMNESS_GENERATOR, NULLIFIER_POSITION_GENERATOR,
-    PROOF_GENERATION_KEY_GENERATOR, SPENDING_KEY_GENERATOR, VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-    VALUE_COMMITMENT_VALUE_GENERATOR,
-};
-use bellman::gadgets::blake2s;
-use bellman::gadgets::boolean;
-use bellman::gadgets::multipack;
-use bellman::gadgets::num;
-use bellman::gadgets::Assignment;
-
-#[cfg(test)]
-use group::ff::PrimeFieldBits;
-
-#[cfg(test)]
-use zcash_primitives::sapling::value::NoteValue;
-
-/// The opening (value and randomness) of a Sapling value commitment.
-#[derive(Clone)]
-pub struct ValueCommitmentOpening {
-    pub value: u64,
-    pub randomness: jubjub::Scalar,
-}
-
-#[cfg(test)]
-impl ValueCommitmentOpening {
-    fn commitment(&self) -> jubjub::ExtendedPoint {
-        let cv = (constants::VALUE_COMMITMENT_VALUE_GENERATOR * jubjub::Fr::from(self.value))
-            + (constants::VALUE_COMMITMENT_RANDOMNESS_GENERATOR * self.randomness);
-        cv.into()
-    }
-}
-
-/// This is an instance of the `Spend` circuit.
-pub struct Spend {
-    /// The opening of a Pedersen commitment to the value being spent.
-    pub value_commitment_opening: Option<ValueCommitmentOpening>,
-
-    /// Key required to construct proofs for spending notes
-    /// for a particular spending key
-    pub proof_generation_key: Option<ProofGenerationKey>,
-
-    /// The payment address associated with the note
-    pub payment_address: Option<PaymentAddress>,
-
-    /// The randomness of the note commitment
-    pub commitment_randomness: Option<jubjub::Fr>,
-
-    /// Re-randomization of the public key
-    pub ar: Option<jubjub::Fr>,
-
-    /// The authentication path of the commitment in the tree
-    pub auth_path: Vec<Option<(bls12_381::Scalar, bool)>>,
-
-    /// The anchor; the root of the tree. If the note being
-    /// spent is zero-value, this can be anything.
-    pub anchor: Option<bls12_381::Scalar>,
-}
-
-/// This is an output circuit instance.
-pub struct Output {
-    /// The opening of a Pedersen commitment to the value being spent.
-    pub value_commitment_opening: Option<ValueCommitmentOpening>,
-
-    /// The payment address of the recipient
-    pub payment_address: Option<PaymentAddress>,
-
-    /// The randomness used to hide the note commitment data
-    pub commitment_randomness: Option<jubjub::Fr>,
-
-    /// The ephemeral secret key for DH with recipient
-    pub esk: Option<jubjub::Fr>,
-}
-
-/// Exposes a Pedersen commitment to the value as an
-/// input to the circuit
-fn expose_value_commitment<CS>(
-    mut cs: CS,
-    value_commitment_opening: Option<ValueCommitmentOpening>,
-) -> Result<Vec<boolean::Boolean>, SynthesisError>
-where
-    CS: ConstraintSystem<bls12_381::Scalar>,
-{
-    // Booleanize the value into little-endian bit order
-    let value_bits = boolean::u64_into_boolean_vec_le(
-        cs.namespace(|| "value"),
-        value_commitment_opening.as_ref().map(|c| c.value),
-    )?;
-
-    // Compute the note value in the exponent
-    let value = ecc::fixed_base_multiplication(
-        cs.namespace(|| "compute the value in the exponent"),
-        &VALUE_COMMITMENT_VALUE_GENERATOR,
-        &value_bits,
-    )?;
-
-    // Booleanize the randomness. This does not ensure
-    // the bit representation is "in the field" because
-    // it doesn't matter for security.
-    let rcv = boolean::field_into_boolean_vec_le(
-        cs.namespace(|| "rcv"),
-        value_commitment_opening.as_ref().map(|c| c.randomness),
-    )?;
-
-    // Compute the randomness in the exponent
-    let rcv = ecc::fixed_base_multiplication(
-        cs.namespace(|| "computation of rcv"),
-        &VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-        &rcv,
-    )?;
-
-    // Compute the Pedersen commitment to the value
-    let cv = value.add(cs.namespace(|| "computation of cv"), &rcv)?;
-
-    // Expose the commitment as an input to the circuit
-    cv.inputize(cs.namespace(|| "commitment point"))?;
-
-    Ok(value_bits)
-}
-
-impl Circuit<bls12_381::Scalar> for Spend {
-    fn synthesize<CS: ConstraintSystem<bls12_381::Scalar>>(
-        self,
-        cs: &mut CS,
-    ) -> Result<(), SynthesisError> {
-        // Prover witnesses ak (ensures that it's on the curve)
-        let ak = ecc::EdwardsPoint::witness(
-            cs.namespace(|| "ak"),
-            self.proof_generation_key.as_ref().map(|k| k.ak.into()),
-        )?;
-
-        // There are no sensible attacks on small order points
-        // of ak (that we're aware of!) but it's a cheap check,
-        // so we do it.
-        ak.assert_not_small_order(cs.namespace(|| "ak not small order"))?;
-
-        // Rerandomize ak and expose it as an input to the circuit
-        {
-            let ar = boolean::field_into_boolean_vec_le(cs.namespace(|| "ar"), self.ar)?;
-
-            // Compute the randomness in the exponent
-            let ar = ecc::fixed_base_multiplication(
-                cs.namespace(|| "computation of randomization for the signing key"),
-                &SPENDING_KEY_GENERATOR,
-                &ar,
-            )?;
-
-            let rk = ak.add(cs.namespace(|| "computation of rk"), &ar)?;
-
-            rk.inputize(cs.namespace(|| "rk"))?;
-        }
-
-        // Compute nk = [nsk] ProofGenerationKey
-        let nk;
-        {
-            // Witness nsk as bits
-            let nsk = boolean::field_into_boolean_vec_le(
-                cs.namespace(|| "nsk"),
-                self.proof_generation_key.as_ref().map(|k| k.nsk),
-            )?;
-
-            // NB: We don't ensure that the bit representation of nsk
-            // is "in the field" (jubjub::Fr) because it's not used
-            // except to demonstrate the prover knows it. If they know
-            // a congruency then that's equivalent.
-
-            // Compute nk = [nsk] ProvingPublicKey
-            nk = ecc::fixed_base_multiplication(
-                cs.namespace(|| "computation of nk"),
-                &PROOF_GENERATION_KEY_GENERATOR,
-                &nsk,
-            )?;
-        }
-
-        // This is the "viewing key" preimage for CRH^ivk
-        let mut ivk_preimage = vec![];
-
-        // Place ak in the preimage for CRH^ivk
-        ivk_preimage.extend(ak.repr(cs.namespace(|| "representation of ak"))?);
-
-        // This is the nullifier preimage for PRF^nf
-        let mut nf_preimage = vec![];
-
-        // Extend ivk and nf preimages with the representation of
-        // nk.
-        {
-            let repr_nk = nk.repr(cs.namespace(|| "representation of nk"))?;
-
-            ivk_preimage.extend(repr_nk.iter().cloned());
-            nf_preimage.extend(repr_nk);
-        }
-
-        assert_eq!(ivk_preimage.len(), 512);
-        assert_eq!(nf_preimage.len(), 256);
-
-        // Compute the incoming viewing key ivk
-        let mut ivk = blake2s::blake2s(
-            cs.namespace(|| "computation of ivk"),
-            &ivk_preimage,
-            constants::CRH_IVK_PERSONALIZATION,
-        )?;
-
-        // drop_5 to ensure it's in the field
-        ivk.truncate(jubjub::Fr::CAPACITY as usize);
-
-        // Witness g_d, checking that it's on the curve.
-        let g_d = {
-            ecc::EdwardsPoint::witness(
-                cs.namespace(|| "witness g_d"),
-                self.payment_address.as_ref().map(|a| {
-                    a.diversifier()
-                        .g_d()
-                        .expect("checked at construction")
-                        .into()
-                }),
-            )?
-        };
-
-        // Check that g_d is not small order. Technically, this check
-        // is already done in the Output circuit, and this proof ensures
-        // g_d is bound to a product of that check, but for defense in
-        // depth let's check it anyway. It's cheap.
-        g_d.assert_not_small_order(cs.namespace(|| "g_d not small order"))?;
-
-        // Compute pk_d = g_d^ivk
-        let pk_d = g_d.mul(cs.namespace(|| "compute pk_d"), &ivk)?;
-
-        // Compute note contents:
-        // value (in big endian) followed by g_d and pk_d
-        let mut note_contents = vec![];
-
-        // Handle the value; we'll need it later for the
-        // dummy input check.
-        let mut value_num = num::Num::zero();
-        {
-            // Get the value in little-endian bit order
-            let value_bits = expose_value_commitment(
-                cs.namespace(|| "value commitment"),
-                self.value_commitment_opening,
-            )?;
-
-            // Compute the note's value as a linear combination
-            // of the bits.
-            let mut coeff = bls12_381::Scalar::one();
-            for bit in &value_bits {
-                value_num = value_num.add_bool_with_coeff(CS::one(), bit, coeff);
-                coeff = coeff.double();
-            }
-
-            // Place the value in the note
-            note_contents.extend(value_bits);
-        }
-
-        // Place g_d in the note
-        note_contents.extend(g_d.repr(cs.namespace(|| "representation of g_d"))?);
-
-        // Place pk_d in the note
-        note_contents.extend(pk_d.repr(cs.namespace(|| "representation of pk_d"))?);
-
-        assert_eq!(
-            note_contents.len(),
-            64 + // value
-            256 + // g_d
-            256 // p_d
-        );
-
-        // Compute the hash of the note contents
-        let mut cm = pedersen_hash::pedersen_hash(
-            cs.namespace(|| "note content hash"),
-            pedersen_hash::Personalization::NoteCommitment,
-            &note_contents,
-        )?;
-
-        {
-            // Booleanize the randomness for the note commitment
-            let rcm = boolean::field_into_boolean_vec_le(
-                cs.namespace(|| "rcm"),
-                self.commitment_randomness,
-            )?;
-
-            // Compute the note commitment randomness in the exponent
-            let rcm = ecc::fixed_base_multiplication(
-                cs.namespace(|| "computation of commitment randomness"),
-                &NOTE_COMMITMENT_RANDOMNESS_GENERATOR,
-                &rcm,
-            )?;
-
-            // Randomize the note commitment. Pedersen hashes are not
-            // themselves hiding commitments.
-            cm = cm.add(cs.namespace(|| "randomization of note commitment"), &rcm)?;
-        }
-
-        // This will store (least significant bit first)
-        // the position of the note in the tree, for use
-        // in nullifier computation.
-        let mut position_bits = vec![];
-
-        // This is an injective encoding, as cur is a
-        // point in the prime order subgroup.
-        let mut cur = cm.get_u().clone();
-
-        // Ascend the merkle tree authentication path
-        for (i, e) in self.auth_path.into_iter().enumerate() {
-            let cs = &mut cs.namespace(|| format!("merkle tree hash {}", i));
-
-            // Determines if the current subtree is the "right" leaf at this
-            // depth of the tree.
-            let cur_is_right = boolean::Boolean::from(boolean::AllocatedBit::alloc(
-                cs.namespace(|| "position bit"),
-                e.map(|e| e.1),
-            )?);
-
-            // Push this boolean for nullifier computation later
-            position_bits.push(cur_is_right.clone());
-
-            // Witness the authentication path element adjacent
-            // at this depth.
-            let path_element =
-                num::AllocatedNum::alloc(cs.namespace(|| "path element"), || Ok(e.get()?.0))?;
-
-            // Swap the two if the current subtree is on the right
-            let (ul, ur) = num::AllocatedNum::conditionally_reverse(
-                cs.namespace(|| "conditional reversal of preimage"),
-                &cur,
-                &path_element,
-                &cur_is_right,
-            )?;
-
-            // We don't need to be strict, because the function is
-            // collision-resistant. If the prover witnesses a congruency,
-            // they will be unable to find an authentication path in the
-            // tree with high probability.
-            let mut preimage = vec![];
-            preimage.extend(ul.to_bits_le(cs.namespace(|| "ul into bits"))?);
-            preimage.extend(ur.to_bits_le(cs.namespace(|| "ur into bits"))?);
-
-            // Compute the new subtree value
-            cur = pedersen_hash::pedersen_hash(
-                cs.namespace(|| "computation of pedersen hash"),
-                pedersen_hash::Personalization::MerkleTree(i),
-                &preimage,
-            )?
-            .get_u()
-            .clone(); // Injective encoding
-        }
-
-        {
-            let real_anchor_value = self.anchor;
-
-            // Allocate the "real" anchor that will be exposed.
-            let rt = num::AllocatedNum::alloc(cs.namespace(|| "conditional anchor"), || {
-                Ok(*real_anchor_value.get()?)
-            })?;
-
-            // (cur - rt) * value = 0
-            // if value is zero, cur and rt can be different
-            // if value is nonzero, they must be equal
-            cs.enforce(
-                || "conditionally enforce correct root",
-                |lc| lc + cur.get_variable() - rt.get_variable(),
-                |lc| lc + &value_num.lc(bls12_381::Scalar::one()),
-                |lc| lc,
-            );
-
-            // Expose the anchor
-            rt.inputize(cs.namespace(|| "anchor"))?;
-        }
-
-        // Compute the cm + g^position for preventing
-        // faerie gold attacks
-        let mut rho = cm;
-        {
-            // Compute the position in the exponent
-            let position = ecc::fixed_base_multiplication(
-                cs.namespace(|| "g^position"),
-                &NULLIFIER_POSITION_GENERATOR,
-                &position_bits,
-            )?;
-
-            // Add the position to the commitment
-            rho = rho.add(cs.namespace(|| "faerie gold prevention"), &position)?;
-        }
-
-        // Let's compute nf = BLAKE2s(nk || rho)
-        nf_preimage.extend(rho.repr(cs.namespace(|| "representation of rho"))?);
-
-        assert_eq!(nf_preimage.len(), 512);
-
-        // Compute nf
-        let nf = blake2s::blake2s(
-            cs.namespace(|| "nf computation"),
-            &nf_preimage,
-            constants::PRF_NF_PERSONALIZATION,
-        )?;
-
-        multipack::pack_into_inputs(cs.namespace(|| "pack nullifier"), &nf)
-    }
-}
-
-impl Circuit<bls12_381::Scalar> for Output {
-    fn synthesize<CS: ConstraintSystem<bls12_381::Scalar>>(
-        self,
-        cs: &mut CS,
-    ) -> Result<(), SynthesisError> {
-        // Let's start to construct our note, which contains
-        // value (big endian)
-        let mut note_contents = vec![];
-
-        // Expose the value commitment and place the value
-        // in the note.
-        note_contents.extend(expose_value_commitment(
-            cs.namespace(|| "value commitment"),
-            self.value_commitment_opening,
-        )?);
-
-        // Let's deal with g_d
-        {
-            // Prover witnesses g_d, ensuring it's on the
-            // curve.
-            let g_d = ecc::EdwardsPoint::witness(
-                cs.namespace(|| "witness g_d"),
-                self.payment_address.as_ref().map(|a| {
-                    a.diversifier()
-                        .g_d()
-                        .expect("checked at construction")
-                        .into()
-                }),
-            )?;
-
-            // g_d is ensured to be large order. The relationship
-            // between g_d and pk_d ultimately binds ivk to the
-            // note. If this were a small order point, it would
-            // not do this correctly, and the prover could
-            // double-spend by finding random ivk's that satisfy
-            // the relationship.
-            //
-            // Further, if it were small order, epk would be
-            // small order too!
-            g_d.assert_not_small_order(cs.namespace(|| "g_d not small order"))?;
-
-            // Extend our note contents with the representation of
-            // g_d.
-            note_contents.extend(g_d.repr(cs.namespace(|| "representation of g_d"))?);
-
-            // Booleanize our ephemeral secret key
-            let esk = boolean::field_into_boolean_vec_le(cs.namespace(|| "esk"), self.esk)?;
-
-            // Create the ephemeral public key from g_d.
-            let epk = g_d.mul(cs.namespace(|| "epk computation"), &esk)?;
-
-            // Expose epk publicly.
-            epk.inputize(cs.namespace(|| "epk"))?;
-        }
-
-        // Now let's deal with pk_d. We don't do any checks and
-        // essentially allow the prover to witness any 256 bits
-        // they would like.
-        {
-            // Just grab pk_d from the witness
-            let pk_d = self
-                .payment_address
-                .as_ref()
-                .map(|e| jubjub::ExtendedPoint::from(e.pk_d().inner()).to_affine());
-
-            // Witness the v-coordinate, encoded as little
-            // endian bits (to match the representation)
-            let v_contents = boolean::field_into_boolean_vec_le(
-                cs.namespace(|| "pk_d bits of v"),
-                pk_d.map(|e| e.get_v()),
-            )?;
-
-            // Witness the sign bit
-            let sign_bit = boolean::Boolean::from(boolean::AllocatedBit::alloc(
-                cs.namespace(|| "pk_d bit of u"),
-                pk_d.map(|e| e.get_u().is_odd().into()),
-            )?);
-
-            // Extend the note with pk_d representation
-            note_contents.extend(v_contents);
-            note_contents.push(sign_bit);
-        }
-
-        assert_eq!(
-            note_contents.len(),
-            64 + // value
-            256 + // g_d
-            256 // pk_d
-        );
-
-        // Compute the hash of the note contents
-        let mut cm = pedersen_hash::pedersen_hash(
-            cs.namespace(|| "note content hash"),
-            pedersen_hash::Personalization::NoteCommitment,
-            &note_contents,
-        )?;
-
-        {
-            // Booleanize the randomness
-            let rcm = boolean::field_into_boolean_vec_le(
-                cs.namespace(|| "rcm"),
-                self.commitment_randomness,
-            )?;
-
-            // Compute the note commitment randomness in the exponent
-            let rcm = ecc::fixed_base_multiplication(
-                cs.namespace(|| "computation of commitment randomness"),
-                &NOTE_COMMITMENT_RANDOMNESS_GENERATOR,
-                &rcm,
-            )?;
-
-            // Randomize our note commitment
-            cm = cm.add(cs.namespace(|| "randomization of note commitment"), &rcm)?;
-        }
-
-        // Only the u-coordinate of the output is revealed,
-        // since we know it is prime order, and we know that
-        // the u-coordinate is an injective encoding for
-        // elements in the prime-order subgroup.
-        cm.get_u().inputize(cs.namespace(|| "commitment"))?;
-
-        Ok(())
-    }
-}
-
-#[test]
-fn test_input_circuit_with_bls12_381() {
-    use bellman::gadgets::test::*;
-    use group::{ff::Field, Group};
-    use rand_core::{RngCore, SeedableRng};
-    use rand_xorshift::XorShiftRng;
-    use zcash_primitives::sapling::{pedersen_hash, Diversifier, Note, ProofGenerationKey, Rseed};
-
-    let mut rng = XorShiftRng::from_seed([
-        0x58, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
-        0xe5,
-    ]);
-
-    let tree_depth = 32;
-
-    for _ in 0..10 {
-        let value_commitment = ValueCommitmentOpening {
-            value: rng.next_u64(),
-            randomness: jubjub::Fr::random(&mut rng),
-        };
-
-        let proof_generation_key = ProofGenerationKey {
-            ak: jubjub::SubgroupPoint::random(&mut rng),
-            nsk: jubjub::Fr::random(&mut rng),
-        };
-
-        let viewing_key = proof_generation_key.to_viewing_key();
-
-        let payment_address;
-
-        loop {
-            let diversifier = {
-                let mut d = [0; 11];
-                rng.fill_bytes(&mut d);
-                Diversifier(d)
-            };
-
-            if let Some(p) = viewing_key.to_payment_address(diversifier) {
-                payment_address = p;
-                break;
-            }
-        }
-
-        let commitment_randomness = jubjub::Fr::random(&mut rng);
-        let auth_path =
-            vec![Some((bls12_381::Scalar::random(&mut rng), rng.next_u32() % 2 != 0)); tree_depth];
-        let ar = jubjub::Fr::random(&mut rng);
-
-        {
-            let rk = jubjub::ExtendedPoint::from(viewing_key.rk(ar)).to_affine();
-            let expected_value_commitment = value_commitment.commitment().to_affine();
-            let note = Note::from_parts(
-                payment_address,
-                NoteValue::from_raw(value_commitment.value),
-                Rseed::BeforeZip212(commitment_randomness),
-            );
-
-            let mut position = 0u64;
-            let cmu = note.cmu();
-            let mut cur = bls12_381::Scalar::from_bytes(&cmu.to_bytes()).unwrap();
-
-            for (i, val) in auth_path.clone().into_iter().enumerate() {
-                let (uncle, b) = val.unwrap();
-
-                let mut lhs = cur;
-                let mut rhs = uncle;
-
-                if b {
-                    ::std::mem::swap(&mut lhs, &mut rhs);
-                }
-
-                let lhs = lhs.to_le_bits();
-                let rhs = rhs.to_le_bits();
-
-                cur = jubjub::ExtendedPoint::from(pedersen_hash::pedersen_hash(
-                    pedersen_hash::Personalization::MerkleTree(i),
-                    lhs.iter()
-                        .by_vals()
-                        .take(bls12_381::Scalar::NUM_BITS as usize)
-                        .chain(
-                            rhs.iter()
-                                .by_vals()
-                                .take(bls12_381::Scalar::NUM_BITS as usize),
-                        ),
-                ))
-                .to_affine()
-                .get_u();
-
-                if b {
-                    position |= 1 << i;
-                }
-            }
-
-            let expected_nf = note.nf(&viewing_key.nk, position);
-            let expected_nf = multipack::bytes_to_bits_le(&expected_nf.0);
-            let expected_nf = multipack::compute_multipacking(&expected_nf);
-            assert_eq!(expected_nf.len(), 2);
-
-            let mut cs = TestConstraintSystem::new();
-
-            let instance = Spend {
-                value_commitment_opening: Some(value_commitment.clone()),
-                proof_generation_key: Some(proof_generation_key.clone()),
-                payment_address: Some(payment_address),
-                commitment_randomness: Some(commitment_randomness),
-                ar: Some(ar),
-                auth_path: auth_path.clone(),
-                anchor: Some(cur),
-            };
-
-            instance.synthesize(&mut cs).unwrap();
-
-            assert!(cs.is_satisfied());
-            assert_eq!(cs.num_constraints(), 98777);
-            assert_eq!(
-                cs.hash(),
-                "d37c738e83df5d9b0bb6495ac96abf21bcb2697477e2c15c2c7916ff7a3b6a89"
-            );
-
-            assert_eq!(
-                cs.get("randomization of note commitment/u3/num").to_repr(),
-                cmu.to_bytes()
-            );
-
-            assert_eq!(cs.num_inputs(), 8);
-            assert_eq!(cs.get_input(0, "ONE"), bls12_381::Scalar::one());
-            assert_eq!(cs.get_input(1, "rk/u/input variable"), rk.get_u());
-            assert_eq!(cs.get_input(2, "rk/v/input variable"), rk.get_v());
-            assert_eq!(
-                cs.get_input(3, "value commitment/commitment point/u/input variable"),
-                expected_value_commitment.get_u()
-            );
-            assert_eq!(
-                cs.get_input(4, "value commitment/commitment point/v/input variable"),
-                expected_value_commitment.get_v()
-            );
-            assert_eq!(
-                cs.get_input(5, "anchor/input variable").to_repr(),
-                cur.to_bytes()
-            );
-            assert_eq!(cs.get_input(6, "pack nullifier/input 0"), expected_nf[0]);
-            assert_eq!(cs.get_input(7, "pack nullifier/input 1"), expected_nf[1]);
-        }
-    }
-}
-
-#[test]
-fn test_input_circuit_with_bls12_381_external_test_vectors() {
-    use bellman::gadgets::test::*;
-    use group::{ff::Field, Group};
-    use rand_core::{RngCore, SeedableRng};
-    use rand_xorshift::XorShiftRng;
-    use zcash_primitives::sapling::{pedersen_hash, Diversifier, Note, ProofGenerationKey, Rseed};
-
-    let mut rng = XorShiftRng::from_seed([
-        0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
-        0xe5,
-    ]);
-
-    let tree_depth = 32;
-
-    let expected_commitment_us = vec![
-        "43821661663052659750276289184181083197337192946256245809816728673021647664276",
-        "7220807656052227578299730541645543434083158611414003423211850718229633594616",
-        "13239753550660714843257636471668037031928211668773449453628093339627668081697",
-        "10900524635678389360790699587556574797582192824300145558807405770494079767974",
-        "1411013767457690636461779630023011774660680126764323588543800715293173598850",
-        "32334206652383066267661379202183359608706535021387905923603014648832344657662",
-        "20206750741605167608500278423400565295188703622528437817438897624149653579380",
-        "46716485782200334735478719487356079850582051575003452698983255860512578229998",
-        "31221372899739042781372142393132358519434268512685538373976981051223051220367",
-        "18269767207277008186871145355531741929166733260352590789136389380124992250945",
-    ];
-
-    let expected_commitment_vs = vec![
-        "27630722367128086497290371604583225252915685718989450292520883698391703910",
-        "23310648738313092772044712773481584369462075017189681529702825235349449805260",
-        "25709635353183537915646348052945798827495141780341329896098121888376871589480",
-        "10516315852014492141081718791576479298042117442649432716255936672048164184691",
-        "23970713991179488695004801139667700217127937225554773561645815034212389459772",
-        "3256052161046564597126736968199320852691566092694819239485673781545479548450",
-        "18887250722195819674378865377623103071236046274361890247643850134985809137409",
-        "36501156873031641173054592888886902104303750771545647842488588827138867116570",
-        "21927526310070011864833939629345235038589128172309792087590183778192091594775",
-        "32959334601512756708397683646222389414681003290313255304927423560477040775488",
-    ];
-
-    for i in 0..10 {
-        let value_commitment = ValueCommitmentOpening {
-            value: i,
-            randomness: jubjub::Fr::from(1000 * (i + 1)),
-        };
-
-        let proof_generation_key = ProofGenerationKey {
-            ak: jubjub::SubgroupPoint::random(&mut rng),
-            nsk: jubjub::Fr::random(&mut rng),
-        };
-
-        let viewing_key = proof_generation_key.to_viewing_key();
-
-        let payment_address;
-
-        loop {
-            let diversifier = {
-                let mut d = [0; 11];
-                rng.fill_bytes(&mut d);
-                Diversifier(d)
-            };
-
-            if let Some(p) = viewing_key.to_payment_address(diversifier) {
-                payment_address = p;
-                break;
-            }
-        }
-
-        let commitment_randomness = jubjub::Fr::random(&mut rng);
-        let auth_path =
-            vec![Some((bls12_381::Scalar::random(&mut rng), rng.next_u32() % 2 != 0)); tree_depth];
-        let ar = jubjub::Fr::random(&mut rng);
-
-        {
-            let rk = jubjub::ExtendedPoint::from(viewing_key.rk(ar)).to_affine();
-            let expected_value_commitment = value_commitment.commitment().to_affine();
-            assert_eq!(
-                expected_value_commitment.get_u(),
-                bls12_381::Scalar::from_str_vartime(expected_commitment_us[i as usize]).unwrap()
-            );
-            assert_eq!(
-                expected_value_commitment.get_v(),
-                bls12_381::Scalar::from_str_vartime(expected_commitment_vs[i as usize]).unwrap()
-            );
-            let note = Note::from_parts(
-                payment_address,
-                NoteValue::from_raw(value_commitment.value),
-                Rseed::BeforeZip212(commitment_randomness),
-            );
-
-            let mut position = 0u64;
-            let cmu = note.cmu();
-            let mut cur = bls12_381::Scalar::from_bytes(&cmu.to_bytes()).unwrap();
-
-            for (i, val) in auth_path.clone().into_iter().enumerate() {
-                let (uncle, b) = val.unwrap();
-
-                let mut lhs = cur;
-                let mut rhs = uncle;
-
-                if b {
-                    ::std::mem::swap(&mut lhs, &mut rhs);
-                }
-
-                let lhs = lhs.to_le_bits();
-                let rhs = rhs.to_le_bits();
-
-                cur = jubjub::ExtendedPoint::from(pedersen_hash::pedersen_hash(
-                    pedersen_hash::Personalization::MerkleTree(i),
-                    lhs.iter()
-                        .by_vals()
-                        .take(bls12_381::Scalar::NUM_BITS as usize)
-                        .chain(
-                            rhs.iter()
-                                .by_vals()
-                                .take(bls12_381::Scalar::NUM_BITS as usize),
-                        ),
-                ))
-                .to_affine()
-                .get_u();
-
-                if b {
-                    position |= 1 << i;
-                }
-            }
-
-            let expected_nf = note.nf(&viewing_key.nk, position);
-            let expected_nf = multipack::bytes_to_bits_le(&expected_nf.0);
-            let expected_nf = multipack::compute_multipacking(&expected_nf);
-            assert_eq!(expected_nf.len(), 2);
-
-            let mut cs = TestConstraintSystem::new();
-
-            let instance = Spend {
-                value_commitment_opening: Some(value_commitment.clone()),
-                proof_generation_key: Some(proof_generation_key.clone()),
-                payment_address: Some(payment_address),
-                commitment_randomness: Some(commitment_randomness),
-                ar: Some(ar),
-                auth_path: auth_path.clone(),
-                anchor: Some(cur),
-            };
-
-            instance.synthesize(&mut cs).unwrap();
-
-            assert!(cs.is_satisfied());
-            assert_eq!(cs.num_constraints(), 98777);
-            assert_eq!(
-                cs.hash(),
-                "d37c738e83df5d9b0bb6495ac96abf21bcb2697477e2c15c2c7916ff7a3b6a89"
-            );
-
-            assert_eq!(
-                cs.get("randomization of note commitment/u3/num").to_repr(),
-                cmu.to_bytes()
-            );
-
-            assert_eq!(cs.num_inputs(), 8);
-            assert_eq!(cs.get_input(0, "ONE"), bls12_381::Scalar::one());
-            assert_eq!(cs.get_input(1, "rk/u/input variable"), rk.get_u());
-            assert_eq!(cs.get_input(2, "rk/v/input variable"), rk.get_v());
-            assert_eq!(
-                cs.get_input(3, "value commitment/commitment point/u/input variable"),
-                expected_value_commitment.get_u()
-            );
-            assert_eq!(
-                cs.get_input(4, "value commitment/commitment point/v/input variable"),
-                expected_value_commitment.get_v()
-            );
-            assert_eq!(
-                cs.get_input(5, "anchor/input variable").to_repr(),
-                cur.to_bytes()
-            );
-            assert_eq!(cs.get_input(6, "pack nullifier/input 0"), expected_nf[0]);
-            assert_eq!(cs.get_input(7, "pack nullifier/input 1"), expected_nf[1]);
-        }
-    }
-}
-
-#[test]
-fn test_output_circuit_with_bls12_381() {
-    use bellman::gadgets::test::*;
-    use group::{ff::Field, Group};
-    use rand_core::{RngCore, SeedableRng};
-    use rand_xorshift::XorShiftRng;
-    use zcash_primitives::sapling::{Diversifier, ProofGenerationKey, Rseed};
-
-    let mut rng = XorShiftRng::from_seed([
-        0x58, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
-        0xe5,
-    ]);
-
-    for _ in 0..100 {
-        let value_commitment = ValueCommitmentOpening {
-            value: rng.next_u64(),
-            randomness: jubjub::Fr::random(&mut rng),
-        };
-
-        let nsk = jubjub::Fr::random(&mut rng);
-        let ak = jubjub::SubgroupPoint::random(&mut rng);
-
-        let proof_generation_key = ProofGenerationKey { ak, nsk };
-
-        let viewing_key = proof_generation_key.to_viewing_key();
-
-        let payment_address;
-
-        loop {
-            let diversifier = {
-                let mut d = [0; 11];
-                rng.fill_bytes(&mut d);
-                Diversifier(d)
-            };
-
-            if let Some(p) = viewing_key.to_payment_address(diversifier) {
-                payment_address = p;
-                break;
-            }
-        }
-
-        let commitment_randomness = jubjub::Fr::random(&mut rng);
-        let esk = jubjub::Fr::random(&mut rng);
-
-        {
-            let mut cs = TestConstraintSystem::new();
-
-            let instance = Output {
-                value_commitment_opening: Some(value_commitment.clone()),
-                payment_address: Some(payment_address),
-                commitment_randomness: Some(commitment_randomness),
-                esk: Some(esk),
-            };
-
-            instance.synthesize(&mut cs).unwrap();
-
-            assert!(cs.is_satisfied());
-            assert_eq!(cs.num_constraints(), 7827);
-            assert_eq!(
-                cs.hash(),
-                "c26d5cdfe6ccd65c03390902c02e11393ea6bb96aae32a7f2ecb12eb9103faee"
-            );
-
-            let expected_cmu = payment_address
-                .create_note(
-                    value_commitment.value,
-                    Rseed::BeforeZip212(commitment_randomness),
-                )
-                .cmu();
-
-            let expected_value_commitment = value_commitment.commitment().to_affine();
-
-            let expected_epk = jubjub::ExtendedPoint::from(
-                payment_address
-                    .diversifier()
-                    .g_d()
-                    .expect("should be valid")
-                    * esk,
-            )
-            .to_affine();
-
-            assert_eq!(cs.num_inputs(), 6);
-            assert_eq!(cs.get_input(0, "ONE"), bls12_381::Scalar::one());
-            assert_eq!(
-                cs.get_input(1, "value commitment/commitment point/u/input variable"),
-                expected_value_commitment.get_u()
-            );
-            assert_eq!(
-                cs.get_input(2, "value commitment/commitment point/v/input variable"),
-                expected_value_commitment.get_v()
-            );
-            assert_eq!(
-                cs.get_input(3, "epk/u/input variable"),
-                expected_epk.get_u()
-            );
-            assert_eq!(
-                cs.get_input(4, "epk/v/input variable"),
-                expected_epk.get_v()
-            );
-            assert_eq!(
-                cs.get_input(5, "commitment/input variable").to_repr(),
-                expected_cmu.to_bytes()
-            );
-        }
-    }
-}
diff --git a/zcash_proofs/src/circuit/sprout/input.rs b/zcash_proofs/src/circuit/sprout/input.rs
index 39a2d4170a..cadcfcbd8c 100644
--- a/zcash_proofs/src/circuit/sprout/input.rs
+++ b/zcash_proofs/src/circuit/sprout/input.rs
@@ -66,7 +66,7 @@ impl InputNote {
             let lhs = cur;
             let rhs = witness_u256(
                 cs.namespace(|| "sibling"),
-                layer.as_ref().map(|&(ref sibling, _)| &sibling[..]),
+                layer.as_ref().map(|(sibling, _)| &sibling[..]),
             )?;
 
             // Conditionally swap if cur is right
diff --git a/zcash_proofs/src/circuit/sprout/mod.rs b/zcash_proofs/src/circuit/sprout/mod.rs
index 7adddb0794..ff1bd83fda 100644
--- a/zcash_proofs/src/circuit/sprout/mod.rs
+++ b/zcash_proofs/src/circuit/sprout/mod.rs
@@ -335,6 +335,7 @@ where
 
 #[test]
 #[ignore]
+#[cfg(feature = "expensive-tests")]
 fn test_sprout_constraints() {
     use bellman::gadgets::test::*;
     use bls12_381::Scalar;
@@ -358,8 +359,8 @@ fn test_sprout_constraints() {
         let mut cs = TestConstraintSystem::<Scalar>::new();
 
         let phi = Some(get_u256(&mut test_vector));
-        let rt = Some(get_u256(&mut test_vector));
-        let h_sig = Some(get_u256(&mut test_vector));
+        let rt = get_u256(&mut test_vector);
+        let h_sig = get_u256(&mut test_vector);
 
         let mut inputs = vec![];
         for _ in 0..2 {
@@ -409,8 +410,8 @@ fn test_sprout_constraints() {
             outputs.push(JsOutput { value, a_pk, r });
         }
 
-        let vpub_old = Some(test_vector.read_u64::<LittleEndian>().unwrap());
-        let vpub_new = Some(test_vector.read_u64::<LittleEndian>().unwrap());
+        let vpub_old = test_vector.read_u64::<LittleEndian>().unwrap();
+        let vpub_new = test_vector.read_u64::<LittleEndian>().unwrap();
 
         let nf1 = get_u256(&mut test_vector);
         let nf2 = get_u256(&mut test_vector);
@@ -422,13 +423,13 @@ fn test_sprout_constraints() {
         let mac2 = get_u256(&mut test_vector);
 
         let js = JoinSplit {
-            vpub_old,
-            vpub_new,
-            h_sig,
+            vpub_old: Some(vpub_old),
+            vpub_new: Some(vpub_new),
+            h_sig: Some(h_sig),
             phi,
             inputs,
             outputs,
-            rt,
+            rt: Some(rt),
         };
 
         js.synthesize(&mut cs).unwrap();
@@ -445,20 +446,16 @@ fn test_sprout_constraints() {
         );
 
         let mut expected_inputs = vec![];
-        expected_inputs.extend(rt.unwrap().to_vec());
-        expected_inputs.extend(h_sig.unwrap().to_vec());
+        expected_inputs.extend(rt.to_vec());
+        expected_inputs.extend(h_sig.to_vec());
         expected_inputs.extend(nf1.to_vec());
         expected_inputs.extend(mac1.to_vec());
         expected_inputs.extend(nf2.to_vec());
         expected_inputs.extend(mac2.to_vec());
         expected_inputs.extend(cm1.to_vec());
         expected_inputs.extend(cm2.to_vec());
-        expected_inputs
-            .write_u64::<LittleEndian>(vpub_old.unwrap())
-            .unwrap();
-        expected_inputs
-            .write_u64::<LittleEndian>(vpub_new.unwrap())
-            .unwrap();
+        expected_inputs.write_u64::<LittleEndian>(vpub_old).unwrap();
+        expected_inputs.write_u64::<LittleEndian>(vpub_new).unwrap();
 
         use bellman::gadgets::multipack;
 
diff --git a/zcash_proofs/src/constants.rs b/zcash_proofs/src/constants.rs
deleted file mode 100644
index 658a5e43da..0000000000
--- a/zcash_proofs/src/constants.rs
+++ /dev/null
@@ -1,195 +0,0 @@
-//! Various constants used for the Zcash proofs.
-
-use bls12_381::Scalar;
-use group::{ff::Field, Curve, Group};
-use jubjub::ExtendedPoint;
-use lazy_static::lazy_static;
-use zcash_primitives::constants::{PEDERSEN_HASH_CHUNKS_PER_GENERATOR, PEDERSEN_HASH_GENERATORS};
-
-/// The `d` constant of the twisted Edwards curve.
-pub(crate) const EDWARDS_D: Scalar = Scalar::from_raw([
-    0x0106_5fd6_d634_3eb1,
-    0x292d_7f6d_3757_9d26,
-    0xf5fd_9207_e6bd_7fd4,
-    0x2a93_18e7_4bfa_2b48,
-]);
-
-/// The `A` constant of the birationally equivalent Montgomery curve.
-pub(crate) const MONTGOMERY_A: Scalar = Scalar::from_raw([
-    0x0000_0000_0000_a002,
-    0x0000_0000_0000_0000,
-    0x0000_0000_0000_0000,
-    0x0000_0000_0000_0000,
-]);
-
-/// The scaling factor used for conversion to and from the Montgomery form.
-pub(crate) const MONTGOMERY_SCALE: Scalar = Scalar::from_raw([
-    0x8f45_35f7_cf82_b8d9,
-    0xce40_6970_3da8_8abd,
-    0x31de_341e_77d7_64e5,
-    0x2762_de61_e862_645e,
-]);
-
-/// The number of chunks needed to represent a full scalar during fixed-base
-/// exponentiation.
-const FIXED_BASE_CHUNKS_PER_GENERATOR: usize = 84;
-
-/// Reference to a circuit version of a generator for fixed-base salar multiplication.
-pub type FixedGenerator = &'static [Vec<(Scalar, Scalar)>];
-
-/// Circuit version of a generator for fixed-base salar multiplication.
-pub type FixedGeneratorOwned = Vec<Vec<(Scalar, Scalar)>>;
-
-lazy_static! {
-    pub static ref PROOF_GENERATION_KEY_GENERATOR: FixedGeneratorOwned =
-        generate_circuit_generator(zcash_primitives::constants::PROOF_GENERATION_KEY_GENERATOR);
-
-    pub static ref NOTE_COMMITMENT_RANDOMNESS_GENERATOR: FixedGeneratorOwned =
-        generate_circuit_generator(zcash_primitives::constants::NOTE_COMMITMENT_RANDOMNESS_GENERATOR);
-
-    pub static ref NULLIFIER_POSITION_GENERATOR: FixedGeneratorOwned =
-        generate_circuit_generator(zcash_primitives::constants::NULLIFIER_POSITION_GENERATOR);
-
-    pub static ref VALUE_COMMITMENT_VALUE_GENERATOR: FixedGeneratorOwned =
-        generate_circuit_generator(zcash_primitives::constants::VALUE_COMMITMENT_VALUE_GENERATOR);
-
-    pub static ref VALUE_COMMITMENT_RANDOMNESS_GENERATOR: FixedGeneratorOwned =
-        generate_circuit_generator(zcash_primitives::constants::VALUE_COMMITMENT_RANDOMNESS_GENERATOR);
-
-    pub static ref SPENDING_KEY_GENERATOR: FixedGeneratorOwned =
-        generate_circuit_generator(zcash_primitives::constants::SPENDING_KEY_GENERATOR);
-
-    /// The pre-computed window tables `[-4, 3, 2, 1, 1, 2, 3, 4]` of different magnitudes
-    /// of the Pedersen hash segment generators.
-    pub(crate) static ref PEDERSEN_CIRCUIT_GENERATORS: Vec<Vec<Vec<(Scalar, Scalar)>>> =
-        generate_pedersen_circuit_generators();
-}
-
-/// Creates the 3-bit window table `[0, 1, ..., 8]` for different magnitudes of a fixed
-/// generator.
-pub fn generate_circuit_generator(mut gen: jubjub::SubgroupPoint) -> FixedGeneratorOwned {
-    let mut windows = vec![];
-
-    for _ in 0..FIXED_BASE_CHUNKS_PER_GENERATOR {
-        let mut coeffs = vec![(Scalar::zero(), Scalar::one())];
-        let mut g = gen;
-        for _ in 0..7 {
-            let g_affine = jubjub::ExtendedPoint::from(g).to_affine();
-            coeffs.push((g_affine.get_u(), g_affine.get_v()));
-            g += gen;
-        }
-        windows.push(coeffs);
-
-        // gen = gen * 8
-        gen = g;
-    }
-
-    windows
-}
-
-/// Returns the coordinates of this point's Montgomery curve representation, or `None` if
-/// it is the point at infinity.
-#[allow(clippy::many_single_char_names)]
-pub(crate) fn to_montgomery_coords(g: ExtendedPoint) -> Option<(Scalar, Scalar)> {
-    let g = g.to_affine();
-    let (x, y) = (g.get_u(), g.get_v());
-
-    if y == Scalar::one() {
-        // The only solution for y = 1 is x = 0. (0, 1) is the neutral element, so we map
-        // this to the point at infinity.
-        None
-    } else {
-        // The map from a twisted Edwards curve is defined as
-        // (x, y) -> (u, v) where
-        //      u = (1 + y) / (1 - y)
-        //      v = u / x
-        //
-        // This mapping is not defined for y = 1 and for x = 0.
-        //
-        // We have that y != 1 above. If x = 0, the only
-        // solutions for y are 1 (contradiction) or -1.
-        if x.is_zero_vartime() {
-            // (0, -1) is the point of order two which is not
-            // the neutral element, so we map it to (0, 0) which is
-            // the only affine point of order 2.
-            Some((Scalar::zero(), Scalar::zero()))
-        } else {
-            // The mapping is defined as above.
-            //
-            // (x, y) -> (u, v) where
-            //      u = (1 + y) / (1 - y)
-            //      v = u / x
-
-            let u = (Scalar::one() + y) * (Scalar::one() - y).invert().unwrap();
-            let v = u * x.invert().unwrap();
-
-            // Scale it into the correct curve constants
-            // scaling factor = sqrt(4 / (a - d))
-            Some((u, v * MONTGOMERY_SCALE))
-        }
-    }
-}
-
-/// Creates the 2-bit window table lookups for each 4-bit "chunk" in each segment of the
-/// Pedersen hash.
-fn generate_pedersen_circuit_generators() -> Vec<Vec<Vec<(Scalar, Scalar)>>> {
-    // Process each segment
-    PEDERSEN_HASH_GENERATORS
-        .iter()
-        .cloned()
-        .map(|mut gen| {
-            let mut windows = vec![];
-
-            for _ in 0..PEDERSEN_HASH_CHUNKS_PER_GENERATOR {
-                // Create (x, y) coeffs for this chunk
-                let mut coeffs = vec![];
-                let mut g = gen;
-
-                // coeffs = g, g*2, g*3, g*4
-                for _ in 0..4 {
-                    coeffs.push(
-                        to_montgomery_coords(g.into())
-                            .expect("we never encounter the point at infinity"),
-                    );
-                    g += gen;
-                }
-                windows.push(coeffs);
-
-                // Our chunks are separated by 2 bits to prevent overlap.
-                for _ in 0..4 {
-                    gen = gen.double();
-                }
-            }
-
-            windows
-        })
-        .collect()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn edwards_d() {
-        // d = -(10240/10241)
-        assert_eq!(
-            -Scalar::from(10240) * Scalar::from(10241).invert().unwrap(),
-            EDWARDS_D
-        );
-    }
-
-    #[test]
-    fn montgomery_a() {
-        assert_eq!(Scalar::from(40962), MONTGOMERY_A);
-    }
-
-    #[test]
-    fn montgomery_scale() {
-        // scaling factor = sqrt(4 / (a - d))
-        assert_eq!(
-            MONTGOMERY_SCALE.square() * (-Scalar::one() - EDWARDS_D),
-            Scalar::from(4),
-        );
-    }
-}
diff --git a/zcash_proofs/src/lib.rs b/zcash_proofs/src/lib.rs
index 346fa48ad3..e9d63255cc 100644
--- a/zcash_proofs/src/lib.rs
+++ b/zcash_proofs/src/lib.rs
@@ -2,39 +2,39 @@
 //!
 //! `zcash_proofs` contains the zk-SNARK circuits used by Zcash, and the APIs for creating
 //! and verifying proofs.
+//!
+//! ## Feature flags
+#![doc = document_features::document_features!()]
+//!
 
 #![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
 // Catch documentation errors caused by code changes.
 #![deny(rustdoc::broken_intra_doc_links)]
 // Temporary until we have addressed all Result<T, ()> cases.
 #![allow(clippy::result_unit_err)]
 
-use bellman::groth16::{prepare_verifying_key, Parameters, PreparedVerifyingKey, VerifyingKey};
+use bellman::groth16::{prepare_verifying_key, PreparedVerifyingKey, VerifyingKey};
 use bls12_381::Bls12;
+use sapling::circuit::{
+    OutputParameters, PreparedOutputVerifyingKey, PreparedSpendVerifyingKey, SpendParameters,
+};
+
 use std::fs::File;
 use std::io::{self, BufReader};
 use std::path::Path;
 
-#[cfg(feature = "directories")]
-use directories::BaseDirs;
 #[cfg(feature = "directories")]
 use std::path::PathBuf;
 
 pub mod circuit;
-pub mod constants;
 mod hashreader;
-pub mod sapling;
 pub mod sprout;
 
 #[cfg(any(feature = "local-prover", feature = "bundled-prover"))]
-#[cfg_attr(
-    docsrs,
-    doc(cfg(any(feature = "local-prover", feature = "bundled-prover")))
-)]
 pub mod prover;
 
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 mod downloadreader;
 
 // Circuit names
@@ -63,7 +63,6 @@ const DOWNLOAD_URL: &str = "https://download.z.cash/downloads";
 
 /// The paths to the Sapling parameter files.
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct SaplingParameterPaths {
     /// The path to the Sapling spend parameter file.
@@ -75,15 +74,24 @@ pub struct SaplingParameterPaths {
 
 /// Returns the default folder that the Zcash proving parameters are located in.
 #[cfg(feature = "directories")]
-#[cfg_attr(docsrs, doc(cfg(feature = "directories")))]
 pub fn default_params_folder() -> Option<PathBuf> {
-    BaseDirs::new().map(|base_dirs| {
-        if cfg!(any(windows, target_os = "macos")) {
-            base_dirs.data_dir().join("ZcashParams")
-        } else {
-            base_dirs.home_dir().join(".zcash-params")
-        }
-    })
+    #[cfg(windows)]
+    {
+        use known_folders::{get_known_folder_path, KnownFolder};
+        get_known_folder_path(KnownFolder::RoamingAppData).map(|base| base.join("ZcashParams"))
+    }
+
+    #[cfg(target_os = "macos")]
+    {
+        xdg::BaseDirectories::new()
+            .ok()
+            .map(|base_dirs| base_dirs.get_data_home().join("ZcashParams"))
+    }
+
+    #[cfg(not(any(windows, target_os = "macos")))]
+    {
+        home::home_dir().map(|base| base.join(".zcash-params"))
+    }
 }
 
 /// Download the Zcash Sapling parameters if needed, and store them in the default location.
@@ -93,7 +101,6 @@ pub fn default_params_folder() -> Option<PathBuf> {
 ///
 /// This mirrors the behaviour of the `fetch-params.sh` script from `zcashd`.
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 #[deprecated(
     since = "0.6.0",
     note = "please replace with `download_sapling_parameters`, and use `download_sprout_parameters` if needed"
@@ -112,7 +119,6 @@ pub fn download_parameters() -> Result<(), minreq::Error> {
 ///
 /// Returns the paths to the downloaded files.
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 pub fn download_sapling_parameters(
     timeout: Option<u64>,
 ) -> Result<SaplingParameterPaths, minreq::Error> {
@@ -142,7 +148,6 @@ pub fn download_sapling_parameters(
 ///
 /// Returns the path to the downloaded file.
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 pub fn download_sprout_parameters(timeout: Option<u64>) -> Result<PathBuf, minreq::Error> {
     fetch_params(SPROUT_NAME, SPROUT_HASH, SPROUT_BYTES, timeout)
 }
@@ -152,7 +157,6 @@ pub fn download_sprout_parameters(timeout: Option<u64>) -> Result<PathBuf, minre
 ///
 /// See [`download_sapling_parameters`] for details.
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 fn fetch_params(
     name: &str,
     expected_hash: &str,
@@ -220,7 +224,6 @@ fn fetch_params(
 ///
 /// See [`download_sapling_parameters`] for details.
 #[cfg(feature = "download-params")]
-#[cfg_attr(docsrs, doc(cfg(feature = "download-params")))]
 fn stream_params_downloads_to_disk(
     params_path: &Path,
     name: &str,
@@ -278,10 +281,10 @@ fn stream_params_downloads_to_disk(
 
 /// Zcash Sprout and Sapling groth16 circuit parameters.
 pub struct ZcashParameters {
-    pub spend_params: Parameters<Bls12>,
-    pub spend_vk: PreparedVerifyingKey<Bls12>,
-    pub output_params: Parameters<Bls12>,
-    pub output_vk: PreparedVerifyingKey<Bls12>,
+    pub spend_params: SpendParameters,
+    pub spend_vk: PreparedSpendVerifyingKey,
+    pub output_params: OutputParameters,
+    pub output_vk: PreparedOutputVerifyingKey,
     pub sprout_vk: Option<PreparedVerifyingKey<Bls12>>,
 }
 
@@ -342,9 +345,11 @@ pub fn load_parameters(
     )
 }
 
-/// Parse Bls12 keys from bytes as serialized by [`Parameters::write`].
+/// Parse Bls12 keys from bytes as serialized by [`groth16::Parameters::write`].
 ///
 /// This function will panic if it encounters unparsable data.
+///
+/// [`groth16::Parameters::write`]: bellman::groth16::Parameters::write
 pub fn parse_parameters<R: io::Read>(
     spend_fs: R,
     output_fs: R,
@@ -355,10 +360,10 @@ pub fn parse_parameters<R: io::Read>(
     let mut sprout_fs = sprout_fs.map(hashreader::HashReader::new);
 
     // Deserialize params
-    let spend_params = Parameters::<Bls12>::read(&mut spend_fs, false)
-        .expect("couldn't deserialize Sapling spend parameters file");
-    let output_params = Parameters::<Bls12>::read(&mut output_fs, false)
-        .expect("couldn't deserialize Sapling spend parameters file");
+    let spend_params = SpendParameters::read(&mut spend_fs, false)
+        .expect("couldn't deserialize Sapling spend parameters");
+    let output_params = OutputParameters::read(&mut output_fs, false)
+        .expect("couldn't deserialize Sapling spend parameters");
 
     // We only deserialize the verifying key for the Sprout parameters, which
     // appears at the beginning of the parameter file. The rest is loaded
@@ -417,8 +422,8 @@ pub fn parse_parameters<R: io::Read>(
     }
 
     // Prepare verifying keys
-    let spend_vk = prepare_verifying_key(&spend_params.vk);
-    let output_vk = prepare_verifying_key(&output_params.vk);
+    let spend_vk = spend_params.prepared_verifying_key();
+    let output_vk = output_params.prepared_verifying_key();
     let sprout_vk = sprout_vk.map(|vk| prepare_verifying_key(&vk));
 
     ZcashParameters {
diff --git a/zcash_proofs/src/prover.rs b/zcash_proofs/src/prover.rs
index 63c1db79f2..01cfa7b1aa 100644
--- a/zcash_proofs/src/prover.rs
+++ b/zcash_proofs/src/prover.rs
@@ -1,29 +1,27 @@
 //! Abstractions over the proving system and parameters for ease of use.
 
-use bellman::groth16::{Parameters, PreparedVerifyingKey};
+use bellman::groth16::Proof;
 use bls12_381::Bls12;
 use std::path::Path;
-use zcash_primitives::{
-    sapling::{
-        prover::TxProver,
-        redjubjub::{PublicKey, Signature},
-        value::ValueCommitment,
-        Diversifier, MerklePath, PaymentAddress, ProofGenerationKey, Rseed,
-    },
-    transaction::components::{Amount, GROTH_PROOF_SIZE},
+
+use sapling::{
+    bundle::GrothProofBytes,
+    prover::{OutputProver, SpendProver},
+    value::{NoteValue, ValueCommitTrapdoor},
+    Diversifier, MerklePath, PaymentAddress, ProofGenerationKey, Rseed,
 };
+use zcash_primitives::transaction::components::GROTH_PROOF_SIZE;
 
-use crate::{load_parameters, parse_parameters, sapling::SaplingProvingContext};
+use crate::{load_parameters, parse_parameters, OutputParameters, SpendParameters};
 
 #[cfg(feature = "local-prover")]
 use crate::{default_params_folder, SAPLING_OUTPUT_NAME, SAPLING_SPEND_NAME};
 
-/// An implementation of [`TxProver`] using Sapling Spend and Output parameters from
-/// locally-accessible paths.
+/// An implementation of [`SpendProver`] and [`OutputProver`] using Sapling Spend and
+/// Output parameters from locally-accessible paths.
 pub struct LocalTxProver {
-    spend_params: Parameters<Bls12>,
-    spend_vk: PreparedVerifyingKey<Bls12>,
-    output_params: Parameters<Bls12>,
+    spend_params: SpendParameters,
+    output_params: OutputParameters,
 }
 
 impl LocalTxProver {
@@ -49,7 +47,6 @@ impl LocalTxProver {
         let p = load_parameters(spend_path, output_path, None);
         LocalTxProver {
             spend_params: p.spend_params,
-            spend_vk: p.spend_vk,
             output_params: p.output_params,
         }
     }
@@ -74,7 +71,6 @@ impl LocalTxProver {
 
         LocalTxProver {
             spend_params: p.spend_params,
-            spend_vk: p.spend_vk,
             output_params: p.output_params,
         }
     }
@@ -101,7 +97,6 @@ impl LocalTxProver {
     /// This function will panic if the parameters in the default local location do not
     /// have the expected hashes.
     #[cfg(feature = "local-prover")]
-    #[cfg_attr(docsrs, doc(cfg(feature = "local-prover")))]
     pub fn with_default_location() -> Option<Self> {
         let params_dir = default_params_folder()?;
         let (spend_path, output_path) = if params_dir.exists() {
@@ -124,81 +119,85 @@ impl LocalTxProver {
     /// This requires the `bundled-prover` feature, which will increase the binary size by
     /// around 50 MiB.
     #[cfg(feature = "bundled-prover")]
-    #[cfg_attr(docsrs, doc(cfg(feature = "bundled-prover")))]
     pub fn bundled() -> Self {
         let (spend_buf, output_buf) = wagyu_zcash_parameters::load_sapling_parameters();
         let p = parse_parameters(&spend_buf[..], &output_buf[..], None);
 
         LocalTxProver {
             spend_params: p.spend_params,
-            spend_vk: p.spend_vk,
             output_params: p.output_params,
         }
     }
 }
 
-impl TxProver for LocalTxProver {
-    type SaplingProvingContext = SaplingProvingContext;
-
-    fn new_sapling_proving_context(&self) -> Self::SaplingProvingContext {
-        SaplingProvingContext::new()
-    }
+impl SpendProver for LocalTxProver {
+    type Proof = Proof<Bls12>;
 
-    fn spend_proof(
-        &self,
-        ctx: &mut Self::SaplingProvingContext,
+    fn prepare_circuit(
         proof_generation_key: ProofGenerationKey,
         diversifier: Diversifier,
         rseed: Rseed,
-        ar: jubjub::Fr,
-        value: u64,
+        value: NoteValue,
+        alpha: jubjub::Fr,
+        rcv: ValueCommitTrapdoor,
         anchor: bls12_381::Scalar,
         merkle_path: MerklePath,
-    ) -> Result<([u8; GROTH_PROOF_SIZE], ValueCommitment, PublicKey), ()> {
-        let (proof, cv, rk) = ctx.spend_proof(
+    ) -> Option<sapling::circuit::Spend> {
+        SpendParameters::prepare_circuit(
             proof_generation_key,
             diversifier,
             rseed,
-            ar,
             value,
+            alpha,
+            rcv,
             anchor,
             merkle_path,
-            &self.spend_params,
-            &self.spend_vk,
-        )?;
+        )
+    }
 
+    fn create_proof<R: rand_core::RngCore>(
+        &self,
+        circuit: sapling::circuit::Spend,
+        rng: &mut R,
+    ) -> Self::Proof {
+        self.spend_params.create_proof(circuit, rng)
+    }
+
+    fn encode_proof(proof: Self::Proof) -> GrothProofBytes {
         let mut zkproof = [0u8; GROTH_PROOF_SIZE];
         proof
             .write(&mut zkproof[..])
             .expect("should be able to serialize a proof");
-
-        Ok((zkproof, cv, rk))
+        zkproof
     }
+}
 
-    fn output_proof(
-        &self,
-        ctx: &mut Self::SaplingProvingContext,
+impl OutputProver for LocalTxProver {
+    type Proof = Proof<Bls12>;
+
+    fn prepare_circuit(
         esk: jubjub::Fr,
         payment_address: PaymentAddress,
         rcm: jubjub::Fr,
-        value: u64,
-    ) -> ([u8; GROTH_PROOF_SIZE], ValueCommitment) {
-        let (proof, cv) = ctx.output_proof(esk, payment_address, rcm, value, &self.output_params);
+        value: NoteValue,
+        rcv: ValueCommitTrapdoor,
+    ) -> sapling::circuit::Output {
+        OutputParameters::prepare_circuit(esk, payment_address, rcm, value, rcv)
+    }
+
+    fn create_proof<R: rand_core::RngCore>(
+        &self,
+        circuit: sapling::circuit::Output,
+        rng: &mut R,
+    ) -> Self::Proof {
+        self.output_params.create_proof(circuit, rng)
+    }
 
+    fn encode_proof(proof: Self::Proof) -> GrothProofBytes {
         let mut zkproof = [0u8; GROTH_PROOF_SIZE];
         proof
             .write(&mut zkproof[..])
             .expect("should be able to serialize a proof");
-
-        (zkproof, cv)
-    }
-
-    fn binding_sig(
-        &self,
-        ctx: &mut Self::SaplingProvingContext,
-        value_balance: Amount,
-        sighash: &[u8; 32],
-    ) -> Result<Signature, ()> {
-        ctx.binding_sig(value_balance, sighash)
+        zkproof
     }
 }
diff --git a/zcash_proofs/src/sapling/mod.rs b/zcash_proofs/src/sapling/mod.rs
deleted file mode 100644
index 3aae724be8..0000000000
--- a/zcash_proofs/src/sapling/mod.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-//! Helpers for creating Sapling proofs.
-
-mod prover;
-mod verifier;
-
-pub use self::prover::SaplingProvingContext;
-pub use self::verifier::{BatchValidator, SaplingVerificationContext};
diff --git a/zcash_proofs/src/sapling/prover.rs b/zcash_proofs/src/sapling/prover.rs
deleted file mode 100644
index 9ecfb8f6a9..0000000000
--- a/zcash_proofs/src/sapling/prover.rs
+++ /dev/null
@@ -1,234 +0,0 @@
-use bellman::{
-    gadgets::multipack,
-    groth16::{create_random_proof, verify_proof, Parameters, PreparedVerifyingKey, Proof},
-};
-use bls12_381::Bls12;
-use group::{Curve, GroupEncoding};
-use rand_core::OsRng;
-use zcash_primitives::{
-    constants::{SPENDING_KEY_GENERATOR, VALUE_COMMITMENT_RANDOMNESS_GENERATOR},
-    sapling::{
-        redjubjub::{PublicKey, Signature},
-        value::{CommitmentSum, NoteValue, TrapdoorSum, ValueCommitTrapdoor, ValueCommitment},
-        Diversifier, MerklePath, Note, PaymentAddress, ProofGenerationKey, Rseed,
-    },
-    transaction::components::Amount,
-};
-
-use crate::circuit::sapling::{Output, Spend, ValueCommitmentOpening};
-
-/// A context object for creating the Sapling components of a Zcash transaction.
-pub struct SaplingProvingContext {
-    bsk: TrapdoorSum,
-    // (sum of the Spend value commitments) - (sum of the Output value commitments)
-    cv_sum: CommitmentSum,
-}
-
-impl Default for SaplingProvingContext {
-    fn default() -> Self {
-        SaplingProvingContext::new()
-    }
-}
-
-impl SaplingProvingContext {
-    /// Construct a new context to be used with a single transaction.
-    pub fn new() -> Self {
-        SaplingProvingContext {
-            bsk: TrapdoorSum::zero(),
-            cv_sum: CommitmentSum::zero(),
-        }
-    }
-
-    /// Create the value commitment, re-randomized key, and proof for a Sapling
-    /// SpendDescription, while accumulating its value commitment randomness
-    /// inside the context for later use.
-    #[allow(clippy::too_many_arguments)]
-    pub fn spend_proof(
-        &mut self,
-        proof_generation_key: ProofGenerationKey,
-        diversifier: Diversifier,
-        rseed: Rseed,
-        ar: jubjub::Fr,
-        value: u64,
-        anchor: bls12_381::Scalar,
-        merkle_path: MerklePath,
-        proving_key: &Parameters<Bls12>,
-        verifying_key: &PreparedVerifyingKey<Bls12>,
-    ) -> Result<(Proof<Bls12>, ValueCommitment, PublicKey), ()> {
-        // Initialize secure RNG
-        let mut rng = OsRng;
-
-        // We create the randomness of the value commitment
-        let rcv = ValueCommitTrapdoor::random(&mut rng);
-
-        // Accumulate the value commitment randomness in the context
-        self.bsk += &rcv;
-
-        // Construct the value commitment
-        let value_commitment_opening = ValueCommitmentOpening {
-            value,
-            randomness: rcv.inner(),
-        };
-        let value_commitment = ValueCommitment::derive(NoteValue::from_raw(value), rcv);
-
-        // Construct the viewing key
-        let viewing_key = proof_generation_key.to_viewing_key();
-
-        // Construct the payment address with the viewing key / diversifier
-        let payment_address = viewing_key.to_payment_address(diversifier).ok_or(())?;
-
-        // This is the result of the re-randomization, we compute it for the caller
-        let rk = PublicKey(proof_generation_key.ak.into()).randomize(ar, SPENDING_KEY_GENERATOR);
-
-        // Let's compute the nullifier while we have the position
-        let note = Note::from_parts(payment_address, NoteValue::from_raw(value), rseed);
-
-        let nullifier = note.nf(
-            &viewing_key.nk,
-            u64::try_from(merkle_path.position())
-                .expect("Sapling note commitment tree position must fit into a u64"),
-        );
-
-        // We now have the full witness for our circuit
-        let pos: u64 = merkle_path.position().into();
-        let instance = Spend {
-            value_commitment_opening: Some(value_commitment_opening),
-            proof_generation_key: Some(proof_generation_key),
-            payment_address: Some(payment_address),
-            commitment_randomness: Some(note.rcm()),
-            ar: Some(ar),
-            auth_path: merkle_path
-                .path_elems()
-                .iter()
-                .enumerate()
-                .map(|(i, node)| Some(((*node).into(), pos >> i & 0x1 == 1)))
-                .collect(),
-            anchor: Some(anchor),
-        };
-
-        // Create proof
-        let proof =
-            create_random_proof(instance, proving_key, &mut rng).expect("proving should not fail");
-
-        // Try to verify the proof:
-        // Construct public input for circuit
-        let mut public_input = [bls12_381::Scalar::zero(); 7];
-        {
-            let affine = rk.0.to_affine();
-            let (u, v) = (affine.get_u(), affine.get_v());
-            public_input[0] = u;
-            public_input[1] = v;
-        }
-        {
-            let affine = value_commitment.as_inner().to_affine();
-            let (u, v) = (affine.get_u(), affine.get_v());
-            public_input[2] = u;
-            public_input[3] = v;
-        }
-        public_input[4] = anchor;
-
-        // Add the nullifier through multiscalar packing
-        {
-            let nullifier = multipack::bytes_to_bits_le(&nullifier.0);
-            let nullifier = multipack::compute_multipacking(&nullifier);
-
-            assert_eq!(nullifier.len(), 2);
-
-            public_input[5] = nullifier[0];
-            public_input[6] = nullifier[1];
-        }
-
-        // Verify the proof
-        verify_proof(verifying_key, &proof, &public_input[..]).map_err(|_| ())?;
-
-        // Accumulate the value commitment in the context
-        self.cv_sum += &value_commitment;
-
-        Ok((proof, value_commitment, rk))
-    }
-
-    /// Create the value commitment and proof for a Sapling OutputDescription,
-    /// while accumulating its value commitment randomness inside the context
-    /// for later use.
-    pub fn output_proof(
-        &mut self,
-        esk: jubjub::Fr,
-        payment_address: PaymentAddress,
-        rcm: jubjub::Fr,
-        value: u64,
-        proving_key: &Parameters<Bls12>,
-    ) -> (Proof<Bls12>, ValueCommitment) {
-        // Initialize secure RNG
-        let mut rng = OsRng;
-
-        // We construct ephemeral randomness for the value commitment. This
-        // randomness is not given back to the caller, but the synthetic
-        // blinding factor `bsk` is accumulated in the context.
-        let rcv = ValueCommitTrapdoor::random(&mut rng);
-
-        // Accumulate the value commitment randomness in the context
-        self.bsk -= &rcv; // Outputs subtract from the total.
-
-        // Construct the value commitment for the proof instance
-        let value_commitment_opening = ValueCommitmentOpening {
-            value,
-            randomness: rcv.inner(),
-        };
-        let value_commitment = ValueCommitment::derive(NoteValue::from_raw(value), rcv);
-
-        // We now have a full witness for the output proof.
-        let instance = Output {
-            value_commitment_opening: Some(value_commitment_opening),
-            payment_address: Some(payment_address),
-            commitment_randomness: Some(rcm),
-            esk: Some(esk),
-        };
-
-        // Create proof
-        let proof =
-            create_random_proof(instance, proving_key, &mut rng).expect("proving should not fail");
-
-        // Accumulate the value commitment in the context. We do this to check internal consistency.
-        self.cv_sum -= &value_commitment; // Outputs subtract from the total.
-
-        (proof, value_commitment)
-    }
-
-    /// Create the bindingSig for a Sapling transaction. All calls to spend_proof()
-    /// and output_proof() must be completed before calling this function.
-    pub fn binding_sig(&self, value_balance: Amount, sighash: &[u8; 32]) -> Result<Signature, ()> {
-        // Initialize secure RNG
-        let mut rng = OsRng;
-
-        // Grab the current `bsk` from the context
-        let bsk = self.bsk.into_bsk();
-
-        // Grab the `bvk` using DerivePublic.
-        let bvk = PublicKey::from_private(&bsk, VALUE_COMMITMENT_RANDOMNESS_GENERATOR);
-
-        // In order to check internal consistency, let's use the accumulated value
-        // commitments (as the verifier would) and apply value_balance to compare
-        // against our derived bvk.
-        {
-            // Compute the final bvk.
-            let final_bvk = self.cv_sum.into_bvk(value_balance);
-
-            // The result should be the same, unless the provided valueBalance is wrong.
-            if bvk.0 != final_bvk.0 {
-                return Err(());
-            }
-        }
-
-        // Construct signature message
-        let mut data_to_be_signed = [0u8; 64];
-        data_to_be_signed[0..32].copy_from_slice(&bvk.0.to_bytes());
-        data_to_be_signed[32..64].copy_from_slice(&sighash[..]);
-
-        // Sign
-        Ok(bsk.sign(
-            &data_to_be_signed,
-            &mut rng,
-            VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-        ))
-    }
-}
diff --git a/zcash_proofs/src/sapling/verifier.rs b/zcash_proofs/src/sapling/verifier.rs
deleted file mode 100644
index be7a9a0a20..0000000000
--- a/zcash_proofs/src/sapling/verifier.rs
+++ /dev/null
@@ -1,165 +0,0 @@
-use bellman::{gadgets::multipack, groth16::Proof};
-use bls12_381::Bls12;
-use group::{ff::PrimeField, Curve, GroupEncoding};
-use zcash_primitives::{
-    sapling::{
-        note::ExtractedNoteCommitment,
-        redjubjub::{PublicKey, Signature},
-        value::{CommitmentSum, ValueCommitment},
-    },
-    transaction::components::Amount,
-};
-
-mod single;
-pub use single::SaplingVerificationContext;
-
-mod batch;
-pub use batch::BatchValidator;
-
-/// A context object for verifying the Sapling components of a Zcash transaction.
-struct SaplingVerificationContextInner {
-    // (sum of the Spend value commitments) - (sum of the Output value commitments)
-    cv_sum: CommitmentSum,
-}
-
-impl SaplingVerificationContextInner {
-    /// Construct a new context to be used with a single transaction.
-    fn new() -> Self {
-        SaplingVerificationContextInner {
-            cv_sum: CommitmentSum::zero(),
-        }
-    }
-
-    /// Perform consensus checks on a Sapling SpendDescription, while
-    /// accumulating its value commitment inside the context for later use.
-    #[allow(clippy::too_many_arguments)]
-    fn check_spend<C>(
-        &mut self,
-        cv: &ValueCommitment,
-        anchor: bls12_381::Scalar,
-        nullifier: &[u8; 32],
-        rk: &PublicKey,
-        sighash_value: &[u8; 32],
-        spend_auth_sig: &Signature,
-        zkproof: Proof<Bls12>,
-        verifier_ctx: &mut C,
-        spend_auth_sig_verifier: impl FnOnce(&mut C, &PublicKey, [u8; 64], &Signature) -> bool,
-        proof_verifier: impl FnOnce(&mut C, Proof<Bls12>, [bls12_381::Scalar; 7]) -> bool,
-    ) -> bool {
-        // The "cv is not small order" happens when a SpendDescription is deserialized.
-        // This happens when transactions or blocks are received over the network, or when
-        // mined blocks are introduced via the `submitblock` RPC method on full nodes.
-        if rk.0.is_small_order().into() {
-            return false;
-        }
-
-        // Accumulate the value commitment in the context
-        self.cv_sum += cv;
-
-        // Grab the nullifier as a sequence of bytes
-        let nullifier = &nullifier[..];
-
-        // Compute the signature's message for rk/spend_auth_sig
-        let mut data_to_be_signed = [0u8; 64];
-        data_to_be_signed[0..32].copy_from_slice(&rk.0.to_bytes());
-        data_to_be_signed[32..64].copy_from_slice(&sighash_value[..]);
-
-        // Verify the spend_auth_sig
-        let rk_affine = rk.0.to_affine();
-        if !spend_auth_sig_verifier(verifier_ctx, rk, data_to_be_signed, spend_auth_sig) {
-            return false;
-        }
-
-        // Construct public input for circuit
-        let mut public_input = [bls12_381::Scalar::zero(); 7];
-        {
-            let affine = rk_affine;
-            let (u, v) = (affine.get_u(), affine.get_v());
-            public_input[0] = u;
-            public_input[1] = v;
-        }
-        {
-            let affine = cv.as_inner().to_affine();
-            let (u, v) = (affine.get_u(), affine.get_v());
-            public_input[2] = u;
-            public_input[3] = v;
-        }
-        public_input[4] = anchor;
-
-        // Add the nullifier through multiscalar packing
-        {
-            let nullifier = multipack::bytes_to_bits_le(nullifier);
-            let nullifier = multipack::compute_multipacking(&nullifier);
-
-            assert_eq!(nullifier.len(), 2);
-
-            public_input[5] = nullifier[0];
-            public_input[6] = nullifier[1];
-        }
-
-        // Verify the proof
-        proof_verifier(verifier_ctx, zkproof, public_input)
-    }
-
-    /// Perform consensus checks on a Sapling OutputDescription, while
-    /// accumulating its value commitment inside the context for later use.
-    fn check_output(
-        &mut self,
-        cv: &ValueCommitment,
-        cmu: ExtractedNoteCommitment,
-        epk: jubjub::ExtendedPoint,
-        zkproof: Proof<Bls12>,
-        proof_verifier: impl FnOnce(Proof<Bls12>, [bls12_381::Scalar; 5]) -> bool,
-    ) -> bool {
-        // The "cv is not small order" happens when an OutputDescription is deserialized.
-        // This happens when transactions or blocks are received over the network, or when
-        // mined blocks are introduced via the `submitblock` RPC method on full nodes.
-        if epk.is_small_order().into() {
-            return false;
-        }
-
-        // Accumulate the value commitment in the context
-        self.cv_sum -= cv;
-
-        // Construct public input for circuit
-        let mut public_input = [bls12_381::Scalar::zero(); 5];
-        {
-            let affine = cv.as_inner().to_affine();
-            let (u, v) = (affine.get_u(), affine.get_v());
-            public_input[0] = u;
-            public_input[1] = v;
-        }
-        {
-            let affine = epk.to_affine();
-            let (u, v) = (affine.get_u(), affine.get_v());
-            public_input[2] = u;
-            public_input[3] = v;
-        }
-        public_input[4] = bls12_381::Scalar::from_repr(cmu.to_bytes()).unwrap();
-
-        // Verify the proof
-        proof_verifier(zkproof, public_input)
-    }
-
-    /// Perform consensus checks on the valueBalance and bindingSig parts of a
-    /// Sapling transaction. All SpendDescriptions and OutputDescriptions must
-    /// have been checked before calling this function.
-    fn final_check(
-        &self,
-        value_balance: Amount,
-        sighash_value: &[u8; 32],
-        binding_sig: Signature,
-        binding_sig_verifier: impl FnOnce(PublicKey, [u8; 64], Signature) -> bool,
-    ) -> bool {
-        // Compute the final bvk.
-        let bvk = self.cv_sum.into_bvk(value_balance);
-
-        // Compute the signature's message for bvk/binding_sig
-        let mut data_to_be_signed = [0u8; 64];
-        data_to_be_signed[0..32].copy_from_slice(&bvk.0.to_bytes());
-        data_to_be_signed[32..64].copy_from_slice(&sighash_value[..]);
-
-        // Verify the binding_sig
-        binding_sig_verifier(bvk, data_to_be_signed, binding_sig)
-    }
-}
diff --git a/zcash_proofs/src/sapling/verifier/batch.rs b/zcash_proofs/src/sapling/verifier/batch.rs
deleted file mode 100644
index 2a87c5868e..0000000000
--- a/zcash_proofs/src/sapling/verifier/batch.rs
+++ /dev/null
@@ -1,181 +0,0 @@
-use bellman::groth16;
-use bls12_381::Bls12;
-use group::GroupEncoding;
-use rand_core::{CryptoRng, RngCore};
-use zcash_primitives::transaction::components::sapling::{Authorized, Bundle};
-
-use super::SaplingVerificationContextInner;
-
-/// Batch validation context for Sapling.
-///
-/// This batch-validates Spend and Output proofs, and RedJubjub signatures.
-///
-/// Signatures are verified assuming ZIP 216 is active.
-pub struct BatchValidator {
-    bundles_added: bool,
-    spend_proofs: groth16::batch::Verifier<Bls12>,
-    output_proofs: groth16::batch::Verifier<Bls12>,
-    signatures: redjubjub::batch::Verifier,
-}
-
-impl Default for BatchValidator {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl BatchValidator {
-    /// Constructs a new batch validation context.
-    pub fn new() -> Self {
-        BatchValidator {
-            bundles_added: false,
-            spend_proofs: groth16::batch::Verifier::new(),
-            output_proofs: groth16::batch::Verifier::new(),
-            signatures: redjubjub::batch::Verifier::new(),
-        }
-    }
-
-    /// Checks the bundle against Sapling-specific consensus rules, and adds its proof and
-    /// signatures to the validator.
-    ///
-    /// Returns `false` if the bundle doesn't satisfy all of the consensus rules. This
-    /// `BatchValidator` can continue to be used regardless, but some or all of the proofs
-    /// and signatures from this bundle may have already been added to the batch even if
-    /// it fails other consensus rules.
-    pub fn check_bundle(&mut self, bundle: Bundle<Authorized>, sighash: [u8; 32]) -> bool {
-        self.bundles_added = true;
-
-        let mut ctx = SaplingVerificationContextInner::new();
-
-        for spend in bundle.shielded_spends() {
-            // Deserialize the proof
-            let zkproof = match groth16::Proof::read(&spend.zkproof()[..]) {
-                Ok(p) => p,
-                Err(_) => return false,
-            };
-
-            // Check the Spend consensus rules, and batch its proof and spend
-            // authorization signature.
-            let consensus_rules_passed = ctx.check_spend(
-                spend.cv(),
-                *spend.anchor(),
-                &spend.nullifier().0,
-                spend.rk(),
-                &sighash,
-                spend.spend_auth_sig(),
-                zkproof,
-                self,
-                |this, rk, _, spend_auth_sig| {
-                    let rk = redjubjub::VerificationKeyBytes::<redjubjub::SpendAuth>::from(
-                        rk.0.to_bytes(),
-                    );
-                    let spend_auth_sig = {
-                        let mut buf = [0; 64];
-                        spend_auth_sig.write(&mut buf[..]).unwrap();
-                        redjubjub::Signature::<redjubjub::SpendAuth>::from(buf)
-                    };
-
-                    this.signatures.queue((rk, spend_auth_sig, &sighash));
-                    true
-                },
-                |this, proof, public_inputs| {
-                    this.spend_proofs.queue((proof, public_inputs.to_vec()));
-                    true
-                },
-            );
-            if !consensus_rules_passed {
-                return false;
-            }
-        }
-
-        for output in bundle.shielded_outputs() {
-            // Deserialize the ephemeral key
-            let epk = match jubjub::ExtendedPoint::from_bytes(&output.ephemeral_key().0).into() {
-                Some(p) => p,
-                None => return false,
-            };
-
-            // Deserialize the proof
-            let zkproof = match groth16::Proof::read(&output.zkproof()[..]) {
-                Ok(p) => p,
-                Err(_) => return false,
-            };
-
-            // Check the Output consensus rules, and batch its proof.
-            let consensus_rules_passed = ctx.check_output(
-                output.cv(),
-                *output.cmu(),
-                epk,
-                zkproof,
-                |proof, public_inputs| {
-                    self.output_proofs.queue((proof, public_inputs.to_vec()));
-                    true
-                },
-            );
-            if !consensus_rules_passed {
-                return false;
-            }
-        }
-
-        // Check the whole-bundle consensus rules, and batch the binding signature.
-        ctx.final_check(
-            *bundle.value_balance(),
-            &sighash,
-            bundle.authorization().binding_sig,
-            |bvk, _, binding_sig| {
-                let bvk =
-                    redjubjub::VerificationKeyBytes::<redjubjub::Binding>::from(bvk.0.to_bytes());
-                let binding_sig = {
-                    let mut buf = [0; 64];
-                    binding_sig.write(&mut buf[..]).unwrap();
-                    redjubjub::Signature::<redjubjub::Binding>::from(buf)
-                };
-
-                self.signatures.queue((bvk, binding_sig, &sighash));
-                true
-            },
-        )
-    }
-
-    /// Batch-validates the accumulated bundles.
-    ///
-    /// Returns `true` if every proof and signature in every bundle added to the batch
-    /// validator is valid, or `false` if one or more are invalid. No attempt is made to
-    /// figure out which of the accumulated bundles might be invalid; if that information
-    /// is desired, construct separate [`BatchValidator`]s for sub-batches of the bundles.
-    pub fn validate<R: RngCore + CryptoRng>(
-        self,
-        spend_vk: &groth16::VerifyingKey<Bls12>,
-        output_vk: &groth16::VerifyingKey<Bls12>,
-        mut rng: R,
-    ) -> bool {
-        if !self.bundles_added {
-            // An empty batch is always valid, but is not free to run; skip it.
-            return true;
-        }
-
-        if let Err(e) = self.signatures.verify(&mut rng) {
-            tracing::debug!("Signature batch validation failed: {}", e);
-            return false;
-        }
-
-        #[cfg(feature = "multicore")]
-        let verify_proofs = |batch: groth16::batch::Verifier<Bls12>, vk| batch.verify_multicore(vk);
-
-        #[cfg(not(feature = "multicore"))]
-        let mut verify_proofs =
-            |batch: groth16::batch::Verifier<Bls12>, vk| batch.verify(&mut rng, vk);
-
-        if verify_proofs(self.spend_proofs, spend_vk).is_err() {
-            tracing::debug!("Spend proof batch validation failed");
-            return false;
-        }
-
-        if verify_proofs(self.output_proofs, output_vk).is_err() {
-            tracing::debug!("Output proof batch validation failed");
-            return false;
-        }
-
-        true
-    }
-}
diff --git a/zcash_proofs/src/sapling/verifier/single.rs b/zcash_proofs/src/sapling/verifier/single.rs
deleted file mode 100644
index 02c1a9876f..0000000000
--- a/zcash_proofs/src/sapling/verifier/single.rs
+++ /dev/null
@@ -1,102 +0,0 @@
-use bellman::groth16::{verify_proof, PreparedVerifyingKey, Proof};
-use bls12_381::Bls12;
-use zcash_primitives::{
-    constants::{SPENDING_KEY_GENERATOR, VALUE_COMMITMENT_RANDOMNESS_GENERATOR},
-    sapling::{
-        note::ExtractedNoteCommitment,
-        redjubjub::{PublicKey, Signature},
-        value::ValueCommitment,
-    },
-    transaction::components::Amount,
-};
-
-use super::SaplingVerificationContextInner;
-
-/// A context object for verifying the Sapling components of a single Zcash transaction.
-pub struct SaplingVerificationContext {
-    inner: SaplingVerificationContextInner,
-    zip216_enabled: bool,
-}
-
-impl SaplingVerificationContext {
-    /// Construct a new context to be used with a single transaction.
-    pub fn new(zip216_enabled: bool) -> Self {
-        SaplingVerificationContext {
-            inner: SaplingVerificationContextInner::new(),
-            zip216_enabled,
-        }
-    }
-
-    /// Perform consensus checks on a Sapling SpendDescription, while
-    /// accumulating its value commitment inside the context for later use.
-    #[allow(clippy::too_many_arguments)]
-    pub fn check_spend(
-        &mut self,
-        cv: &ValueCommitment,
-        anchor: bls12_381::Scalar,
-        nullifier: &[u8; 32],
-        rk: PublicKey,
-        sighash_value: &[u8; 32],
-        spend_auth_sig: Signature,
-        zkproof: Proof<Bls12>,
-        verifying_key: &PreparedVerifyingKey<Bls12>,
-    ) -> bool {
-        let zip216_enabled = self.zip216_enabled;
-        self.inner.check_spend(
-            cv,
-            anchor,
-            nullifier,
-            &rk,
-            sighash_value,
-            &spend_auth_sig,
-            zkproof,
-            &mut (),
-            |_, rk, msg, spend_auth_sig| {
-                rk.verify_with_zip216(&msg, spend_auth_sig, SPENDING_KEY_GENERATOR, zip216_enabled)
-            },
-            |_, proof, public_inputs| {
-                verify_proof(verifying_key, &proof, &public_inputs[..]).is_ok()
-            },
-        )
-    }
-
-    /// Perform consensus checks on a Sapling OutputDescription, while
-    /// accumulating its value commitment inside the context for later use.
-    pub fn check_output(
-        &mut self,
-        cv: &ValueCommitment,
-        cmu: ExtractedNoteCommitment,
-        epk: jubjub::ExtendedPoint,
-        zkproof: Proof<Bls12>,
-        verifying_key: &PreparedVerifyingKey<Bls12>,
-    ) -> bool {
-        self.inner
-            .check_output(cv, cmu, epk, zkproof, |proof, public_inputs| {
-                verify_proof(verifying_key, &proof, &public_inputs[..]).is_ok()
-            })
-    }
-
-    /// Perform consensus checks on the valueBalance and bindingSig parts of a
-    /// Sapling transaction. All SpendDescriptions and OutputDescriptions must
-    /// have been checked before calling this function.
-    pub fn final_check(
-        &self,
-        value_balance: Amount,
-        sighash_value: &[u8; 32],
-        binding_sig: Signature,
-    ) -> bool {
-        self.inner.final_check(
-            value_balance,
-            sighash_value,
-            binding_sig,
-            |bvk, msg, binding_sig| {
-                bvk.verify_with_zip216(
-                    &msg,
-                    &binding_sig,
-                    VALUE_COMMITMENT_RANDOMNESS_GENERATOR,
-                    self.zip216_enabled,
-                )
-            },
-        )
-    }
-}