Multi-output CARROT transactions store per-output D_e in additional_pubkeys
(tag 0x04) with no tx_pubkey (tag 0x01), so the single-D_e pre-computation
path was skipped entirely — every output hit the full _scanCarrotOutput path
(~40ms each via FFI). Added per-output X25519 + 3-byte view tag rejection
that restores post-fork sync from ~10 blk/s back to ~900+ blk/s.
Also fixed parseExtra to handle 0xDE (minergate tag) and gracefully skip
unknown tags via varint-length instead of aborting all remaining extra bytes.
Move native code from native/ to Expo-compatible layout with android/
and ios/ at package root. Add Android JNI bridge (OnLoad.cpp,
ExpoSalviumCryptoModule.java, ExpoSalviumCryptoPackage.java).
Prebuilt binaries now go in prebuilt/ instead of native/lib/.
Test fixes:
- wallet-sync: update stale DEFAULT_BATCH_SIZE assertion (10 -> 100)
- bulletproofs+: fix hashToPoint -> hashToPointMonero rename in test,
fix serializeProof to include V array matching parseProof format
- transaction-builder: expect 2 outputs for exact-amount tx (zero-change
output is always added for privacy)
Matt Hess