From 75c98a3398b3b2c6bd05bc22a73278dae3a91dd1 Mon Sep 17 00:00:00 2001
From: Jack Grigg <thestr4d@gmail.com>
Date: Mon, 3 Jul 2023 15:25:09 +0000
Subject: [PATCH] Bring in latest `compact_formats.proto`

From zcash/librustzcash@c13c8c667896e8089ad49e88d5c033f9e844ffc4,
including the rework of how the commitment tree sizes are to be
represented in CompactBlocks.
---
 common/common.go                |   4 +-
 docs/rtd/index.html             |  83 ++++++---
 frontend/service.go             |   8 +-
 parser/block.go                 |   9 +-
 parser/transaction.go           |   6 +-
 walletrpc/compact_formats.pb.go | 308 ++++++++++++++++++++------------
 walletrpc/compact_formats.proto |  48 +++--
 7 files changed, 289 insertions(+), 177 deletions(-)

diff --git a/common/common.go b/common/common.go
index 8d3ee167..8940ab3a 100644
--- a/common/common.go
+++ b/common/common.go
@@ -339,8 +339,8 @@ func getBlockFromRPC(height int) (*walletrpc.CompactBlock, error) {
 		t.SetTxID(parser.Reverse(txid))
 	}
 	r := block.ToCompact()
-	r.SaplingCommitmentTreeSize = block1.Trees.Sapling.Size
-	r.OrchardCommitmentTreeSize = block1.Trees.Orchard.Size
+	r.ChainMetadata.SaplingCommitmentTreeSize = block1.Trees.Sapling.Size
+	r.ChainMetadata.OrchardCommitmentTreeSize = block1.Trees.Orchard.Size
 	return r, nil
 }
 
diff --git a/docs/rtd/index.html b/docs/rtd/index.html
index 5e9dca23..791e96a3 100644
--- a/docs/rtd/index.html
+++ b/docs/rtd/index.html
@@ -178,6 +178,10 @@ <h2>Table of Contents</h2>
             <a href="#compact_formats.proto">compact_formats.proto</a>
             <ul>
               
+                <li>
+                  <a href="#cash.z.wallet.sdk.rpc.ChainMetadata"><span class="badge">M</span>ChainMetadata</a>
+                </li>
+              
                 <li>
                   <a href="#cash.z.wallet.sdk.rpc.CompactBlock"><span class="badge">M</span>CompactBlock</a>
                 </li>
@@ -358,6 +362,37 @@ <h2 id="compact_formats.proto">compact_formats.proto</h2><a href="#title">Top</a
       <p></p>
 
       
+        <h3 id="cash.z.wallet.sdk.rpc.ChainMetadata">ChainMetadata</h3>
+        <p>ChainMetadata represents information about the state of the chain as of a given block.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>saplingCommitmentTreeSize</td>
+                  <td><a href="#uint32">uint32</a></td>
+                  <td></td>
+                  <td><p>the size of the Sapling note commitment tree as of the end of this block </p></td>
+                </tr>
+              
+                <tr>
+                  <td>orchardCommitmentTreeSize</td>
+                  <td><a href="#uint32">uint32</a></td>
+                  <td></td>
+                  <td><p>the size of the Orchard note commitment tree as of the end of this block </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="cash.z.wallet.sdk.rpc.CompactBlock">CompactBlock</h3>
         <p>CompactBlock is a packaging of ONLY the data from a block that's needed to:</p><p>1. Detect a payment to your shielded Sapling address</p><p>2. Detect a spend of your shielded Sapling notes</p><p>3. Update your witnesses to generate new Sapling spend proofs.</p>
 
@@ -418,17 +453,10 @@ <h3 id="cash.z.wallet.sdk.rpc.CompactBlock">CompactBlock</h3>
                 </tr>
               
                 <tr>
-                  <td>saplingCommitmentTreeSize</td>
-                  <td><a href="#uint32">uint32</a></td>
-                  <td></td>
-                  <td><p>the size of the Sapling note commitment tree as of the end of this block </p></td>
-                </tr>
-              
-                <tr>
-                  <td>orchardCommitmentTreeSize</td>
-                  <td><a href="#uint32">uint32</a></td>
+                  <td>chainMetadata</td>
+                  <td><a href="#cash.z.wallet.sdk.rpc.ChainMetadata">ChainMetadata</a></td>
                   <td></td>
-                  <td><p>the size of the Orchard note commitment tree as of the end of this block </p></td>
+                  <td><p>information about the state of the chain as of this block </p></td>
                 </tr>
               
             </tbody>
@@ -473,7 +501,7 @@ <h3 id="cash.z.wallet.sdk.rpc.CompactOrchardAction">CompactOrchardAction</h3>
                   <td>ciphertext</td>
                   <td><a href="#bytes">bytes</a></td>
                   <td></td>
-                  <td><p>[52] The note plaintext component of the encCiphertext field </p></td>
+                  <td><p>[52] The first 52 bytes of the encCiphertext field </p></td>
                 </tr>
               
             </tbody>
@@ -484,7 +512,7 @@ <h3 id="cash.z.wallet.sdk.rpc.CompactOrchardAction">CompactOrchardAction</h3>
         
       
         <h3 id="cash.z.wallet.sdk.rpc.CompactSaplingOutput">CompactSaplingOutput</h3>
-        <p>output is a Sapling Output Description as described in section 7.4 of the</p><p>Zcash protocol spec. Total size is 948.</p>
+        <p>output encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the</p><p>`encCiphertext` field of a Sapling Output Description. These fields are described in</p><p>section 7.4 of the Zcash protocol spec:</p><p>https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus</p><p>Total size is 116 bytes.</p>
 
         
           <table class="field-table">
@@ -501,7 +529,7 @@ <h3 id="cash.z.wallet.sdk.rpc.CompactSaplingOutput">CompactSaplingOutput</h3>
                 </tr>
               
                 <tr>
-                  <td>epk</td>
+                  <td>ephemeralKey</td>
                   <td><a href="#bytes">bytes</a></td>
                   <td></td>
                   <td><p>ephemeral public key </p></td>
@@ -559,7 +587,11 @@ <h3 id="cash.z.wallet.sdk.rpc.CompactTx">CompactTx</h3>
                   <td>index</td>
                   <td><a href="#uint64">uint64</a></td>
                   <td></td>
-                  <td><p>the index within the full block </p></td>
+                  <td><p>Index and hash will allow the receiver to call out to chain
+explorers or other data structures to retrieve more information
+about this transaction.
+
+the index within the full block </p></td>
                 </tr>
               
                 <tr>
@@ -576,22 +608,22 @@ <h3 id="cash.z.wallet.sdk.rpc.CompactTx">CompactTx</h3>
                   <td><p>The transaction fee: present if server can provide. In the case of a
 stateless server and a transaction with transparent inputs, this will be
 unset because the calculation requires reference to prior transactions.
-in a pure-Sapling context, the fee will be calculable as:
-   valueBalance &#43; (sum(vPubNew) - sum(vPubOld) - sum(tOut)) </p></td>
+If there are no transparent inputs, the fee will be calculable as:
+   valueBalanceSapling &#43; valueBalanceOrchard &#43; sum(vPubNew) - sum(vPubOld) - sum(tOut) </p></td>
                 </tr>
               
                 <tr>
                   <td>spends</td>
                   <td><a href="#cash.z.wallet.sdk.rpc.CompactSaplingSpend">CompactSaplingSpend</a></td>
                   <td>repeated</td>
-                  <td><p>inputs </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
                   <td>outputs</td>
                   <td><a href="#cash.z.wallet.sdk.rpc.CompactSaplingOutput">CompactSaplingOutput</a></td>
                   <td>repeated</td>
-                  <td><p>outputs </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
@@ -1308,8 +1340,8 @@ <h3 id="cash.z.wallet.sdk.rpc.GetSubtreeRootsArg">GetSubtreeRootsArg</h3>
                 </tr>
               
                 <tr>
-                  <td>limit</td>
-                  <td><a href="#uint64">uint64</a></td>
+                  <td>maxEntries</td>
+                  <td><a href="#uint32">uint32</a></td>
                   <td></td>
                   <td><p>Maximum number of entries to return, or 0 for all entries. </p></td>
                 </tr>
@@ -1539,13 +1571,6 @@ <h3 id="cash.z.wallet.sdk.rpc.SubtreeRoot">SubtreeRoot</h3>
             </thead>
             <tbody>
               
-                <tr>
-                  <td>index</td>
-                  <td><a href="#uint32">uint32</a></td>
-                  <td></td>
-                  <td><p>The index of the subtree. Each subtree containx 2^16 leaves. </p></td>
-                </tr>
-              
                 <tr>
                   <td>rootHash</td>
                   <td><a href="#bytes">bytes</a></td>
@@ -1713,13 +1738,13 @@ <h3 id="cash.z.wallet.sdk.rpc.ShieldedProtocol">ShieldedProtocol</h3>
           <tbody>
             
               <tr>
-                <td>SAPLING</td>
+                <td>sapling</td>
                 <td>0</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ORCHARD</td>
+                <td>orchard</td>
                 <td>1</td>
                 <td><p></p></td>
               </tr>
diff --git a/frontend/service.go b/frontend/service.go
index a9630ded..edf6bba6 100644
--- a/frontend/service.go
+++ b/frontend/service.go
@@ -175,8 +175,8 @@ func (s *lwdStreamer) GetBlockNullifiers(ctx context.Context, id *walletrpc.Bloc
 		tx.Outputs = nil
 	}
 	// these are not needed (we prefer to save bandwidth)
-	cBlock.SaplingCommitmentTreeSize = 0
-	cBlock.OrchardCommitmentTreeSize = 0
+	cBlock.ChainMetadata.SaplingCommitmentTreeSize = 0
+	cBlock.ChainMetadata.OrchardCommitmentTreeSize = 0
 	return cBlock, err
 }
 
@@ -228,8 +228,8 @@ func (s *lwdStreamer) GetBlockRangeNullifiers(span *walletrpc.BlockRange, resp w
 				tx.Outputs = nil
 			}
 			// these are not needed (we prefer to save bandwidth)
-			cBlock.SaplingCommitmentTreeSize = 0
-			cBlock.OrchardCommitmentTreeSize = 0
+			cBlock.ChainMetadata.SaplingCommitmentTreeSize = 0
+			cBlock.ChainMetadata.OrchardCommitmentTreeSize = 0
 			if err := resp.Send(cBlock); err != nil {
 				return err
 			}
diff --git a/parser/block.go b/parser/block.go
index ebbfba74..9e19dc5b 100644
--- a/parser/block.go
+++ b/parser/block.go
@@ -109,10 +109,11 @@ func (b *Block) GetPrevHash() []byte {
 func (b *Block) ToCompact() *walletrpc.CompactBlock {
 	compactBlock := &walletrpc.CompactBlock{
 		//TODO ProtoVersion: 1,
-		Height:   uint64(b.GetHeight()),
-		PrevHash: b.hdr.HashPrevBlock,
-		Hash:     b.GetEncodableHash(),
-		Time:     b.hdr.Time,
+		Height:        uint64(b.GetHeight()),
+		PrevHash:      b.hdr.HashPrevBlock,
+		Hash:          b.GetEncodableHash(),
+		Time:          b.hdr.Time,
+		ChainMetadata: &walletrpc.ChainMetadata{},
 	}
 
 	// Only Sapling transactions have a meaningful compact encoding
diff --git a/parser/transaction.go b/parser/transaction.go
index 5c3fb24b..ae032d9e 100644
--- a/parser/transaction.go
+++ b/parser/transaction.go
@@ -214,9 +214,9 @@ func (p *output) ParseFromSlice(data []byte, version uint32) ([]byte, error) {
 
 func (p *output) ToCompact() *walletrpc.CompactSaplingOutput {
 	return &walletrpc.CompactSaplingOutput{
-		Cmu:        p.cmu,
-		Epk:        p.ephemeralKey,
-		Ciphertext: p.encCiphertext[:52],
+		Cmu:          p.cmu,
+		EphemeralKey: p.ephemeralKey,
+		Ciphertext:   p.encCiphertext[:52],
 	}
 }
 
diff --git a/walletrpc/compact_formats.pb.go b/walletrpc/compact_formats.pb.go
index 7496b34a..1b14480e 100644
--- a/walletrpc/compact_formats.pb.go
+++ b/walletrpc/compact_formats.pb.go
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2020 The Zcash developers
+// Copyright (c) 2019-2021 The Zcash developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or https://www.opensource.org/licenses/mit-license.php .
 
@@ -24,30 +24,85 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// ChainMetadata represents information about the state of the chain as of a given block.
+type ChainMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SaplingCommitmentTreeSize uint32 `protobuf:"varint,1,opt,name=saplingCommitmentTreeSize,proto3" json:"saplingCommitmentTreeSize,omitempty"` // the size of the Sapling note commitment tree as of the end of this block
+	OrchardCommitmentTreeSize uint32 `protobuf:"varint,2,opt,name=orchardCommitmentTreeSize,proto3" json:"orchardCommitmentTreeSize,omitempty"` // the size of the Orchard note commitment tree as of the end of this block
+}
+
+func (x *ChainMetadata) Reset() {
+	*x = ChainMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_compact_formats_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ChainMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ChainMetadata) ProtoMessage() {}
+
+func (x *ChainMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_compact_formats_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ChainMetadata.ProtoReflect.Descriptor instead.
+func (*ChainMetadata) Descriptor() ([]byte, []int) {
+	return file_compact_formats_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ChainMetadata) GetSaplingCommitmentTreeSize() uint32 {
+	if x != nil {
+		return x.SaplingCommitmentTreeSize
+	}
+	return 0
+}
+
+func (x *ChainMetadata) GetOrchardCommitmentTreeSize() uint32 {
+	if x != nil {
+		return x.OrchardCommitmentTreeSize
+	}
+	return 0
+}
+
 // CompactBlock is a packaging of ONLY the data from a block that's needed to:
-//  1. Detect a payment to your shielded Sapling address
-//  2. Detect a spend of your shielded Sapling notes
-//  3. Update your witnesses to generate new Sapling spend proofs.
+//   1. Detect a payment to your shielded Sapling address
+//   2. Detect a spend of your shielded Sapling notes
+//   3. Update your witnesses to generate new Sapling spend proofs.
 type CompactBlock struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	ProtoVersion              uint32       `protobuf:"varint,1,opt,name=protoVersion,proto3" json:"protoVersion,omitempty"`                           // the version of this wire format, for storage
-	Height                    uint64       `protobuf:"varint,2,opt,name=height,proto3" json:"height,omitempty"`                                       // the height of this block
-	Hash                      []byte       `protobuf:"bytes,3,opt,name=hash,proto3" json:"hash,omitempty"`                                            // the ID (hash) of this block, same as in block explorers
-	PrevHash                  []byte       `protobuf:"bytes,4,opt,name=prevHash,proto3" json:"prevHash,omitempty"`                                    // the ID (hash) of this block's predecessor
-	Time                      uint32       `protobuf:"varint,5,opt,name=time,proto3" json:"time,omitempty"`                                           // Unix epoch time when the block was mined
-	Header                    []byte       `protobuf:"bytes,6,opt,name=header,proto3" json:"header,omitempty"`                                        // (hash, prevHash, and time) OR (full header)
-	Vtx                       []*CompactTx `protobuf:"bytes,7,rep,name=vtx,proto3" json:"vtx,omitempty"`                                              // zero or more compact transactions from this block
-	SaplingCommitmentTreeSize uint32       `protobuf:"varint,8,opt,name=saplingCommitmentTreeSize,proto3" json:"saplingCommitmentTreeSize,omitempty"` // the size of the Sapling note commitment tree as of the end of this block
-	OrchardCommitmentTreeSize uint32       `protobuf:"varint,9,opt,name=orchardCommitmentTreeSize,proto3" json:"orchardCommitmentTreeSize,omitempty"` // the size of the Orchard note commitment tree as of the end of this block
+	ProtoVersion  uint32         `protobuf:"varint,1,opt,name=protoVersion,proto3" json:"protoVersion,omitempty"`  // the version of this wire format, for storage
+	Height        uint64         `protobuf:"varint,2,opt,name=height,proto3" json:"height,omitempty"`              // the height of this block
+	Hash          []byte         `protobuf:"bytes,3,opt,name=hash,proto3" json:"hash,omitempty"`                   // the ID (hash) of this block, same as in block explorers
+	PrevHash      []byte         `protobuf:"bytes,4,opt,name=prevHash,proto3" json:"prevHash,omitempty"`           // the ID (hash) of this block's predecessor
+	Time          uint32         `protobuf:"varint,5,opt,name=time,proto3" json:"time,omitempty"`                  // Unix epoch time when the block was mined
+	Header        []byte         `protobuf:"bytes,6,opt,name=header,proto3" json:"header,omitempty"`               // (hash, prevHash, and time) OR (full header)
+	Vtx           []*CompactTx   `protobuf:"bytes,7,rep,name=vtx,proto3" json:"vtx,omitempty"`                     // zero or more compact transactions from this block
+	ChainMetadata *ChainMetadata `protobuf:"bytes,8,opt,name=chainMetadata,proto3" json:"chainMetadata,omitempty"` // information about the state of the chain as of this block
 }
 
 func (x *CompactBlock) Reset() {
 	*x = CompactBlock{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_compact_formats_proto_msgTypes[0]
+		mi := &file_compact_formats_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -60,7 +115,7 @@ func (x *CompactBlock) String() string {
 func (*CompactBlock) ProtoMessage() {}
 
 func (x *CompactBlock) ProtoReflect() protoreflect.Message {
-	mi := &file_compact_formats_proto_msgTypes[0]
+	mi := &file_compact_formats_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -73,7 +128,7 @@ func (x *CompactBlock) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompactBlock.ProtoReflect.Descriptor instead.
 func (*CompactBlock) Descriptor() ([]byte, []int) {
-	return file_compact_formats_proto_rawDescGZIP(), []int{0}
+	return file_compact_formats_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *CompactBlock) GetProtoVersion() uint32 {
@@ -125,18 +180,11 @@ func (x *CompactBlock) GetVtx() []*CompactTx {
 	return nil
 }
 
-func (x *CompactBlock) GetSaplingCommitmentTreeSize() uint32 {
+func (x *CompactBlock) GetChainMetadata() *ChainMetadata {
 	if x != nil {
-		return x.SaplingCommitmentTreeSize
-	}
-	return 0
-}
-
-func (x *CompactBlock) GetOrchardCommitmentTreeSize() uint32 {
-	if x != nil {
-		return x.OrchardCommitmentTreeSize
+		return x.ChainMetadata
 	}
-	return 0
+	return nil
 }
 
 // CompactTx contains the minimum information for a wallet to know if this transaction
@@ -147,24 +195,26 @@ type CompactTx struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Index and hash will allow the receiver to call out to chain
+	// explorers or other data structures to retrieve more information
+	// about this transaction.
 	Index uint64 `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"` // the index within the full block
 	Hash  []byte `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`    // the ID (hash) of this transaction, same as in block explorers
 	// The transaction fee: present if server can provide. In the case of a
 	// stateless server and a transaction with transparent inputs, this will be
 	// unset because the calculation requires reference to prior transactions.
-	// in a pure-Sapling context, the fee will be calculable as:
-	//
-	//	valueBalance + (sum(vPubNew) - sum(vPubOld) - sum(tOut))
+	// If there are no transparent inputs, the fee will be calculable as:
+	//    valueBalanceSapling + valueBalanceOrchard + sum(vPubNew) - sum(vPubOld) - sum(tOut)
 	Fee     uint32                  `protobuf:"varint,3,opt,name=fee,proto3" json:"fee,omitempty"`
-	Spends  []*CompactSaplingSpend  `protobuf:"bytes,4,rep,name=spends,proto3" json:"spends,omitempty"`   // inputs
-	Outputs []*CompactSaplingOutput `protobuf:"bytes,5,rep,name=outputs,proto3" json:"outputs,omitempty"` // outputs
+	Spends  []*CompactSaplingSpend  `protobuf:"bytes,4,rep,name=spends,proto3" json:"spends,omitempty"`
+	Outputs []*CompactSaplingOutput `protobuf:"bytes,5,rep,name=outputs,proto3" json:"outputs,omitempty"`
 	Actions []*CompactOrchardAction `protobuf:"bytes,6,rep,name=actions,proto3" json:"actions,omitempty"`
 }
 
 func (x *CompactTx) Reset() {
 	*x = CompactTx{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_compact_formats_proto_msgTypes[1]
+		mi := &file_compact_formats_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -177,7 +227,7 @@ func (x *CompactTx) String() string {
 func (*CompactTx) ProtoMessage() {}
 
 func (x *CompactTx) ProtoReflect() protoreflect.Message {
-	mi := &file_compact_formats_proto_msgTypes[1]
+	mi := &file_compact_formats_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -190,7 +240,7 @@ func (x *CompactTx) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompactTx.ProtoReflect.Descriptor instead.
 func (*CompactTx) Descriptor() ([]byte, []int) {
-	return file_compact_formats_proto_rawDescGZIP(), []int{1}
+	return file_compact_formats_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *CompactTx) GetIndex() uint64 {
@@ -248,7 +298,7 @@ type CompactSaplingSpend struct {
 func (x *CompactSaplingSpend) Reset() {
 	*x = CompactSaplingSpend{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_compact_formats_proto_msgTypes[2]
+		mi := &file_compact_formats_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -261,7 +311,7 @@ func (x *CompactSaplingSpend) String() string {
 func (*CompactSaplingSpend) ProtoMessage() {}
 
 func (x *CompactSaplingSpend) ProtoReflect() protoreflect.Message {
-	mi := &file_compact_formats_proto_msgTypes[2]
+	mi := &file_compact_formats_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -274,7 +324,7 @@ func (x *CompactSaplingSpend) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompactSaplingSpend.ProtoReflect.Descriptor instead.
 func (*CompactSaplingSpend) Descriptor() ([]byte, []int) {
-	return file_compact_formats_proto_rawDescGZIP(), []int{2}
+	return file_compact_formats_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *CompactSaplingSpend) GetNf() []byte {
@@ -284,22 +334,25 @@ func (x *CompactSaplingSpend) GetNf() []byte {
 	return nil
 }
 
-// output is a Sapling Output Description as described in section 7.4 of the
-// Zcash protocol spec. Total size is 948.
+// output encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the
+// `encCiphertext` field of a Sapling Output Description. These fields are described in
+// section 7.4 of the Zcash protocol spec:
+// https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus
+// Total size is 116 bytes.
 type CompactSaplingOutput struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Cmu        []byte `protobuf:"bytes,1,opt,name=cmu,proto3" json:"cmu,omitempty"`               // note commitment u-coordinate
-	Epk        []byte `protobuf:"bytes,2,opt,name=epk,proto3" json:"epk,omitempty"`               // ephemeral public key
-	Ciphertext []byte `protobuf:"bytes,3,opt,name=ciphertext,proto3" json:"ciphertext,omitempty"` // first 52 bytes of ciphertext
+	Cmu          []byte `protobuf:"bytes,1,opt,name=cmu,proto3" json:"cmu,omitempty"`                   // note commitment u-coordinate
+	EphemeralKey []byte `protobuf:"bytes,2,opt,name=ephemeralKey,proto3" json:"ephemeralKey,omitempty"` // ephemeral public key
+	Ciphertext   []byte `protobuf:"bytes,3,opt,name=ciphertext,proto3" json:"ciphertext,omitempty"`     // first 52 bytes of ciphertext
 }
 
 func (x *CompactSaplingOutput) Reset() {
 	*x = CompactSaplingOutput{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_compact_formats_proto_msgTypes[3]
+		mi := &file_compact_formats_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -312,7 +365,7 @@ func (x *CompactSaplingOutput) String() string {
 func (*CompactSaplingOutput) ProtoMessage() {}
 
 func (x *CompactSaplingOutput) ProtoReflect() protoreflect.Message {
-	mi := &file_compact_formats_proto_msgTypes[3]
+	mi := &file_compact_formats_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -325,7 +378,7 @@ func (x *CompactSaplingOutput) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompactSaplingOutput.ProtoReflect.Descriptor instead.
 func (*CompactSaplingOutput) Descriptor() ([]byte, []int) {
-	return file_compact_formats_proto_rawDescGZIP(), []int{3}
+	return file_compact_formats_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *CompactSaplingOutput) GetCmu() []byte {
@@ -335,9 +388,9 @@ func (x *CompactSaplingOutput) GetCmu() []byte {
 	return nil
 }
 
-func (x *CompactSaplingOutput) GetEpk() []byte {
+func (x *CompactSaplingOutput) GetEphemeralKey() []byte {
 	if x != nil {
-		return x.Epk
+		return x.EphemeralKey
 	}
 	return nil
 }
@@ -359,13 +412,13 @@ type CompactOrchardAction struct {
 	Nullifier    []byte `protobuf:"bytes,1,opt,name=nullifier,proto3" json:"nullifier,omitempty"`       // [32] The nullifier of the input note
 	Cmx          []byte `protobuf:"bytes,2,opt,name=cmx,proto3" json:"cmx,omitempty"`                   // [32] The x-coordinate of the note commitment for the output note
 	EphemeralKey []byte `protobuf:"bytes,3,opt,name=ephemeralKey,proto3" json:"ephemeralKey,omitempty"` // [32] An encoding of an ephemeral Pallas public key
-	Ciphertext   []byte `protobuf:"bytes,4,opt,name=ciphertext,proto3" json:"ciphertext,omitempty"`     // [52] The note plaintext component of the encCiphertext field
+	Ciphertext   []byte `protobuf:"bytes,4,opt,name=ciphertext,proto3" json:"ciphertext,omitempty"`     // [52] The first 52 bytes of the encCiphertext field
 }
 
 func (x *CompactOrchardAction) Reset() {
 	*x = CompactOrchardAction{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_compact_formats_proto_msgTypes[4]
+		mi := &file_compact_formats_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -378,7 +431,7 @@ func (x *CompactOrchardAction) String() string {
 func (*CompactOrchardAction) ProtoMessage() {}
 
 func (x *CompactOrchardAction) ProtoReflect() protoreflect.Message {
-	mi := &file_compact_formats_proto_msgTypes[4]
+	mi := &file_compact_formats_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -391,7 +444,7 @@ func (x *CompactOrchardAction) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CompactOrchardAction.ProtoReflect.Descriptor instead.
 func (*CompactOrchardAction) Descriptor() ([]byte, []int) {
-	return file_compact_formats_proto_rawDescGZIP(), []int{4}
+	return file_compact_formats_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *CompactOrchardAction) GetNullifier() []byte {
@@ -427,53 +480,60 @@ var File_compact_formats_proto protoreflect.FileDescriptor
 var file_compact_formats_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74,
 	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x15, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e,
-	0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x22, 0xd6,
-	0x02, 0x0a, 0x0c, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x12,
-	0x22, 0x0a, 0x0c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x56, 0x65, 0x72, 0x73,
-	0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x04, 0x52, 0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68,
-	0x61, 0x73, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12,
-	0x1a, 0x0a, 0x08, 0x70, 0x72, 0x65, 0x76, 0x48, 0x61, 0x73, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x08, 0x70, 0x72, 0x65, 0x76, 0x48, 0x61, 0x73, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x74,
-	0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x12,
-	0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x32, 0x0a, 0x03, 0x76, 0x74, 0x78, 0x18, 0x07,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61,
+	0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x22, 0x8b,
+	0x01, 0x0a, 0x0d, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x12, 0x3c, 0x0a, 0x19, 0x73, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x69,
+	0x74, 0x6d, 0x65, 0x6e, 0x74, 0x54, 0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x19, 0x73, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d,
+	0x69, 0x74, 0x6d, 0x65, 0x6e, 0x74, 0x54, 0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x3c,
+	0x0a, 0x19, 0x6f, 0x72, 0x63, 0x68, 0x61, 0x72, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x6d,
+	0x65, 0x6e, 0x74, 0x54, 0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x19, 0x6f, 0x72, 0x63, 0x68, 0x61, 0x72, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74,
+	0x6d, 0x65, 0x6e, 0x74, 0x54, 0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x22, 0xa6, 0x02, 0x0a,
+	0x0c, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x42, 0x6c, 0x6f, 0x63, 0x6b, 0x12, 0x22, 0x0a,
+	0x0c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x0c, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73,
+	0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x1a, 0x0a,
+	0x08, 0x70, 0x72, 0x65, 0x76, 0x48, 0x61, 0x73, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x08, 0x70, 0x72, 0x65, 0x76, 0x48, 0x61, 0x73, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x16, 0x0a,
+	0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x32, 0x0a, 0x03, 0x76, 0x74, 0x78, 0x18, 0x07, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61, 0x6c, 0x6c,
+	0x65, 0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x61,
+	0x63, 0x74, 0x54, 0x78, 0x52, 0x03, 0x76, 0x74, 0x78, 0x12, 0x4a, 0x0a, 0x0d, 0x63, 0x68, 0x61,
+	0x69, 0x6e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x24, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74,
+	0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x0d, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x99, 0x02, 0x0a, 0x09, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
+	0x74, 0x54, 0x78, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73,
+	0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x10, 0x0a,
+	0x03, 0x66, 0x65, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x66, 0x65, 0x65, 0x12,
+	0x42, 0x0a, 0x06, 0x73, 0x70, 0x65, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x2a, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74, 0x2e,
+	0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x53,
+	0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x53, 0x70, 0x65, 0x6e, 0x64, 0x52, 0x06, 0x73, 0x70, 0x65,
+	0x6e, 0x64, 0x73, 0x12, 0x45, 0x0a, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61,
 	0x6c, 0x6c, 0x65, 0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43, 0x6f, 0x6d,
-	0x70, 0x61, 0x63, 0x74, 0x54, 0x78, 0x52, 0x03, 0x76, 0x74, 0x78, 0x12, 0x3c, 0x0a, 0x19, 0x73,
-	0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x6d, 0x65, 0x6e, 0x74,
-	0x54, 0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x19,
-	0x73, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x6d, 0x65, 0x6e,
-	0x74, 0x54, 0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x3c, 0x0a, 0x19, 0x6f, 0x72, 0x63,
-	0x68, 0x61, 0x72, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x6d, 0x65, 0x6e, 0x74, 0x54, 0x72,
-	0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x19, 0x6f, 0x72,
-	0x63, 0x68, 0x61, 0x72, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x6d, 0x65, 0x6e, 0x74, 0x54,
-	0x72, 0x65, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x22, 0x99, 0x02, 0x0a, 0x09, 0x43, 0x6f, 0x6d, 0x70,
-	0x61, 0x63, 0x74, 0x54, 0x78, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x12, 0x0a, 0x04, 0x68,
-	0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12,
-	0x10, 0x0a, 0x03, 0x66, 0x65, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x66, 0x65,
-	0x65, 0x12, 0x42, 0x0a, 0x06, 0x73, 0x70, 0x65, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61, 0x6c, 0x6c, 0x65,
-	0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63,
-	0x74, 0x53, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x53, 0x70, 0x65, 0x6e, 0x64, 0x52, 0x06, 0x73,
-	0x70, 0x65, 0x6e, 0x64, 0x73, 0x12, 0x45, 0x0a, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73,
-	0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e,
-	0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43,
-	0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x53, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x4f, 0x75, 0x74,
-	0x70, 0x75, 0x74, 0x52, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x12, 0x45, 0x0a, 0x07,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e,
-	0x63, 0x61, 0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74, 0x2e, 0x73, 0x64,
-	0x6b, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x4f, 0x72, 0x63,
-	0x68, 0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x22, 0x25, 0x0a, 0x13, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x53, 0x61,
-	0x70, 0x6c, 0x69, 0x6e, 0x67, 0x53, 0x70, 0x65, 0x6e, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x6e, 0x66,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x6e, 0x66, 0x22, 0x5a, 0x0a, 0x14, 0x43, 0x6f,
-	0x6d, 0x70, 0x61, 0x63, 0x74, 0x53, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x4f, 0x75, 0x74, 0x70,
-	0x75, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x63, 0x6d, 0x75, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x03, 0x63, 0x6d, 0x75, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x70, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x03, 0x65, 0x70, 0x6b, 0x12, 0x1e, 0x0a, 0x0a, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72,
+	0x70, 0x61, 0x63, 0x74, 0x53, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x4f, 0x75, 0x74, 0x70, 0x75,
+	0x74, 0x52, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x12, 0x45, 0x0a, 0x07, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x63, 0x61,
+	0x73, 0x68, 0x2e, 0x7a, 0x2e, 0x77, 0x61, 0x6c, 0x6c, 0x65, 0x74, 0x2e, 0x73, 0x64, 0x6b, 0x2e,
+	0x72, 0x70, 0x63, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x4f, 0x72, 0x63, 0x68, 0x61,
+	0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x22, 0x25, 0x0a, 0x13, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x63, 0x74, 0x53, 0x61, 0x70, 0x6c,
+	0x69, 0x6e, 0x67, 0x53, 0x70, 0x65, 0x6e, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x6e, 0x66, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x6e, 0x66, 0x22, 0x6c, 0x0a, 0x14, 0x43, 0x6f, 0x6d, 0x70,
+	0x61, 0x63, 0x74, 0x53, 0x61, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74,
+	0x12, 0x10, 0x0a, 0x03, 0x63, 0x6d, 0x75, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x63,
+	0x6d, 0x75, 0x12, 0x22, 0x0a, 0x0c, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x4b,
+	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65,
+	0x72, 0x61, 0x6c, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72,
 	0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x69, 0x70, 0x68,
 	0x65, 0x72, 0x74, 0x65, 0x78, 0x74, 0x22, 0x8a, 0x01, 0x0a, 0x14, 0x43, 0x6f, 0x6d, 0x70, 0x61,
 	0x63, 0x74, 0x4f, 0x72, 0x63, 0x68, 0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
@@ -501,24 +561,26 @@ func file_compact_formats_proto_rawDescGZIP() []byte {
 	return file_compact_formats_proto_rawDescData
 }
 
-var file_compact_formats_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_compact_formats_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_compact_formats_proto_goTypes = []interface{}{
-	(*CompactBlock)(nil),         // 0: cash.z.wallet.sdk.rpc.CompactBlock
-	(*CompactTx)(nil),            // 1: cash.z.wallet.sdk.rpc.CompactTx
-	(*CompactSaplingSpend)(nil),  // 2: cash.z.wallet.sdk.rpc.CompactSaplingSpend
-	(*CompactSaplingOutput)(nil), // 3: cash.z.wallet.sdk.rpc.CompactSaplingOutput
-	(*CompactOrchardAction)(nil), // 4: cash.z.wallet.sdk.rpc.CompactOrchardAction
+	(*ChainMetadata)(nil),        // 0: cash.z.wallet.sdk.rpc.ChainMetadata
+	(*CompactBlock)(nil),         // 1: cash.z.wallet.sdk.rpc.CompactBlock
+	(*CompactTx)(nil),            // 2: cash.z.wallet.sdk.rpc.CompactTx
+	(*CompactSaplingSpend)(nil),  // 3: cash.z.wallet.sdk.rpc.CompactSaplingSpend
+	(*CompactSaplingOutput)(nil), // 4: cash.z.wallet.sdk.rpc.CompactSaplingOutput
+	(*CompactOrchardAction)(nil), // 5: cash.z.wallet.sdk.rpc.CompactOrchardAction
 }
 var file_compact_formats_proto_depIdxs = []int32{
-	1, // 0: cash.z.wallet.sdk.rpc.CompactBlock.vtx:type_name -> cash.z.wallet.sdk.rpc.CompactTx
-	2, // 1: cash.z.wallet.sdk.rpc.CompactTx.spends:type_name -> cash.z.wallet.sdk.rpc.CompactSaplingSpend
-	3, // 2: cash.z.wallet.sdk.rpc.CompactTx.outputs:type_name -> cash.z.wallet.sdk.rpc.CompactSaplingOutput
-	4, // 3: cash.z.wallet.sdk.rpc.CompactTx.actions:type_name -> cash.z.wallet.sdk.rpc.CompactOrchardAction
-	4, // [4:4] is the sub-list for method output_type
-	4, // [4:4] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	2, // 0: cash.z.wallet.sdk.rpc.CompactBlock.vtx:type_name -> cash.z.wallet.sdk.rpc.CompactTx
+	0, // 1: cash.z.wallet.sdk.rpc.CompactBlock.chainMetadata:type_name -> cash.z.wallet.sdk.rpc.ChainMetadata
+	3, // 2: cash.z.wallet.sdk.rpc.CompactTx.spends:type_name -> cash.z.wallet.sdk.rpc.CompactSaplingSpend
+	4, // 3: cash.z.wallet.sdk.rpc.CompactTx.outputs:type_name -> cash.z.wallet.sdk.rpc.CompactSaplingOutput
+	5, // 4: cash.z.wallet.sdk.rpc.CompactTx.actions:type_name -> cash.z.wallet.sdk.rpc.CompactOrchardAction
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_compact_formats_proto_init() }
@@ -528,7 +590,7 @@ func file_compact_formats_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_compact_formats_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CompactBlock); i {
+			switch v := v.(*ChainMetadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -540,7 +602,7 @@ func file_compact_formats_proto_init() {
 			}
 		}
 		file_compact_formats_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CompactTx); i {
+			switch v := v.(*CompactBlock); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -552,7 +614,7 @@ func file_compact_formats_proto_init() {
 			}
 		}
 		file_compact_formats_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CompactSaplingSpend); i {
+			switch v := v.(*CompactTx); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -564,7 +626,7 @@ func file_compact_formats_proto_init() {
 			}
 		}
 		file_compact_formats_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CompactSaplingOutput); i {
+			switch v := v.(*CompactSaplingSpend); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -576,6 +638,18 @@ func file_compact_formats_proto_init() {
 			}
 		}
 		file_compact_formats_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CompactSaplingOutput); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_compact_formats_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CompactOrchardAction); i {
 			case 0:
 				return &v.state
@@ -594,7 +668,7 @@ func file_compact_formats_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_compact_formats_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   5,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/walletrpc/compact_formats.proto b/walletrpc/compact_formats.proto
index 84e54437..09df06d4 100644
--- a/walletrpc/compact_formats.proto
+++ b/walletrpc/compact_formats.proto
@@ -1,4 +1,4 @@
-// Copyright (c) 2019-2020 The Zcash developers
+// Copyright (c) 2019-2021 The Zcash developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or https://www.opensource.org/licenses/mit-license.php .
 
@@ -6,41 +6,50 @@ syntax = "proto3";
 package cash.z.wallet.sdk.rpc;
 option go_package = "lightwalletd/walletrpc";
 option swift_prefix = "";
+
 // Remember that proto3 fields are all optional. A field that is not present will be set to its zero value.
 // bytes fields of hashes are in canonical little-endian format.
 
+// ChainMetadata represents information about the state of the chain as of a given block.
+message ChainMetadata {
+    uint32 saplingCommitmentTreeSize = 1; // the size of the Sapling note commitment tree as of the end of this block
+    uint32 orchardCommitmentTreeSize = 2; // the size of the Orchard note commitment tree as of the end of this block
+}
+
 // CompactBlock is a packaging of ONLY the data from a block that's needed to:
 //   1. Detect a payment to your shielded Sapling address
 //   2. Detect a spend of your shielded Sapling notes
 //   3. Update your witnesses to generate new Sapling spend proofs.
 message CompactBlock {
-    uint32 protoVersion = 1;    // the version of this wire format, for storage
-    uint64 height = 2;          // the height of this block
-    bytes hash = 3;             // the ID (hash) of this block, same as in block explorers
-    bytes prevHash = 4;         // the ID (hash) of this block's predecessor
-    uint32 time = 5;            // Unix epoch time when the block was mined
-    bytes header = 6;           // (hash, prevHash, and time) OR (full header)
-    repeated CompactTx vtx = 7; // zero or more compact transactions from this block
-    uint32 saplingCommitmentTreeSize = 8; // the size of the Sapling note commitment tree as of the end of this block
-    uint32 orchardCommitmentTreeSize = 9; // the size of the Orchard note commitment tree as of the end of this block
+    uint32 protoVersion = 1;         // the version of this wire format, for storage
+    uint64 height = 2;               // the height of this block
+    bytes hash = 3;                  // the ID (hash) of this block, same as in block explorers
+    bytes prevHash = 4;              // the ID (hash) of this block's predecessor
+    uint32 time = 5;                 // Unix epoch time when the block was mined
+    bytes header = 6;                // (hash, prevHash, and time) OR (full header)
+    repeated CompactTx vtx = 7;      // zero or more compact transactions from this block
+    ChainMetadata chainMetadata = 8; // information about the state of the chain as of this block
 }
 
 // CompactTx contains the minimum information for a wallet to know if this transaction
 // is relevant to it (either pays to it or spends from it) via shielded elements
 // only. This message will not encode a transparent-to-transparent transaction.
 message CompactTx {
+    // Index and hash will allow the receiver to call out to chain
+    // explorers or other data structures to retrieve more information
+    // about this transaction.
     uint64 index = 1;   // the index within the full block
     bytes hash = 2;     // the ID (hash) of this transaction, same as in block explorers
 
     // The transaction fee: present if server can provide. In the case of a
     // stateless server and a transaction with transparent inputs, this will be
     // unset because the calculation requires reference to prior transactions.
-    // in a pure-Sapling context, the fee will be calculable as:
-    //    valueBalance + (sum(vPubNew) - sum(vPubOld) - sum(tOut))
+    // If there are no transparent inputs, the fee will be calculable as:
+    //    valueBalanceSapling + valueBalanceOrchard + sum(vPubNew) - sum(vPubOld) - sum(tOut)
     uint32 fee = 3;
 
-    repeated CompactSaplingSpend spends = 4;   // inputs
-    repeated CompactSaplingOutput outputs = 5; // outputs
+    repeated CompactSaplingSpend spends = 4;
+    repeated CompactSaplingOutput outputs = 5;
     repeated CompactOrchardAction actions = 6;
 }
 
@@ -50,11 +59,14 @@ message CompactSaplingSpend {
     bytes nf = 1;   // nullifier (see the Zcash protocol specification)
 }
 
-// output is a Sapling Output Description as described in section 7.4 of the
-// Zcash protocol spec. Total size is 948.
+// output encodes the `cmu` field, `ephemeralKey` field, and a 52-byte prefix of the
+// `encCiphertext` field of a Sapling Output Description. These fields are described in
+// section 7.4 of the Zcash protocol spec:
+// https://zips.z.cash/protocol/protocol.pdf#outputencodingandconsensus
+// Total size is 116 bytes.
 message CompactSaplingOutput {
     bytes cmu = 1;          // note commitment u-coordinate
-    bytes epk = 2;          // ephemeral public key
+    bytes ephemeralKey = 2; // ephemeral public key
     bytes ciphertext = 3;   // first 52 bytes of ciphertext
 }
 
@@ -64,5 +76,5 @@ message CompactOrchardAction {
     bytes nullifier = 1;        // [32] The nullifier of the input note
     bytes cmx = 2;              // [32] The x-coordinate of the note commitment for the output note
     bytes ephemeralKey = 3;     // [32] An encoding of an ephemeral Pallas public key
-    bytes ciphertext = 4;       // [52] The note plaintext component of the encCiphertext field
+    bytes ciphertext = 4;       // [52] The first 52 bytes of the encCiphertext field
 }