@aztec/bb.js 0.0.1-alpha.6 → 0.0.1-commit.24de95ac

package/src/barretenberg/backend.ts

@@ -0,0 +1,390 @@
+import { BackendOptions, Barretenberg, CircuitOptions } from './index.js';
+import { ProofData, uint8ArrayToHex, hexToUint8Array } from '../proof/index.js';
+import { fromChonkProof, toChonkProof } from '../cbind/generated/api_types.js';
+import { ungzip } from 'pako';
+import { Buffer } from 'buffer';
+import { Decoder, Encoder } from 'msgpackr';
+
+export class AztecClientBackendError extends Error {
+  constructor(message: string) {
+    super(message);
+  }
+}
+
+/**
+ * Options for the UltraHonkBackend.
+ */
+export type UltraHonkBackendOptions = {
+  /** Selecting this option will use the keccak hash function instead of poseidon
+   * when generating challenges in the proof.
+   * Use this when you want to verify the created proof on an EVM chain.
+   */
+  keccak?: boolean;
+  /** Selecting this option will use the keccak hash function instead of poseidon
+   * when generating challenges in the proof.
+   * Use this when you want to verify the created proof on an EVM chain.
+   */
+  keccakZK?: boolean;
+  /** Selecting this option will use the poseidon/stark252 hash function instead of poseidon
+   * when generating challenges in the proof.
+   * Use this when you want to verify the created proof on an Starknet chain with Garaga.
+   */
+  starknet?: boolean;
+  /** Selecting this option will use the poseidon/stark252 hash function instead of poseidon
+   * when generating challenges in the proof.
+   * Use this when you want to verify the created proof on an Starknet chain with Garaga.
+   */
+  starknetZK?: boolean;
+};
+
+function getProofSettingsFromOptions(options?: UltraHonkBackendOptions): {
+  ipaAccumulation: boolean;
+  oracleHashType: string;
+  disableZk: boolean;
+  optimizedSolidityVerifier: boolean;
+} {
+  return {
+    ipaAccumulation: false,
+    oracleHashType:
+      options?.keccak || options?.keccakZK
+        ? 'keccak'
+        : options?.starknet || options?.starknetZK
+          ? 'starknet'
+          : 'poseidon2',
+    // TODO no current way to target non-zk poseidon2 hash
+    disableZk: options?.keccak || options?.starknet ? true : false,
+    optimizedSolidityVerifier: false,
+  };
+}
+
+export class UltraHonkVerifierBackend {
+  protected api!: Barretenberg;
+
+  constructor(
+    protected backendOptions: BackendOptions = { threads: 1 },
+    protected circuitOptions: CircuitOptions = { recursive: false },
+  ) {}
+  /** @ignore */
+  private async instantiate(): Promise<void> {
+    if (!this.api) {
+      const api = await Barretenberg.new(this.backendOptions);
+      const honkRecursion = true;
+      await api.initSRSForCircuitSize(0);
+
+      this.api = api;
+    }
+  }
+
+  async verifyProof(
+    proofData: ProofData & { verificationKey: Uint8Array },
+    options?: UltraHonkBackendOptions,
+  ): Promise<boolean> {
+    await this.instantiate();
+
+    const proofFrs: Uint8Array[] = [];
+    for (let i = 0; i < proofData.proof.length; i += 32) {
+      proofFrs.push(proofData.proof.slice(i, i + 32));
+    }
+    const { verified } = await this.api.circuitVerify({
+      verificationKey: proofData.verificationKey,
+      publicInputs: proofData.publicInputs.map(hexToUint8Array),
+      proof: proofFrs,
+      settings: getProofSettingsFromOptions(options),
+    });
+    return verified;
+  }
+  destroy(): Promise<void> {
+    if (!this.api) {
+      return Promise.resolve();
+    }
+    return this.api.destroy();
+  }
+}
+
+export class UltraHonkBackend {
+  // These type assertions are used so that we don't
+  // have to initialize `api` in the constructor.
+  // These are initialized asynchronously in the `init` function,
+  // constructors cannot be asynchronous which is why we do this.
+
+  protected api!: Barretenberg;
+  protected acirUncompressedBytecode: Uint8Array;
+
+  constructor(
+    acirBytecode: string,
+    protected backendOptions: BackendOptions = { threads: 1 },
+    protected circuitOptions: CircuitOptions = { recursive: false },
+  ) {
+    this.acirUncompressedBytecode = acirToUint8Array(acirBytecode);
+  }
+  /** @ignore */
+  private async instantiate(): Promise<void> {
+    if (!this.api) {
+      const api = await Barretenberg.new(this.backendOptions);
+      const honkRecursion = true;
+      await api.acirInitSRS(this.acirUncompressedBytecode, this.circuitOptions.recursive, honkRecursion);
+
+      this.api = api;
+    }
+  }
+
+  async generateProof(compressedWitness: Uint8Array, options?: UltraHonkBackendOptions): Promise<ProofData> {
+    await this.instantiate();
+
+    const witness = ungzip(compressedWitness);
+    const { proof, publicInputs } = await this.api.circuitProve({
+      witness,
+      circuit: {
+        name: 'circuit',
+        bytecode: Buffer.from(this.acirUncompressedBytecode),
+        verificationKey: Buffer.from([]), // Empty VK - lower performance.
+      },
+      settings: getProofSettingsFromOptions(options),
+    });
+    console.log(`Generated proof for circuit with ${publicInputs.length} public inputs and ${proof.length} fields.`);
+
+    // We return ProofData as a flat buffer and an array of strings to match the current ProofData class.
+    const flatProof = new Uint8Array(proof.length * 32);
+    proof.forEach((fr, i) => {
+      flatProof.set(fr, i * 32);
+    });
+
+    return { proof: flatProof, publicInputs: publicInputs.map(uint8ArrayToHex) };
+  }
+
+  async verifyProof(proofData: ProofData, options?: UltraHonkBackendOptions): Promise<boolean> {
+    await this.instantiate();
+
+    const proofFrs: Uint8Array[] = [];
+    for (let i = 0; i < proofData.proof.length; i += 32) {
+      proofFrs.push(proofData.proof.slice(i, i + 32));
+    }
+    // TODO reconsider API - computing the VK at this point is not optimal
+    const vkResult = await this.api.circuitComputeVk({
+      circuit: {
+        name: 'circuit',
+        bytecode: this.acirUncompressedBytecode,
+      },
+      settings: getProofSettingsFromOptions(options),
+    });
+    const { verified } = await this.api.circuitVerify({
+      verificationKey: vkResult.bytes,
+      publicInputs: proofData.publicInputs.map(hexToUint8Array),
+      proof: proofFrs,
+      settings: getProofSettingsFromOptions(options),
+    });
+    return verified;
+  }
+
+  async getVerificationKey(options?: UltraHonkBackendOptions): Promise<Uint8Array> {
+    await this.instantiate();
+
+    const vkResult = await this.api.circuitComputeVk({
+      circuit: {
+        name: 'circuit',
+        bytecode: Buffer.from(this.acirUncompressedBytecode),
+      },
+      settings: getProofSettingsFromOptions(options),
+    });
+    return vkResult.bytes;
+  }
+
+  /** @description Returns a solidity verifier */
+  async getSolidityVerifier(vk: Uint8Array, options?: UltraHonkBackendOptions): Promise<string> {
+    await this.instantiate();
+    const result = await this.api.circuitWriteSolidityVerifier({
+      verificationKey: vk,
+      settings: getProofSettingsFromOptions(options),
+    });
+    return result.solidityCode;
+  }
+
+  // TODO(https://github.com/noir-lang/noir/issues/5661): Update this to handle Honk recursive aggregation in the browser once it is ready in the backend itself
+  async generateRecursiveProofArtifacts(
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _proof: Uint8Array,
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _numOfPublicInputs: number,
+  ): Promise<{ proofAsFields: string[]; vkAsFields: string[]; vkHash: string }> {
+    await this.instantiate();
+    // TODO(https://github.com/noir-lang/noir/issues/5661): This needs to be updated to handle recursive aggregation.
+    // There is still a proofAsFields method but we could consider getting rid of it as the proof itself
+    // is a list of field elements.
+    // UltraHonk also does not have public inputs directly prepended to the proof and they are still instead
+    // inserted at an offset.
+    // const proof = reconstructProofWithPublicInputs(proofData);
+    // const proofAsFields = (await this.api.acirProofAsFieldsUltraHonk(proof)).slice(numOfPublicInputs);
+
+    // TODO: perhaps we should put this in the init function. Need to benchmark
+    // TODO how long it takes.
+    const vkResult = await this.api.circuitComputeVk({
+      circuit: {
+        name: 'circuit',
+        bytecode: Buffer.from(this.acirUncompressedBytecode),
+      },
+      settings: getProofSettingsFromOptions({}),
+    });
+
+    // Convert VK bytes to field elements (32-byte chunks)
+    const vkAsFields: string[] = [];
+    for (let i = 0; i < vkResult.bytes.length; i += 32) {
+      const chunk = vkResult.bytes.slice(i, i + 32);
+      vkAsFields.push(uint8ArrayToHex(chunk));
+    }
+
+    return {
+      // TODO(https://github.com/noir-lang/noir/issues/5661)
+      proofAsFields: [],
+      vkAsFields,
+      // We use an empty string for the vk hash here as it is unneeded as part of the recursive artifacts
+      // The user can be expected to hash the vk inside their circuit to check whether the vk is the circuit
+      // they expect
+      vkHash: uint8ArrayToHex(vkResult.hash),
+    };
+  }
+
+  async destroy(): Promise<void> {
+    if (!this.api) {
+      return;
+    }
+    await this.api.destroy();
+  }
+}
+
+export class AztecClientBackend {
+  // These type assertions are used so that we don't
+  // have to initialize `api` in the constructor.
+  // These are initialized asynchronously in the `init` function,
+  // constructors cannot be asynchronous which is why we do this.
+
+  protected api!: Barretenberg;
+
+  constructor(
+    protected acirBuf: Uint8Array[],
+    protected options: BackendOptions = { threads: 1 },
+  ) {}
+
+  /** @ignore */
+  private async instantiate(): Promise<void> {
+    if (!this.api) {
+      const api = await Barretenberg.new(this.options);
+      await api.initSRSChonk();
+      this.api = api;
+    }
+  }
+
+  async prove(witnessBuf: Uint8Array[], vksBuf: Uint8Array[] = []): Promise<[Uint8Array[], Uint8Array, Uint8Array]> {
+    if (vksBuf.length !== 0 && this.acirBuf.length !== witnessBuf.length) {
+      throw new AztecClientBackendError('Witness and bytecodes must have the same stack depth!');
+    }
+    if (vksBuf.length !== 0 && vksBuf.length !== witnessBuf.length) {
+      // NOTE: we allow 0 as an explicit 'I have no VKs'. This is a deprecated feature.
+      throw new AztecClientBackendError('Witness and VKs must have the same stack depth!');
+    }
+    await this.instantiate();
+
+    // Queue IVC start with the number of circuits
+    this.api.chonkStart({ numCircuits: this.acirBuf.length });
+
+    // Queue load and accumulate for each circuit
+    for (let i = 0; i < this.acirBuf.length; i++) {
+      const bytecode = this.acirBuf[i];
+      const witness = witnessBuf[i] || Buffer.from([]);
+      const vk = vksBuf[i] || Buffer.from([]);
+      const functionName = `unknown_wasm_${i}`;
+
+      // Load the circuit
+      this.api.chonkLoad({
+        circuit: {
+          name: functionName,
+          bytecode: Buffer.from(bytecode),
+          verificationKey: Buffer.from(vk),
+        },
+      });
+
+      // Accumulate with witness
+      this.api.chonkAccumulate({
+        witness: Buffer.from(witness),
+      });
+    }
+
+    // Generate the proof (and wait for all previous steps to finish)
+    const proveResult = await this.api.chonkProve({});
+    // The API currently expects a msgpack-encoded API.
+    const proof = new Encoder({ useRecords: false }).encode(fromChonkProof(proveResult.proof));
+    // Generate the VK
+    const vkResult = await this.api.chonkComputeIvcVk({
+      circuit: {
+        name: 'hiding',
+        bytecode: this.acirBuf[this.acirBuf.length - 1],
+      },
+    });
+
+    const proofFields = [
+      proveResult.proof.megaProof,
+      proveResult.proof.goblinProof.mergeProof,
+      proveResult.proof.goblinProof.eccvmProof.preIpaProof,
+      proveResult.proof.goblinProof.eccvmProof.ipaProof,
+      proveResult.proof.goblinProof.translatorProof,
+    ].flat();
+
+    // Note: Verification may not work correctly until we properly serialize the proof
+    if (!(await this.verify(proof, vkResult.bytes))) {
+      throw new AztecClientBackendError('Failed to verify the private (Chonk) transaction proof!');
+    }
+    return [proofFields, proof, vkResult.bytes];
+  }
+
+  async verify(proof: Uint8Array, vk: Uint8Array): Promise<boolean> {
+    await this.instantiate();
+    const result = await this.api.chonkVerify({
+      proof: toChonkProof(new Decoder({ useRecords: false }).decode(proof)),
+      vk: Buffer.from(vk),
+    });
+    return result.valid;
+  }
+
+  async gates(): Promise<number[]> {
+    await this.instantiate();
+    const circuitSizes: number[] = [];
+    for (const buf of this.acirBuf) {
+      const gates = await this.api.chonkStats({
+        circuit: {
+          name: 'circuit',
+          bytecode: buf,
+        },
+        includeGatesPerOpcode: false,
+      });
+      circuitSizes.push(gates.circuitSize);
+    }
+    return circuitSizes;
+  }
+
+  async destroy(): Promise<void> {
+    if (!this.api) {
+      return;
+    }
+    await this.api.destroy();
+  }
+}
+
+// Converts bytecode from a base64 string to a Uint8Array
+function acirToUint8Array(base64EncodedBytecode: string): Uint8Array {
+  const compressedByteCode = base64Decode(base64EncodedBytecode);
+  return ungzip(compressedByteCode);
+}
+
+// Since this is a simple function, we can use feature detection to
+// see if we are in the nodeJs environment or the browser environment.
+function base64Decode(input: string): Uint8Array {
+  if (typeof Buffer !== 'undefined') {
+    // Node.js environment
+    const b = Buffer.from(input, 'base64');
+    return new Uint8Array(b.buffer, b.byteOffset, b.byteLength);
+  } else if (typeof atob === 'function') {
+    // Browser environment
+    return Uint8Array.from(atob(input), c => c.charCodeAt(0));
+  } else {
+    throw new Error('No implementation found for base64 decoding.');
+  }
+}

package/src/barretenberg/blake2s.test.ts

@@ -0,0 +1,69 @@
+import { BackendType, Barretenberg, BarretenbergSync } from './index.js';
+import { Fr } from '../types/index.js';
+
+describe('blake2s async', () => {
+  let api: Barretenberg;
+
+  beforeAll(async () => {
+    // We're going to test over a worker backend to cover more code paths.
+    api = await Barretenberg.new({ threads: 1, backend: BackendType.WasmWorker });
+  });
+
+  afterAll(async () => {
+    await api.destroy();
+  });
+
+  it('blake2s', async () => {
+    const input = Buffer.from('abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789');
+    const expected = new Uint8Array([
+      0x44, 0xdd, 0xdb, 0x39, 0xbd, 0xb2, 0xaf, 0x80, 0xc1, 0x47, 0x89, 0x4c, 0x1d, 0x75, 0x6a, 0xda, 0x3d, 0x1c, 0x2a,
+      0xc2, 0xb1, 0x00, 0x54, 0x1e, 0x04, 0xfe, 0x87, 0xb4, 0xa5, 0x9e, 0x12, 0x43,
+    ]);
+    const response = await api.blake2s({ data: input });
+    expect(response.hash).toEqual(expected);
+  });
+
+  it('blake2sToField', async () => {
+    const input = Buffer.from('abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789');
+    const expected = Fr.fromBufferReduce(
+      new Uint8Array([
+        0x44, 0xdd, 0xdb, 0x39, 0xbd, 0xb2, 0xaf, 0x80, 0xc1, 0x47, 0x89, 0x4c, 0x1d, 0x75, 0x6a, 0xda, 0x3d, 0x1c,
+        0x2a, 0xc2, 0xb1, 0x00, 0x54, 0x1e, 0x04, 0xfe, 0x87, 0xb4, 0xa5, 0x9e, 0x12, 0x43,
+      ]),
+    );
+    const response = await api.blake2sToField({ data: input });
+    const result = Fr.fromBuffer(response.field);
+    expect(result).toEqual(expected);
+  });
+});
+
+describe('blake2s sync', () => {
+  let api: BarretenbergSync;
+
+  beforeAll(async () => {
+    api = await BarretenbergSync.initSingleton();
+  });
+
+  it('blake2s', () => {
+    const input = Buffer.from('abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789');
+    const expected = new Uint8Array([
+      0x44, 0xdd, 0xdb, 0x39, 0xbd, 0xb2, 0xaf, 0x80, 0xc1, 0x47, 0x89, 0x4c, 0x1d, 0x75, 0x6a, 0xda, 0x3d, 0x1c, 0x2a,
+      0xc2, 0xb1, 0x00, 0x54, 0x1e, 0x04, 0xfe, 0x87, 0xb4, 0xa5, 0x9e, 0x12, 0x43,
+    ]);
+    const response = api.blake2s({ data: input });
+    expect(response.hash).toEqual(expected);
+  });
+
+  it('blake2sToField', () => {
+    const input = Buffer.from('abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789');
+    const expected = Fr.fromBufferReduce(
+      new Uint8Array([
+        0x44, 0xdd, 0xdb, 0x39, 0xbd, 0xb2, 0xaf, 0x80, 0xc1, 0x47, 0x89, 0x4c, 0x1d, 0x75, 0x6a, 0xda, 0x3d, 0x1c,
+        0x2a, 0xc2, 0xb1, 0x00, 0x54, 0x1e, 0x04, 0xfe, 0x87, 0xb4, 0xa5, 0x9e, 0x12, 0x43,
+      ]),
+    );
+    const response = api.blake2sToField({ data: input });
+    const result = Fr.fromBuffer(response.field);
+    expect(result).toEqual(expected);
+  });
+});

package/src/barretenberg/index.ts

@@ -0,0 +1,223 @@
+import { Crs, GrumpkinCrs } from '../crs/index.js';
+import { createDebugLogger } from '../log/index.js';
+import { AsyncApi } from '../cbind/generated/async.js';
+import { SyncApi } from '../cbind/generated/sync.js';
+import { IMsgpackBackendSync, IMsgpackBackendAsync } from '../bb_backends/interface.js';
+import { BackendOptions, BackendType } from '../bb_backends/index.js';
+import { createAsyncBackend, createSyncBackend } from '../bb_backends/node/index.js';
+
+export { UltraHonkBackend, UltraHonkVerifierBackend, AztecClientBackend } from './backend.js';
+export * from '../bb_backends/index.js';
+
+export type CircuitOptions = {
+  /** @description Whether to produce SNARK friendly proofs */
+  recursive: boolean;
+};
+
+/**
+ * The main class library consumers interact with.
+ * It extends the generated api, and provides a static constructor "new" to compose components.
+ */
+export class Barretenberg extends AsyncApi {
+  private options: BackendOptions;
+
+  constructor(backend: IMsgpackBackendAsync, options: BackendOptions) {
+    super(backend);
+    this.options = options;
+  }
+
+  /**
+   * Constructs an instance of Barretenberg.
+   *
+   * If options.backend is set: uses that specific backend (throws if unavailable)
+   * If options.backend is unset: tries backends in order with fallback:
+   *   1. NativeSharedMemory (if bb binary available)
+   *   2. WasmWorker (in browser) or Wasm (in Node.js)
+   */
+  static async new(options: BackendOptions = {}) {
+    const logger = options.logger ?? createDebugLogger('bb_async');
+
+    if (options.backend) {
+      // Explicit backend required - no fallback
+      return await createAsyncBackend(options.backend, options, logger);
+    }
+
+    if (typeof window === 'undefined') {
+      try {
+        return await createAsyncBackend(BackendType.NativeSharedMemory, options, logger);
+      } catch (err: any) {
+        logger(`Shared memory unavailable (${err.message}), falling back to other backends`);
+        try {
+          return await createAsyncBackend(BackendType.NativeUnixSocket, options, logger);
+        } catch (err: any) {
+          logger(`Unix socket unavailable (${err.message}), falling back to WASM`);
+          return await createAsyncBackend(BackendType.Wasm, options, logger);
+        }
+      }
+    } else {
+      logger(`In browser, using WASM over worker backend.`);
+      return await createAsyncBackend(BackendType.WasmWorker, options, logger);
+    }
+  }
+
+  async initSRSForCircuitSize(circuitSize: number): Promise<void> {
+    const minSRSSize = 2 ** 9; // 2**9 is the dyadic size for the SmallSubgroupIPA MSM.
+    const crs = await Crs.new(Math.max(circuitSize, minSRSSize) + 1, this.options.crsPath, this.options.logger);
+    // TODO(https://github.com/AztecProtocol/barretenberg/issues/1129): Do slab allocator initialization?
+    // await this.commonInitSlabAllocator(circuitSize);
+    await this.srsInitSrs({ pointsBuf: crs.getG1Data(), numPoints: crs.numPoints, g2Point: crs.getG2Data() });
+  }
+
+  async initSRSChonk(srsSize = this.getDefaultSrsSize()): Promise<void> {
+    // crsPath can be undefined
+    const crs = await Crs.new(srsSize + 1, this.options.crsPath, this.options.logger);
+    const grumpkinCrs = await GrumpkinCrs.new(2 ** 16 + 1, this.options.crsPath, this.options.logger);
+
+    // Load CRS into wasm global CRS state.
+    // TODO: Make RawBuffer be default behavior, and have a specific Vector type for when wanting length prefixed.
+    await this.srsInitSrs({ pointsBuf: crs.getG1Data(), numPoints: crs.numPoints, g2Point: crs.getG2Data() });
+    await this.srsInitGrumpkinSrs({ pointsBuf: grumpkinCrs.getG1Data(), numPoints: grumpkinCrs.numPoints });
+  }
+
+  getDefaultSrsSize(): number {
+    // iOS browser is very aggressive with memory. Check if running in browser and on iOS
+    // We expect the mobile iOS browser to kill us >=1GB, so no real use in using a larger SRS.
+    if (typeof window !== 'undefined' && /iPad|iPhone/.test(navigator.userAgent)) {
+      return 2 ** 18;
+    }
+    return 2 ** 20;
+  }
+
+  async acirGetCircuitSizes(
+    bytecode: Uint8Array,
+    recursive: boolean,
+    honkRecursion: boolean,
+  ): Promise<[number, number]> {
+    const response = await this.circuitStats({
+      circuit: { name: '', bytecode, verificationKey: new Uint8Array() },
+      includeGatesPerOpcode: false,
+      settings: {
+        ipaAccumulation: false,
+        oracleHashType: honkRecursion ? 'poseidon2' : 'keccak',
+        disableZk: !recursive,
+        optimizedSolidityVerifier: false,
+      },
+    });
+    return [response.numGates, response.numGatesDyadic];
+  }
+
+  async acirInitSRS(bytecode: Uint8Array, recursive: boolean, honkRecursion: boolean): Promise<void> {
+    const [_, subgroupSize] = await this.acirGetCircuitSizes(bytecode, recursive, honkRecursion);
+    return this.initSRSForCircuitSize(subgroupSize);
+  }
+
+  async destroy() {
+    return super.destroy();
+  }
+
+  /**
+   * Initialize the singleton instance of Barretenberg.
+   * @param options Backend configuration options
+   */
+  static async initSingleton(options: BackendOptions = {}) {
+    if (!barretenbergSingletonPromise) {
+      barretenbergSingletonPromise = Barretenberg.new(options);
+    }
+    try {
+      barretenbergSingleton = await barretenbergSingletonPromise;
+      return barretenbergSingleton;
+    } catch (error) {
+      // If initialization fails, clear the singleton so next call can retry
+      barretenbergSingleton = undefined!;
+      barretenbergSingletonPromise = undefined!;
+      throw error;
+    }
+  }
+
+  static async destroySingleton() {
+    if (barretenbergSingleton) {
+      await barretenbergSingleton.destroy();
+      barretenbergSingleton = undefined!;
+      barretenbergSingletonPromise = undefined!;
+    }
+  }
+
+  /**
+   * Get the singleton instance of Barretenberg.
+   * Must call initSingleton() first.
+   */
+  static getSingleton() {
+    if (!barretenbergSingleton) {
+      throw new Error('First call Barretenberg.initSingleton() on @aztec/bb.js module.');
+    }
+    return barretenbergSingleton;
+  }
+}
+
+let barretenbergSingletonPromise: Promise<Barretenberg>;
+let barretenbergSingleton: Barretenberg;
+
+let barretenbergSyncSingletonPromise: Promise<BarretenbergSync>;
+let barretenbergSyncSingleton: BarretenbergSync;
+
+export class BarretenbergSync extends SyncApi {
+  constructor(backend: IMsgpackBackendSync) {
+    super(backend);
+  }
+
+  /**
+   * Create a new BarretenbergSync instance.
+   *
+   * If options.backend is set: uses that specific backend (throws if unavailable)
+   * If options.backend is unset: tries backends in order with fallback:
+   *   1. NativeSharedMem (if bb binary + NAPI module available)
+   *   2. Wasm
+   *
+   * Supported backends: Wasm, NativeSharedMem
+   * Not supported: WasmWorker (no workers in sync), NativeUnixSocket (async only)
+   */
+  static async new(options: BackendOptions = {}) {
+    const logger = options.logger ?? createDebugLogger('bb_sync');
+
+    if (options.backend) {
+      return await createSyncBackend(options.backend, options, logger);
+    }
+
+    // Try native, fallback to WASM.
+    try {
+      return await createSyncBackend(BackendType.NativeSharedMemory, options, logger);
+    } catch (err: any) {
+      logger(`Shared memory unavailable (${err.message}), falling back to WASM`);
+    }
+
+    return await createSyncBackend(BackendType.Wasm, options, logger);
+  }
+
+  /**
+   * Initialize the singleton instance.
+   * @param options Backend configuration options
+   */
+  static async initSingleton(options: BackendOptions = {}) {
+    if (!barretenbergSyncSingletonPromise) {
+      barretenbergSyncSingletonPromise = BarretenbergSync.new(options);
+    }
+
+    barretenbergSyncSingleton = await barretenbergSyncSingletonPromise;
+    return barretenbergSyncSingleton;
+  }
+
+  static destroySingleton() {
+    if (barretenbergSyncSingleton) {
+      barretenbergSyncSingleton.destroy();
+      barretenbergSyncSingleton = undefined!;
+      barretenbergSyncSingletonPromise = undefined!;
+    }
+  }
+
+  static getSingleton() {
+    if (!barretenbergSyncSingleton) {
+      throw new Error('First call BarretenbergSync.initSingleton() on @aztec/bb.js module.');
+    }
+    return barretenbergSyncSingleton;
+  }
+}