@aztec/end-to-end 5.0.0-nightly.20260708 → 5.0.0-nightly.20260709

package/dest/automine/delivery/interactive_handshake_responder.d.ts

@@ -0,0 +1,48 @@
+import { AztecAddress, type CompleteAddress } from '@aztec/aztec.js/addresses';
+import { type SchnorrSignature } from '@aztec/foundation/crypto/schnorr';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import type { CustomRequest } from '@aztec/pxe/config';
+import { type PublicKeys } from '@aztec/stdlib/keys';
+/**
+ * The decoded payload of the registry's interactive-handshake signature request. Note it never carries the sender,
+ * so the recipient authorizes the handshake without learning who initiated it.
+ */
+export type InteractiveHandshakeRequest = {
+    /** The account whose authorization is being requested. */
+    recipient: AztecAddress;
+    chainId: Fr;
+    version: Fr;
+    /** The x-coordinate of the handshake's ephemeral public key (its y-coordinate is positive by construction). */
+    ephPkX: Fr;
+};
+/**
+ * The recipient's signed authorization for an interactive handshake. Mirrors the registry contract's
+ * `RecipientSignature` struct field for field.
+ */
+export type RecipientSignature = {
+    /** The recipient's master public keys, bound in-circuit to the recipient's address via `partialAddress`. */
+    publicKeys: PublicKeys;
+    partialAddress: Fr;
+    /** The x-coordinate of the recipient's master message-signing public key. */
+    mspkX: Fr;
+    /** Whether that key's y-coordinate is positive, so the circuit can reconstruct the point from `mspkX`. */
+    mspkYIsPositive: boolean;
+    /** The schnorr signature over the handshake message. */
+    signature: SchnorrSignature;
+};
+/**
+ * Parses and validates the registry's interactive-handshake signature request.
+ *
+ * @throws If the request kind is not {@link INTERACTIVE_HANDSHAKE_REQUEST_KIND}, the issuing contract is not the
+ * standard HandshakeRegistry, or the payload does not have the expected shape.
+ */
+export declare function parseInteractiveHandshakeRequest(request: CustomRequest): InteractiveHandshakeRequest;
+/**
+ * Produces the recipient's signed authorization for an interactive handshake, signing with the master
+ * message-signing secret key.
+ */
+export declare function signInteractiveHandshake(request: InteractiveHandshakeRequest, completeAddress: CompleteAddress, masterMessageSigningSecretKey: GrumpkinScalar): Promise<RecipientSignature>;
+/** Serializes a {@link RecipientSignature} to the field layout the registry's in-circuit deserialization expects. */
+export declare function recipientSignatureToFields(recipientSignature: RecipientSignature): Fr[];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJhY3RpdmVfaGFuZHNoYWtlX3Jlc3BvbmRlci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2F1dG9taW5lL2RlbGl2ZXJ5L2ludGVyYWN0aXZlX2hhbmRzaGFrZV9yZXNwb25kZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFlBQVksRUFBRSxLQUFLLGVBQWUsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBRy9FLE9BQU8sRUFBVyxLQUFLLGdCQUFnQixFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDbEYsT0FBTyxFQUFNLEVBQUUsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQ3hELE9BQU8sS0FBSyxFQUFFLGNBQWMsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBQ3hFLE9BQU8sS0FBSyxFQUFFLGFBQWEsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBS3ZELE9BQU8sRUFBRSxLQUFLLFVBQVUsRUFBZ0MsTUFBTSxvQkFBb0IsQ0FBQztBQUVuRjs7O0dBR0c7QUFDSCxNQUFNLE1BQU0sMkJBQTJCLEdBQUc7SUFDeEMsMERBQTBEO0lBQzFELFNBQVMsRUFBRSxZQUFZLENBQUM7SUFDeEIsT0FBTyxFQUFFLEVBQUUsQ0FBQztJQUNaLE9BQU8sRUFBRSxFQUFFLENBQUM7SUFDWiwrR0FBK0c7SUFDL0csTUFBTSxFQUFFLEVBQUUsQ0FBQztDQUNaLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLE1BQU0sa0JBQWtCLEdBQUc7SUFDL0IsNEdBQTRHO0lBQzVHLFVBQVUsRUFBRSxVQUFVLENBQUM7SUFDdkIsY0FBYyxFQUFFLEVBQUUsQ0FBQztJQUNuQiw2RUFBNkU7SUFDN0UsS0FBSyxFQUFFLEVBQUUsQ0FBQztJQUNWLDBHQUEwRztJQUMxRyxlQUFlLEVBQUUsT0FBTyxDQUFDO0lBQ3pCLHdEQUF3RDtJQUN4RCxTQUFTLEVBQUUsZ0JBQWdCLENBQUM7Q0FDN0IsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsd0JBQWdCLGdDQUFnQyxDQUFDLE9BQU8sRUFBRSxhQUFhLEdBQUcsMkJBQTJCLENBZXBHO0FBRUQ7OztHQUdHO0FBQ0gsd0JBQXNCLHdCQUF3QixDQUM1QyxPQUFPLEVBQUUsMkJBQTJCLEVBQ3BDLGVBQWUsRUFBRSxlQUFlLEVBQ2hDLDZCQUE2QixFQUFFLGNBQWMsR0FDNUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDLENBbUI3QjtBQUVELHFIQUFxSDtBQUNySCx3QkFBZ0IsMEJBQTBCLENBQUMsa0JBQWtCLEVBQUUsa0JBQWtCLEdBQUcsRUFBRSxFQUFFLENBYXZGIn0=

package/dest/automine/delivery/interactive_handshake_responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive_handshake_responder.d.ts","sourceRoot":"","sources":["../../../src/automine/delivery/interactive_handshake_responder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG/E,OAAO,EAAW,KAAK,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAM,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvD,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,oBAAoB,CAAC;AAEnF;;;GAGG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,0DAA0D;IAC1D,SAAS,EAAE,YAAY,CAAC;IACxB,OAAO,EAAE,EAAE,CAAC;IACZ,OAAO,EAAE,EAAE,CAAC;IACZ,+GAA+G;IAC/G,MAAM,EAAE,EAAE,CAAC;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,4GAA4G;IAC5G,UAAU,EAAE,UAAU,CAAC;IACvB,cAAc,EAAE,EAAE,CAAC;IACnB,6EAA6E;IAC7E,KAAK,EAAE,EAAE,CAAC;IACV,0GAA0G;IAC1G,eAAe,EAAE,OAAO,CAAC;IACzB,wDAAwD;IACxD,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,aAAa,GAAG,2BAA2B,CAepG;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,2BAA2B,EACpC,eAAe,EAAE,eAAe,EAChC,6BAA6B,EAAE,cAAc,GAC5C,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AAED,qHAAqH;AACrH,wBAAgB,0BAA0B,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,EAAE,EAAE,CAavF"}

package/dest/automine/delivery/interactive_handshake_responder.js

@@ -0,0 +1,76 @@
+import { AztecAddress } from '@aztec/aztec.js/addresses';
+import { DomainSeparator } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { Schnorr } from '@aztec/foundation/crypto/schnorr';
+import { Fq, Fr } from '@aztec/foundation/curves/bn254';
+import { INTERACTIVE_HANDSHAKE_REQUEST_KIND, STANDARD_HANDSHAKE_REGISTRY_ADDRESS } from '@aztec/standard-contracts/handshake-registry/constants';
+import { derivePublicKeyFromSecretKey } from '@aztec/stdlib/keys';
+/**
+ * Parses and validates the registry's interactive-handshake signature request.
+ *
+ * @throws If the request kind is not {@link INTERACTIVE_HANDSHAKE_REQUEST_KIND}, the issuing contract is not the
+ * standard HandshakeRegistry, or the payload does not have the expected shape.
+ */ export function parseInteractiveHandshakeRequest(request) {
+    if (!request.kind.equals(INTERACTIVE_HANDSHAKE_REQUEST_KIND)) {
+        throw new Error(`Not an interactive-handshake signature request: unexpected kind ${request.kind}`);
+    }
+    if (!request.contractAddress.equals(STANDARD_HANDSHAKE_REGISTRY_ADDRESS)) {
+        throw new Error(`Interactive-handshake signature request issued by ${request.contractAddress}, expected the standard HandshakeRegistry at ${STANDARD_HANDSHAKE_REGISTRY_ADDRESS}`);
+    }
+    if (request.payload.length !== 4) {
+        throw new Error(`Interactive-handshake signature request payload has ${request.payload.length} fields, expected 4`);
+    }
+    const [recipient, chainId, version, ephPkX] = request.payload;
+    return {
+        recipient: new AztecAddress(recipient),
+        chainId,
+        version,
+        ephPkX
+    };
+}
+/**
+ * Produces the recipient's signed authorization for an interactive handshake, signing with the master
+ * message-signing secret key.
+ */ export async function signInteractiveHandshake(request, completeAddress, masterMessageSigningSecretKey) {
+    const mspk = await derivePublicKeyFromSecretKey(masterMessageSigningSecretKey);
+    const [mspkX, mspkYIsPositive] = mspk.toXAndSign();
+    const message = await computeInteractiveHandshakeSignatureMessage({
+        chainId: request.chainId,
+        version: request.version,
+        registry: STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+        ephPkX: request.ephPkX
+    });
+    const signature = await new Schnorr().constructSignature(message, masterMessageSigningSecretKey);
+    return {
+        publicKeys: completeAddress.publicKeys,
+        partialAddress: completeAddress.partialAddress,
+        mspkX,
+        mspkYIsPositive,
+        signature
+    };
+}
+/** Serializes a {@link RecipientSignature} to the field layout the registry's in-circuit deserialization expects. */ export function recipientSignatureToFields(recipientSignature) {
+    const s = Fq.fromBuffer(recipientSignature.signature.s);
+    const e = Fq.fromBuffer(recipientSignature.signature.e);
+    return [
+        ...recipientSignature.publicKeys.toFields(),
+        recipientSignature.partialAddress,
+        recipientSignature.mspkX,
+        new Fr(recipientSignature.mspkYIsPositive),
+        s.lo,
+        s.hi,
+        e.lo,
+        e.hi
+    ];
+}
+/**
+ * The message an interactive-handshake authorization signs: the handshake's ephemeral key and chain context under
+ * `DomainSeparator.INTERACTIVE_HANDSHAKE_SIGNATURE`, exactly as the registry recomputes it in-circuit.
+ */ function computeInteractiveHandshakeSignatureMessage(args) {
+    return poseidon2HashWithSeparator([
+        args.chainId,
+        args.version,
+        args.registry,
+        args.ephPkX
+    ], DomainSeparator.INTERACTIVE_HANDSHAKE_SIGNATURE);
+}

package/dest/automine/delivery/onchain_delivery_harness.d.ts

@@ -1,7 +1,8 @@
-import type { AztecAddress } from '@aztec/aztec.js/addresses';
-import type { PXECreationOptions } from '@aztec/pxe/server';
+import { type InitialAccountData } from '@aztec/accounts/testing';
+import type { AztecAddress, CompleteAddress } from '@aztec/aztec.js/addresses';
+import type { ResolveCustomRequest, ResolveTaggingSecretStrategy } from '@aztec/pxe/config';
 import { TestWallet } from '../../test-wallet/test_wallet.js';
-export type SenderHook = NonNullable<NonNullable<PXECreationOptions['hooks']>['resolveTaggingSecretStrategy']>;
+export type CustomRequestResponder = (recipient: TestWallet, recipientAccount: InitialAccountData, recipientCompleteAddress: CompleteAddress) => ResolveCustomRequest;
 export type Mode = 'constrained' | 'unconstrained';
 export type DeliveryMode = Mode | {
     events: Mode;
@@ -10,8 +11,9 @@ export type DeliveryMode = Mode | {
 export declare function buildMessageDeliveryTest(opts: {
     strategy: string;
     mode: DeliveryMode;
-    senderHook: SenderHook;
+    senderHook: ResolveTaggingSecretStrategy;
     recipientRegistration?: (recipient: TestWallet, recipientAddress: AztecAddress, sender: AztecAddress) => Promise<void>;
+    customRequestResponder?: CustomRequestResponder;
     additionalTests?: () => void;
 }): void;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib25jaGFpbl9kZWxpdmVyeV9oYXJuZXNzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXV0b21pbmUvZGVsaXZlcnkvb25jaGFpbl9kZWxpdmVyeV9oYXJuZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUdBLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBSTlELE9BQU8sS0FBSyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFPNUQsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBSTlELE1BQU0sTUFBTSxVQUFVLEdBQUcsV0FBVyxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLDhCQUE4QixDQUFDLENBQUMsQ0FBQztBQUUvRyxNQUFNLE1BQU0sSUFBSSxHQUFHLGFBQWEsR0FBRyxlQUFlLENBQUM7QUFJbkQsTUFBTSxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUc7SUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDO0lBQUMsS0FBSyxFQUFFLElBQUksQ0FBQTtDQUFFLENBQUM7QUFZaEUsd0JBQWdCLHdCQUF3QixDQUFDLElBQUksRUFBRTtJQUc3QyxRQUFRLEVBQUUsTUFBTSxDQUFDO0lBQ2pCLElBQUksRUFBRSxZQUFZLENBQUM7SUFFbkIsVUFBVSxFQUFFLFVBQVUsQ0FBQztJQUV2QixxQkFBcUIsQ0FBQyxFQUFFLENBQ3RCLFNBQVMsRUFBRSxVQUFVLEVBQ3JCLGdCQUFnQixFQUFFLFlBQVksRUFDOUIsTUFBTSxFQUFFLFlBQVksS0FDakIsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBSW5CLGVBQWUsQ0FBQyxFQUFFLE1BQU0sSUFBSSxDQUFDO0NBQzlCLFFBMkhBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib25jaGFpbl9kZWxpdmVyeV9oYXJuZXNzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXV0b21pbmUvZGVsaXZlcnkvb25jaGFpbl9kZWxpdmVyeV9oYXJuZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxLQUFLLGtCQUFrQixFQUEyQixNQUFNLHlCQUF5QixDQUFDO0FBRzNGLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxlQUFlLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUsvRSxPQUFPLEtBQUssRUFBaUIsb0JBQW9CLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQU8zRyxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFJOUQsTUFBTSxNQUFNLHNCQUFzQixHQUFHLENBQ25DLFNBQVMsRUFBRSxVQUFVLEVBQ3JCLGdCQUFnQixFQUFFLGtCQUFrQixFQUNwQyx3QkFBd0IsRUFBRSxlQUFlLEtBQ3RDLG9CQUFvQixDQUFDO0FBRTFCLE1BQU0sTUFBTSxJQUFJLEdBQUcsYUFBYSxHQUFHLGVBQWUsQ0FBQztBQUluRCxNQUFNLE1BQU0sWUFBWSxHQUFHLElBQUksR0FBRztJQUFFLE1BQU0sRUFBRSxJQUFJLENBQUM7SUFBQyxLQUFLLEVBQUUsSUFBSSxDQUFBO0NBQUUsQ0FBQztBQVloRSx3QkFBZ0Isd0JBQXdCLENBQUMsSUFBSSxFQUFFO0lBRzdDLFFBQVEsRUFBRSxNQUFNLENBQUM7SUFDakIsSUFBSSxFQUFFLFlBQVksQ0FBQztJQUVuQixVQUFVLEVBQUUsNEJBQTRCLENBQUM7SUFFekMscUJBQXFCLENBQUMsRUFBRSxDQUN0QixTQUFTLEVBQUUsVUFBVSxFQUNyQixnQkFBZ0IsRUFBRSxZQUFZLEVBQzlCLE1BQU0sRUFBRSxZQUFZLEtBQ2pCLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUduQixzQkFBc0IsQ0FBQyxFQUFFLHNCQUFzQixDQUFDO0lBSWhELGVBQWUsQ0FBQyxFQUFFLE1BQU0sSUFBSSxDQUFDO0NBQzlCLFFBdUpBIn0=

package/dest/automine/delivery/onchain_delivery_harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onchain_delivery_harness.d.ts","sourceRoot":"","sources":["../../../src/automine/delivery/onchain_delivery_harness.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAI9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAO5D,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAI9D,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;AAE/G,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,eAAe,CAAC;AAInD,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC;AAYhE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAG7C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IAEnB,UAAU,EAAE,UAAU,CAAC;IAEvB,qBAAqB,CAAC,EAAE,CACtB,SAAS,EAAE,UAAU,EACrB,gBAAgB,EAAE,YAAY,EAC9B,MAAM,EAAE,YAAY,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IAInB,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;CAC9B,QA2HA"}
+{"version":3,"file":"onchain_delivery_harness.d.ts","sourceRoot":"","sources":["../../../src/automine/delivery/onchain_delivery_harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAA2B,MAAM,yBAAyB,CAAC;AAG3F,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAK/E,OAAO,KAAK,EAAiB,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAO3G,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAI9D,MAAM,MAAM,sBAAsB,GAAG,CACnC,SAAS,EAAE,UAAU,EACrB,gBAAgB,EAAE,kBAAkB,EACpC,wBAAwB,EAAE,eAAe,KACtC,oBAAoB,CAAC;AAE1B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,eAAe,CAAC;AAInD,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC;AAYhE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAG7C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;IAEnB,UAAU,EAAE,4BAA4B,CAAC;IAEzC,qBAAqB,CAAC,EAAE,CACtB,SAAS,EAAE,UAAU,EACrB,gBAAgB,EAAE,YAAY,EAC9B,MAAM,EAAE,YAAY,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnB,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAIhD,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;CAC9B,QAuJA"}

package/dest/automine/delivery/onchain_delivery_harness.js

@@ -15,7 +15,7 @@ const formatMode = (mode)=>typeof mode === 'string' ? mode : `${mode.events}->${
 // Cross-PXE is the meaningful setup: the recipient PXE holds no sender state, so a cell only "discovers" a message if
 // the source truly reached it.
 export function buildMessageDeliveryTest(opts) {
-    const { strategy, mode, senderHook, recipientRegistration, additionalTests } = opts;
+    const { strategy, mode, senderHook, recipientRegistration, customRequestResponder, additionalTests } = opts;
     const description = `${strategy} x ${formatMode(mode)}`;
     describe(description, ()=>{
         jest.setTimeout(300_000);
@@ -47,22 +47,35 @@ export function buildMessageDeliveryTest(opts) {
         } : mode;
         const sendEvent = (value)=>eventMode === 'constrained' ? contractSender.methods.emit_event(recipient, value) : contractSender.methods.emit_event_unconstrained(recipient, value);
         const sendNote = (value)=>noteMode === 'constrained' ? contractSender.methods.emit_note(recipient, value) : contractSender.methods.emit_note_unconstrained(recipient, value);
+        let additionallyFundedAccounts;
+        let recipientAccount;
+        let customRequestCount = 0;
         beforeAll(async ()=>{
             // The sender PXE holds the sender and carries this cell's tagging-secret-strategy hook. The recipient is funded
             // at genesis here but created and deployed on the isolated recipient PXE below, so it carries no sender state
             // from other cells.
-            let additionallyFundedAccounts;
             ({ aztecNode, additionallyFundedAccounts, wallet: walletSender, accounts: [sender], teardown: teardownSender } = await setup(1, {
                 ...AUTOMINE_E2E_OPTS,
                 additionallyFundedAccounts: await generateSchnorrAccounts(1, 'schnorr'),
                 pxeCreationOptions: {
                     hooks: {
-                        resolveTaggingSecretStrategy: senderHook
+                        resolveTaggingSecretStrategy: senderHook,
+                        resolveCustomRequest: async (request)=>{
+                            if (!customRequestResponder) {
+                                throw new Error('A custom request arrived but this test cell has no customRequestResponder configured');
+                            }
+                            if (!recipientAccount) {
+                                throw new Error('A custom request arrived before the recipient wallet was created');
+                            }
+                            customRequestCount++;
+                            const respond = customRequestResponder(walletRecipient, additionallyFundedAccounts[0], await recipientAccount.getCompleteAddress());
+                            return respond(request);
+                        }
                     }
                 }
             }));
             ({ wallet: walletRecipient, teardown: teardownRecipient } = await setupPXEAndGetWallet(aztecNode, aztecNode, {}, undefined, 'pxe-recipient'));
-            const recipientAccount = await walletRecipient.createSchnorrAccount(additionallyFundedAccounts[0].secret, additionallyFundedAccounts[0].salt, additionallyFundedAccounts[0].signingKey);
+            recipientAccount = await walletRecipient.createSchnorrAccount(additionallyFundedAccounts[0].secret, additionallyFundedAccounts[0].salt, additionallyFundedAccounts[0].signingKey);
             await (await recipientAccount.getDeployMethod()).send({
                 from: NO_FROM
             });
@@ -118,6 +131,11 @@ export function buildMessageDeliveryTest(opts) {
         it('the recipient PXE reads back the notes delivered by the sender PXE', ()=>{
             expect(readNotes).toEqual(noteValues);
         });
+        if (customRequestResponder) {
+            it('the custom request hook fires exactly once, on the send that bootstraps the tagging secret', ()=>{
+                expect(customRequestCount).toBe(1);
+            });
+        }
         additionalTests?.();
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/end-to-end",
-  "version": "5.0.0-nightly.20260708",
+  "version": "5.0.0-nightly.20260709",
   "type": "module",
   "exports": {
     ".": "./dest/index.js",
@@ -29,45 +29,45 @@
     "formatting": "run -T prettier --check ./src && run -T eslint ./src"
   },
   "dependencies": {
-    "@aztec/accounts": "5.0.0-nightly.20260708",
-    "@aztec/archiver": "5.0.0-nightly.20260708",
-    "@aztec/aztec": "5.0.0-nightly.20260708",
-    "@aztec/aztec-node": "5.0.0-nightly.20260708",
-    "@aztec/aztec.js": "5.0.0-nightly.20260708",
-    "@aztec/bb-prover": "5.0.0-nightly.20260708",
-    "@aztec/bb.js": "5.0.0-nightly.20260708",
-    "@aztec/blob-client": "5.0.0-nightly.20260708",
-    "@aztec/blob-lib": "5.0.0-nightly.20260708",
-    "@aztec/bot": "5.0.0-nightly.20260708",
-    "@aztec/cli": "5.0.0-nightly.20260708",
-    "@aztec/constants": "5.0.0-nightly.20260708",
-    "@aztec/entrypoints": "5.0.0-nightly.20260708",
-    "@aztec/epoch-cache": "5.0.0-nightly.20260708",
-    "@aztec/ethereum": "5.0.0-nightly.20260708",
-    "@aztec/foundation": "5.0.0-nightly.20260708",
-    "@aztec/kv-store": "5.0.0-nightly.20260708",
-    "@aztec/l1-artifacts": "5.0.0-nightly.20260708",
-    "@aztec/node-keystore": "5.0.0-nightly.20260708",
-    "@aztec/noir-contracts.js": "5.0.0-nightly.20260708",
-    "@aztec/noir-noirc_abi": "5.0.0-nightly.20260708",
-    "@aztec/noir-protocol-circuits-types": "5.0.0-nightly.20260708",
-    "@aztec/noir-test-contracts.js": "5.0.0-nightly.20260708",
-    "@aztec/p2p": "5.0.0-nightly.20260708",
-    "@aztec/protocol-contracts": "5.0.0-nightly.20260708",
-    "@aztec/prover-client": "5.0.0-nightly.20260708",
-    "@aztec/prover-node": "5.0.0-nightly.20260708",
-    "@aztec/pxe": "5.0.0-nightly.20260708",
-    "@aztec/sequencer-client": "5.0.0-nightly.20260708",
-    "@aztec/simulator": "5.0.0-nightly.20260708",
-    "@aztec/slasher": "5.0.0-nightly.20260708",
-    "@aztec/standard-contracts": "5.0.0-nightly.20260708",
-    "@aztec/stdlib": "5.0.0-nightly.20260708",
-    "@aztec/telemetry-client": "5.0.0-nightly.20260708",
-    "@aztec/validator-client": "5.0.0-nightly.20260708",
-    "@aztec/validator-ha-signer": "5.0.0-nightly.20260708",
-    "@aztec/wallet-sdk": "5.0.0-nightly.20260708",
-    "@aztec/wallets": "5.0.0-nightly.20260708",
-    "@aztec/world-state": "5.0.0-nightly.20260708",
+    "@aztec/accounts": "5.0.0-nightly.20260709",
+    "@aztec/archiver": "5.0.0-nightly.20260709",
+    "@aztec/aztec": "5.0.0-nightly.20260709",
+    "@aztec/aztec-node": "5.0.0-nightly.20260709",
+    "@aztec/aztec.js": "5.0.0-nightly.20260709",
+    "@aztec/bb-prover": "5.0.0-nightly.20260709",
+    "@aztec/bb.js": "5.0.0-nightly.20260709",
+    "@aztec/blob-client": "5.0.0-nightly.20260709",
+    "@aztec/blob-lib": "5.0.0-nightly.20260709",
+    "@aztec/bot": "5.0.0-nightly.20260709",
+    "@aztec/cli": "5.0.0-nightly.20260709",
+    "@aztec/constants": "5.0.0-nightly.20260709",
+    "@aztec/entrypoints": "5.0.0-nightly.20260709",
+    "@aztec/epoch-cache": "5.0.0-nightly.20260709",
+    "@aztec/ethereum": "5.0.0-nightly.20260709",
+    "@aztec/foundation": "5.0.0-nightly.20260709",
+    "@aztec/kv-store": "5.0.0-nightly.20260709",
+    "@aztec/l1-artifacts": "5.0.0-nightly.20260709",
+    "@aztec/node-keystore": "5.0.0-nightly.20260709",
+    "@aztec/noir-contracts.js": "5.0.0-nightly.20260709",
+    "@aztec/noir-noirc_abi": "5.0.0-nightly.20260709",
+    "@aztec/noir-protocol-circuits-types": "5.0.0-nightly.20260709",
+    "@aztec/noir-test-contracts.js": "5.0.0-nightly.20260709",
+    "@aztec/p2p": "5.0.0-nightly.20260709",
+    "@aztec/protocol-contracts": "5.0.0-nightly.20260709",
+    "@aztec/prover-client": "5.0.0-nightly.20260709",
+    "@aztec/prover-node": "5.0.0-nightly.20260709",
+    "@aztec/pxe": "5.0.0-nightly.20260709",
+    "@aztec/sequencer-client": "5.0.0-nightly.20260709",
+    "@aztec/simulator": "5.0.0-nightly.20260709",
+    "@aztec/slasher": "5.0.0-nightly.20260709",
+    "@aztec/standard-contracts": "5.0.0-nightly.20260709",
+    "@aztec/stdlib": "5.0.0-nightly.20260709",
+    "@aztec/telemetry-client": "5.0.0-nightly.20260709",
+    "@aztec/validator-client": "5.0.0-nightly.20260709",
+    "@aztec/validator-ha-signer": "5.0.0-nightly.20260709",
+    "@aztec/wallet-sdk": "5.0.0-nightly.20260709",
+    "@aztec/wallets": "5.0.0-nightly.20260709",
+    "@aztec/world-state": "5.0.0-nightly.20260709",
     "@iarna/toml": "^2.2.5",
     "@jest/globals": "^30.0.0",
     "@noble/curves": "=1.0.0",

package/src/automine/delivery/interactive_handshake_responder.ts

@@ -0,0 +1,125 @@
+import { AztecAddress, type CompleteAddress } from '@aztec/aztec.js/addresses';
+import { DomainSeparator } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { Schnorr, type SchnorrSignature } from '@aztec/foundation/crypto/schnorr';
+import { Fq, Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import type { CustomRequest } from '@aztec/pxe/config';
+import {
+  INTERACTIVE_HANDSHAKE_REQUEST_KIND,
+  STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+} from '@aztec/standard-contracts/handshake-registry/constants';
+import { type PublicKeys, derivePublicKeyFromSecretKey } from '@aztec/stdlib/keys';
+
+/**
+ * The decoded payload of the registry's interactive-handshake signature request. Note it never carries the sender,
+ * so the recipient authorizes the handshake without learning who initiated it.
+ */
+export type InteractiveHandshakeRequest = {
+  /** The account whose authorization is being requested. */
+  recipient: AztecAddress;
+  chainId: Fr;
+  version: Fr;
+  /** The x-coordinate of the handshake's ephemeral public key (its y-coordinate is positive by construction). */
+  ephPkX: Fr;
+};
+
+/**
+ * The recipient's signed authorization for an interactive handshake. Mirrors the registry contract's
+ * `RecipientSignature` struct field for field.
+ */
+export type RecipientSignature = {
+  /** The recipient's master public keys, bound in-circuit to the recipient's address via `partialAddress`. */
+  publicKeys: PublicKeys;
+  partialAddress: Fr;
+  /** The x-coordinate of the recipient's master message-signing public key. */
+  mspkX: Fr;
+  /** Whether that key's y-coordinate is positive, so the circuit can reconstruct the point from `mspkX`. */
+  mspkYIsPositive: boolean;
+  /** The schnorr signature over the handshake message. */
+  signature: SchnorrSignature;
+};
+
+/**
+ * Parses and validates the registry's interactive-handshake signature request.
+ *
+ * @throws If the request kind is not {@link INTERACTIVE_HANDSHAKE_REQUEST_KIND}, the issuing contract is not the
+ * standard HandshakeRegistry, or the payload does not have the expected shape.
+ */
+export function parseInteractiveHandshakeRequest(request: CustomRequest): InteractiveHandshakeRequest {
+  if (!request.kind.equals(INTERACTIVE_HANDSHAKE_REQUEST_KIND)) {
+    throw new Error(`Not an interactive-handshake signature request: unexpected kind ${request.kind}`);
+  }
+  if (!request.contractAddress.equals(STANDARD_HANDSHAKE_REGISTRY_ADDRESS)) {
+    throw new Error(
+      `Interactive-handshake signature request issued by ${request.contractAddress}, expected the standard HandshakeRegistry at ${STANDARD_HANDSHAKE_REGISTRY_ADDRESS}`,
+    );
+  }
+  if (request.payload.length !== 4) {
+    throw new Error(`Interactive-handshake signature request payload has ${request.payload.length} fields, expected 4`);
+  }
+
+  const [recipient, chainId, version, ephPkX] = request.payload;
+  return { recipient: new AztecAddress(recipient), chainId, version, ephPkX };
+}
+
+/**
+ * Produces the recipient's signed authorization for an interactive handshake, signing with the master
+ * message-signing secret key.
+ */
+export async function signInteractiveHandshake(
+  request: InteractiveHandshakeRequest,
+  completeAddress: CompleteAddress,
+  masterMessageSigningSecretKey: GrumpkinScalar,
+): Promise<RecipientSignature> {
+  const mspk = await derivePublicKeyFromSecretKey(masterMessageSigningSecretKey);
+  const [mspkX, mspkYIsPositive] = mspk.toXAndSign();
+
+  const message = await computeInteractiveHandshakeSignatureMessage({
+    chainId: request.chainId,
+    version: request.version,
+    registry: STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+    ephPkX: request.ephPkX,
+  });
+  const signature = await new Schnorr().constructSignature(message, masterMessageSigningSecretKey);
+
+  return {
+    publicKeys: completeAddress.publicKeys,
+    partialAddress: completeAddress.partialAddress,
+    mspkX,
+    mspkYIsPositive,
+    signature,
+  };
+}
+
+/** Serializes a {@link RecipientSignature} to the field layout the registry's in-circuit deserialization expects. */
+export function recipientSignatureToFields(recipientSignature: RecipientSignature): Fr[] {
+  const s = Fq.fromBuffer(recipientSignature.signature.s);
+  const e = Fq.fromBuffer(recipientSignature.signature.e);
+  return [
+    ...recipientSignature.publicKeys.toFields(),
+    recipientSignature.partialAddress,
+    recipientSignature.mspkX,
+    new Fr(recipientSignature.mspkYIsPositive),
+    s.lo,
+    s.hi,
+    e.lo,
+    e.hi,
+  ];
+}
+
+/**
+ * The message an interactive-handshake authorization signs: the handshake's ephemeral key and chain context under
+ * `DomainSeparator.INTERACTIVE_HANDSHAKE_SIGNATURE`, exactly as the registry recomputes it in-circuit.
+ */
+function computeInteractiveHandshakeSignatureMessage(args: {
+  chainId: Fr;
+  version: Fr;
+  registry: AztecAddress;
+  ephPkX: Fr;
+}): Promise<Fr> {
+  return poseidon2HashWithSeparator(
+    [args.chainId, args.version, args.registry, args.ephPkX],
+    DomainSeparator.INTERACTIVE_HANDSHAKE_SIGNATURE,
+  );
+}

package/src/automine/delivery/onchain_delivery_harness.ts

@@ -1,11 +1,12 @@
 import { type InitialAccountData, generateSchnorrAccounts } from '@aztec/accounts/testing';
 import type { FieldLike } from '@aztec/aztec.js/abi';
 import { NO_FROM } from '@aztec/aztec.js/account';
-import type { AztecAddress } from '@aztec/aztec.js/addresses';
+import type { AztecAddress, CompleteAddress } from '@aztec/aztec.js/addresses';
 import type { AztecNode } from '@aztec/aztec.js/node';
+import type { AccountManager } from '@aztec/aztec.js/wallet';
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { type DeliveryEvent, OnchainDeliveryTestContract } from '@aztec/noir-test-contracts.js/OnchainDeliveryTest';
-import type { PXECreationOptions } from '@aztec/pxe/server';
+import type { CustomRequest, ResolveCustomRequest, ResolveTaggingSecretStrategy } from '@aztec/pxe/config';
 import type { AztecNodeDebug } from '@aztec/stdlib/interfaces/client';
 
 import { jest } from '@jest/globals';
@@ -14,9 +15,13 @@ import { AUTOMINE_E2E_OPTS } from '../../fixtures/fixtures.js';
 import { ensureHandshakeRegistryPublished, setup, setupPXEAndGetWallet } from '../../fixtures/setup.js';
 import { TestWallet } from '../../test-wallet/test_wallet.js';
 
-// The wallet hook that selects a message's tagging-secret source. Derived from the exported PXE options
-// rather than importing the hook type, which `@aztec/pxe/server` does not re-export.
-export type SenderHook = NonNullable<NonNullable<PXECreationOptions['hooks']>['resolveTaggingSecretStrategy']>;
+// Builds the hook serving custom requests issued during the sender's simulations. Installed on the sender PXE at
+// creation but built only once the recipient exists, since serving typically needs the recipient's wallet and keys.
+export type CustomRequestResponder = (
+  recipient: TestWallet,
+  recipientAccount: InitialAccountData,
+  recipientCompleteAddress: CompleteAddress,
+) => ResolveCustomRequest;
 
 export type Mode = 'constrained' | 'unconstrained';
 
@@ -40,19 +45,22 @@ export function buildMessageDeliveryTest(opts: {
   strategy: string;
   mode: DeliveryMode;
   // Required: every cell states its source explicitly rather than leaning on the PXE default (covered by unit tests).
-  senderHook: SenderHook;
+  senderHook: ResolveTaggingSecretStrategy;
   // Recipient-side setup the source requires (e.g. registering a raw arbitrary secret); runs once after deployment.
   recipientRegistration?: (
     recipient: TestWallet,
     recipientAddress: AztecAddress,
     sender: AztecAddress,
   ) => Promise<void>;
+  // Serves the custom requests issued during the sender's simulations (e.g. the registry's interactive-handshake
+  // signature request).
+  customRequestResponder?: CustomRequestResponder;
   // Extra `it()`s to register in this cell's suite, e.g. assertions against state a custom `senderHook` recorded.
   // Called inside the same `describe`, after the two baseline assertions below, so it shares their `beforeAll`
   // instead of depending on Jest's cross-`describe` execution order.
   additionalTests?: () => void;
 }) {
-  const { strategy, mode, senderHook, recipientRegistration, additionalTests } = opts;
+  const { strategy, mode, senderHook, recipientRegistration, customRequestResponder, additionalTests } = opts;
   const description = `${strategy} x ${formatMode(mode)}`;
 
   describe(description, () => {
@@ -84,11 +92,14 @@ export function buildMessageDeliveryTest(opts: {
         ? contractSender.methods.emit_note(recipient, value)
         : contractSender.methods.emit_note_unconstrained(recipient, value);
 
+    let additionallyFundedAccounts: InitialAccountData[];
+    let recipientAccount: AccountManager | undefined;
+    let customRequestCount = 0;
+
     beforeAll(async () => {
       // The sender PXE holds the sender and carries this cell's tagging-secret-strategy hook. The recipient is funded
       // at genesis here but created and deployed on the isolated recipient PXE below, so it carries no sender state
       // from other cells.
-      let additionallyFundedAccounts: InitialAccountData[];
       ({
         aztecNode,
         additionallyFundedAccounts,
@@ -98,7 +109,26 @@ export function buildMessageDeliveryTest(opts: {
       } = await setup(1, {
         ...AUTOMINE_E2E_OPTS,
         additionallyFundedAccounts: await generateSchnorrAccounts(1, 'schnorr'),
-        pxeCreationOptions: { hooks: { resolveTaggingSecretStrategy: senderHook } },
+        pxeCreationOptions: {
+          hooks: {
+            resolveTaggingSecretStrategy: senderHook,
+            resolveCustomRequest: async (request: CustomRequest) => {
+              if (!customRequestResponder) {
+                throw new Error('A custom request arrived but this test cell has no customRequestResponder configured');
+              }
+              if (!recipientAccount) {
+                throw new Error('A custom request arrived before the recipient wallet was created');
+              }
+              customRequestCount++;
+              const respond = customRequestResponder(
+                walletRecipient,
+                additionallyFundedAccounts[0],
+                await recipientAccount.getCompleteAddress(),
+              );
+              return respond(request);
+            },
+          },
+        },
       }));
 
       ({ wallet: walletRecipient, teardown: teardownRecipient } = await setupPXEAndGetWallet(
@@ -108,7 +138,7 @@ export function buildMessageDeliveryTest(opts: {
         undefined,
         'pxe-recipient',
       ));
-      const recipientAccount = await walletRecipient.createSchnorrAccount(
+      recipientAccount = await walletRecipient.createSchnorrAccount(
         additionallyFundedAccounts[0].secret,
         additionallyFundedAccounts[0].salt,
         additionallyFundedAccounts[0].signingKey,
@@ -172,6 +202,12 @@ export function buildMessageDeliveryTest(opts: {
       expect(readNotes).toEqual(noteValues);
     });
 
+    if (customRequestResponder) {
+      it('the custom request hook fires exactly once, on the send that bootstraps the tagging secret', () => {
+        expect(customRequestCount).toBe(1);
+      });
+    }
+
     additionalTests?.();
   });
 }