@aztec/foundation 0.0.0-test.1 → 0.0.1-commit.b655e406

package/dest/crypto/schnorr/index.js

@@ -1,7 +1,5 @@
 import { BarretenbergSync } from '@aztec/bb.js';
 import { Point } from '@aztec/foundation/fields';
-import { numToInt32BE } from '@aztec/foundation/serialize';
-import { concatenateUint8Arrays } from '../serialize.js';
 import { SchnorrSignature } from './signature.js';
 export * from './signature.js';
 /**
@@ -12,13 +10,17 @@ export * from './signature.js';
    * @param privateKey - The private key.
    * @returns A grumpkin public key.
    */ async computePublicKey(privateKey) {
-        const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
-        const [result] = api.getWasm().callWasmExport('schnorr_compute_public_key', [
-            privateKey.toBuffer()
-        ], [
-            64
-        ]);
-        return Point.fromBuffer(Buffer.from(result));
+        await BarretenbergSync.initSingleton({
+            wasmPath: process.env.BB_WASM_PATH
+        });
+        const api = BarretenbergSync.getSingleton();
+        const response = api.schnorrComputePublicKey({
+            privateKey: privateKey.toBuffer()
+        });
+        return Point.fromBuffer(Buffer.concat([
+            Buffer.from(response.publicKey.x),
+            Buffer.from(response.publicKey.y)
+        ]));
     }
     /**
    * Constructs a Schnorr signature given a msg and a private key.
@@ -26,21 +28,17 @@ export * from './signature.js';
    * @param privateKey - The private key of the signer.
    * @returns A Schnorr signature of the form (s, e).
    */ async constructSignature(msg, privateKey) {
-        const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
-        const messageArray = concatenateUint8Arrays([
-            numToInt32BE(msg.length),
-            msg
-        ]);
-        const [s, e] = api.getWasm().callWasmExport('schnorr_construct_signature', [
-            messageArray,
-            privateKey.toBuffer()
-        ], [
-            32,
-            32
-        ]);
+        await BarretenbergSync.initSingleton({
+            wasmPath: process.env.BB_WASM_PATH
+        });
+        const api = BarretenbergSync.getSingleton();
+        const response = api.schnorrConstructSignature({
+            message: msg,
+            privateKey: privateKey.toBuffer()
+        });
         return new SchnorrSignature(Buffer.from([
-            ...s,
-            ...e
+            ...response.s,
+            ...response.e
         ]));
     }
     /**
@@ -50,19 +48,19 @@ export * from './signature.js';
    * @param sig - The Schnorr signature.
    * @returns True or false.
    */ async verifySignature(msg, pubKey, sig) {
-        const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
-        const messageArray = concatenateUint8Arrays([
-            numToInt32BE(msg.length),
-            msg
-        ]);
-        const [result] = api.getWasm().callWasmExport('schnorr_verify_signature', [
-            messageArray,
-            pubKey.toBuffer(),
-            sig.s,
-            sig.e
-        ], [
-            1
-        ]);
-        return result[0] === 1;
+        await BarretenbergSync.initSingleton({
+            wasmPath: process.env.BB_WASM_PATH
+        });
+        const api = BarretenbergSync.getSingleton();
+        const response = api.schnorrVerifySignature({
+            message: msg,
+            publicKey: {
+                x: pubKey.x.toBuffer(),
+                y: pubKey.y.toBuffer()
+            },
+            s: sig.s,
+            e: sig.e
+        });
+        return response.verified;
     }
 }

package/dest/crypto/schnorr/signature.d.ts

@@ -1,5 +1,3 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 import { Fr } from '@aztec/foundation/fields';
 import { BufferReader } from '@aztec/foundation/serialize';
 import type { Signature } from '../signature/index.js';
@@ -39,17 +37,17 @@ export declare class SchnorrSignature implements Signature {
      * Returns the 's' component of the signature.
      * @returns A buffer containing the signature's 's' component.
      */
-    get s(): Buffer;
+    get s(): Buffer<ArrayBufferLike>;
     /**
      * Returns the 'e' component of the signature.
      * @returns A buffer containing the signature's 'e' component.
      */
-    get e(): Buffer;
+    get e(): Buffer<ArrayBufferLike>;
     /**
      * Returns the full signature as a buffer.
      * @returns A buffer containing the signature.
      */
-    toBuffer(): Buffer;
+    toBuffer(): Buffer<ArrayBufferLike>;
     /**
      * Deserializes from a buffer.
      * @param buffer - The buffer representation of the object.

package/dest/crypto/schnorr/signature.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../../src/crypto/schnorr/signature.ts"],"names":[],"mappings":";;AACA,OAAO,EAAE,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAY,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,SAAS;IAWpC,OAAO,CAAC,MAAM;IAV1B;;OAEG;IACH,OAAc,IAAI,SAAM;IAExB;;OAEG;IACH,OAAc,KAAK,mBAA0C;gBAEzC,MAAM,EAAE,MAAM;IAMlC;;;;OAIG;WACW,WAAW,CAAC,SAAS,EAAE,MAAM;IAI3C;;;;OAIG;WACW,UAAU,CAAC,SAAS,EAAE,MAAM;IAO1C;;;OAGG;WACW,MAAM;IAIpB;;;OAGG;IACH,IAAI,CAAC,WAEJ;IAED;;;OAGG;IACH,IAAI,CAAC,WAEJ;IAED;;;OAGG;IACH,QAAQ;IAIR;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,gBAAgB;IAKlE;;;OAGG;IACH,QAAQ;IAIR;;;OAGG;IACH,QAAQ,IAAI,EAAE,EAAE;CAajB"}
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../../src/crypto/schnorr/signature.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAY,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,SAAS;IAWpC,OAAO,CAAC,MAAM;IAV1B;;OAEG;IACH,OAAc,IAAI,SAAM;IAExB;;OAEG;IACH,OAAc,KAAK,mBAA0C;gBAEzC,MAAM,EAAE,MAAM;IAMlC;;;;OAIG;WACW,WAAW,CAAC,SAAS,EAAE,MAAM;IAI3C;;;;OAIG;WACW,UAAU,CAAC,SAAS,EAAE,MAAM;IAO1C;;;OAGG;WACW,MAAM;IAIpB;;;OAGG;IACH,IAAI,CAAC,4BAEJ;IAED;;;OAGG;IACH,IAAI,CAAC,4BAEJ;IAED;;;OAGG;IACH,QAAQ;IAIR;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,gBAAgB;IAKlE;;;OAGG;IACH,QAAQ;IAIR;;;OAGG;IACH,QAAQ,IAAI,EAAE,EAAE;CAajB"}

package/dest/crypto/secp256k1/index.d.ts

@@ -1,10 +1,8 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 /**
  * Secp256k1 elliptic curve operations.
  */
 export declare class Secp256k1 {
-    static generator: Buffer;
+    static generator: Buffer<ArrayBuffer>;
     /**
      * Point generator
      * @returns The generator for the curve.
@@ -16,17 +14,17 @@ export declare class Secp256k1 {
      * @param scalar - Scalar to multiply by.
      * @returns Result of the multiplication.
      */
-    mul(point: Uint8Array, scalar: Uint8Array): Promise<Buffer>;
+    mul(point: Uint8Array, scalar: Uint8Array): Promise<Buffer<ArrayBuffer>>;
     /**
      * Gets a random field element.
      * @returns Random field element.
      */
-    getRandomFr(): Promise<Buffer>;
+    getRandomFr(): Promise<Buffer<ArrayBuffer>>;
     /**
      * Converts a 512 bits long buffer to a field.
      * @param uint512Buf - The buffer to convert.
      * @returns Buffer representation of the field element.
      */
-    reduce512BufferToFr(uint512Buf: Buffer): Promise<Buffer>;
+    reduce512BufferToFr(uint512Buf: Buffer): Promise<Buffer<ArrayBuffer>>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dest/crypto/secp256k1/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/secp256k1/index.ts"],"names":[],"mappings":";;AAEA;;GAEG;AACH,qBAAa,SAAS;IAEpB,MAAM,CAAC,SAAS,SAKb;IAEH;;;OAGG;IACI,SAAS,IAAI,MAAM;IAI1B;;;;;OAKG;IACU,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU;IAMtD;;;OAGG;IACU,WAAW;IAMxB;;;;OAIG;IACU,mBAAmB,CAAC,UAAU,EAAE,MAAM;CAOpD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/secp256k1/index.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,SAAS;IAEpB,MAAM,CAAC,SAAS,sBAKb;IAEH;;;OAGG;IACI,SAAS,IAAI,MAAM;IAI1B;;;;;OAKG;IACU,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU;IAUtD;;;OAGG;IACU,WAAW;IAOxB;;;;OAIG;IACU,mBAAmB,CAAC,UAAU,EAAE,MAAM;CAMpD"}

package/dest/crypto/secp256k1/index.js

@@ -81,36 +81,47 @@ import { BarretenbergSync } from '@aztec/bb.js';
    * @param scalar - Scalar to multiply by.
    * @returns Result of the multiplication.
    */ async mul(point, scalar) {
-        const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
-        const [result] = api.getWasm().callWasmExport('ecc_secp256k1__mul', [
-            point,
+        await BarretenbergSync.initSingleton({
+            wasmPath: process.env.BB_WASM_PATH
+        });
+        const api = BarretenbergSync.getSingleton();
+        const response = api.secp256k1Mul({
+            point: {
+                x: point.subarray(0, 32),
+                y: point.subarray(32, 64)
+            },
             scalar
-        ], [
-            64
+        });
+        return Buffer.concat([
+            Buffer.from(response.point.x),
+            Buffer.from(response.point.y)
         ]);
-        return Buffer.from(result);
     }
     /**
    * Gets a random field element.
    * @returns Random field element.
    */ async getRandomFr() {
-        const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
-        const [result] = api.getWasm().callWasmExport('ecc_secp256k1__get_random_scalar_mod_circuit_modulus', [], [
-            32
-        ]);
-        return Buffer.from(result);
+        await BarretenbergSync.initSingleton({
+            wasmPath: process.env.BB_WASM_PATH
+        });
+        const api = BarretenbergSync.getSingleton();
+        const response = api.secp256k1GetRandomFr({
+            dummy: 0
+        });
+        return Buffer.from(response.value);
     }
     /**
    * Converts a 512 bits long buffer to a field.
    * @param uint512Buf - The buffer to convert.
    * @returns Buffer representation of the field element.
    */ async reduce512BufferToFr(uint512Buf) {
-        const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
-        const [result] = api.getWasm().callWasmExport('ecc_secp256k1__reduce512_buffer_mod_circuit_modulus', [
-            uint512Buf
-        ], [
-            32
-        ]);
-        return Buffer.from(result);
+        await BarretenbergSync.initSingleton({
+            wasmPath: process.env.BB_WASM_PATH
+        });
+        const api = BarretenbergSync.getSingleton();
+        const response = api.secp256k1Reduce512({
+            input: uint512Buf
+        });
+        return Buffer.from(response.value);
     }
 }

package/dest/crypto/secp256k1-signer/utils.d.ts

@@ -1,8 +1,24 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 import { Buffer32 } from '../../buffer/buffer32.js';
 import { EthAddress } from '../../eth-address/index.js';
 import { Signature } from '../../eth-signature/eth_signature.js';
+/** Signature recovery options */
+type RecoveryOpts = {
+    /**
+     * Whether to allow s-values in the high half of the curve (s >= CURVE.n/2).
+     * These are discouraged by EIP2 to prevent signature malleability, and outright
+     * rejected in OpenZeppelin's ECDSA recover, which we use in our Rollup contract.
+     */
+    allowMalleable?: boolean;
+    /**
+     * Whether to allow an y-parity 0-1 bit instead of the standard v value 27-28.
+     */
+    allowYParityAsV?: boolean;
+};
+export declare class Secp256k1Error extends Error {
+    constructor(message: string, opts?: {
+        cause: unknown;
+    });
+}
 export declare function makeEthSignDigest(message: Buffer32): Buffer32;
 /**
  * Converts a private key to a public key.
@@ -20,9 +36,26 @@ export declare function addressFromPrivateKey(privateKey: Buffer): EthAddress;
  * Recovers an address from a hash and a signature.
  * @param hash - The hash to recover the address from.
  * @param signature - The signature to recover the address from.
+ * @param opts - Recovery options.
  * @returns The address.
+ * @throws Error if signature recovery fails or if signature is malleable and allowMalleable is false.
  */
-export declare function recoverAddress(hash: Buffer32, signature: Signature): EthAddress;
+export declare function recoverAddress(hash: Buffer32, signature: Signature, opts?: RecoveryOpts): EthAddress;
+/**
+ * Safely attempts to recover an address from a hash and a signature.
+ * @param hash - The hash to recover the address from.
+ * @param signature - The signature to recover the address from.
+ * @param opts - Recovery options.
+ * @returns The address if recovery succeeds, undefined otherwise.
+ */
+export declare function tryRecoverAddress(hash: Buffer32, signature: Signature, opts?: RecoveryOpts): EthAddress | undefined;
+/**
+ * @attribution - viem
+ * Converts a yParityOrV value to a recovery bit.
+ * @param yParityOrV - The yParityOrV value to convert.
+ * @returns The recovery bit.
+ */
+export declare function toRecoveryBit(yParityOrV: number): 0 | 1;
 /**
  * Signs a message using ecdsa over the secp256k1 curve.
  * @param message - The message to sign.
@@ -30,11 +63,29 @@ export declare function recoverAddress(hash: Buffer32, signature: Signature): Et
  * @returns The signature.
  */
 export declare function signMessage(message: Buffer32, privateKey: Buffer): Signature;
+/**
+ * Flips an ECDSA signature.
+ * If the signature has a low s-value (s < CURVE.n/2), it flips it to high s-value (CURVE.n - s) and vice versa.
+ * Also flips the v value accordingly (27 <-> 28, or 0 <-> 1).
+ * This is useful for testing signature malleability handling.
+ * @param signature - The signature to flip.
+ * @returns A new signature with flipped s-value and v-value.
+ */
+export declare function flipSignature(signature: Signature): Signature;
+/**
+ * Normalizes an ECDSA signature.
+ * If the signature has a high s-value (s >= CURVE.n/2), it flips it to low s-value (CURVE.n - s), and flips v accordingly.
+ * If the signature uses a recovery bit of 0/1, it is converted to a v-value 27/28 for ecrecover.
+ * @remarks This does not handle post EIP155 tx signatures which embed the chain id in v. Use it only for feeding into ECRECOVER precompiles.
+ * @param signature - The signature to normalize.
+ */
+export declare function normalizeSignature(signature: Signature): Signature;
 /**
  * Recovers a public key from a hash and a signature.
  * @param hash - The hash to recover the public key from.
  * @param signature - The signature to recover the public key from.
  * @returns The public key.
  */
-export declare function recoverPublicKey(hash: Buffer32, signature: Signature): Buffer;
+export declare function recoverPublicKey(hash: Buffer32, signature: Signature, opts?: RecoveryOpts): Buffer;
+export {};
 //# sourceMappingURL=utils.d.ts.map

package/dest/crypto/secp256k1-signer/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/crypto/secp256k1-signer/utils.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAMjE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAG7D;AAYD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAGpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,GAAG,UAAU,CAG/E;AAqBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAGhE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,GAAG,MAAM,CAO7E"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/crypto/secp256k1-signer/utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAKjE,iCAAiC;AACjC,KAAK,YAAY,GAAG;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE;CAIvD;AAGD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,CAG7D;AAYD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAGpE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,UAAU,CAUpG;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,SAAS,CAOnH;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,SAW/C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAGhE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAM7D;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAUlE;AA6BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAE,YAAiB,GAAG,MAAM,CAYtG"}

package/dest/crypto/secp256k1-signer/utils.js

@@ -4,6 +4,12 @@ import { EthAddress } from '../../eth-address/index.js';
 import { Signature } from '../../eth-signature/eth_signature.js';
 import { keccak256 } from '../keccak/index.js';
 const ETH_SIGN_PREFIX = '\x19Ethereum Signed Message:\n32';
+export class Secp256k1Error extends Error {
+    constructor(message, opts){
+        super(message, opts);
+        this.name = 'Secp256k1Error';
+    }
+}
 // We just hash the message to make it easier to work with in the smart contract.
 export function makeEthSignDigest(message) {
     const prefix = Buffer.from(ETH_SIGN_PREFIX);
@@ -39,17 +45,39 @@ export function makeEthSignDigest(message) {
  * Recovers an address from a hash and a signature.
  * @param hash - The hash to recover the address from.
  * @param signature - The signature to recover the address from.
+ * @param opts - Recovery options.
  * @returns The address.
- */ export function recoverAddress(hash, signature) {
-    const publicKey = recoverPublicKey(hash, signature);
-    return publicKeyToAddress(publicKey);
+ * @throws Error if signature recovery fails or if signature is malleable and allowMalleable is false.
+ */ export function recoverAddress(hash, signature, opts) {
+    try {
+        const publicKey = recoverPublicKey(hash, signature, opts);
+        return publicKeyToAddress(publicKey);
+    } catch (err) {
+        throw new Secp256k1Error(`Error recovering Ethereum address from hash ${hash.toString()} and signature ${signature.toString()}`, {
+            cause: err
+        });
+    }
+}
+/**
+ * Safely attempts to recover an address from a hash and a signature.
+ * @param hash - The hash to recover the address from.
+ * @param signature - The signature to recover the address from.
+ * @param opts - Recovery options.
+ * @returns The address if recovery succeeds, undefined otherwise.
+ */ export function tryRecoverAddress(hash, signature, opts) {
+    try {
+        const publicKey = recoverPublicKey(hash, signature, opts);
+        return publicKeyToAddress(publicKey);
+    } catch  {
+        return undefined;
+    }
 }
 /**
  * @attribution - viem
  * Converts a yParityOrV value to a recovery bit.
  * @param yParityOrV - The yParityOrV value to convert.
  * @returns The recovery bit.
- */ function toRecoveryBit(yParityOrV) {
+ */ export function toRecoveryBit(yParityOrV) {
     if (yParityOrV === 0 || yParityOrV === 1) {
         return yParityOrV;
     }
@@ -59,7 +87,7 @@ export function makeEthSignDigest(message) {
     if (yParityOrV === 28) {
         return 1;
     }
-    throw new Error('Invalid yParityOrV value');
+    throw new Secp256k1Error(`Invalid yParityOrV value ${yParityOrV}`);
 }
 /**
  * Signs a message using ecdsa over the secp256k1 curve.
@@ -70,15 +98,73 @@ export function makeEthSignDigest(message) {
     const { r, s, recovery } = secp256k1.sign(message.buffer, privateKey);
     return new Signature(Buffer32.fromBigInt(r), Buffer32.fromBigInt(s), recovery ? 28 : 27);
 }
+/**
+ * Flips an ECDSA signature.
+ * If the signature has a low s-value (s < CURVE.n/2), it flips it to high s-value (CURVE.n - s) and vice versa.
+ * Also flips the v value accordingly (27 <-> 28, or 0 <-> 1).
+ * This is useful for testing signature malleability handling.
+ * @param signature - The signature to flip.
+ * @returns A new signature with flipped s-value and v-value.
+ */ export function flipSignature(signature) {
+    const { r, s, v } = signature;
+    const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt());
+    const flippedS = secp256k1.CURVE.n - sig.s;
+    return new Signature(r, Buffer32.fromBigInt(flippedS), flipV(v));
+}
+/**
+ * Normalizes an ECDSA signature.
+ * If the signature has a high s-value (s >= CURVE.n/2), it flips it to low s-value (CURVE.n - s), and flips v accordingly.
+ * If the signature uses a recovery bit of 0/1, it is converted to a v-value 27/28 for ecrecover.
+ * @remarks This does not handle post EIP155 tx signatures which embed the chain id in v. Use it only for feeding into ECRECOVER precompiles.
+ * @param signature - The signature to normalize.
+ */ export function normalizeSignature(signature) {
+    const { r, s, v } = signature;
+    const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt());
+    if (sig.hasHighS()) {
+        const newV = flipV(v);
+        const newS = sig.normalizeS().s;
+        return new Signature(r, Buffer32.fromBigInt(newS), toVFromYParityOrV(newV));
+    }
+    return new Signature(r, s, toVFromYParityOrV(v));
+}
+/** Converts a yParityOrV value to a pre-EIP155 v-value 27-28. */ function toVFromYParityOrV(yParityOrV) {
+    if (yParityOrV === 0 || yParityOrV === 1) {
+        return yParityOrV + 27;
+    } else if (yParityOrV === 27 || yParityOrV === 28) {
+        return yParityOrV;
+    } else {
+        throw new Secp256k1Error(`Invalid yParityOrV value ${yParityOrV}`);
+    }
+}
+/** Flips the recovery bit or v-value */ function flipV(v) {
+    switch(v){
+        case 27:
+            return 28;
+        case 28:
+            return 27;
+        case 0:
+            return 1;
+        case 1:
+            return 0;
+        default:
+            throw new Secp256k1Error(`Invalid v value ${v}`);
+    }
+}
 /**
  * Recovers a public key from a hash and a signature.
  * @param hash - The hash to recover the public key from.
  * @param signature - The signature to recover the public key from.
  * @returns The public key.
- */ export function recoverPublicKey(hash, signature) {
+ */ export function recoverPublicKey(hash, signature, opts = {}) {
     const { r, s, v } = signature;
+    if (!opts.allowYParityAsV && v !== 27 && v !== 28) {
+        throw new Secp256k1Error(`Invalid v value ${v} (expected 27 or 28)`);
+    }
     const recoveryBit = toRecoveryBit(v);
     const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt()).addRecoveryBit(recoveryBit);
+    if (!opts.allowMalleable && sig.hasHighS()) {
+        throw new Secp256k1Error('Signature has high s-value (malleable signature)');
+    }
     const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
     return Buffer.from(publicKey, 'hex');
 }

package/dest/crypto/serialize.d.ts

@@ -1,5 +1,3 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 import { Buffer } from 'buffer';
 /**
  * For serializing an array of fixed length buffers.
@@ -7,7 +5,7 @@ import { Buffer } from 'buffer';
  * @param arr - Array of bufffers.
  * @returns The serialized buffers.
  */
-export declare function serializeBufferArrayToVector(arr: Buffer[]): Buffer;
+export declare function serializeBufferArrayToVector(arr: Buffer[]): Buffer<ArrayBuffer>;
 /**
  * Helper function for deserializeArrayFromVector.
  */
@@ -37,7 +35,7 @@ export declare function deserializeArrayFromVector<T>(deserialize: DeserializeFn
  * @param n - The number.
  * @returns The endian-corrected number.
  */
-export declare function numToUInt32LE(n: number, bufferSize?: number): Buffer;
+export declare function numToUInt32LE(n: number, bufferSize?: number): Buffer<ArrayBuffer>;
 /**
  * Deserialize the 256-bit number at address `offset`.
  * @param buf - The buffer.
@@ -45,9 +43,9 @@ export declare function numToUInt32LE(n: number, bufferSize?: number): Buffer;
  * @returns The derserialized 256-bit field.
  */
 export declare function deserializeField(buf: Buffer, offset?: number): {
-    elem: Buffer;
+    elem: Buffer<ArrayBuffer>;
     adv: number;
 };
-export declare function concatenateUint8Arrays(arrayOfUint8Arrays: Uint8Array[]): Uint8Array;
+export declare function concatenateUint8Arrays(arrayOfUint8Arrays: Uint8Array[]): Uint8Array<ArrayBuffer>;
 export {};
 //# sourceMappingURL=serialize.d.ts.map

package/dest/crypto/serialize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/crypto/serialize.ts"],"names":[],"mappings":";;AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,UAIzD;AAED;;GAEG;AACH,KAAK,aAAa,CAAC,CAAC,IAAI,CACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,KACX;IACH;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC;IACR;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI;;;EAWtG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,SAAI,UAItD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAI;;;EAGvD;AAED,wBAAgB,sBAAsB,CAAC,kBAAkB,EAAE,UAAU,EAAE,cAStE"}
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/crypto/serialize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,uBAIzD;AAED;;GAEG;AACH,KAAK,aAAa,CAAC,CAAC,IAAI,CACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,KACX;IACH;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC;IACR;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI;;;EAWtG;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,SAAI,uBAItD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAI;;;EAGvD;AAED,wBAAgB,sBAAsB,CAAC,kBAAkB,EAAE,UAAU,EAAE,2BAStE"}

package/dest/crypto/sha256/index.d.ts

@@ -1,9 +1,8 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 import { Fr } from '../../fields/fields.js';
 import { type Bufferable } from '../../serialize/serialize.js';
-export declare function sha256(data: Buffer): Buffer;
-export declare function sha256Trunc(data: Buffer): Buffer;
+import type { Hasher } from '../../trees/hasher.js';
+export declare function sha256(data: Buffer): Buffer<ArrayBuffer>;
+export declare function sha256Trunc(data: Buffer): Buffer<ArrayBufferLike>;
 export declare function sha256ToField(data: Bufferable[]): Fr;
 /**
  * The "SHA256 Compression" operation (component operation of SHA256 "Hash").
@@ -17,4 +16,22 @@ export declare function sha256ToField(data: Bufferable[]): Fr;
  * @returns The modified state. 8 u32s.
  */
 export declare function sha256Compression(state: Uint32Array, inputs: Uint32Array): Uint32Array;
+/**
+ * A helper class encapsulating SHA256 hash functionality.
+ * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+ * purposes.
+ */
+export declare class SHA256 implements Hasher {
+    hash(lhs: Uint8Array, rhs: Uint8Array): Buffer<ArrayBuffer>;
+    hashInputs(inputs: Buffer[]): Buffer<ArrayBuffer>;
+}
+/**
+ * A helper class encapsulating truncated SHA256 hash functionality.
+ * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+ * purposes.
+ */
+export declare class SHA256Trunc implements Hasher {
+    hash(lhs: Uint8Array, rhs: Uint8Array): Buffer<ArrayBuffer>;
+    hashInputs(inputs: Buffer[]): Buffer<ArrayBuffer>;
+}
 //# sourceMappingURL=index.d.ts.map

package/dest/crypto/sha256/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/sha256/index.ts"],"names":[],"mappings":";;AAGA,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAE5C,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,8BAA8B,CAAC;AAElF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,UAElC;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,UAEvC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,MAG/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW,CAyEtF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/sha256/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAE5C,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,8BAA8B,CAAC;AAClF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,uBAElC;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,2BAEvC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,MAG/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW,CAyEtF;AA4CD;;;;GAIG;AACH,qBAAa,MAAO,YAAW,MAAM;IAK5B,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAC4B,MAAM,CAAC,WAAW,CAAC;IAOpF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GACQ,MAAM,CAAC,WAAW,CAAC;CAE9D;AAED;;;;GAIG;AACH,qBAAa,WAAY,YAAW,MAAM;IAKjC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAC4C,MAAM,CAAC,WAAW,CAAC;IAOpG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GACwB,MAAM,CAAC,WAAW,CAAC;CAE9E"}

package/dest/crypto/sha256/index.js

@@ -164,3 +164,45 @@ function g0_256(x) {
 function g1_256(x) {
     return rotr32(x, 17) ^ rotr32(x, 19) ^ x >>> 10;
 }
+/**
+ * A helper class encapsulating SHA256 hash functionality.
+ * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+ * purposes.
+ */ export class SHA256 {
+    /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */ hash(lhs, rhs) {
+        return sha256(Buffer.concat([
+            Buffer.from(lhs),
+            Buffer.from(rhs)
+        ]));
+    }
+    /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */ hashInputs(inputs) {
+        return sha256(Buffer.concat(inputs));
+    }
+}
+/**
+ * A helper class encapsulating truncated SHA256 hash functionality.
+ * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+ * purposes.
+ */ export class SHA256Trunc {
+    /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */ hash(lhs, rhs) {
+        return truncateAndPad(sha256(Buffer.concat([
+            Buffer.from(lhs),
+            Buffer.from(rhs)
+        ])));
+    }
+    /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */ hashInputs(inputs) {
+        return truncateAndPad(sha256(Buffer.concat(inputs)));
+    }
+}

package/dest/crypto/sha512/index.d.ts

@@ -1,7 +1,5 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 import { type Bufferable } from '../../serialize/serialize.js';
-export declare const sha512: (data: Buffer) => Buffer;
+export declare const sha512: (data: Buffer) => Buffer<ArrayBuffer>;
 /**
  * @dev We don't truncate in this function (unlike in sha256ToField) because this function is used in situations where
  * we don't care only about collision resistance but we need the output to be uniformly distributed as well. This is

package/dest/crypto/sha512/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/sha512/index.ts"],"names":[],"mappings":";;AAGA,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,8BAA8B,CAAC;AAElF,eAAO,MAAM,MAAM,SAAU,MAAM,WAAqD,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,SAAU,UAAU,EAAE,wCAGxD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/sha512/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,8BAA8B,CAAC;AAElF,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,wBAAqD,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,MAAM,UAAU,EAAE,wCAGxD,CAAC"}

package/dest/crypto/signature/index.d.ts

@@ -1,5 +1,3 @@
-/// <reference types="node" resolution-mode="require"/>
-/// <reference types="node" resolution-mode="require"/>
 import type { Fr } from '@aztec/foundation/fields';
 /**
  * Interface to represent a signature.

package/dest/crypto/signature/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/signature/index.ts"],"names":[],"mappings":";;AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,IAAI,EAAE,EAAE,CAAC;CAClB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/crypto/signature/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;;OAGG;IACH,QAAQ,IAAI,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,IAAI,EAAE,EAAE,CAAC;CAClB"}

package/dest/crypto/sync/index.js

@@ -1,4 +1,6 @@
 import { BarretenbergSync } from '@aztec/bb.js';
 export * from './poseidon/index.js';
 export * from './pedersen/index.js';
-await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+await BarretenbergSync.initSingleton({
+    wasmPath: process.env.BB_WASM_PATH
+});