@aztec/foundation 0.0.1-commit.21ecf947b → 0.0.1-commit.2448fdb

package/dest/serialize/buffer_reader.js

@@ -224,15 +224,28 @@ import { toBigIntBE } from '../bigint-buffer/index.js';
         return result;
     }
     /**
-   * Read an array of a fixed size with elements of type T from the buffer.
-   * The 'itemDeserializer' object should have a 'fromBuffer' method that takes a BufferReader instance as input,
-   * and returns an instance of the desired deserialized data type T.
-   * This method will call the 'fromBuffer' method for each element in the array and return the resulting array.
+   * Read an array from the buffer using lazy allocation (new Array + loop).
+   * Safe for use with untrusted sizes — does not pre-allocate memory proportional to size.
    *
-   * @param size - The fixed number of elements in the array.
+   * @param size - The number of elements to read.
    * @param itemDeserializer - An object with a 'fromBuffer' method to deserialize individual elements of type T.
    * @returns An array of instances of type T.
    */ readArray(size, itemDeserializer) {
+        const result = new Array(size);
+        for(let i = 0; i < size; i++){
+            result[i] = itemDeserializer.fromBuffer(this);
+        }
+        return result;
+    }
+    /**
+   * Read a fixed-size tuple from the buffer using dense allocation (Array.from).
+   * Only use with compile-time constant sizes — the size parameter MUST NOT come from untrusted input
+   * as Array.from pre-allocates memory proportional to size.
+   *
+   * @param size - The fixed number of elements (must be a compile-time constant).
+   * @param itemDeserializer - An object with a 'fromBuffer' method to deserialize individual elements of type T.
+   * @returns A densely-allocated tuple of instances of type T.
+   */ readTuple(size, itemDeserializer) {
         const result = Array.from({
             length: size
         }, ()=>itemDeserializer.fromBuffer(this));

package/dest/serialize/field_reader.d.ts

@@ -93,10 +93,18 @@ export declare class FieldReader {
      * @param itemDeserializer - An object with a 'fromFields' method to deserialize individual elements of type T.
      * @returns An array of instances of type T.
      */
-    readArray<T, N extends number>(size: N, itemDeserializer: {
-        /**
-         * A function for deserializing data from a FieldReader instance.
-         */
+    /**
+     * Read an array from the field array using lazy allocation (new Array + loop).
+     * Safe for use with untrusted sizes.
+     */
+    readArray<T>(size: number, itemDeserializer: {
+        fromFields: (reader: FieldReader) => T;
+    }): T[];
+    /**
+     * Read a fixed-size tuple from the field array using dense allocation (Array.from).
+     * Only use with compile-time constant sizes — the size parameter MUST NOT come from untrusted input.
+     */
+    readTuple<T, N extends number>(size: N, itemDeserializer: {
         fromFields: (reader: FieldReader) => T;
     }): Tuple<T, N>;
     /**
@@ -118,4 +126,4 @@ export declare class FieldReader {
      */
     isFinished(): boolean;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZmllbGRfcmVhZGVyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VyaWFsaXplL2ZpZWxkX3JlYWRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDdkQsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sWUFBWSxDQUFDO0FBRXhDOzs7Ozs7O0dBT0c7QUFDSCxxQkFBYSxXQUFXO0lBS3BCLE9BQU8sQ0FBQyxNQUFNO0lBSmhCLE9BQU8sQ0FBQyxLQUFLLENBQVM7SUFDdEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQVM7SUFFaEMsWUFDVSxNQUFNLEVBQUUsRUFBRSxFQUFFLEVBQ3BCLE1BQU0sU0FBSSxFQU9YO0lBRUQ7Ozs7O09BS0c7SUFDSCxPQUFjLFFBQVEsQ0FBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLEdBQUcsV0FBVyxHQUFHLFdBQVcsQ0FNOUQ7SUFFRDs7OztPQUlHO0lBQ0gsSUFBVyxNQUFNLFdBRWhCO0lBRU0sZUFBZSxJQUFJLE1BQU0sQ0FFL0I7SUFFRDs7OztPQUlHO0lBQ0ksSUFBSSxDQUFDLENBQUMsRUFBRSxNQUFNLFFBS3BCO0lBRUQ7Ozs7T0FJRztJQUNJLFNBQVMsSUFBSSxFQUFFLENBS3JCO0lBRUQ7Ozs7T0FJRztJQUNJLFNBQVMsSUFBSSxFQUFFLENBS3JCO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sSUFBSSxFQUFFLENBRWxCO0lBRUQ7Ozs7Ozs7T0FPRztJQUNJLFdBQVcsSUFBSSxPQUFPLENBTzVCO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksT0FBTyxJQUFJLE1BQU0sQ0FPdkI7SUFFRDs7Ozs7O09BTUc7SUFDSSxPQUFPLElBQUksTUFBTSxDQU92QjtJQUVEOzs7OztPQUtHO0lBQ0ksY0FBYyxDQUFDLENBQUMsU0FBUyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQU03RDtJQUVEOzs7Ozs7Ozs7T0FTRztJQUNJLFNBQVMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxTQUFTLE1BQU0sRUFDbEMsSUFBSSxFQUFFLENBQUMsRUFDUCxnQkFBZ0IsRUFBRTtRQUNoQjs7V0FFRztRQUNILFVBQVUsRUFBRSxDQUFDLE1BQU0sRUFBRSxXQUFXLEtBQUssQ0FBQyxDQUFDO0tBQ3hDLEdBQ0EsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FHYjtJQUVEOzs7Ozs7T0FNRztJQUNJLFVBQVUsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFO1FBQ2pDOztXQUVHO1FBQ0gsVUFBVSxFQUFFLENBQUMsTUFBTSxFQUFFLFdBQVcsS0FBSyxDQUFDLENBQUM7S0FDeEMsR0FBRyxDQUFDLENBRUo7SUFFRDs7O09BR0c7SUFDSSxVQUFVLElBQUksT0FBTyxDQUUzQjtDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZmllbGRfcmVhZGVyLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc2VyaWFsaXplL2ZpZWxkX3JlYWRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDdkQsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sWUFBWSxDQUFDO0FBRXhDOzs7Ozs7O0dBT0c7QUFDSCxxQkFBYSxXQUFXO0lBS3BCLE9BQU8sQ0FBQyxNQUFNO0lBSmhCLE9BQU8sQ0FBQyxLQUFLLENBQVM7SUFDdEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQVM7SUFFaEMsWUFDVSxNQUFNLEVBQUUsRUFBRSxFQUFFLEVBQ3BCLE1BQU0sU0FBSSxFQU9YO0lBRUQ7Ozs7O09BS0c7SUFDSCxPQUFjLFFBQVEsQ0FBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLEdBQUcsV0FBVyxHQUFHLFdBQVcsQ0FNOUQ7SUFFRDs7OztPQUlHO0lBQ0gsSUFBVyxNQUFNLFdBRWhCO0lBRU0sZUFBZSxJQUFJLE1BQU0sQ0FFL0I7SUFFRDs7OztPQUlHO0lBQ0ksSUFBSSxDQUFDLENBQUMsRUFBRSxNQUFNLFFBS3BCO0lBRUQ7Ozs7T0FJRztJQUNJLFNBQVMsSUFBSSxFQUFFLENBS3JCO0lBRUQ7Ozs7T0FJRztJQUNJLFNBQVMsSUFBSSxFQUFFLENBS3JCO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sSUFBSSxFQUFFLENBRWxCO0lBRUQ7Ozs7Ozs7T0FPRztJQUNJLFdBQVcsSUFBSSxPQUFPLENBTzVCO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksT0FBTyxJQUFJLE1BQU0sQ0FPdkI7SUFFRDs7Ozs7O09BTUc7SUFDSSxPQUFPLElBQUksTUFBTSxDQU92QjtJQUVEOzs7OztPQUtHO0lBQ0ksY0FBYyxDQUFDLENBQUMsU0FBUyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQU03RDtJQUVEOzs7Ozs7Ozs7T0FTRztJQUNIOzs7T0FHRztJQUNJLFNBQVMsQ0FBQyxDQUFDLEVBQ2hCLElBQUksRUFBRSxNQUFNLEVBQ1osZ0JBQWdCLEVBQUU7UUFDaEIsVUFBVSxFQUFFLENBQUMsTUFBTSxFQUFFLFdBQVcsS0FBSyxDQUFDLENBQUM7S0FDeEMsR0FDQSxDQUFDLEVBQUUsQ0FNTDtJQUVEOzs7T0FHRztJQUNJLFNBQVMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxTQUFTLE1BQU0sRUFDbEMsSUFBSSxFQUFFLENBQUMsRUFDUCxnQkFBZ0IsRUFBRTtRQUNoQixVQUFVLEVBQUUsQ0FBQyxNQUFNLEVBQUUsV0FBVyxLQUFLLENBQUMsQ0FBQztLQUN4QyxHQUNBLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBR2I7SUFFRDs7Ozs7O09BTUc7SUFDSSxVQUFVLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRTtRQUNqQzs7V0FFRztRQUNILFVBQVUsRUFBRSxDQUFDLE1BQU0sRUFBRSxXQUFXLEtBQUssQ0FBQyxDQUFDO0tBQ3hDLEdBQUcsQ0FBQyxDQUVKO0lBRUQ7OztPQUdHO0lBQ0ksVUFBVSxJQUFJLE9BQU8sQ0FFM0I7Q0FDRiJ9

package/dest/serialize/field_reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"field_reader.d.ts","sourceRoot":"","sources":["../../src/serialize/field_reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;GAOG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YACU,MAAM,EAAE,EAAE,EAAE,EACpB,MAAM,SAAI,EAOX;IAED;;;;;OAKG;IACH,OAAc,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,GAAG,WAAW,CAM9D;IAED;;;;OAIG;IACH,IAAW,MAAM,WAEhB;IAEM,eAAe,IAAI,MAAM,CAE/B;IAED;;;;OAIG;IACI,IAAI,CAAC,CAAC,EAAE,MAAM,QAKpB;IAED;;;;OAIG;IACI,SAAS,IAAI,EAAE,CAKrB;IAED;;;;OAIG;IACI,SAAS,IAAI,EAAE,CAKrB;IAED;;;;OAIG;IACI,MAAM,IAAI,EAAE,CAElB;IAED;;;;;;;OAOG;IACI,WAAW,IAAI,OAAO,CAO5B;IAED;;;;;;OAMG;IACI,OAAO,IAAI,MAAM,CAOvB;IAED;;;;;;OAMG;IACI,OAAO,IAAI,MAAM,CAOvB;IAED;;;;;OAKG;IACI,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAM7D;IAED;;;;;;;;;OASG;IACI,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAClC,IAAI,EAAE,CAAC,EACP,gBAAgB,EAAE;QAChB;;WAEG;QACH,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC;KACxC,GACA,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAGb;IAED;;;;;;OAMG;IACI,UAAU,CAAC,CAAC,EAAE,YAAY,EAAE;QACjC;;WAEG;QACH,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC;KACxC,GAAG,CAAC,CAEJ;IAED;;;OAGG;IACI,UAAU,IAAI,OAAO,CAE3B;CACF"}
+{"version":3,"file":"field_reader.d.ts","sourceRoot":"","sources":["../../src/serialize/field_reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;GAOG;AACH,qBAAa,WAAW;IAKpB,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YACU,MAAM,EAAE,EAAE,EAAE,EACpB,MAAM,SAAI,EAOX;IAED;;;;;OAKG;IACH,OAAc,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,GAAG,WAAW,CAM9D;IAED;;;;OAIG;IACH,IAAW,MAAM,WAEhB;IAEM,eAAe,IAAI,MAAM,CAE/B;IAED;;;;OAIG;IACI,IAAI,CAAC,CAAC,EAAE,MAAM,QAKpB;IAED;;;;OAIG;IACI,SAAS,IAAI,EAAE,CAKrB;IAED;;;;OAIG;IACI,SAAS,IAAI,EAAE,CAKrB;IAED;;;;OAIG;IACI,MAAM,IAAI,EAAE,CAElB;IAED;;;;;;;OAOG;IACI,WAAW,IAAI,OAAO,CAO5B;IAED;;;;;;OAMG;IACI,OAAO,IAAI,MAAM,CAOvB;IAED;;;;;;OAMG;IACI,OAAO,IAAI,MAAM,CAOvB;IAED;;;;;OAKG;IACI,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAM7D;IAED;;;;;;;;;OASG;IACH;;;OAGG;IACI,SAAS,CAAC,CAAC,EAChB,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE;QAChB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC;KACxC,GACA,CAAC,EAAE,CAML;IAED;;;OAGG;IACI,SAAS,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,EAClC,IAAI,EAAE,CAAC,EACP,gBAAgB,EAAE;QAChB,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC;KACxC,GACA,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAGb;IAED;;;;;;OAMG;IACI,UAAU,CAAC,CAAC,EAAE,YAAY,EAAE;QACjC;;WAEG;QACH,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC;KACxC,GAAG,CAAC,CAEJ;IAED;;;OAGG;IACI,UAAU,IAAI,OAAO,CAE3B;CACF"}

package/dest/serialize/field_reader.js

@@ -140,7 +140,20 @@ import { Fq } from '../curves/bn254/field.js';
    * @param size - The fixed number of elements in the array.
    * @param itemDeserializer - An object with a 'fromFields' method to deserialize individual elements of type T.
    * @returns An array of instances of type T.
+   */ /**
+   * Read an array from the field array using lazy allocation (new Array + loop).
+   * Safe for use with untrusted sizes.
    */ readArray(size, itemDeserializer) {
+        const result = new Array(size);
+        for(let i = 0; i < size; i++){
+            result[i] = itemDeserializer.fromFields(this);
+        }
+        return result;
+    }
+    /**
+   * Read a fixed-size tuple from the field array using dense allocation (Array.from).
+   * Only use with compile-time constant sizes — the size parameter MUST NOT come from untrusted input.
+   */ readTuple(size, itemDeserializer) {
         const result = Array.from({
             length: size
         }, ()=>itemDeserializer.fromFields(this));

package/dest/transport/transport_client.js

@@ -55,7 +55,7 @@ const log = createLogger('foundation:transport_client');
             msgId,
             payload
         };
-        log.debug(format(`->`, msg));
+        log.trace(format(`->`, msg));
         return new Promise((resolve, reject)=>{
             this.pendingRequests.push({
                 resolve,
@@ -77,7 +77,7 @@ const log = createLogger('foundation:transport_client');
             this.close();
             return;
         }
-        log.debug(format(`<-`, msg));
+        log.trace(format(`<-`, msg));
         if (isEventMessage(msg)) {
             this.emit('event_msg', msg.payload);
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/foundation",
-  "version": "0.0.1-commit.21ecf947b",
+  "version": "0.0.1-commit.2448fdb",
   "type": "module",
   "main": "./dest/index.js",
   "types": "./dest/index.d.ts",
@@ -144,7 +144,7 @@
     "testEnvironment": "../../foundation/src/jest/env.mjs"
   },
   "dependencies": {
-    "@aztec/bb.js": "0.0.1-commit.21ecf947b",
+    "@aztec/bb.js": "0.0.1-commit.2448fdb",
     "@koa/cors": "^5.0.0",
     "@noble/curves": "=1.7.0",
     "@noble/hashes": "^1.6.1",

package/src/branded-types/slot.ts

@@ -73,6 +73,11 @@ SlotNumber.isValid = function (value: unknown): value is SlotNumber {
   return typeof value === 'number' && Number.isInteger(value) && value >= 0;
 };
 
+/** Increments a SlotNumber by a given value. */
+SlotNumber.add = function (sn: SlotNumber, increment: number): SlotNumber {
+  return SlotNumber(sn + increment);
+};
+
 /**
  * The zero slot value.
  */

package/src/buffer/index.ts

@@ -1,2 +1,3 @@
 export * from './buffer32.js';
 export * from './buffer16.js';
+export * from './utils.js';

package/src/buffer/utils.ts

@@ -0,0 +1,8 @@
+/** Returns the number of bytes in the buffer, excluding any trailing zero bytes. */
+export function trimmedBytesLength(buf: Uint8Array): number {
+  let end = buf.length;
+  while (end > 0 && buf[end - 1] === 0) {
+    end--;
+  }
+  return end;
+}

package/src/collection/array.ts

@@ -315,3 +315,17 @@ export function partition<T>(items: T[], predicate: (item: T) => boolean): [T[],
   }
   return [pass, fail];
 }
+
+/** Partitions the given iterable into two arrays based on the predicate. */
+export async function partitionAsync<T>(items: T[], predicate: (item: T) => Promise<boolean>): Promise<[T[], T[]]> {
+  const pass: T[] = [];
+  const fail: T[] = [];
+  for (const item of items) {
+    if (await predicate(item)) {
+      pass.push(item);
+    } else {
+      fail.push(item);
+    }
+  }
+  return [pass, fail];
+}

package/src/config/env_var.ts

@@ -12,6 +12,10 @@ export type EnvVar =
   | 'ARCHIVER_VIEM_POLLING_INTERVAL_MS'
   | 'ARCHIVER_BATCH_SIZE'
   | 'AZTEC_ADMIN_PORT'
+  | 'AZTEC_NODE_DEBUG'
+  | 'AZTEC_ADMIN_API_KEY_HASH'
+  | 'AZTEC_DISABLE_ADMIN_API_KEY'
+  | 'AZTEC_RESET_ADMIN_API_KEY'
   | 'AZTEC_NODE_ADMIN_URL'
   | 'AZTEC_NODE_URL'
   | 'AZTEC_PORT'
@@ -67,6 +71,7 @@ export type EnvVar =
   | 'PUBLIC_DATA_TREE_MAP_SIZE_KB'
   | 'DEBUG'
   | 'DEBUG_P2P_DISABLE_COLOCATION_PENALTY'
+  | 'ENABLE_PROVER_NODE'
   | 'ETHEREUM_HOSTS'
   | 'ETHEREUM_DEBUG_HOSTS'
   | 'ETHEREUM_ALLOW_NO_DEBUG_HOSTS'
@@ -76,6 +81,7 @@ export type EnvVar =
   | 'KEY_STORE_DIRECTORY'
   | 'L1_CHAIN_ID'
   | 'L1_CONSENSUS_HOST_URLS'
+  | 'ETHEREUM_HTTP_TIMEOUT_MS'
   | 'L1_CONSENSUS_HOST_API_KEYS'
   | 'L1_CONSENSUS_HOST_API_KEY_HEADERS'
   | 'LOG_JSON'
@@ -85,7 +91,6 @@ export type EnvVar =
   | 'MNEMONIC'
   | 'NETWORK'
   | 'NETWORK_CONFIG_LOCATION'
-  | 'NO_PXE'
   | 'USE_GCLOUD_LOGGING'
   | 'OTEL_EXPORTER_OTLP_METRICS_ENDPOINT'
   | 'OTEL_EXPORTER_OTLP_TRACES_ENDPOINT'
@@ -148,6 +153,7 @@ export type EnvVar =
   | 'P2P_DROP_TX_CHANCE'
   | 'P2P_TX_POOL_DELETE_TXS_AFTER_REORG'
   | 'P2P_MIN_TX_POOL_AGE_MS'
+  | 'P2P_RPC_PRICE_BUMP_PERCENTAGE'
   | 'DEBUG_P2P_INSTRUMENT_MESSAGES'
   | 'PEER_ID_PRIVATE_KEY'
   | 'PEER_ID_PRIVATE_KEY_PATH'
@@ -163,6 +169,7 @@ export type EnvVar =
   | 'PROVER_BROKER_MAX_EPOCHS_TO_KEEP_RESULTS_FOR'
   | 'PROVER_BROKER_DEBUG_REPLAY_ENABLED'
   | 'PROVER_CANCEL_JOBS_ON_STOP'
+  | 'PROVER_ENQUEUE_CONCURRENCY'
   | 'PROVER_COORDINATION_NODE_URLS'
   | 'PROVER_PROOF_STORE'
   | 'PROVER_FAILED_PROOF_STORE'
@@ -196,12 +203,14 @@ export type EnvVar =
   | 'SENTINEL_ENABLED'
   | 'SENTINEL_HISTORY_LENGTH_IN_EPOCHS'
   | 'SENTINEL_HISTORIC_PROVEN_PERFORMANCE_LENGTH_IN_EPOCHS'
-  | 'SEQ_MAX_BLOCK_SIZE_IN_BYTES'
   | 'SEQ_MAX_TX_PER_BLOCK'
+  | 'SEQ_MAX_TX_PER_CHECKPOINT'
   | 'SEQ_MIN_TX_PER_BLOCK'
   | 'SEQ_PUBLISH_TXS_WITH_PROPOSALS'
   | 'SEQ_MAX_DA_BLOCK_GAS'
   | 'SEQ_MAX_L2_BLOCK_GAS'
+  | 'SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER'
+  | 'SEQ_REDISTRIBUTE_CHECKPOINT_BUDGET'
   | 'SEQ_PUBLISHER_PRIVATE_KEY'
   | 'SEQ_PUBLISHER_PRIVATE_KEYS'
   | 'SEQ_PUBLISHER_ADDRESSES'
@@ -212,9 +221,11 @@ export type EnvVar =
   | 'SEQ_L1_PUBLISHING_TIME_ALLOWANCE_IN_SLOT'
   | 'SEQ_ATTESTATION_PROPAGATION_TIME'
   | 'SEQ_BLOCK_DURATION_MS'
+  | 'SEQ_EXPECTED_BLOCK_PROPOSALS_PER_SLOT'
   | 'SEQ_BUILD_CHECKPOINT_IF_EMPTY'
   | 'SEQ_SECONDS_BEFORE_INVALIDATING_BLOCK_AS_COMMITTEE_MEMBER'
   | 'SEQ_SECONDS_BEFORE_INVALIDATING_BLOCK_AS_NON_COMMITTEE_MEMBER'
+  | 'SEQ_SKIP_CHECKPOINT_PUBLISH_PERCENT'
   | 'SLASH_MIN_PENALTY_PERCENTAGE'
   | 'SLASH_MAX_PENALTY_PERCENTAGE'
   | 'SLASH_VALIDATORS_ALWAYS'
@@ -241,6 +252,7 @@ export type EnvVar =
   | 'TELEMETRY'
   | 'TEST_ACCOUNTS'
   | 'SPONSORED_FPC'
+  | 'PREFUND_ADDRESSES'
   | 'TX_COLLECTION_FAST_NODES_TIMEOUT_BEFORE_REQ_RESP_MS'
   | 'TX_COLLECTION_SLOW_NODES_INTERVAL_MS'
   | 'TX_COLLECTION_SLOW_REQ_RESP_INTERVAL_MS'
@@ -270,6 +282,10 @@ export type EnvVar =
   | 'TRANSACTIONS_DISABLED'
   | 'VALIDATOR_ATTESTATIONS_POLLING_INTERVAL_MS'
   | 'VALIDATOR_DISABLED'
+  | 'VALIDATOR_MAX_DA_BLOCK_GAS'
+  | 'VALIDATOR_MAX_L2_BLOCK_GAS'
+  | 'VALIDATOR_MAX_TX_PER_BLOCK'
+  | 'VALIDATOR_MAX_TX_PER_CHECKPOINT'
   | 'VALIDATOR_PRIVATE_KEYS'
   | 'VALIDATOR_PRIVATE_KEY'
   | 'VALIDATOR_REEXECUTE'
@@ -279,6 +295,7 @@ export type EnvVar =
   | 'WS_BLOCK_REQUEST_BATCH_SIZE'
   | 'L1_READER_VIEM_POLLING_INTERVAL_MS'
   | 'WS_DATA_DIRECTORY'
+  | 'WS_NUM_HISTORIC_CHECKPOINTS'
   | 'WS_NUM_HISTORIC_BLOCKS'
   | 'ETHEREUM_SLOT_DURATION'
   | 'AZTEC_SLOT_DURATION'
@@ -333,9 +350,8 @@ export type EnvVar =
   | 'K8S_POD_NAME'
   | 'K8S_POD_UID'
   | 'K8S_NAMESPACE_NAME'
+  | 'ENABLE_VERSION_CHECK'
   | 'VALIDATOR_REEXECUTE_DEADLINE_MS'
-  | 'AUTO_UPDATE'
-  | 'AUTO_UPDATE_URL'
   | 'WEB3_SIGNER_URL'
   | 'SKIP_ARCHIVER_INITIAL_SYNC'
   | 'BLOB_ALLOW_EMPTY_SOURCES'

package/src/config/index.ts

@@ -177,6 +177,21 @@ export function bigintConfigHelper(defaultVal?: bigint): Pick<ConfigMapping, 'pa
       if (val === '') {
         return defaultVal;
       }
+      // Handle scientific notation (e.g. "1e+23", "2E23") which BigInt() doesn't accept directly.
+      // We parse it losslessly using bigint arithmetic instead of going through float64.
+      if (/[eE]/.test(val)) {
+        const match = val.match(/^(-?\d+(?:\.(\d+))?)[eE]([+-]?\d+)$/);
+        if (!match) {
+          throw new Error(`Cannot convert '${val}' to a BigInt`);
+        }
+        const digits = match[1].replace('.', '');
+        const decimalPlaces = match[2]?.length ?? 0;
+        const exponent = parseInt(match[3], 10) - decimalPlaces;
+        if (exponent < 0) {
+          throw new Error(`Cannot convert '${val}' to a BigInt: result is not an integer`);
+        }
+        return BigInt(digits) * 10n ** BigInt(exponent);
+      }
       return BigInt(val);
     },
     defaultValue: defaultVal,

package/src/config/network_config.ts

@@ -5,10 +5,13 @@ export const NetworkConfigSchema = z
     bootnodes: z.array(z.string()),
     snapshots: z.array(z.string()),
     blobFileStoreUrls: z.array(z.string()).optional(),
+    txCollectionFileStoreUrls: z.array(z.string()).optional(),
     registryAddress: z.string(),
     feeAssetHandlerAddress: z.string().optional(),
     l1ChainId: z.number(),
     blockDurationMs: z.number().positive().optional(),
+    nodeVersion: z.string().optional(),
+    txPublicSetupAllowListExtend: z.string().optional(),
   })
   .passthrough(); // Allow additional unknown fields to pass through
 

package/src/crypto/poseidon/index.ts

@@ -1,21 +1,35 @@
-import { BarretenbergSync } from '@aztec/bb.js';
+import { Barretenberg, BarretenbergSync } from '@aztec/bb.js';
 
 import { Fr } from '../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../serialize/serialize.js';
 
+const IS_BROWSER = typeof self !== 'undefined';
+
+async function poseidon2HashFields(inputFields: Fr[]): Promise<Fr> {
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  }
+}
+
 /**
  * Create a poseidon hash (field) from an array of input fields.
  * @param input - The input fields to hash.
  * @returns The poseidon hash.
  */
-export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
-  const inputFields = serializeToFields(input);
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+export function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
+  return poseidon2HashFields(serializeToFields(input));
 }
 
 /**
@@ -24,15 +38,10 @@ export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
  * @param separator - The domain separator.
  * @returns The poseidon hash.
  */
-export async function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
+export function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
   const inputFields = serializeToFields(input);
   inputFields.unshift(new Fr(separator));
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }
 
 /**
@@ -42,19 +51,24 @@ export async function poseidon2HashWithSeparator(input: Fieldable[], separator:
  */
 export async function poseidon2Permutation(input: Fieldable[]): Promise<Fr[]> {
   const inputFields = serializeToFields(input);
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(input.length === 4, 'Input state must be of size 4');
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Permutation({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(response.outputs.length === 4, 'Output state must be of size 4');
-  return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  }
 }
 
-export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
+export function poseidon2HashBytes(input: Buffer): Promise<Fr> {
   const inputFields = [];
   for (let i = 0; i < input.length; i += 31) {
     const fieldBytes = Buffer.alloc(32, 0);
@@ -65,11 +79,5 @@ export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
     inputFields.push(Fr.fromBuffer(fieldBytes));
   }
 
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }

package/src/crypto/secp256k1-signer/utils.ts

@@ -210,3 +210,35 @@ export function recoverPublicKey(hash: Buffer32, signature: Signature, opts: Rec
   const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
   return Buffer.from(publicKey, 'hex');
 }
+
+/** Arbitrary hash used for testing signature recoverability. */
+const PROBE_HASH = Buffer32.fromBuffer(keccak256(Buffer.from('signature-recoverability-probe')));
+
+/**
+ * Generates a random valid ECDSA signature that is recoverable to some address.
+ * Since Signature.random() produces real signatures via secp256k1 signing, the result is always
+ * recoverable, but we verify defensively by checking tryRecoverAddress.
+ */
+export function generateRecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = Signature.random();
+    if (tryRecoverAddress(PROBE_HASH, sig) !== undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate a recoverable signature after 100 attempts');
+}
+
+/**
+ * Generates a random signature where ECDSA address recovery fails.
+ * Uses random r/s values (not from real signing) so that r is unlikely to be a valid secp256k1 x-coordinate.
+ */
+export function generateUnrecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = new Signature(Buffer32.random(), Buffer32.random(), 27);
+    if (tryRecoverAddress(PROBE_HASH, sig) === undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate an unrecoverable signature after 100 attempts');
+}

package/src/curves/bn254/field.ts

@@ -118,14 +118,18 @@ abstract class BaseField {
   }
 
   cmp(rhs: BaseField): -1 | 0 | 1 {
-    const rhsBigInt = rhs.asBigInt;
-    return this.asBigInt === rhsBigInt ? 0 : this.asBigInt < rhsBigInt ? -1 : 1;
+    return BaseField.cmpAsBigInt(this.asBigInt, rhs.asBigInt);
   }
 
   static cmp(lhs: BaseField, rhs: BaseField): -1 | 0 | 1 {
     return lhs.cmp(rhs);
   }
 
+  // Actual bigint comparison. Arguments must have been validated previously.
+  static cmpAsBigInt(lhs: bigint, rhs: bigint): -1 | 0 | 1 {
+    return lhs === rhs ? 0 : lhs < rhs ? -1 : 1;
+  }
+
   isZero(): boolean {
     return this.asBigInt === 0n;
   }

package/src/curves/grumpkin/point.ts

@@ -65,7 +65,7 @@ export class Point {
   }
 
   /**
-   * Generate a random Point instance.
+   * Generate a random Point instance that is on the curve.
    *
    * @returns A randomly generated Point instance.
    */
@@ -125,9 +125,12 @@ export class Point {
   }
 
   /**
-   * Returns the contents of the point as an array of 2 fields.
-   * @returns The point as an array of 2 fields
+   * Returns the contents of the point as an array of 3 fields.
+   * @returns The point as an array of 3 fields
    */
+  // TODO(F-553): Once we take the breaking change and drop the custom Noir `Point` wrapper in
+  // `noir-projects/noir-protocol-circuits/crates/types/src/point.nr`, revert this to serialize as `[x, y]` (2 fields)
+  // and drop the `is_infinite` flag from `fromFields` / `toNoirStruct` below.
   toFields() {
     return [this.x, this.y, new Fr(this.isInfinite)];
   }

package/src/eth-signature/eth_signature.ts

@@ -1,8 +1,10 @@
 import { Buffer32 } from '@aztec/foundation/buffer';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import { secp256k1 } from '@noble/curves/secp256k1';
 import { z } from 'zod';
 
+import { randomBytes } from '../crypto/random/index.js';
 import { hasHexPrefix, hexToBuffer } from '../string/index.js';
 
 /**
@@ -77,8 +79,12 @@ export class Signature {
     return new Signature(Buffer32.fromBuffer(hexToBuffer(sig.r)), Buffer32.fromBuffer(hexToBuffer(sig.s)), sig.yParity);
   }
 
+  /** Generates a random valid ECDSA signature with a low s-value by signing a random message with a random key. */
   static random(): Signature {
-    return new Signature(Buffer32.random(), Buffer32.random(), 1);
+    const privateKey = randomBytes(32);
+    const message = randomBytes(32);
+    const { r, s, recovery } = secp256k1.sign(message, privateKey);
+    return new Signature(Buffer32.fromBigInt(r), Buffer32.fromBigInt(s), recovery ? 28 : 27);
   }
 
   static empty(): Signature {

package/src/json-rpc/client/safe_json_rpc_client.ts

@@ -24,6 +24,7 @@ export type SafeJsonRpcClientOptions = {
   batchWindowMS?: number;
   maxBatchSize?: number;
   maxRequestBodySize?: number;
+  extraHeaders?: Record<string, string>;
   onResponse?: (res: {
     response: any;
     headers: { get: (header: string) => string | null | undefined };
@@ -129,6 +130,7 @@ export function createSafeJsonRpcClient<T extends object>(
       const { response, headers } = await fetch(
         host,
         rpcCalls.map(({ request }) => request),
+        config.extraHeaders,
       );
 
       if (config.onResponse) {

package/src/json-rpc/server/api_key_auth.ts

@@ -0,0 +1,63 @@
+import { timingSafeEqual } from 'crypto';
+import type Koa from 'koa';
+
+import { sha256 } from '../../crypto/sha256/index.js';
+import { createLogger } from '../../log/index.js';
+
+const log = createLogger('json-rpc:api-key-auth');
+
+/**
+ * Computes the SHA-256 hash of a string and returns it as a Buffer.
+ * @param input - The input string to hash.
+ * @returns The SHA-256 hash as a Buffer.
+ */
+export function sha256Hash(input: string): Buffer {
+  return sha256(Buffer.from(input));
+}
+
+/**
+ * Creates a Koa middleware that enforces API key authentication on all requests
+ * except the health check endpoint (GET /status).
+ *
+ * The API key can be provided via the `x-api-key` header or the `Authorization: Bearer <key>` header.
+ * Comparison is done by hashing the provided key with SHA-256 and comparing against the stored hash.
+ *
+ * @param apiKeyHash - The SHA-256 hash of the expected API key as a Buffer.
+ * @returns A Koa middleware that rejects requests without a valid API key.
+ */
+export function getApiKeyAuthMiddleware(
+  apiKeyHash: Buffer,
+): (ctx: Koa.Context, next: () => Promise<void>) => Promise<void> {
+  return async (ctx: Koa.Context, next: () => Promise<void>) => {
+    // Allow health check through without auth
+    if (ctx.path === '/status' && ctx.method === 'GET') {
+      return next();
+    }
+
+    const providedKey = ctx.get('x-api-key') || ctx.get('authorization')?.replace(/^Bearer\s+/i, '');
+    if (!providedKey) {
+      log.warn(`Rejected admin RPC request from ${ctx.ip}: missing API key`);
+      ctx.status = 401;
+      ctx.body = {
+        jsonrpc: '2.0',
+        id: null,
+        error: { code: -32000, message: 'Unauthorized: invalid or missing API key' },
+      };
+      return;
+    }
+
+    const providedHashBuf = sha256Hash(providedKey);
+    if (!timingSafeEqual(apiKeyHash, providedHashBuf)) {
+      log.warn(`Rejected admin RPC request from ${ctx.ip}: invalid API key`);
+      ctx.status = 401;
+      ctx.body = {
+        jsonrpc: '2.0',
+        id: null,
+        error: { code: -32000, message: 'Unauthorized: invalid or missing API key' },
+      };
+      return;
+    }
+
+    await next();
+  };
+}

package/src/json-rpc/server/index.ts

@@ -1 +1,2 @@
+export * from './api_key_auth.js';
 export * from './safe_json_rpc_server.js';