@aztec/foundation 0.0.1-commit.3469e52 → 0.0.1-commit.350e0a4d

package/src/curves/grumpkin/point.ts

@@ -1,5 +1,4 @@
 import { toBigIntBE } from '../../bigint-buffer/index.js';
-import { poseidon2Hash } from '../../crypto/poseidon/index.js';
 import { randomBoolean } from '../../crypto/random/index.js';
 import { hexSchemaFor } from '../../schemas/utils.js';
 import { BufferReader, FieldReader, serializeToBuffer } from '../../serialize/index.js';
@@ -13,13 +12,16 @@ import { Fr } from '../bn254/field.js';
  * TODO(#7386): Clean up this class.
  */
 export class Point {
-  static ZERO = new Point(Fr.ZERO, Fr.ZERO, false);
+  static INFINITY = new Point(Fr.ZERO, Fr.ZERO);
   static SIZE_IN_BYTES = Fr.SIZE_IN_BYTES * 2;
   static COMPRESSED_SIZE_IN_BYTES = Fr.SIZE_IN_BYTES;
 
   /** Used to differentiate this class from AztecAddress */
   public readonly kind = 'point';
 
+  /** Whether the point is at infinity */
+  public readonly isInfinite: boolean;
+
   constructor(
     /**
      * The point's x coordinate
@@ -29,12 +31,10 @@ export class Point {
      * The point's y coordinate
      */
     public readonly y: Fr,
-    /**
-     * Whether the point is at infinity
-     */
-    public readonly isInfinite: boolean,
   ) {
     // TODO(#7386): check if on curve
+    // NOTE: now there is no isInfinite in the struct, empty == inf, so an empty class would pass an on-curve check. This may be fine depending on the usage.
+    this.isInfinite = x.isZero() && y.isZero();
   }
 
   toJSON() {
@@ -61,11 +61,11 @@ export class Point {
     if (obj instanceof Buffer || Buffer.isBuffer(obj)) {
       return Point.fromBuffer(obj);
     }
-    return new Point(Fr.fromPlainObject(obj.x), Fr.fromPlainObject(obj.y), obj.isInfinite ?? false);
+    return new this(Fr.fromPlainObject(obj.x), Fr.fromPlainObject(obj.y));
   }
 
   /**
-   * Generate a random Point instance.
+   * Generate a random Point instance that is on the curve.
    *
    * @returns A randomly generated Point instance.
    */
@@ -92,7 +92,7 @@ export class Point {
    */
   static fromBuffer(buffer: Buffer | BufferReader) {
     const reader = BufferReader.asReader(buffer);
-    return new this(Fr.fromBuffer(reader), Fr.fromBuffer(reader), false);
+    return new this(Fr.fromBuffer(reader), Fr.fromBuffer(reader));
   }
 
   /**
@@ -129,12 +129,13 @@ export class Point {
    * @returns The point as an array of 2 fields
    */
   toFields() {
-    return [this.x, this.y, new Fr(this.isInfinite)];
+    return [this.x, this.y];
   }
 
   static fromFields(fields: Fr[] | FieldReader) {
     const reader = FieldReader.asReader(fields);
-    return new this(reader.readField(), reader.readField(), reader.readBoolean());
+    const [x, y] = [reader.readField(), reader.readField()];
+    return new this(x, y);
   }
 
   /**
@@ -159,11 +160,12 @@ export class Point {
     const finalY = sign ? new Fr(yPositiveBigInt) : new Fr(yNegativeBigInt);
 
     // Create and return the new Point
-    return new this(x, finalY, false);
+    return new this(x, finalY);
   }
 
   /**
-   * @returns
+   * @param x - The x coordinate of the point
+   * @returns y^2 such that y^2 = x^3 - 17
    */
   static YFromX(x: Fr): Promise<Fr | null> {
     // Calculate y^2 = x^3 - 17 (i.e. the Grumpkin curve equation)
@@ -191,24 +193,15 @@ export class Point {
     return {
       x: this.x.toBigInt(),
       y: this.y.toBigInt(),
-      isInfinite: this.isInfinite ? 1n : 0n,
     };
   }
 
   /**
    * Converts the Point instance to a Buffer representation of the coordinates.
    * @returns A Buffer representation of the Point instance.
-   * @dev Note that toBuffer does not include the isInfinite flag and other serialization methods do (e.g. toFields).
-   * This is because currently when we work with point as bytes we don't want to populate the extra bytes for
-   * isInfinite flag because:
-   * 1. Our Grumpkin BB API currently does not handle point at infinity,
-   * 2. we use toBuffer when serializing notes and events and there we only work with public keys and point at infinity
-   *   is not considered a valid public key and the extra byte would raise DA cost.
+   * @dev Note that toBuffer does not include the isInfinite flag. The point at infinity is serialized as (0, 0).
    */
   toBuffer() {
-    if (this.isInfinite) {
-      throw new Error('Cannot serialize infinite point with isInfinite flag');
-    }
     const buf = serializeToBuffer([this.x, this.y]);
     if (buf.length !== Point.SIZE_IN_BYTES) {
       throw new Error(`Invalid buffer length for Point: ${buf.length}`);
@@ -258,12 +251,10 @@ export class Point {
   }
 
   toNoirStruct() {
-    /* eslint-disable camelcase */
-    return { x: this.x, y: this.y, is_infinite: this.isInfinite };
-    /* eslint-enable camelcase */
+    return { x: this.x, y: this.y };
   }
 
-  // Used for IvpkM, OvpkM, NpkM and TpkM. TODO(#8124): Consider removing this method.
+  // Used for IvpkM. TODO(#8124): Consider removing this method.
   toWrappedNoirStruct() {
     return { inner: this.toNoirStruct() };
   }
@@ -283,21 +274,13 @@ export class Point {
     return this.x.isZero() && this.y.isZero();
   }
 
-  hash() {
-    return poseidon2Hash(this.toFields());
-  }
-
   /**
-   * Check if this is point at infinity.
-   * Check this is consistent with how bb is encoding the point at infinity
+   * @param x - The x coordinate of the point
+   * @param y - The y coordinate of the point
+   * @returns Whether the point exists on Grumpkin
    */
-  public get inf() {
-    return this.isInfinite;
-  }
-
-  isOnGrumpkin() {
-    // TODO: Check this against how bb handles curve check and infinity point check
-    if (this.inf) {
+  isOnCurve() {
+    if (this.isInfinite) {
       return true;
     }
 

package/src/eth-address/index.ts

@@ -5,7 +5,6 @@ import { randomBytes } from '../crypto/random/index.js';
 import { Fr } from '../curves/bn254/index.js';
 import { hexSchemaFor } from '../schemas/utils.js';
 import { BufferReader, FieldReader } from '../serialize/index.js';
-import { TypeRegistry } from '../serialize/type_registry.js';
 import { bufferToHex } from '../string/index.js';
 
 /**
@@ -268,6 +267,3 @@ export class EthAddress {
     return addrA.equals(addrB);
   }
 }
-
-// For deserializing JSON.
-TypeRegistry.register('EthAddress', EthAddress);

package/src/eth-signature/eth_signature.ts

@@ -1,8 +1,10 @@
 import { Buffer32 } from '@aztec/foundation/buffer';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import { secp256k1 } from '@noble/curves/secp256k1';
 import { z } from 'zod';
 
+import { randomBytes } from '../crypto/random/index.js';
 import { hasHexPrefix, hexToBuffer } from '../string/index.js';
 
 /**
@@ -77,8 +79,12 @@ export class Signature {
     return new Signature(Buffer32.fromBuffer(hexToBuffer(sig.r)), Buffer32.fromBuffer(hexToBuffer(sig.s)), sig.yParity);
   }
 
+  /** Generates a random valid ECDSA signature with a low s-value by signing a random message with a random key. */
   static random(): Signature {
-    return new Signature(Buffer32.random(), Buffer32.random(), 1);
+    const privateKey = randomBytes(32);
+    const message = randomBytes(32);
+    const { r, s, recovery } = secp256k1.sign(message, privateKey);
+    return new Signature(Buffer32.fromBigInt(r), Buffer32.fromBigInt(s), recovery ? 28 : 27);
   }
 
   static empty(): Signature {

package/src/fifo/fifo_frame_reader.ts

@@ -0,0 +1,113 @@
+import EventEmitter from 'node:events';
+import * as fs from 'node:fs';
+import * as net from 'node:net';
+import type { Readable } from 'node:stream';
+
+/**
+ * Events emitted by FifoFrameReader.
+ *
+ * - `frame`: A complete frame payload (without the 4-byte length header).
+ * - `error`: An unrecoverable error (invalid frame length, stream error).
+ * - `end`: The underlying stream has ended.
+ */
+export interface FifoFrameReaderEvents {
+  frame: [payload: Buffer];
+  error: [error: Error];
+  end: [];
+}
+
+/**
+ * Reads length-delimited frames from a readable stream (typically a named FIFO pipe).
+ *
+ * Wire format: `[4-byte big-endian payload length][payload bytes]`
+ *
+ * Emits a `frame` event for each complete frame with the raw payload buffer.
+ * Callers are responsible for deserializing the payload (e.g., via msgpack).
+ *
+ * On encountering an invalid payload length (0 or >maxPayloadSize), emits `error`
+ * and destroys the stream.
+ */
+export class FifoFrameReader extends EventEmitter<FifoFrameReaderEvents> {
+  private stream: Readable | null = null;
+  private pendingBuf: Buffer = Buffer.alloc(0);
+  private running = false;
+
+  constructor(private readonly maxPayloadSize = 10 * 1024 * 1024) {
+    super();
+  }
+
+  /** Open a FIFO at the given path and start reading frames. */
+  start(fifoPath: string): void {
+    // Read the FIFO through a libuv pipe handle (net.Socket) rather than fs.createReadStream.
+    // An fs read stream services the pipe with a blocking threadpool read that destroy() cannot
+    // cancel: if a writer never closes, that read stays parked and keeps the host process alive
+    // (manifesting as Jest "did not exit"). Opening O_NONBLOCK and wrapping the fd in a pipe
+    // handle makes reads epoll-based, so stop()'s destroy() releases the handle immediately,
+    // regardless of whether the writer is still attached.
+    const fd = fs.openSync(fifoPath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+    let socket: net.Socket;
+    try {
+      socket = new net.Socket({ fd, readable: true, writable: false });
+    } catch (err) {
+      fs.closeSync(fd);
+      throw err;
+    }
+    this.startFromStream(socket);
+  }
+
+  /** Start reading frames from an existing readable stream. */
+  startFromStream(stream: Readable): void {
+    if (this.running) {
+      throw new Error('FifoFrameReader is already running');
+    }
+    this.running = true;
+    this.pendingBuf = Buffer.alloc(0);
+    this.stream = stream;
+
+    stream.on('data', (chunk: Buffer | string) => {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      this.pendingBuf = this.pendingBuf.length > 0 ? Buffer.concat([this.pendingBuf, buf]) : buf;
+      this.drainFrames();
+    });
+
+    stream.on('error', (err: Error) => {
+      if (this.running) {
+        this.emit('error', err);
+      }
+    });
+
+    stream.on('end', () => {
+      this.emit('end');
+    });
+  }
+
+  /** Stop reading and destroy the underlying stream. */
+  stop(): void {
+    this.running = false;
+    if (this.stream) {
+      this.stream.destroy();
+      this.stream = null;
+    }
+  }
+
+  /** Parse complete frames out of the pending buffer. */
+  private drainFrames(): void {
+    while (this.pendingBuf.length >= 4) {
+      const payloadLen = this.pendingBuf.readUInt32BE(0);
+      if (payloadLen === 0 || payloadLen > this.maxPayloadSize) {
+        this.emit('error', new Error(`Invalid payload length: ${payloadLen}`));
+        this.stop();
+        return;
+      }
+
+      const frameLen = 4 + payloadLen;
+      if (this.pendingBuf.length < frameLen) {
+        break; // Wait for more data
+      }
+
+      const payload = this.pendingBuf.subarray(4, frameLen);
+      this.pendingBuf = this.pendingBuf.subarray(frameLen);
+      this.emit('frame', Buffer.from(payload));
+    }
+  }
+}

package/src/fifo/index.ts

@@ -0,0 +1 @@
+export { FifoFrameReader } from './fifo_frame_reader.js';

package/src/fifo_set/fifo_set.ts

@@ -0,0 +1,52 @@
+/** A Set capped to a fixed number of entries, evicting the oldest inserted value when full. */
+export class FifoSet<T> extends Set<T> {
+  private _limit: number | undefined;
+
+  private constructor(values?: Iterable<T>) {
+    super(values);
+  }
+
+  /** Creates a bounded set with a positive integer limit. */
+  static withLimit<T>(limit: number, values?: Iterable<T>): FifoSet<T> {
+    if (!Number.isSafeInteger(limit) || limit <= 0) {
+      throw new TypeError(`FifoSet limit must be a positive safe integer: ${limit}`);
+    }
+
+    const set = new FifoSet(values);
+    set._limit = limit;
+    set.compact();
+
+    return set;
+  }
+
+  override add(value: T): this {
+    super.add(value);
+    this.compact();
+    return this;
+  }
+
+  /** Maximum number of entries retained by this set. */
+  public get limit(): number {
+    return this._limit ?? Infinity;
+  }
+
+  /** Evicts oldest entries until the set is within its limit. */
+  public compact(): void {
+    while (this.size > this.limit) {
+      const head = this.values().next();
+      if (head.done) {
+        return;
+      }
+      this.delete(head.value);
+    }
+  }
+
+  /** Adds a value only if it is absent, returning whether the set changed. */
+  public addIfAbsent(value: T): boolean {
+    if (this.has(value)) {
+      return false;
+    }
+    this.add(value);
+    return true;
+  }
+}

package/src/fifo_set/index.ts

@@ -0,0 +1 @@
+export * from './fifo_set.js';

package/src/jest/setup.mjs

@@ -1,3 +1,4 @@
+import { parseBooleanEnv } from '@aztec/foundation/config';
 import { overwriteLoggingStream, pinoPrettyOpts } from '@aztec/foundation/log';
 
 import pretty from 'pino-pretty';
@@ -6,4 +7,33 @@ import pretty from 'pino-pretty';
 // file so we don't mess up with dependencies in non-testing environments,
 // since pino-pretty messes up with browser bundles.
 // See also https://www.npmjs.com/package/pino-pretty?activeTab=readme#user-content-usage-with-jest
-overwriteLoggingStream(pretty(pinoPrettyOpts));
+if (!parseBooleanEnv(process.env.LOG_JSON)) {
+  overwriteLoggingStream(pretty(pinoPrettyOpts));
+}
+
+// Prevent timers from keeping the process alive after tests complete.
+// Libraries like viem create internal polling loops (via setTimeout) that
+// reschedule themselves indefinitely. In test environments we never want a
+// timer to be the reason the process can't exit. We also unref stdout/stderr
+// which, when they are pipes (as in Jest workers), remain ref'd by default.
+{
+  const origSetTimeout = globalThis.setTimeout;
+  const origSetInterval = globalThis.setInterval;
+  globalThis.setTimeout = function unrefSetTimeout(...args) {
+    const id = origSetTimeout.apply(this, args);
+    id?.unref?.();
+    return id;
+  };
+  // Preserve .unref, .__promisify__ etc. that may exist on the original
+  Object.setPrototypeOf(globalThis.setTimeout, origSetTimeout);
+
+  globalThis.setInterval = function unrefSetInterval(...args) {
+    const id = origSetInterval.apply(this, args);
+    id?.unref?.();
+    return id;
+  };
+  Object.setPrototypeOf(globalThis.setInterval, origSetInterval);
+
+  if (process.stdout?._handle?.unref) process.stdout._handle.unref();
+  if (process.stderr?._handle?.unref) process.stderr._handle.unref();
+}

package/src/json-rpc/client/fetch.ts

@@ -43,17 +43,18 @@ export async function defaultFetch(
   }
 
   let responseJson;
+  const responseText = await resp.text();
   try {
-    responseJson = await resp.json();
+    responseJson = JSON.parse(responseText);
   } catch {
     if (!resp.ok) {
       throw new Error(resp.statusText);
     }
-    throw new Error(`Failed to parse body as JSON: ${await resp.text()}`);
+    throw new Error(`Failed to parse body as JSON: ${responseText}`);
   }
 
   if (!resp.ok) {
-    const errorMessage = `Error ${resp.status} from server ${host}: ${responseJson.error.message}`;
+    const errorMessage = `Error ${resp.status} from server ${host}: ${responseJson?.error?.message ?? JSON.stringify(responseJson)}`;
     if (noRetry || (resp.status >= 400 && resp.status < 500)) {
       throw new NoRetryError(errorMessage);
     } else {

package/src/json-rpc/client/safe_json_rpc_client.ts

@@ -2,7 +2,7 @@ import { format } from 'util';
 
 import { type Logger, createLogger } from '../../log/pino-logger.js';
 import { type PromiseWithResolvers, promiseWithResolvers } from '../../promise/utils.js';
-import { type ApiSchema, type ApiSchemaFor, schemaHasMethod } from '../../schemas/api.js';
+import { type ApiSchema, type ApiSchemaFor, getSchemaReturnType, schemaHasMethod } from '../../schemas/api.js';
 import { jsonStringify } from '../convert.js';
 import { type JsonRpcFetch, defaultFetch } from './fetch.js';
 
@@ -24,6 +24,7 @@ export type SafeJsonRpcClientOptions = {
   batchWindowMS?: number;
   maxBatchSize?: number;
   maxRequestBodySize?: number;
+  extraHeaders?: Record<string, string>;
   onResponse?: (res: {
     response: any;
     headers: { get: (header: string) => string | null | undefined };
@@ -129,6 +130,7 @@ export function createSafeJsonRpcClient<T extends object>(
       const { response, headers } = await fetch(
         host,
         rpcCalls.map(({ request }) => request),
+        config.extraHeaders,
       );
 
       if (config.onResponse) {
@@ -234,7 +236,7 @@ export function createSafeJsonRpcClient<T extends object>(
     if ([null, undefined, 'null', 'undefined'].includes(response.result)) {
       return;
     }
-    return (schema as ApiSchema)[methodName].returnType().parseAsync(response.result);
+    return getSchemaReturnType((schema as ApiSchema)[methodName]).parseAsync(response.result);
   };
 
   const clientId = nextClientId++;

package/src/json-rpc/client/undici.ts

@@ -1,3 +1,5 @@
+import { promisify } from 'node:util';
+import { gunzip as gunzipCb, gzip as gzipCb } from 'node:zlib';
 import { Agent, type Dispatcher } from 'undici';
 
 import { createLogger } from '../../log/pino-logger.js';
@@ -5,8 +7,14 @@ import { NoRetryError } from '../../retry/index.js';
 import { jsonStringify } from '../convert.js';
 import type { JsonRpcFetch } from './fetch.js';
 
+const gzip = promisify(gzipCb);
+const gunzip = promisify(gunzipCb);
+
 const log = createLogger('json-rpc:json_rpc_client:undici');
 
+/** Minimum request size in bytes to trigger compression. */
+const COMPRESSION_THRESHOLD = 1024;
+
 export { Agent };
 
 export function makeUndiciFetch(client = new Agent()): JsonRpcFetch {
@@ -14,14 +22,18 @@ export function makeUndiciFetch(client = new Agent()): JsonRpcFetch {
     log.trace(`JsonRpcClient.fetch: ${host}`, { host, body });
     let resp: Dispatcher.ResponseData;
     try {
+      const jsonBody = Buffer.from(jsonStringify(body));
+      const shouldCompress = jsonBody.length >= COMPRESSION_THRESHOLD;
       resp = await client.request({
         method: 'POST',
         origin: new URL(host),
         path: '/',
-        body: jsonStringify(body),
+        body: shouldCompress ? await gzip(jsonBody) : jsonBody,
         headers: {
           ...extraHeaders,
           'content-type': 'application/json',
+          ...(shouldCompress && { 'content-encoding': 'gzip' }),
+          'accept-encoding': 'gzip',
         },
       });
     } catch (err) {
@@ -31,13 +43,21 @@ export function makeUndiciFetch(client = new Agent()): JsonRpcFetch {
 
     let responseJson: any;
     const responseOk = resp.statusCode >= 200 && resp.statusCode <= 299;
+    const contentEncoding = resp.headers['content-encoding'];
+    let responseText: string;
     try {
-      responseJson = await resp.body.json();
+      if (contentEncoding === 'gzip') {
+        const jsonBuffer = await gunzip(await resp.body.arrayBuffer());
+        responseText = jsonBuffer.toString('utf-8');
+      } else {
+        responseText = await resp.body.text();
+      }
+      responseJson = JSON.parse(responseText);
     } catch {
       if (!responseOk) {
         throw new Error('HTTP ' + resp.statusCode);
       }
-      throw new Error(`Failed to parse body as JSON: ${await resp.body.text()}`);
+      throw new Error(`Failed to parse body as JSON. encoding: ${contentEncoding}, body: ${responseText!}`);
     }
 
     if (!responseOk) {

package/src/json-rpc/fixtures/test_state.ts

@@ -130,14 +130,14 @@ export class TestState implements TestStateApi {
 }
 
 export const TestStateSchema: ApiSchemaFor<TestStateApi> = {
-  getNote: z.function().args(z.number()).returns(TestNote.schema.optional()),
-  getNotes: z.function().args(optional(schemas.Integer)).returns(z.array(TestNote.schema)),
-  getNotes2: z.function().args(optional(schemas.BigInt)).returns(z.array(TestNote.schema)),
-  getNotes3: z.function().args(optional(schemas.Integer)).returns(z.array(TestNote.schema)),
-  clear: z.function().returns(z.void()),
-  addNotes: z.function().args(z.array(TestNote.schema)).returns(z.array(TestNote.schema)),
-  fail: z.function().returns(z.void()),
-  count: z.function().returns(z.number()),
-  getStatus: z.function().returns(z.object({ status: z.string(), count: schemas.BigInt })),
-  getTuple: z.function().returns(z.tuple([z.string(), optional(z.string()), z.number()])),
+  getNote: z.function({ input: z.tuple([z.number()]), output: TestNote.schema.optional() }),
+  getNotes: z.function({ input: z.tuple([optional(schemas.Integer)]), output: z.array(TestNote.schema) }),
+  getNotes2: z.function({ input: z.tuple([optional(schemas.BigInt)]), output: z.array(TestNote.schema) }),
+  getNotes3: z.function({ input: z.tuple([optional(schemas.Integer)]), output: z.array(TestNote.schema) }),
+  clear: z.function({ input: z.tuple([]), output: z.void() }),
+  addNotes: z.function({ input: z.tuple([z.array(TestNote.schema)]), output: z.array(TestNote.schema) }),
+  fail: z.function({ input: z.tuple([]), output: z.void() }),
+  count: z.function({ input: z.tuple([]), output: z.number() }),
+  getStatus: z.function({ input: z.tuple([]), output: z.object({ status: z.string(), count: schemas.BigInt }) }),
+  getTuple: z.function({ input: z.tuple([]), output: z.tuple([z.string(), optional(z.string()), z.number()]) }),
 };

package/src/json-rpc/server/api_key_auth.ts

@@ -0,0 +1,63 @@
+import { timingSafeEqual } from 'crypto';
+import type Koa from 'koa';
+
+import { sha256 } from '../../crypto/sha256/index.js';
+import { createLogger } from '../../log/index.js';
+
+const log = createLogger('json-rpc:api-key-auth');
+
+/**
+ * Computes the SHA-256 hash of a string and returns it as a Buffer.
+ * @param input - The input string to hash.
+ * @returns The SHA-256 hash as a Buffer.
+ */
+export function sha256Hash(input: string): Buffer {
+  return sha256(Buffer.from(input));
+}
+
+/**
+ * Creates a Koa middleware that enforces API key authentication on all requests
+ * except the health check endpoint (GET /status).
+ *
+ * The API key can be provided via the `x-api-key` header or the `Authorization: Bearer <key>` header.
+ * Comparison is done by hashing the provided key with SHA-256 and comparing against the stored hash.
+ *
+ * @param apiKeyHash - The SHA-256 hash of the expected API key as a Buffer.
+ * @returns A Koa middleware that rejects requests without a valid API key.
+ */
+export function getApiKeyAuthMiddleware(
+  apiKeyHash: Buffer,
+): (ctx: Koa.Context, next: () => Promise<void>) => Promise<void> {
+  return async (ctx: Koa.Context, next: () => Promise<void>) => {
+    // Allow health check through without auth
+    if (ctx.path === '/status' && ctx.method === 'GET') {
+      return next();
+    }
+
+    const providedKey = ctx.get('x-api-key') || ctx.get('authorization')?.replace(/^Bearer\s+/i, '');
+    if (!providedKey) {
+      log.warn(`Rejected admin RPC request from ${ctx.ip}: missing API key`);
+      ctx.status = 401;
+      ctx.body = {
+        jsonrpc: '2.0',
+        id: null,
+        error: { code: -32000, message: 'Unauthorized: invalid or missing API key' },
+      };
+      return;
+    }
+
+    const providedHashBuf = sha256Hash(providedKey);
+    if (!timingSafeEqual(apiKeyHash, providedHashBuf)) {
+      log.warn(`Rejected admin RPC request from ${ctx.ip}: invalid API key`);
+      ctx.status = 401;
+      ctx.body = {
+        jsonrpc: '2.0',
+        id: null,
+        error: { code: -32000, message: 'Unauthorized: invalid or missing API key' },
+      };
+      return;
+    }
+
+    await next();
+  };
+}

package/src/json-rpc/server/index.ts

@@ -1 +1,2 @@
+export * from './api_key_auth.js';
 export * from './safe_json_rpc_server.js';