@aztec/foundation 0.0.1-commit.e2b2873ed → 0.0.1-commit.e304674f1

package/src/config/env_var.ts

@@ -1,7 +1,6 @@
 export type EnvVar =
   | 'REGISTRY_CONTRACT_ADDRESS'
   | 'FEE_ASSET_HANDLER_CONTRACT_ADDRESS'
-  | 'SLASH_FACTORY_CONTRACT_ADDRESS'
   | 'ACVM_BINARY_PATH'
   | 'ACVM_WORKING_DIRECTORY'
   | 'API_KEY'
@@ -12,6 +11,9 @@ export type EnvVar =
   | 'ARCHIVER_VIEM_POLLING_INTERVAL_MS'
   | 'ARCHIVER_BATCH_SIZE'
   | 'AZTEC_ADMIN_PORT'
+  | 'AZTEC_ADMIN_API_KEY_HASH'
+  | 'AZTEC_DISABLE_ADMIN_API_KEY'
+  | 'AZTEC_RESET_ADMIN_API_KEY'
   | 'AZTEC_NODE_ADMIN_URL'
   | 'AZTEC_NODE_URL'
   | 'AZTEC_PORT'
@@ -20,6 +22,8 @@ export type EnvVar =
   | 'BB_WORKING_DIRECTORY'
   | 'BB_NUM_IVC_VERIFIERS'
   | 'BB_IVC_CONCURRENCY'
+  | 'BB_CHONK_VERIFY_MAX_BATCH'
+  | 'BB_CHONK_VERIFY_BATCH_CONCURRENCY'
   | 'BOOTSTRAP_NODES'
   | 'BLOB_ARCHIVE_API_URL'
   | 'BLOB_FILE_STORE_URLS'
@@ -47,7 +51,10 @@ export type EnvVar =
   | 'BOT_TX_MINED_WAIT_SECONDS'
   | 'BOT_MAX_CONSECUTIVE_ERRORS'
   | 'BOT_STOP_WHEN_UNHEALTHY'
-  | 'BOT_AMM_TXS'
+  | 'BOT_MODE'
+  | 'BOT_L2_TO_L1_MESSAGES_PER_TX'
+  | 'BOT_L1_TO_L2_SEED_COUNT'
+  | 'BOT_L1_TO_L2_SEED_INTERVAL'
   | 'COINBASE'
   | 'CRS_PATH'
   | 'DATA_DIRECTORY'
@@ -56,6 +63,7 @@ export type EnvVar =
   | 'BLOB_SINK_MAP_SIZE_KB'
   | 'P2P_STORE_MAP_SIZE_KB'
   | 'PROVER_BROKER_STORE_MAP_SIZE_KB'
+  | 'SIGNING_PROTECTION_MAP_SIZE_KB'
   | 'WS_DB_MAP_SIZE_KB'
   | 'ARCHIVE_TREE_MAP_SIZE_KB'
   | 'NULLIFIER_TREE_MAP_SIZE_KB'
@@ -64,6 +72,7 @@ export type EnvVar =
   | 'PUBLIC_DATA_TREE_MAP_SIZE_KB'
   | 'DEBUG'
   | 'DEBUG_P2P_DISABLE_COLOCATION_PENALTY'
+  | 'ENABLE_PROVER_NODE'
   | 'ETHEREUM_HOSTS'
   | 'ETHEREUM_DEBUG_HOSTS'
   | 'ETHEREUM_ALLOW_NO_DEBUG_HOSTS'
@@ -73,8 +82,10 @@ export type EnvVar =
   | 'KEY_STORE_DIRECTORY'
   | 'L1_CHAIN_ID'
   | 'L1_CONSENSUS_HOST_URLS'
+  | 'ETHEREUM_HTTP_TIMEOUT_MS'
   | 'L1_CONSENSUS_HOST_API_KEYS'
   | 'L1_CONSENSUS_HOST_API_KEY_HEADERS'
+  | 'L1_TX_FAILED_STORE'
   | 'LOG_JSON'
   | 'LOG_MULTILINE'
   | 'LOG_NO_COLOR_PER_ACTOR'
@@ -121,6 +132,7 @@ export type EnvVar =
   | 'P2P_L2_QUEUE_SIZE'
   | 'P2P_MAX_PEERS'
   | 'P2P_PEER_CHECK_INTERVAL_MS'
+  | 'P2P_PEER_FAILED_BAN_TIME_MS'
   | 'P2P_PEER_PENALTY_VALUES'
   | 'P2P_QUERY_FOR_IP'
   | 'P2P_REQRESP_INDIVIDUAL_REQUEST_TIMEOUT_MS'
@@ -141,9 +153,10 @@ export type EnvVar =
   | 'P2P_PREFERRED_PEERS'
   | 'P2P_MAX_PENDING_TX_COUNT'
   | 'P2P_SEEN_MSG_CACHE_SIZE'
-  | 'P2P_DROP_TX'
   | 'P2P_DROP_TX_CHANCE'
   | 'P2P_TX_POOL_DELETE_TXS_AFTER_REORG'
+  | 'P2P_MIN_TX_POOL_AGE_MS'
+  | 'P2P_RPC_PRICE_BUMP_PERCENTAGE'
   | 'DEBUG_P2P_INSTRUMENT_MESSAGES'
   | 'PEER_ID_PRIVATE_KEY'
   | 'PEER_ID_PRIVATE_KEY_PATH'
@@ -159,6 +172,7 @@ export type EnvVar =
   | 'PROVER_BROKER_MAX_EPOCHS_TO_KEEP_RESULTS_FOR'
   | 'PROVER_BROKER_DEBUG_REPLAY_ENABLED'
   | 'PROVER_CANCEL_JOBS_ON_STOP'
+  | 'PROVER_ENQUEUE_CONCURRENCY'
   | 'PROVER_COORDINATION_NODE_URLS'
   | 'PROVER_PROOF_STORE'
   | 'PROVER_FAILED_PROOF_STORE'
@@ -192,27 +206,32 @@ export type EnvVar =
   | 'SENTINEL_ENABLED'
   | 'SENTINEL_HISTORY_LENGTH_IN_EPOCHS'
   | 'SENTINEL_HISTORIC_PROVEN_PERFORMANCE_LENGTH_IN_EPOCHS'
-  | 'SEQ_MAX_BLOCK_SIZE_IN_BYTES'
+  | 'SEQ_ENABLE_PROPOSER_PIPELINING'
   | 'SEQ_MAX_TX_PER_BLOCK'
+  | 'SEQ_MAX_TX_PER_CHECKPOINT'
   | 'SEQ_MIN_TX_PER_BLOCK'
   | 'SEQ_PUBLISH_TXS_WITH_PROPOSALS'
   | 'SEQ_MAX_DA_BLOCK_GAS'
   | 'SEQ_MAX_L2_BLOCK_GAS'
+  | 'SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER'
+  | 'SEQ_REDISTRIBUTE_CHECKPOINT_BUDGET'
   | 'SEQ_PUBLISHER_PRIVATE_KEY'
   | 'SEQ_PUBLISHER_PRIVATE_KEYS'
   | 'SEQ_PUBLISHER_ADDRESSES'
   | 'SEQ_PUBLISHER_ALLOW_INVALID_STATES'
   | 'SEQ_PUBLISHER_FORWARDER_ADDRESS'
+  | 'PUBLISHER_FUNDING_THRESHOLD'
+  | 'PUBLISHER_FUNDING_AMOUNT'
   | 'SEQ_POLLING_INTERVAL_MS'
   | 'SEQ_ENFORCE_TIME_TABLE'
   | 'SEQ_L1_PUBLISHING_TIME_ALLOWANCE_IN_SLOT'
   | 'SEQ_ATTESTATION_PROPAGATION_TIME'
   | 'SEQ_BLOCK_DURATION_MS'
+  | 'SEQ_EXPECTED_BLOCK_PROPOSALS_PER_SLOT'
   | 'SEQ_BUILD_CHECKPOINT_IF_EMPTY'
   | 'SEQ_SECONDS_BEFORE_INVALIDATING_BLOCK_AS_COMMITTEE_MEMBER'
   | 'SEQ_SECONDS_BEFORE_INVALIDATING_BLOCK_AS_NON_COMMITTEE_MEMBER'
-  | 'SLASH_MIN_PENALTY_PERCENTAGE'
-  | 'SLASH_MAX_PENALTY_PERCENTAGE'
+  | 'SEQ_SKIP_CHECKPOINT_PUBLISH_PERCENT'
   | 'SLASH_VALIDATORS_ALWAYS'
   | 'SLASH_VALIDATORS_NEVER'
   | 'SLASH_PRUNE_PENALTY'
@@ -237,6 +256,7 @@ export type EnvVar =
   | 'TELEMETRY'
   | 'TEST_ACCOUNTS'
   | 'SPONSORED_FPC'
+  | 'PREFUND_ADDRESSES'
   | 'TX_COLLECTION_FAST_NODES_TIMEOUT_BEFORE_REQ_RESP_MS'
   | 'TX_COLLECTION_SLOW_NODES_INTERVAL_MS'
   | 'TX_COLLECTION_SLOW_REQ_RESP_INTERVAL_MS'
@@ -251,6 +271,12 @@ export type EnvVar =
   | 'TX_COLLECTION_FILE_STORE_URLS'
   | 'TX_COLLECTION_FILE_STORE_SLOW_DELAY_MS'
   | 'TX_COLLECTION_FILE_STORE_FAST_DELAY_MS'
+  | 'TX_COLLECTION_FILE_STORE_FAST_WORKER_COUNT'
+  | 'TX_COLLECTION_FILE_STORE_SLOW_WORKER_COUNT'
+  | 'TX_COLLECTION_FILE_STORE_FAST_BACKOFF_BASE_MS'
+  | 'TX_COLLECTION_FILE_STORE_SLOW_BACKOFF_BASE_MS'
+  | 'TX_COLLECTION_FILE_STORE_FAST_BACKOFF_MAX_MS'
+  | 'TX_COLLECTION_FILE_STORE_SLOW_BACKOFF_MAX_MS'
   | 'TX_FILE_STORE_URL'
   | 'TX_FILE_STORE_UPLOAD_CONCURRENCY'
   | 'TX_FILE_STORE_MAX_QUEUE_SIZE'
@@ -260,15 +286,19 @@ export type EnvVar =
   | 'TRANSACTIONS_DISABLED'
   | 'VALIDATOR_ATTESTATIONS_POLLING_INTERVAL_MS'
   | 'VALIDATOR_DISABLED'
+  | 'VALIDATOR_MAX_DA_BLOCK_GAS'
+  | 'VALIDATOR_MAX_L2_BLOCK_GAS'
+  | 'VALIDATOR_MAX_TX_PER_BLOCK'
+  | 'VALIDATOR_MAX_TX_PER_CHECKPOINT'
   | 'VALIDATOR_PRIVATE_KEYS'
   | 'VALIDATOR_PRIVATE_KEY'
-  | 'VALIDATOR_REEXECUTE'
   | 'VALIDATOR_ADDRESSES'
   | 'ROLLUP_VERSION'
   | 'WS_BLOCK_CHECK_INTERVAL_MS'
   | 'WS_BLOCK_REQUEST_BATCH_SIZE'
   | 'L1_READER_VIEM_POLLING_INTERVAL_MS'
   | 'WS_DATA_DIRECTORY'
+  | 'WS_NUM_HISTORIC_CHECKPOINTS'
   | 'WS_NUM_HISTORIC_BLOCKS'
   | 'ETHEREUM_SLOT_DURATION'
   | 'AZTEC_SLOT_DURATION'
@@ -294,7 +324,7 @@ export type EnvVar =
   | 'AZTEC_SLASH_AMOUNT_SMALL'
   | 'AZTEC_SLASH_AMOUNT_MEDIUM'
   | 'AZTEC_SLASH_AMOUNT_LARGE'
-  | 'AZTEC_SLASHER_FLAVOR'
+  | 'AZTEC_SLASHER_ENABLED'
   | 'AZTEC_GOVERNANCE_PROPOSER_QUORUM'
   | 'AZTEC_GOVERNANCE_PROPOSER_ROUND_SIZE'
   | 'AZTEC_GOVERNANCE_VOTING_DURATION'
@@ -323,12 +353,12 @@ export type EnvVar =
   | 'K8S_POD_NAME'
   | 'K8S_POD_UID'
   | 'K8S_NAMESPACE_NAME'
-  | 'VALIDATOR_REEXECUTE_DEADLINE_MS'
-  | 'AUTO_UPDATE'
-  | 'AUTO_UPDATE_URL'
+  | 'ENABLE_VERSION_CHECK'
   | 'WEB3_SIGNER_URL'
   | 'SKIP_ARCHIVER_INITIAL_SYNC'
   | 'BLOB_ALLOW_EMPTY_SOURCES'
+  | 'BLOB_PREFER_FILESTORES'
+  | 'BLOB_FILE_STORE_TIMEOUT_MS'
   | 'FISHERMAN_MODE'
   | 'MAX_ALLOWED_ETH_CLIENT_DRIFT_SECONDS'
   | 'LEGACY_BLS_CLI'

package/src/config/index.ts

@@ -177,6 +177,21 @@ export function bigintConfigHelper(defaultVal?: bigint): Pick<ConfigMapping, 'pa
       if (val === '') {
         return defaultVal;
       }
+      // Handle scientific notation (e.g. "1e+23", "2E23") which BigInt() doesn't accept directly.
+      // We parse it losslessly using bigint arithmetic instead of going through float64.
+      if (/[eE]/.test(val)) {
+        const match = val.match(/^(-?\d+(?:\.(\d+))?)[eE]([+-]?\d+)$/);
+        if (!match) {
+          throw new Error(`Cannot convert '${val}' to a BigInt`);
+        }
+        const digits = match[1].replace('.', '');
+        const decimalPlaces = match[2]?.length ?? 0;
+        const exponent = parseInt(match[3], 10) - decimalPlaces;
+        if (exponent < 0) {
+          throw new Error(`Cannot convert '${val}' to a BigInt: result is not an integer`);
+        }
+        return BigInt(digits) * 10n ** BigInt(exponent);
+      }
       return BigInt(val);
     },
     defaultValue: defaultVal,

package/src/config/network_config.ts

@@ -5,10 +5,13 @@ export const NetworkConfigSchema = z
     bootnodes: z.array(z.string()),
     snapshots: z.array(z.string()),
     blobFileStoreUrls: z.array(z.string()).optional(),
+    txCollectionFileStoreUrls: z.array(z.string()).optional(),
     registryAddress: z.string(),
     feeAssetHandlerAddress: z.string().optional(),
     l1ChainId: z.number(),
     blockDurationMs: z.number().positive().optional(),
+    txPublicSetupAllowListExtend: z.string().optional(),
+    nodeVersion: z.string().optional(),
   })
   .passthrough(); // Allow additional unknown fields to pass through
 

package/src/config/network_name.ts

@@ -5,7 +5,8 @@ export type NetworkNames =
   | 'testnet'
   | 'mainnet'
   | 'next-net'
-  | 'devnet';
+  | 'devnet'
+  | `v${number}-devnet-${number}`;
 
 export function getActiveNetworkName(name?: string): NetworkNames {
   const network = name || process.env.NETWORK;
@@ -23,6 +24,8 @@ export function getActiveNetworkName(name?: string): NetworkNames {
     return 'next-net';
   } else if (network === 'devnet') {
     return 'devnet';
+  } else if (/^v\d+-devnet-\d+$/.test(network)) {
+    return network as `v${number}-devnet-${number}`;
   }
   throw new Error(`Unknown network: ${network}`);
 }

package/src/crypto/aes128/index.ts

@@ -59,10 +59,19 @@ export class Aes128 {
    * @param iv - AES initialization vector.
    * @param key - Key to decrypt with.
    * @returns Decrypted data.
+   * @throws If the decrypted buffer has invalid PKCS#7 padding.
    */
   public async decryptBufferCBC(data: Uint8Array, iv: Uint8Array, key: Uint8Array) {
     const paddedBuffer = await this.decryptBufferCBCKeepPadding(data, iv, key);
-    const paddingToRemove = paddedBuffer[paddedBuffer.length - 1];
-    return paddedBuffer.subarray(0, paddedBuffer.length - paddingToRemove);
+    const paddingLen = paddedBuffer[paddedBuffer.length - 1];
+    if (paddingLen === 0 || paddingLen > 16) {
+      throw new Error(`Invalid PKCS#7 padding length: ${paddingLen}`);
+    }
+    for (let i = paddedBuffer.length - paddingLen; i < paddedBuffer.length; i++) {
+      if (paddedBuffer[i] !== paddingLen) {
+        throw new Error('Invalid PKCS#7 padding');
+      }
+    }
+    return paddedBuffer.subarray(0, paddedBuffer.length - paddingLen);
   }
 }

package/src/crypto/bls/bn254_keystore.ts

@@ -262,26 +262,3 @@ export function decryptBn254KeystoreFromObject(keystore: Bn254Keystore, password
     throw new Bn254KeystoreError(`Failed to decrypt keystore: ${String(error)}`, error as Error);
   }
 }
-
-/**
- * Validates that a decrypted private key matches the public key in the keystore.
- *
- * @param privateKeyHex - Decrypted private key (0x-prefixed)
- * @param expectedPubkey - Expected public key from keystore
- * @param computePublicKey - Function to compute public key from private key
- * @returns true if keys match, false otherwise
- */
-export function verifyBn254Keypair(
-  privateKeyHex: string,
-  expectedPubkey: string,
-  computePublicKey: (privateKey: string) => string,
-): boolean {
-  try {
-    const computedPubkey = computePublicKey(privateKeyHex);
-    const normalizedExpected = expectedPubkey.toLowerCase().replace(/^0x/i, '');
-    const normalizedComputed = computedPubkey.toLowerCase().replace(/^0x/i, '');
-    return normalizedExpected === normalizedComputed;
-  } catch {
-    return false;
-  }
-}

package/src/crypto/poseidon/index.ts

@@ -1,21 +1,35 @@
-import { BarretenbergSync } from '@aztec/bb.js';
+import { Barretenberg, BarretenbergSync } from '@aztec/bb.js';
 
 import { Fr } from '../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../serialize/serialize.js';
 
+const IS_BROWSER = typeof self !== 'undefined';
+
+async function poseidon2HashFields(inputFields: Fr[]): Promise<Fr> {
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  }
+}
+
 /**
  * Create a poseidon hash (field) from an array of input fields.
  * @param input - The input fields to hash.
  * @returns The poseidon hash.
  */
-export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
-  const inputFields = serializeToFields(input);
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+export function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
+  return poseidon2HashFields(serializeToFields(input));
 }
 
 /**
@@ -24,15 +38,10 @@ export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
  * @param separator - The domain separator.
  * @returns The poseidon hash.
  */
-export async function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
+export function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
   const inputFields = serializeToFields(input);
   inputFields.unshift(new Fr(separator));
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }
 
 /**
@@ -42,19 +51,24 @@ export async function poseidon2HashWithSeparator(input: Fieldable[], separator:
  */
 export async function poseidon2Permutation(input: Fieldable[]): Promise<Fr[]> {
   const inputFields = serializeToFields(input);
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(input.length === 4, 'Input state must be of size 4');
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Permutation({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(response.outputs.length === 4, 'Output state must be of size 4');
-  return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  }
 }
 
-export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
+export function poseidon2HashBytes(input: Buffer): Promise<Fr> {
   const inputFields = [];
   for (let i = 0; i < input.length; i += 31) {
     const fieldBytes = Buffer.alloc(32, 0);
@@ -65,11 +79,5 @@ export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
     inputFields.push(Fr.fromBuffer(fieldBytes));
   }
 
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }

package/src/crypto/secp256k1-signer/utils.ts

@@ -210,3 +210,35 @@ export function recoverPublicKey(hash: Buffer32, signature: Signature, opts: Rec
   const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
   return Buffer.from(publicKey, 'hex');
 }
+
+/** Arbitrary hash used for testing signature recoverability. */
+const PROBE_HASH = Buffer32.fromBuffer(keccak256(Buffer.from('signature-recoverability-probe')));
+
+/**
+ * Generates a random valid ECDSA signature that is recoverable to some address.
+ * Since Signature.random() produces real signatures via secp256k1 signing, the result is always
+ * recoverable, but we verify defensively by checking tryRecoverAddress.
+ */
+export function generateRecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = Signature.random();
+    if (tryRecoverAddress(PROBE_HASH, sig) !== undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate a recoverable signature after 100 attempts');
+}
+
+/**
+ * Generates a random signature where ECDSA address recovery fails.
+ * Uses random r/s values (not from real signing) so that r is unlikely to be a valid secp256k1 x-coordinate.
+ */
+export function generateUnrecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = new Signature(Buffer32.random(), Buffer32.random(), 27);
+    if (tryRecoverAddress(PROBE_HASH, sig) === undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate an unrecoverable signature after 100 attempts');
+}

package/src/curves/bn254/field.ts

@@ -118,14 +118,18 @@ abstract class BaseField {
   }
 
   cmp(rhs: BaseField): -1 | 0 | 1 {
-    const rhsBigInt = rhs.asBigInt;
-    return this.asBigInt === rhsBigInt ? 0 : this.asBigInt < rhsBigInt ? -1 : 1;
+    return BaseField.cmpAsBigInt(this.asBigInt, rhs.asBigInt);
   }
 
   static cmp(lhs: BaseField, rhs: BaseField): -1 | 0 | 1 {
     return lhs.cmp(rhs);
   }
 
+  // Actual bigint comparison. Arguments must have been validated previously.
+  static cmpAsBigInt(lhs: bigint, rhs: bigint): -1 | 0 | 1 {
+    return lhs === rhs ? 0 : lhs < rhs ? -1 : 1;
+  }
+
   isZero(): boolean {
     return this.asBigInt === 0n;
   }

package/src/curves/grumpkin/point.ts

@@ -65,7 +65,7 @@ export class Point {
   }
 
   /**
-   * Generate a random Point instance.
+   * Generate a random Point instance that is on the curve.
    *
    * @returns A randomly generated Point instance.
    */

package/src/eth-signature/eth_signature.ts

@@ -1,8 +1,10 @@
 import { Buffer32 } from '@aztec/foundation/buffer';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import { secp256k1 } from '@noble/curves/secp256k1';
 import { z } from 'zod';
 
+import { randomBytes } from '../crypto/random/index.js';
 import { hasHexPrefix, hexToBuffer } from '../string/index.js';
 
 /**
@@ -77,8 +79,12 @@ export class Signature {
     return new Signature(Buffer32.fromBuffer(hexToBuffer(sig.r)), Buffer32.fromBuffer(hexToBuffer(sig.s)), sig.yParity);
   }
 
+  /** Generates a random valid ECDSA signature with a low s-value by signing a random message with a random key. */
   static random(): Signature {
-    return new Signature(Buffer32.random(), Buffer32.random(), 1);
+    const privateKey = randomBytes(32);
+    const message = randomBytes(32);
+    const { r, s, recovery } = secp256k1.sign(message, privateKey);
+    return new Signature(Buffer32.fromBigInt(r), Buffer32.fromBigInt(s), recovery ? 28 : 27);
   }
 
   static empty(): Signature {

package/src/fifo/fifo_frame_reader.ts

@@ -0,0 +1,98 @@
+import EventEmitter from 'node:events';
+import * as fs from 'node:fs';
+import type { Readable } from 'node:stream';
+
+/**
+ * Events emitted by FifoFrameReader.
+ *
+ * - `frame`: A complete frame payload (without the 4-byte length header).
+ * - `error`: An unrecoverable error (invalid frame length, stream error).
+ * - `end`: The underlying stream has ended.
+ */
+export interface FifoFrameReaderEvents {
+  frame: [payload: Buffer];
+  error: [error: Error];
+  end: [];
+}
+
+/**
+ * Reads length-delimited frames from a readable stream (typically a named FIFO pipe).
+ *
+ * Wire format: `[4-byte big-endian payload length][payload bytes]`
+ *
+ * Emits a `frame` event for each complete frame with the raw payload buffer.
+ * Callers are responsible for deserializing the payload (e.g., via msgpack).
+ *
+ * On encountering an invalid payload length (0 or >maxPayloadSize), emits `error`
+ * and destroys the stream.
+ */
+export class FifoFrameReader extends EventEmitter<FifoFrameReaderEvents> {
+  private stream: Readable | null = null;
+  private pendingBuf: Buffer = Buffer.alloc(0);
+  private running = false;
+
+  constructor(private readonly maxPayloadSize = 10 * 1024 * 1024) {
+    super();
+  }
+
+  /** Open a FIFO at the given path and start reading frames. */
+  start(fifoPath: string, highWaterMark = 64 * 1024): void {
+    this.startFromStream(fs.createReadStream(fifoPath, { highWaterMark }));
+  }
+
+  /** Start reading frames from an existing readable stream. */
+  startFromStream(stream: Readable): void {
+    if (this.running) {
+      throw new Error('FifoFrameReader is already running');
+    }
+    this.running = true;
+    this.pendingBuf = Buffer.alloc(0);
+    this.stream = stream;
+
+    stream.on('data', (chunk: Buffer | string) => {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      this.pendingBuf = this.pendingBuf.length > 0 ? Buffer.concat([this.pendingBuf, buf]) : buf;
+      this.drainFrames();
+    });
+
+    stream.on('error', (err: Error) => {
+      if (this.running) {
+        this.emit('error', err);
+      }
+    });
+
+    stream.on('end', () => {
+      this.emit('end');
+    });
+  }
+
+  /** Stop reading and destroy the underlying stream. */
+  stop(): void {
+    this.running = false;
+    if (this.stream) {
+      this.stream.destroy();
+      this.stream = null;
+    }
+  }
+
+  /** Parse complete frames out of the pending buffer. */
+  private drainFrames(): void {
+    while (this.pendingBuf.length >= 4) {
+      const payloadLen = this.pendingBuf.readUInt32BE(0);
+      if (payloadLen === 0 || payloadLen > this.maxPayloadSize) {
+        this.emit('error', new Error(`Invalid payload length: ${payloadLen}`));
+        this.stop();
+        return;
+      }
+
+      const frameLen = 4 + payloadLen;
+      if (this.pendingBuf.length < frameLen) {
+        break; // Wait for more data
+      }
+
+      const payload = this.pendingBuf.subarray(4, frameLen);
+      this.pendingBuf = this.pendingBuf.subarray(frameLen);
+      this.emit('frame', Buffer.from(payload));
+    }
+  }
+}

package/src/fifo/index.ts

@@ -0,0 +1 @@
+export { FifoFrameReader } from './fifo_frame_reader.js';

package/src/jest/setup.mjs

@@ -10,3 +10,30 @@ import pretty from 'pino-pretty';
 if (!parseBooleanEnv(process.env.LOG_JSON)) {
   overwriteLoggingStream(pretty(pinoPrettyOpts));
 }
+
+// Prevent timers from keeping the process alive after tests complete.
+// Libraries like viem create internal polling loops (via setTimeout) that
+// reschedule themselves indefinitely. In test environments we never want a
+// timer to be the reason the process can't exit. We also unref stdout/stderr
+// which, when they are pipes (as in Jest workers), remain ref'd by default.
+{
+  const origSetTimeout = globalThis.setTimeout;
+  const origSetInterval = globalThis.setInterval;
+  globalThis.setTimeout = function unrefSetTimeout(...args) {
+    const id = origSetTimeout.apply(this, args);
+    id?.unref?.();
+    return id;
+  };
+  // Preserve .unref, .__promisify__ etc. that may exist on the original
+  Object.setPrototypeOf(globalThis.setTimeout, origSetTimeout);
+
+  globalThis.setInterval = function unrefSetInterval(...args) {
+    const id = origSetInterval.apply(this, args);
+    id?.unref?.();
+    return id;
+  };
+  Object.setPrototypeOf(globalThis.setInterval, origSetInterval);
+
+  if (process.stdout?._handle?.unref) process.stdout._handle.unref();
+  if (process.stderr?._handle?.unref) process.stderr._handle.unref();
+}

package/src/json-rpc/client/fetch.ts

@@ -43,17 +43,18 @@ export async function defaultFetch(
   }
 
   let responseJson;
+  const responseText = await resp.text();
   try {
-    responseJson = await resp.json();
+    responseJson = JSON.parse(responseText);
   } catch {
     if (!resp.ok) {
       throw new Error(resp.statusText);
     }
-    throw new Error(`Failed to parse body as JSON: ${await resp.text()}`);
+    throw new Error(`Failed to parse body as JSON: ${responseText}`);
   }
 
   if (!resp.ok) {
-    const errorMessage = `Error ${resp.status} from server ${host}: ${responseJson.error.message}`;
+    const errorMessage = `Error ${resp.status} from server ${host}: ${responseJson?.error?.message ?? JSON.stringify(responseJson)}`;
     if (noRetry || (resp.status >= 400 && resp.status < 500)) {
       throw new NoRetryError(errorMessage);
     } else {

package/src/json-rpc/client/safe_json_rpc_client.ts

@@ -24,6 +24,7 @@ export type SafeJsonRpcClientOptions = {
   batchWindowMS?: number;
   maxBatchSize?: number;
   maxRequestBodySize?: number;
+  extraHeaders?: Record<string, string>;
   onResponse?: (res: {
     response: any;
     headers: { get: (header: string) => string | null | undefined };
@@ -129,6 +130,7 @@ export function createSafeJsonRpcClient<T extends object>(
       const { response, headers } = await fetch(
         host,
         rpcCalls.map(({ request }) => request),
+        config.extraHeaders,
       );
 
       if (config.onResponse) {