@aztec/key-store 0.0.1-fake-c83136db25 → 0.0.2-commit.217f559981

package/dest/index.d.ts

@@ -1,2 +1,2 @@
 export * from './key_store.js';
-//# sourceMappingURL=index.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGdCQUFnQixDQUFDIn0=

package/dest/key_store.d.ts

@@ -1,4 +1,5 @@
-import { Fr, GrumpkinScalar } from '@aztec/foundation/fields';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 import { type Bufferable } from '@aztec/foundation/serialize';
 import type { AztecAsyncKVStore } from '@aztec/kv-store';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
@@ -29,6 +30,8 @@ export declare class KeyStore {
      * @returns A Promise that resolves to an array of account addresses.
      */
     getAccounts(): Promise<AztecAddress[]>;
+    /** Checks whether an account is registered in the key store. */
+    hasAccount(account: AztecAddress): Promise<boolean>;
     /**
      * Gets the key validation request for a given master public key hash and contract address.
      * @throws If the account corresponding to the master public key hash does not exist in the key store.
@@ -88,6 +91,13 @@ export declare class KeyStore {
      * @dev Used when feeding the sk_m to the kernel circuit for keys verification.
      */
     getMasterSecretKey(pkM: PublicKey): Promise<GrumpkinScalar>;
+    /**
+     * Checks whether a given account has a key matching the provided master public key hash.
+     * @param account - The account address to check.
+     * @param pkMHash - The master public key hash to look for.
+     * @returns True if the account has a key with the given hash.
+     */
+    accountHasKey(account: AztecAddress, pkMHash: Fr): Promise<boolean>;
     /**
      * Gets the key prefix and account address for a given value.
      * @returns A tuple containing the key prefix and account address.
@@ -96,4 +106,4 @@ export declare class KeyStore {
      */
     getKeyPrefixAndAccount(value: Bufferable): Promise<[KeyPrefix, AztecAddress]>;
 }
-//# sourceMappingURL=key_store.d.ts.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5X3N0b3JlLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMva2V5X3N0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNwRCxPQUFPLEVBQUUsY0FBYyxFQUFTLE1BQU0sbUNBQW1DLENBQUM7QUFFMUUsT0FBTyxFQUFFLEtBQUssVUFBVSxFQUFxQixNQUFNLDZCQUE2QixDQUFDO0FBQ2pGLE9BQU8sS0FBSyxFQUFFLGlCQUFpQixFQUFpQixNQUFNLGlCQUFpQixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUMzRCxPQUFPLEVBQUUsZUFBZSxFQUFFLEtBQUssY0FBYyxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDOUUsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDNUQsT0FBTyxFQUVMLEtBQUssU0FBUyxFQUNkLEtBQUssU0FBUyxFQUlmLE1BQU0sb0JBQW9CLENBQUM7QUFPNUI7O0dBRUc7QUFDSCxxQkFBYSxRQUFROztJQUNuQixnQkFBdUIsY0FBYyxLQUFLO0lBSTFDLFlBQVksUUFBUSxFQUFFLGlCQUFpQixFQUd0QztJQUVEOzs7T0FHRztJQUNJLGFBQWEsSUFBSSxPQUFPLENBQUMsZUFBZSxDQUFDLENBSS9DO0lBRUQ7Ozs7O09BS0c7SUFDVSxVQUFVLENBQUMsRUFBRSxFQUFFLEVBQUUsRUFBRSxjQUFjLEVBQUUsY0FBYyxHQUFHLE9BQU8sQ0FBQyxlQUFlLENBQUMsQ0F3Q3hGO0lBRUQ7OztPQUdHO0lBQ1UsV0FBVyxJQUFJLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUtsRDtJQUVELGdFQUFnRTtJQUNuRCxVQUFVLENBQUMsT0FBTyxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLENBRS9EO0lBRUQ7Ozs7OztPQU1HO0lBQ1UsdUJBQXVCLENBQUMsT0FBTyxFQUFFLEVBQUUsRUFBRSxlQUFlLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQyxDQXNDOUc7SUFFRDs7Ozs7T0FLRztJQUNVLDJCQUEyQixDQUFDLE9BQU8sRUFBRSxZQUFZLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQVFsRjtJQUVEOzs7OztPQUtHO0lBQ1UsaUNBQWlDLENBQUMsT0FBTyxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUMsU0FBUyxDQUFDLENBUXhGO0lBRUQ7Ozs7O09BS0c7SUFDVSxpQ0FBaUMsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FReEY7SUFFRDs7Ozs7T0FLRztJQUNVLHlCQUF5QixDQUFDLE9BQU8sRUFBRSxZQUFZLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQVFoRjtJQUVEOzs7OztPQUtHO0lBQ1UsaUNBQWlDLENBQUMsT0FBTyxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUMsY0FBYyxDQUFDLENBUTdGO0lBRUQ7Ozs7OztPQU1HO0lBQ1UsOEJBQThCLENBQUMsT0FBTyxFQUFFLFlBQVksRUFBRSxHQUFHLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0Fhakc7SUFFRDs7Ozs7O09BTUc7SUFDVSxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsU0FBUyxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FrQnZFO0lBRUQ7Ozs7O09BS0c7SUFDVSxhQUFhLENBQUMsT0FBTyxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsRUFBRSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FTL0U7SUFFRDs7Ozs7T0FLRztJQUNVLHNCQUFzQixDQUFDLEtBQUssRUFBRSxVQUFVLEdBQUcsT0FBTyxDQUFDLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBY3pGO0NBQ0YifQ==

package/dest/key_store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key_store.d.ts","sourceRoot":"","sources":["../src/key_store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,cAAc,EAAS,MAAM,0BAA0B,CAAC;AAErE,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAE5B;;GAEG;AACH,qBAAa,QAAQ;;IACnB,gBAAuB,cAAc,KAAK;gBAG9B,QAAQ,EAAE,iBAAiB;IAIvC;;;OAGG;IACI,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC;IAMhD;;;;;OAKG;IACU,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAsCzF;;;OAGG;IACU,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAOnD;;;;;;OAMG;IACU,uBAAuB,CAAC,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuC/G;;;;;OAKG;IACU,2BAA2B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IAUnF;;;;;OAKG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IAUzF;;;;;OAKG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IAUzF;;;;;OAKG;IACU,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IAUjF;;;;;OAKG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAU9F;;;;;;OAMG;IACU,8BAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC;IAelG;;;;;;OAMG;IACU,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBxE;;;;;OAKG;IACU,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;CAe3F"}
+{"version":3,"file":"key_store.d.ts","sourceRoot":"","sources":["../src/key_store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,EAAE,cAAc,EAAS,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAO5B;;GAEG;AACH,qBAAa,QAAQ;;IACnB,gBAAuB,cAAc,KAAK;IAI1C,YAAY,QAAQ,EAAE,iBAAiB,EAGtC;IAED;;;OAGG;IACI,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC,CAI/C;IAED;;;;;OAKG;IACU,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAwCxF;IAED;;;OAGG;IACU,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAKlD;IAED,gEAAgE;IACnD,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/D;IAED;;;;;;OAMG;IACU,uBAAuB,CAAC,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsC9G;IAED;;;;;OAKG;IACU,2BAA2B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAQlF;IAED;;;;;OAKG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAQxF;IAED;;;;;OAKG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAQxF;IAED;;;;;OAKG;IACU,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAQhF;IAED;;;;;OAKG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ7F;IAED;;;;;;OAMG;IACU,8BAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,CAajG;IAED;;;;;;OAMG;IACU,kBAAkB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CAkBvE;IAED;;;;;OAKG;IACU,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;IAED;;;;;OAKG;IACU,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAczF;CACF"}

package/dest/key_store.js

@@ -1,18 +1,24 @@
-import { GeneratorIndex } from '@aztec/constants';
-import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto';
-import { Fr, GrumpkinScalar, Point } from '@aztec/foundation/fields';
+import { DomainSeparator } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
 import { toArray } from '@aztec/foundation/iterable';
 import { serializeToBuffer } from '@aztec/foundation/serialize';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { CompleteAddress } from '@aztec/stdlib/contract';
 import { KeyValidationRequest } from '@aztec/stdlib/kernel';
 import { KEY_PREFIXES, computeAppSecretKey, deriveKeys, derivePublicKeyFromSecretKey } from '@aztec/stdlib/keys';
+/** Maps a key prefix to the storage suffix for the corresponding master secret key. */ function secretKeyStorageSuffix(prefix) {
+    return prefix === 'n' ? 'nhk_m' : `${prefix}sk_m`;
+}
 /**
  * Used for managing keys. Can hold keys of multiple accounts.
  */ export class KeyStore {
     static SCHEMA_VERSION = 1;
+    #db;
     #keys;
     constructor(database){
+        this.#db = database;
         this.#keys = database.openMap('key_store');
     }
     /**
@@ -29,28 +35,31 @@ import { KEY_PREFIXES, computeAppSecretKey, deriveKeys, derivePublicKeyFromSecre
    * @param partialAddress - The partial address of the account.
    * @returns The account's complete address.
    */ async addAccount(sk, partialAddress) {
-        const { masterNullifierSecretKey, masterIncomingViewingSecretKey, masterOutgoingViewingSecretKey, masterTaggingSecretKey, publicKeys } = await deriveKeys(sk);
+        const { masterNullifierHidingKey, masterIncomingViewingSecretKey, masterOutgoingViewingSecretKey, masterTaggingSecretKey, publicKeys } = await deriveKeys(sk);
         const completeAddress = await CompleteAddress.fromSecretKeyAndPartialAddress(sk, partialAddress);
         const { address: account } = completeAddress;
-        // Naming of keys is as follows ${account}-${n/iv/ov/t}${sk/pk}_m
-        await this.#keys.set(`${account.toString()}-ivsk_m`, masterIncomingViewingSecretKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-ovsk_m`, masterOutgoingViewingSecretKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-tsk_m`, masterTaggingSecretKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-nsk_m`, masterNullifierSecretKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-npk_m`, publicKeys.masterNullifierPublicKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-ivpk_m`, publicKeys.masterIncomingViewingPublicKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-ovpk_m`, publicKeys.masterOutgoingViewingPublicKey.toBuffer());
-        await this.#keys.set(`${account.toString()}-tpk_m`, publicKeys.masterTaggingPublicKey.toBuffer());
-        // We store pk_m_hash under `account-{n/iv/ov/t}pk_m_hash` key to be able to obtain address and key prefix
-        // using the #getKeyPrefixAndAccount function later on
+        // Compute hashes before transaction
         const masterNullifierPublicKeyHash = await publicKeys.masterNullifierPublicKey.hash();
-        await this.#keys.set(`${account.toString()}-npk_m_hash`, masterNullifierPublicKeyHash.toBuffer());
         const masterIncomingViewingPublicKeyHash = await publicKeys.masterIncomingViewingPublicKey.hash();
-        await this.#keys.set(`${account.toString()}-ivpk_m_hash`, masterIncomingViewingPublicKeyHash.toBuffer());
         const masterOutgoingViewingPublicKeyHash = await publicKeys.masterOutgoingViewingPublicKey.hash();
-        await this.#keys.set(`${account.toString()}-ovpk_m_hash`, masterOutgoingViewingPublicKeyHash.toBuffer());
         const masterTaggingPublicKeyHash = await publicKeys.masterTaggingPublicKey.hash();
-        await this.#keys.set(`${account.toString()}-tpk_m_hash`, masterTaggingPublicKeyHash.toBuffer());
+        await this.#db.transactionAsync(async ()=>{
+            // Naming of keys is as follows ${account}-${n/iv/ov/t}${sk/pk}_m
+            await this.#keys.set(`${account.toString()}-ivsk_m`, masterIncomingViewingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-ovsk_m`, masterOutgoingViewingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-tsk_m`, masterTaggingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-nhk_m`, masterNullifierHidingKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-npk_m`, publicKeys.masterNullifierPublicKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-ivpk_m`, publicKeys.masterIncomingViewingPublicKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-ovpk_m`, publicKeys.masterOutgoingViewingPublicKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-tpk_m`, publicKeys.masterTaggingPublicKey.toBuffer());
+            // We store pk_m_hash under `account-{n/iv/ov/t}pk_m_hash` key to be able to obtain address and key prefix
+            // using the #getKeyPrefixAndAccount function later on
+            await this.#keys.set(`${account.toString()}-npk_m_hash`, masterNullifierPublicKeyHash.toBuffer());
+            await this.#keys.set(`${account.toString()}-ivpk_m_hash`, masterIncomingViewingPublicKeyHash.toBuffer());
+            await this.#keys.set(`${account.toString()}-ovpk_m_hash`, masterOutgoingViewingPublicKeyHash.toBuffer());
+            await this.#keys.set(`${account.toString()}-tpk_m_hash`, masterTaggingPublicKeyHash.toBuffer());
+        });
         // At last, we return the newly derived account address
         return completeAddress;
     }
@@ -63,6 +72,9 @@ import { KEY_PREFIXES, computeAppSecretKey, deriveKeys, derivePublicKeyFromSecre
         const accounts = allMapKeys.filter((key)=>key.endsWith('-ivsk_m')).map((key)=>key.split('-')[0]);
         return accounts.map((account)=>AztecAddress.fromString(account));
     }
+    /** Checks whether an account is registered in the key store. */ async hasAccount(account) {
+        return !!await this.#keys.getAsync(`${account.toString()}-ivsk_m`);
+    }
     /**
    * Gets the key validation request for a given master public key hash and contract address.
    * @throws If the account corresponding to the master public key hash does not exist in the key store.
@@ -82,9 +94,10 @@ import { KEY_PREFIXES, computeAppSecretKey, deriveKeys, derivePublicKeyFromSecre
             throw new Error(`Could not find ${keyPrefix}pkM for ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
         }
         // Now we find the secret key for the public key
-        const skMBuffer = await this.#keys.getAsync(`${account.toString()}-${keyPrefix}sk_m`);
+        const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+        const skMBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
         if (!skMBuffer) {
-            throw new Error(`Could not find ${keyPrefix}sk_m for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
+            throw new Error(`Could not find ${skStorageSuffix} for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
         }
         const skM = GrumpkinScalar.fromBuffer(skMBuffer);
         // We sanity check that it's possible to derive the public key from the secret key
@@ -172,7 +185,7 @@ import { KEY_PREFIXES, computeAppSecretKey, deriveKeys, derivePublicKeyFromSecre
             masterOutgoingViewingSecretKey.hi,
             masterOutgoingViewingSecretKey.lo,
             app
-        ], GeneratorIndex.OVSK_M);
+        ], DomainSeparator.OVSK_M);
     }
     /**
    * Retrieves the sk_m corresponding to the pk_m.
@@ -182,18 +195,34 @@ import { KEY_PREFIXES, computeAppSecretKey, deriveKeys, derivePublicKeyFromSecre
    * @dev Used when feeding the sk_m to the kernel circuit for keys verification.
    */ async getMasterSecretKey(pkM) {
         const [keyPrefix, account] = await this.getKeyPrefixAndAccount(pkM);
-        const secretKeyBuffer = await this.#keys.getAsync(`${account.toString()}-${keyPrefix}sk_m`);
+        const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+        const secretKeyBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
         if (!secretKeyBuffer) {
-            throw new Error(`Could not find ${keyPrefix}sk_m for ${keyPrefix}pk_m ${pkM.toString()}. This should not happen.`);
+            throw new Error(`Could not find ${skStorageSuffix} for ${keyPrefix}pk_m ${pkM.toString()}. This should not happen.`);
         }
         const skM = GrumpkinScalar.fromBuffer(secretKeyBuffer);
         const derivedpkM = await derivePublicKeyFromSecretKey(skM);
         if (!derivedpkM.equals(pkM)) {
-            throw new Error(`Could not find ${keyPrefix}skM for ${keyPrefix}pkM ${pkM.toString()} in secret keys buffer.`);
+            throw new Error(`Could not find ${skStorageSuffix} for ${keyPrefix}pkM ${pkM.toString()} in secret keys buffer.`);
         }
         return Promise.resolve(skM);
     }
     /**
+   * Checks whether a given account has a key matching the provided master public key hash.
+   * @param account - The account address to check.
+   * @param pkMHash - The master public key hash to look for.
+   * @returns True if the account has a key with the given hash.
+   */ async accountHasKey(account, pkMHash) {
+        const pkMHashBuffer = serializeToBuffer(pkMHash);
+        for (const prefix of KEY_PREFIXES){
+            const stored = await this.#keys.getAsync(`${account.toString()}-${prefix}pk_m_hash`);
+            if (stored && Buffer.from(stored).equals(pkMHashBuffer)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
    * Gets the key prefix and account address for a given value.
    * @returns A tuple containing the key prefix and account address.
    * @dev Note that this is quite inefficient but it should not matter because there should never be too many keys

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/key-store",
-  "version": "0.0.1-fake-c83136db25",
+  "version": "0.0.2-commit.217f559981",
   "type": "module",
   "exports": "./dest/index.js",
   "typedocOptions": {
@@ -11,8 +11,8 @@
     "tsconfig": "./tsconfig.json"
   },
   "scripts": {
-    "build": "yarn clean && tsc -b",
-    "build:dev": "tsc -b --watch",
+    "build": "yarn clean && ../scripts/tsc.sh",
+    "build:dev": "../scripts/tsc.sh --watch",
     "clean": "rm -rf ./dest .tsbuildinfo",
     "test": "NODE_NO_WARNINGS=1 node --experimental-vm-modules ../node_modules/.bin/jest --passWithNoTests --maxWorkers=${JEST_MAX_WORKERS:-8}"
   },
@@ -57,16 +57,17 @@
     ]
   },
   "dependencies": {
-    "@aztec/constants": "0.0.1-fake-c83136db25",
-    "@aztec/foundation": "0.0.1-fake-c83136db25",
-    "@aztec/kv-store": "0.0.1-fake-c83136db25",
-    "@aztec/stdlib": "0.0.1-fake-c83136db25",
+    "@aztec/constants": "0.0.2-commit.217f559981",
+    "@aztec/foundation": "0.0.2-commit.217f559981",
+    "@aztec/kv-store": "0.0.2-commit.217f559981",
+    "@aztec/stdlib": "0.0.2-commit.217f559981",
     "tslib": "^2.4.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^22.15.17",
+    "@typescript/native-preview": "7.0.0-dev.20260113.1",
     "jest": "^30.0.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.3"

package/src/key_store.ts

@@ -1,6 +1,7 @@
-import { GeneratorIndex } from '@aztec/constants';
-import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto';
-import { Fr, GrumpkinScalar, Point } from '@aztec/foundation/fields';
+import { DomainSeparator } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
 import { toArray } from '@aztec/foundation/iterable';
 import { type Bufferable, serializeToBuffer } from '@aztec/foundation/serialize';
 import type { AztecAsyncKVStore, AztecAsyncMap } from '@aztec/kv-store';
@@ -16,14 +17,21 @@ import {
   derivePublicKeyFromSecretKey,
 } from '@aztec/stdlib/keys';
 
+/** Maps a key prefix to the storage suffix for the corresponding master secret key. */
+function secretKeyStorageSuffix(prefix: KeyPrefix): string {
+  return prefix === 'n' ? 'nhk_m' : `${prefix}sk_m`;
+}
+
 /**
  * Used for managing keys. Can hold keys of multiple accounts.
  */
 export class KeyStore {
   public static readonly SCHEMA_VERSION = 1;
+  #db: AztecAsyncKVStore;
   #keys: AztecAsyncMap<string, Buffer>;
 
   constructor(database: AztecAsyncKVStore) {
+    this.#db = database;
     this.#keys = database.openMap('key_store');
   }
 
@@ -45,7 +53,7 @@ export class KeyStore {
    */
   public async addAccount(sk: Fr, partialAddress: PartialAddress): Promise<CompleteAddress> {
     const {
-      masterNullifierSecretKey,
+      masterNullifierHidingKey,
       masterIncomingViewingSecretKey,
       masterOutgoingViewingSecretKey,
       masterTaggingSecretKey,
@@ -55,27 +63,31 @@ export class KeyStore {
     const completeAddress = await CompleteAddress.fromSecretKeyAndPartialAddress(sk, partialAddress);
     const { address: account } = completeAddress;
 
-    // Naming of keys is as follows ${account}-${n/iv/ov/t}${sk/pk}_m
-    await this.#keys.set(`${account.toString()}-ivsk_m`, masterIncomingViewingSecretKey.toBuffer());
-    await this.#keys.set(`${account.toString()}-ovsk_m`, masterOutgoingViewingSecretKey.toBuffer());
-    await this.#keys.set(`${account.toString()}-tsk_m`, masterTaggingSecretKey.toBuffer());
-    await this.#keys.set(`${account.toString()}-nsk_m`, masterNullifierSecretKey.toBuffer());
-
-    await this.#keys.set(`${account.toString()}-npk_m`, publicKeys.masterNullifierPublicKey.toBuffer());
-    await this.#keys.set(`${account.toString()}-ivpk_m`, publicKeys.masterIncomingViewingPublicKey.toBuffer());
-    await this.#keys.set(`${account.toString()}-ovpk_m`, publicKeys.masterOutgoingViewingPublicKey.toBuffer());
-    await this.#keys.set(`${account.toString()}-tpk_m`, publicKeys.masterTaggingPublicKey.toBuffer());
-
-    // We store pk_m_hash under `account-{n/iv/ov/t}pk_m_hash` key to be able to obtain address and key prefix
-    // using the #getKeyPrefixAndAccount function later on
+    // Compute hashes before transaction
     const masterNullifierPublicKeyHash = await publicKeys.masterNullifierPublicKey.hash();
-    await this.#keys.set(`${account.toString()}-npk_m_hash`, masterNullifierPublicKeyHash.toBuffer());
     const masterIncomingViewingPublicKeyHash = await publicKeys.masterIncomingViewingPublicKey.hash();
-    await this.#keys.set(`${account.toString()}-ivpk_m_hash`, masterIncomingViewingPublicKeyHash.toBuffer());
     const masterOutgoingViewingPublicKeyHash = await publicKeys.masterOutgoingViewingPublicKey.hash();
-    await this.#keys.set(`${account.toString()}-ovpk_m_hash`, masterOutgoingViewingPublicKeyHash.toBuffer());
     const masterTaggingPublicKeyHash = await publicKeys.masterTaggingPublicKey.hash();
-    await this.#keys.set(`${account.toString()}-tpk_m_hash`, masterTaggingPublicKeyHash.toBuffer());
+
+    await this.#db.transactionAsync(async () => {
+      // Naming of keys is as follows ${account}-${n/iv/ov/t}${sk/pk}_m
+      await this.#keys.set(`${account.toString()}-ivsk_m`, masterIncomingViewingSecretKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-ovsk_m`, masterOutgoingViewingSecretKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-tsk_m`, masterTaggingSecretKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-nhk_m`, masterNullifierHidingKey.toBuffer());
+
+      await this.#keys.set(`${account.toString()}-npk_m`, publicKeys.masterNullifierPublicKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-ivpk_m`, publicKeys.masterIncomingViewingPublicKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-ovpk_m`, publicKeys.masterOutgoingViewingPublicKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-tpk_m`, publicKeys.masterTaggingPublicKey.toBuffer());
+
+      // We store pk_m_hash under `account-{n/iv/ov/t}pk_m_hash` key to be able to obtain address and key prefix
+      // using the #getKeyPrefixAndAccount function later on
+      await this.#keys.set(`${account.toString()}-npk_m_hash`, masterNullifierPublicKeyHash.toBuffer());
+      await this.#keys.set(`${account.toString()}-ivpk_m_hash`, masterIncomingViewingPublicKeyHash.toBuffer());
+      await this.#keys.set(`${account.toString()}-ovpk_m_hash`, masterOutgoingViewingPublicKeyHash.toBuffer());
+      await this.#keys.set(`${account.toString()}-tpk_m_hash`, masterTaggingPublicKeyHash.toBuffer());
+    });
 
     // At last, we return the newly derived account address
     return completeAddress;
@@ -92,6 +104,11 @@ export class KeyStore {
     return accounts.map(account => AztecAddress.fromString(account));
   }
 
+  /** Checks whether an account is registered in the key store. */
+  public async hasAccount(account: AztecAddress): Promise<boolean> {
+    return !!(await this.#keys.getAsync(`${account.toString()}-ivsk_m`));
+  }
+
   /**
    * Gets the key validation request for a given master public key hash and contract address.
    * @throws If the account corresponding to the master public key hash does not exist in the key store.
@@ -117,10 +134,11 @@ export class KeyStore {
     }
 
     // Now we find the secret key for the public key
-    const skMBuffer = await this.#keys.getAsync(`${account.toString()}-${keyPrefix}sk_m`);
+    const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+    const skMBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
     if (!skMBuffer) {
       throw new Error(
-        `Could not find ${keyPrefix}sk_m for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`,
+        `Could not find ${skStorageSuffix} for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`,
       );
     }
 
@@ -236,7 +254,7 @@ export class KeyStore {
 
     return poseidon2HashWithSeparator(
       [masterOutgoingViewingSecretKey.hi, masterOutgoingViewingSecretKey.lo, app],
-      GeneratorIndex.OVSK_M,
+      DomainSeparator.OVSK_M,
     );
   }
 
@@ -250,22 +268,40 @@ export class KeyStore {
   public async getMasterSecretKey(pkM: PublicKey): Promise<GrumpkinScalar> {
     const [keyPrefix, account] = await this.getKeyPrefixAndAccount(pkM);
 
-    const secretKeyBuffer = await this.#keys.getAsync(`${account.toString()}-${keyPrefix}sk_m`);
+    const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+    const secretKeyBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
     if (!secretKeyBuffer) {
       throw new Error(
-        `Could not find ${keyPrefix}sk_m for ${keyPrefix}pk_m ${pkM.toString()}. This should not happen.`,
+        `Could not find ${skStorageSuffix} for ${keyPrefix}pk_m ${pkM.toString()}. This should not happen.`,
       );
     }
 
     const skM = GrumpkinScalar.fromBuffer(secretKeyBuffer);
     const derivedpkM = await derivePublicKeyFromSecretKey(skM);
     if (!derivedpkM.equals(pkM)) {
-      throw new Error(`Could not find ${keyPrefix}skM for ${keyPrefix}pkM ${pkM.toString()} in secret keys buffer.`);
+      throw new Error(`Could not find ${skStorageSuffix} for ${keyPrefix}pkM ${pkM.toString()} in secret keys buffer.`);
     }
 
     return Promise.resolve(skM);
   }
 
+  /**
+   * Checks whether a given account has a key matching the provided master public key hash.
+   * @param account - The account address to check.
+   * @param pkMHash - The master public key hash to look for.
+   * @returns True if the account has a key with the given hash.
+   */
+  public async accountHasKey(account: AztecAddress, pkMHash: Fr): Promise<boolean> {
+    const pkMHashBuffer = serializeToBuffer(pkMHash);
+    for (const prefix of KEY_PREFIXES) {
+      const stored = await this.#keys.getAsync(`${account.toString()}-${prefix}pk_m_hash`);
+      if (stored && Buffer.from(stored).equals(pkMHashBuffer)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Gets the key prefix and account address for a given value.
    * @returns A tuple containing the key prefix and account address.