@openzeppelin/compact-contracts 0.3.0-alpha → 0.3.0-alpha.1

package/README.md

@@ -214,7 +214,7 @@ git clone git@github.com:OpenZeppelin/compact-contracts.git
 ```bash
 nvm install && \
 yarn && \
-yarn compact
+yarn compile
 ```
 
 ### Run tests
@@ -226,8 +226,8 @@ yarn test
 ### Check/apply Biome formatter
 
 ```bash
-yarn fmt-and-lint
-yarn fmt-and-lint:fix
+yarn lint
+yarn lint:fix
 ```
 
 ### Advanced
@@ -235,8 +235,8 @@ yarn fmt-and-lint:fix
 #### Targeted compilation
 
 ```bash
-yarn compact:access
-yarn compact:archive
+yarn compile:access
+yarn compile:archive
 ...
 ```
 
@@ -246,10 +246,10 @@ ZK key generation is slow and usually unnecessary during development.
 
 ```bash
 # Full compilation with skip-zk (use environment variable)
-SKIP_ZK=true yarn compact
+SKIP_ZK=true yarn compile
 
 # Access compilation with skip-zk (this compiles security first as a dependency)
-SKIP_ZK=true yarn compact:access
+SKIP_ZK=true yarn compile:access
 ```
 
 #### Clean environment

package/access/AccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (access/AccessControl.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (access/AccessControl.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/Ownable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (access/Ownable.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (access/Ownable.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/ShieldedAccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (access/ShieldedAccessControl.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (access/ShieldedAccessControl.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/ZOwnablePK.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (access/ZOwnablePK.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (access/ZOwnablePK.compact)
 
 pragma language_version >= 0.23.0;
 

package/crypto/EcdhMask.compact

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (crypto/EcdhMask.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @module EcdhMask
+ * @description Stateless ECDH hybrid encryption of a single field element to a
+ * Jubjub public key. Delivers a value to whoever holds the secret behind a
+ * Jubjub public key WITHOUT encoding it in the exponent, so recovery needs no
+ * discrete-log search and the value is unbounded within `Uint<128>`. This is the
+ * direct-decrypt counterpart to the homomorphic `crypto/ElGamal`: use ElGamal to
+ * accumulate ciphertexts, use this to hand a recipient the plaintext.
+ *
+ * Construction (recipient key `pk = g^ek`, ephemeral scalar `e` fresh per call):
+ *   E    = g^e                      (ephemeral public key)
+ *   S    = pk^e = g^{ek*e}          (ECDH shared secret point)
+ *   mask = KDF(S)                   (domain-separated Field, see `kdf`)
+ *   ct   = value + mask             (field one-time-pad)
+ * Recipient recovers: S = E^ek, mask = KDF(S), value = ct - mask.
+ *
+ * @dev Freshness and secrecy precondition (CRITICAL). `e` MUST be both unique per
+ * call to the same recipient AND secret (unpredictable to observers), even across
+ * circuit invocations that reuse a randomness seed.
+ *
+ * Uniqueness: the mask is a one-time pad, so a repeated `e` repeats `S` and
+ * `mask`, and reusing a pad is catastrophic (subtracting two ciphertexts recovers
+ * both values).
+ *
+ * Secrecy: `recipientPk` is public, so anyone who learns `e` recomputes
+ * `S = recipientPk^e`, hence the mask, and opens the ciphertext. A unique but
+ * PREDICTABLE `e` (a plain counter, a public nonce) therefore breaks
+ * confidentiality completely. `e` must be high-entropy and secret, exactly like
+ * an ElGamal encryption randomness (see `crypto/ElGamal`), not merely distinct.
+ *
+ * The caller supplies `e` and owns both properties, e.g. by expanding a secret
+ * per-invocation seed bound to a per-recipient-unique nonce (a monotonic index).
+ * This is stronger than exponential ElGamal's uniqueness requirement (there,
+ * reuse merely leaks plaintext equality); do not treat `e` as "any randomness."
+ *
+ * @dev Weak inputs. Two degenerate inputs zero the shared secret and expose the
+ * value: `recipientPk = identity` gives `S = identity` for any `e`, and `e = 0`
+ * gives `S = identity` for any key. Both yield `mask = KDF(identity, domain)`, a
+ * value any observer can recompute, so `ct = value + mask` opens trivially. The
+ * identity is a valid subgroup point, so the runtime subgroup guarantee does NOT
+ * catch it; `encrypt` therefore asserts `recipientPk != identity` and
+ * `ephemeralPk (= g^e) != identity`. Guarding the ephemeral POINT rather than the
+ * scalar subsumes `e != 0` and stays correct regardless of how the runtime treats
+ * an out-of-range scalar: `g^e = identity` captures both `e = 0` and any
+ * `e ≡ 0 (mod ℓ)`. (Guarding `e != 0` directly would instead lean on the runtime
+ * faulting `ecMul` for scalars `≥ ℓ`; the point guard removes that dependency.)
+ * These are the only weak inputs (for a subgroup key, `S = identity` iff the
+ * ephemeral point is the identity).
+ *
+ * @dev Integrity. The pad is malleable and NO authentication is added here. This
+ * is safe in the intended on-chain use, where the ciphertext is computed
+ * in-circuit from a value the same circuit commits to elsewhere (a producer
+ * cannot desync the two) and is immutable once written (no in-transit attacker).
+ * A corrupted ciphertext could only fail the recipient's own later proof, never
+ * enable theft. Consumers with a different threat model (mutable storage,
+ * in-transit tampering) MUST add their own authentication.
+ *
+ * @dev Security. This is hashed ElGamal (ECIES without a MAC) over Jubjub and
+ * inherits its guarantees: IND-CPA under the Oracle Diffie-Hellman assumption in
+ * the random-oracle model (the `persistentHash` KDF keyed by the secret point
+ * `S`). It is NOT IND-CCA: the additive pad is malleable (see Integrity), which
+ * is acceptable here only because the on-chain ciphertext is bound in-circuit to
+ * the value it commits to elsewhere. Hiding carries a large margin: `kdf` returns
+ * a `degradeToTransient` output in `[0, 2^248)` while `value < 2^128`, so even
+ * treating the KDF output as uniform the value is hidden with about `2^-120`
+ * statistical slack, leaving only the assumption that the hash of the DH secret
+ * is PRF-like. Confidentiality relies on the runtime constraining every
+ * `JubjubPoint` into the prime-order subgroup (see `crypto/ElGamal`), so `S`
+ * cannot be a low-order point that leaks `ek`. Binding the ephemeral `E` into the
+ * KDF is deliberately omitted: for a fixed `recipientPk`, `E = g^e` and
+ * `S = pk^e` are both determined by `e`, so `KDF(S)` already varies with `E` and
+ * folding it in buys nothing.
+ *
+ * @dev Shared key with `crypto/ElGamal` (in scope). A consumer MAY use the same
+ * recipient Jubjub key for both these memos (hashed ElGamal) and exponential-
+ * ElGamal balance ciphertexts, as the confidential token does. This joint use is
+ * safe: the two schemes share only the public key, this KDF is domain-separated
+ * and keyed by the secret DH point, and neither exposes a decryption oracle, so
+ * under CPA / ODH a ciphertext of one scheme does not help attack the other.
+ *
+ * @dev No ledger state, no witnesses. Every circuit is pure and takes its keys,
+ * value, and randomness as explicit arguments. `decrypt` is exposed as a pure
+ * circuit for wallet/off-chain use (recovering a received value needs no proof);
+ * the on-chain path only ever calls `encrypt`.
+ */
+module EcdhMask {
+  import CompactStandardLibrary;
+
+  /**
+   * @description An ECDH one-time-pad ciphertext: the ephemeral public key and
+   * the field-masked value.
+   */
+  export struct Ciphertext {
+    ephemeralPk: JubjubPoint;
+    ct: Field;
+  }
+
+  /**
+   * @description Derives the field mask from the ECDH shared secret point,
+   * domain-separated by a caller-supplied `domain` tag. Hashes the point to
+   * `Bytes<32>`, then re-hashes it with the domain tag and truncates into the
+   * field via `degradeToTransient`. The consumer chooses `domain` (so this
+   * module is not tied to any one protocol) and MUST use the same value on
+   * encrypt and decrypt.
+   *
+   * @dev Uses `persistentHash` deliberately: the recipient reproduces this mask
+   * to decrypt, possibly across a platform upgrade, so it must be upgrade-stable.
+   *
+   * @param sShared - The ECDH shared secret point (`pk^e` for the sender,
+   *                  `E^ek` for the recipient; equal by construction).
+   * @param domain - The consumer's domain-separation tag.
+   * @return The field mask.
+   */
+  export pure circuit kdf(sShared: JubjubPoint, domain: Bytes<32>): Field {
+    const pointHash = persistentHash<JubjubPoint>(sShared);
+    return degradeToTransient(
+      persistentHash<Vector<2, Bytes<32>>>([pointHash, domain])
+    );
+  }
+
+  /**
+   * @description Encrypts `value` to `recipientPk` under ephemeral scalar `e`.
+   *
+   * @notice `e` MUST be fresh per call (see the module freshness precondition).
+   *
+   * Requirements:
+   *
+   * - `recipientPk` is not the identity point.
+   * - `e` is non-zero, a valid Jubjub scalar (`< ℓ`), secret, and fresh per call.
+   *
+   * @param recipientPk - The recipient's Jubjub public key (`g^ek`).
+   * @param value - The value to deliver (any `Uint<128>`; no `2^48` bound).
+   * @param e - A fresh ephemeral scalar.
+   * @param domain - The consumer's domain-separation tag (must match decrypt).
+   * @return The ciphertext `{ ephemeralPk = g^e, ct = value + KDF(pk^e) }`.
+   */
+  export pure circuit encrypt(
+                        recipientPk: JubjubPoint,
+                        value: Uint<128>,
+                        e: Field,
+                        domain: Bytes<32>
+                        ): Ciphertext {
+    const identity = ecMulGenerator(0 as Field);
+    assert(recipientPk != identity, "EcdhMask: identity pk");
+    const ephemeralPk = ecMulGenerator(e);
+    // Guard the ephemeral POINT, not the scalar: `ephemeralPk == identity`
+    // captures `e == 0` and any `e` that reduces to 0 mod l, so the guard is
+    // correct regardless of how the runtime treats an out-of-range scalar. This
+    // subsumes `e != 0` (see the weak-inputs note).
+    assert(ephemeralPk != identity, "EcdhMask: zero ephemeral");
+    const sShared = ecMul(recipientPk, e);
+    const mask = kdf(sShared, domain);
+    return Ciphertext { ephemeralPk: ephemeralPk, ct: (value as Field) + mask };
+  }
+
+  /**
+   * @description Recovers the value from a ciphertext using the recipient's
+   * secret scalar. Pure and off-chain (no proof needed to read a received value).
+   *
+   * @param ciphertext - The ciphertext to decrypt.
+   * @param ekScalar - The recipient's secret scalar (`crypto/ElGamal`'s
+   *                   `secretToScalar(EK)`).
+   * @param domain - The consumer's domain-separation tag (must match encrypt).
+   * @return The recovered value as a `Field` (equal to the original `value`,
+   *         which is `< 2^128`).
+   */
+  export pure circuit decrypt(ciphertext: Ciphertext, ekScalar: Field, domain: Bytes<32>): Field {
+    const sShared = ecMul(ciphertext.ephemeralPk, ekScalar);
+    const mask = kdf(sShared, domain);
+    return ciphertext.ct - mask;
+  }
+}

package/crypto/ElGamal.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (crypto/ElGamal.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (crypto/ElGamal.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/ForwarderPrivate.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -97,8 +97,12 @@ module ForwarderPrivate {
    * @description Spends a previously-deposited shielded coin to the parent,
    * a coin public key. The caller proves knowledge of `(parent, opSecret)`
    * matching the stored commitment; the coin is sent as a plain shielded note,
-   * so the parent stays hidden on-chain. If `coin.value` exceeds `value`, the
-   * change is re-emitted back to the contract for future drains.
+   * so the parent stays hidden on-chain. If `coin.value` exceeds `value`,
+   * `sendShielded` routes the change back to this contract as a self-owned
+   * output; `_drain` returns it untouched via `result.change`. The
+   * implementing contract chooses what to do with it: leave it dwelling at
+   * the contract for a future drain, or spend it onward to a different
+   * recipient in the same transaction via `sendImmediateShielded`.
    *
    * The parent is a `ZswapCoinPublicKey`, never a `ContractAddress`: a shielded
    * send to a contract publishes that contract's address in cleartext on the
@@ -160,14 +164,14 @@ module ForwarderPrivate {
       disclose(value)
     );
 
-    if (disclose(result.change.is_some)) {
-      sendImmediateShielded(
-        disclose(result.change.value),
-        Utils_selfAsRecipient(),
-        disclose(result.change.value.value)
-      );
-    }
-
+    // `sendShielded` already emits any change as a fresh output owned by this
+    // contract (dwelling at the contract address for future drains). `_drain`
+    // returns it untouched: it must not re-spend the change here and then hand
+    // that same (now-nullified) coin back via `result.change` — that is the
+    // double spend a node rejects on the next drain. A caller is free to spend
+    // the returned change onward itself (e.g. route it to another recipient);
+    // the rule is only that the change must never be re-spent AND still treated
+    // as held.
     return result;
   }
 

package/multisig/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/ForwarderShielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ProposalManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/ProposalManager.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/ProposalManager.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ShieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/ShieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/ShieldedTreasury.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -85,8 +85,12 @@ module ShieldedTreasury {
    * @description Sends shielded tokens from the treasury.
    *
    * Looks up the stored coin by color, verifies sufficient value,
-   * and executes the shielded send. If the send produces change,
-   * it is sent back to the contract via `sendImmediateShielded`.
+   * and executes the shielded send. `sendShielded` already routes any
+   * change back to this contract as a self-owned output. Unlike the
+   * stateless variant, this treasury RETAINS the change: it is recorded in
+   * the UTXO map for the next spend. The returned `result.change` therefore
+   * belongs to the treasury and must not be re-spent by the caller (doing
+   * so would double-spend the recorded coin).
    *
    * @notice Access control is NOT enforced here.
    * The consuming contract must gate this behind its own
@@ -119,14 +123,13 @@ module ShieldedTreasury {
 
     const result = sendShielded(coin, disclose(recipient), disclose(amount));
 
+    // `sendShielded` spends the stored coin (revealing its nullifier) and,
+    // when there is change, emits it as a fresh output owned by this
+    // contract. That change coin is already spendable. Do NOT re-spend it
+    // with `sendImmediateShielded`, which would reveal its nullifier in this
+    // same transaction and leave the recorded coin permanently double-spent.
     if (disclose(result.change.is_some)) {
-      const changeCoin = result.change.value;
-      sendImmediateShielded(
-        changeCoin,
-        Utils_selfAsRecipient(),
-        changeCoin.value
-      );
-      _coins.insertCoin(disclose(color), changeCoin, Utils_selfAsRecipient());
+      _coins.insertCoin(disclose(color), result.change.value, Utils_selfAsRecipient());
     } else {
       _coins.remove(disclose(color));
     }

package/multisig/ShieldedTreasuryStateless.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/ShieldedTreasuryStateless.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/ShieldedTreasuryStateless.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -20,7 +20,6 @@ pragma language_version >= 0.23.0;
  */
 module ShieldedTreasuryStateless {
   import CompactStandardLibrary;
-  import { selfAsRecipient } from "../utils/Utils" prefix Utils_;
 
   // ─── Deposit ────────────────────────────────────────────────────
 
@@ -38,8 +37,14 @@ module ShieldedTreasuryStateless {
    *
    * The coin is supplied by the caller rather than looked up from
    * on-chain state; the token color is derived from `coin.color`.
-   * Executes the shielded send and, if change is produced, returns it
-   * to the contract via `sendImmediateShielded`. No balance or
+   * Executes the shielded send and returns the result untouched.
+   * `sendShielded` already routes any change back to this contract as a
+   * self-owned output, so `result.change` is a live, spendable coin. The
+   * implementing contract chooses what to do with it: persist it and pass
+   * it back as the `coin` for a later spend, or spend it onward to a
+   * different recipient in the same transaction via `sendImmediateShielded`.
+   * (Re-spending change is only meaningful when it goes somewhere other than
+   * self — `sendShielded` already routes it to self.) No balance or
    * received/sent accounting is tracked on the ledger.
    *
    * @notice Access control is NOT enforced here.
@@ -63,14 +68,13 @@ module ShieldedTreasuryStateless {
   ): ShieldedSendResult {
     const result = sendShielded(disclose(coin), disclose(recipient), disclose(amount));
 
-    if (disclose(result.change.is_some)) {
-      sendImmediateShielded(
-        disclose(result.change.value),
-        Utils_selfAsRecipient(),
-        disclose(result.change.value.value)
-      );
-    }
-
+    // `sendShielded` already emits any change as a fresh, self-owned output.
+    // `_send` returns it untouched: it must not re-spend the change here and
+    // then hand that same (now-nullified) coin back via `result.change`. That
+    // is the double spend a node rejects on the next spend. The implementing
+    // contract decides what to do with the returned change: persist it and
+    // spend it later, or route it onward itself. The rule is only that the
+    // change must never be re-spent AND still treated as held.
     return result;
   }
 }

package/multisig/Signer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/Signer.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/Signer.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/SignerManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/SignerManager.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/SignerManager.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/UnshieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/UnshieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/UnshieldedTreasury.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/ShieldedMultiSig.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/presets/ShieldedMultiSig.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/ShieldedMultiSig.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -187,17 +187,12 @@ export circuit getProposal(id: Uint<64>): Proposal_Proposal {
   return Proposal_getProposal(id);
 }
 
-export circuit getProposalRecipient(id: Uint<64>): Proposal_Recipient {
-  return Proposal_getProposalRecipient(id);
-}
-
-export circuit getProposalAmount(id: Uint<64>): Uint<128> {
-  return Proposal_getProposalAmount(id);
-}
-
-export circuit getProposalColor(id: Uint<64>): Bytes<32> {
-  return Proposal_getProposalColor(id);
-}
+// NOTE: the per-field proposal getters (getProposalRecipient / getProposalAmount
+// / getProposalColor) and getReceivedMinusSent were dropped to bring the deploy
+// transaction under the block-weight limit (the full 19-circuit deploy is
+// rejected with "Transaction would exhaust the block limits"). They are all
+// redundant: read the proposal fields via `getProposal(id).to / .amount / .color`,
+// and the net balance via `getReceivedTotal(color) - getSentTotal(color)`.
 
 export circuit getProposalStatus(id: Uint<64>): Proposal_ProposalStatus {
   return Proposal_getProposalStatus(id);
@@ -217,10 +212,6 @@ export circuit getSentTotal(color: Bytes<32>): Uint<128> {
   return Treasury_getSentTotal(color);
 }
 
-export circuit getReceivedMinusSent(color: Bytes<32>): Uint<128> {
-  return Treasury_getReceivedMinusSent(color);
-}
-
 // ISignerManager
 
 export circuit getSignerCount(): Uint<8> {

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/presets/ShieldedMultiSigV2.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/ShieldedMultiSigV2.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/presets/forwarder/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/forwarder/ForwarderPrivate.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/presets/forwarder/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/forwarder/ForwarderShielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (multisig/presets/forwarder/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/forwarder/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.3.0-alpha",
+  "version": "0.3.0-alpha.1",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",
@@ -21,23 +21,24 @@
   "homepage": "https://docs.openzeppelin.com/contracts-compact/",
   "type": "module",
   "imports": {
-    "#test-utils/address.js": "./test-utils/address.js"
+    "#test-utils/*": "./test-utils/*"
   },
   "scripts": {
-    "compact": "compact-compiler --exclude '*/archive/*'",
-    "compact:access": "compact-compiler --dir access",
-    "compact:archive": "compact-compiler --dir archive",
-    "compact:crypto": "compact-compiler --dir crypto",
-    "compact:multisig": "compact-compiler --dir multisig",
-    "compact:security": "compact-compiler --dir security",
-    "compact:token": "compact-compiler --dir token",
-    "compact:utils": "compact-compiler --dir utils",
+    "compile": "compact-compiler --exclude '*/archive/*'",
+    "compile:access": "compact-compiler --dir access",
+    "compile:archive": "compact-compiler --dir archive",
+    "compile:crypto": "compact-compiler --dir crypto",
+    "compile:multisig": "compact-compiler --dir multisig",
+    "compile:security": "compact-compiler --dir security",
+    "compile:token": "compact-compiler --dir token",
+    "compile:utils": "compact-compiler --dir utils",
+    "compile:integration": "SKIP_ZK=true compact-compiler --src test/integration/_mocks",
     "build": "compact-builder --hierarchical --out dist --clean-dist --exclude '*/archive/*' --exclude 'Mock*' --exclude '*.mock.compact' --copy package.json --copy ../README.md && find dist -type d -empty -delete",
-    "test": "SKIP_ZK=true yarn run compact && vitest run",
-    "test:coverage": "SKIP_ZK=true yarn run compact && vitest run --coverage",
-    "test:live": "yarn run compact && MIDNIGHT_BACKEND=live vitest run --config vitest.live.config.ts",
-    "compact:integration": "SKIP_ZK=true compact compile test/integration/_mocks/SharedInitCollision.compact artifacts/SharedInitCollision && SKIP_ZK=true compact compile test/integration/_mocks/ComposedTokens.compact artifacts/ComposedTokens",
-    "test:integration": "yarn run compact:integration && vitest run --config vitest.integration.config.ts",
+    "test": "vitest run --project unit",
+    "test:coverage": "vitest run --project unit --coverage",
+    "test:integration": "vitest run --project integration",
+    "test:harness": "vitest run --project harness",
+    "test:harness:live": "MIDNIGHT_BACKEND=live vitest run --project harness-live",
     "types": "tsc -p tsconfig.json --noEmit",
     "clean": "git clean -fXd"
   },
@@ -48,13 +49,24 @@
     "@openzeppelin/compact-cli": "^0.0.2"
   },
   "devDependencies": {
+    "@midnight-ntwrk/compact-js": "2.5.1",
+    "@midnight-ntwrk/compact-runtime": "0.16.0",
+    "@midnight-ntwrk/ledger-v8": "8.1.0",
+    "@midnight-ntwrk/midnight-js-contracts": "4.1.1",
+    "@midnight-ntwrk/midnight-js-http-client-proof-provider": "4.1.1",
+    "@midnight-ntwrk/midnight-js-indexer-public-data-provider": "4.1.1",
+    "@midnight-ntwrk/midnight-js-network-id": "4.1.1",
+    "@midnight-ntwrk/midnight-js-node-zk-config-provider": "4.1.1",
+    "@midnight-ntwrk/midnight-js-protocol": "4.1.1",
+    "@midnight-ntwrk/midnight-js-types": "4.1.1",
+    "@midnight-ntwrk/testkit-js": "4.1.1",
     "@openzeppelin/compact-simulator": "^0.2.0",
     "@tsconfig/node24": "^24.0.4",
-    "@types/node": "25.9.3",
-    "@vitest/coverage-v8": "^4.1.9",
-    "fast-check": "^4.8.0",
+    "@types/node": "26.1.1",
+    "@vitest/coverage-v8": "^4.1.10",
+    "fast-check": "^4.9.0",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   }
 }

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (security/Allowlist.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (security/Blocklist.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (security/Initializable.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Pausable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha (security/Pausable.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (security/Pausable.compact)
 
 pragma language_version >= 0.23.0;