@openzeppelin/compact-contracts 0.4.0-alpha.1 → 0.4.0-alpha.2

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,10 +1,10 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (multisig/presets/ShieldedMultiSigV2.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (multisig/presets/ShieldedMultiSigV2.compact)
 
 pragma language_version >= 0.26.0;
 
 /**
- * @title ShieldedMultisigV2
+ * @module ShieldedMultiSigV2
  * @description Privacy-preserving 2-of-3 multisig contract.
  *
  * Signer identities are stored as commitments: hashes of ECDSA public
@@ -18,208 +18,271 @@ pragma language_version >= 0.26.0;
  * Deposits call receiveShielded only. The operator discovers coin indices
  * through ZswapOutput events from the indexer, constructs QualifiedShieldedCoinInfo
  * off-chain, and provides it as a circuit parameter for spending.
+ *
+ * @notice Requires ZKIR v3: `keccak256` is unavailable on the v2 backend.
+ *
+ * @notice Implementing contracts register the signer set from their
+ * constructor by calling this module's `initialize`, and MUST NOT import
+ * `EcdsaSignerManager` directly.
  */
+module ShieldedMultiSigV2 {
+  import CompactStandardLibrary;
 
-import CompactStandardLibrary;
+  import "../EcdsaSignerManager" prefix EcdsaSignerManager_;
+  import "../../crypto/Eip712" prefix Eip712_;
+  import "../../utils/EvmAbi" prefix EvmAbi_;
+  import "../ProposalManager" prefix Proposal_;
+  import "../ShieldedTreasuryStateless" prefix Treasury_;
 
-import "../EcdsaSignerManager" prefix EcdsaSignerManager_;
-import "../ProposalManager" prefix Proposal_;
-import "../ShieldedTreasuryStateless" prefix Treasury_;
+  // Implementing contracts need this for the re-exported `execute` signature.
+  // Importing `ProposalManager` again instead would give them a second,
+  // unwritten copy of its state.
+  export { Proposal_Recipient };
 
-// ─── State ──────────────────────────────────────────────────────
+  // ─── State ──────────────────────────────────────────────────────
 
-ledger _nonce: Counter;
+  /**
+   * @description Monotonic operation counter. `execute` reads it as that
+   * operation's nonce and then increments, so no two executions share one.
+   */
+  ledger _nonce: Counter;
 
-// ─── Constructor ────────────────────────────────────────────────
+  /**
+   * @description The EIP-712 domain separator every `execute` digest is built
+   * under, derived from `(name, version, instanceSalt)`. Set once at
+   * construction.
+   */
+  export sealed ledger _domainSeparator: Bytes<32>;
 
-/**
- * @description Deploys the multisig with 3 signer commitments and
- * a threshold.
- *
- * Each commitment is `persistentHash(pkX, pkY, instanceSalt,
- * "multisig:signer:")`. Use the exported `_calculateSignerId` circuit to
- * derive them consistently with in-circuit verification.
- *
- * The instanceSalt should be a random value to prevent the same public
- * key from producing the same commitment across different multisig
- * deployments, breaking cross-contract signer correlation.
- *
- * @dev A threshold of 1 does not weaken `execute`, which always verifies two
- * distinct registered signers.
- *
- * Requirements:
- *
- * - `thresh` must be > 0 and <= 2 (matches the 2-signature `execute` surface).
- * - `signerCommitments` must not contain duplicates.
- * - `instanceSalt` should be cryptographically random.
- *
- * @param {Bytes<32>} instanceSalt - Random salt for commitment derivation.
- * @param {Vector<3, Bytes<32>>} signerCommitments - Hashed signer identities.
- * @param {Uint<8>} thresh - Minimum approvals required.
- */
-constructor(
-  instanceSalt: Bytes<32>,
-  signerCommitments: Vector<3, Bytes<32>>,
-  thresh: Uint<8>,
-) {
-  assert(
-    thresh <= 2,
-    "ShieldedMultiSigV2: threshold cannot exceed 2 (execute verifies at most 2 signatures)"
-  );
-  EcdsaSignerManager_initialize<3>(instanceSalt, signerCommitments, thresh);
-}
+  // ─── Initialization ─────────────────────────────────────────────
 
-// ─── Deposit ────────────────────────────────────────────────────
+  /**
+   * @description Registers the signer set and threshold, and fixes the
+   * EIP-712 domain separator.
+   *
+   * @notice Call from the implementing contract's constructor only. It writes
+   * the `sealed` `_domainSeparator`, so implementing contracts MUST NOT expose
+   * `initialize` as a post-deploy circuit.
+   *
+   * The EIP-712 domain fixed here is `(name, version, salt)`. `chainId` and
+   * `verifyingContract` are absent: no network identifier is available
+   * in-circuit, and a 32-byte Midnight address does not fit
+   * `verifyingContract`'s `address` type.
+   *
+   * Replay protection comes from `execute` binding `kernel.self()` in its
+   * struct rather than from the domain. The ledger randomizes a contract's
+   * address at deployment, so no two deployments share one on any network.
+   * A signature for one cannot authorize another.
+   *
+   * `instanceSalt` also keys the signer commitments, so a fresh value per
+   * deployment keeps one public key from producing the same commitment in two
+   * deployments which would link the signer set across them.
+   *
+   * Requirements:
+   *
+   * - `instanceSalt` should be cryptographically random.
+   * - `signerCommitments` must not contain duplicates.
+   * - `thresh` must be non-zero and must not exceed 2.
+   *
+   * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
+   * @param {Vector<3, Bytes<32>>} signerCommitments - Hashed signer identities.
+   * @param {Uint<8>} thresh - Minimum approvals required.
+   * @returns {[]} Empty tuple.
+   */
+  export circuit initialize(
+    instanceSalt: Bytes<32>,
+    signerCommitments: Vector<3, Bytes<32>>,
+    thresh: Uint<8>
+  ): [] {
+    EcdsaSignerManager_initialize<3>(instanceSalt, signerCommitments, thresh);
 
-/**
- * @description Receives a shielded coin into the multisig treasury.
- *
- * No access control which allows anyone to deposit. The coin is claimed at the
- * protocol level through receiveShielded. No coin data is stored on the
- * public ledger, preserving full balance privacy.
- *
- * The operator discovers the coin's Merkle tree index by subscribing
- * to ZswapOutput events via the indexer, filtering by contract address,
- * and extracting mt_index. Combined with the known ShieldedCoinInfo,
- * this produces the QualifiedShieldedCoinInfo needed for spending.
- *
- * @circuitInfo k=13, rows=5898
- *
- * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
- */
-export circuit deposit(coin: ShieldedCoinInfo): [] {
-  receiveShielded(disclose(coin));
-}
+    const hashedName = keccak256<Bytes<18>>(pad(18, "ShieldedMultiSigV2"));
+    const hashedVersion = keccak256<Bytes<1>>(pad(1, "1"));
+    _domainSeparator = Eip712_domainSeparator(
+      hashedName,
+      hashedVersion,
+      disclose(instanceSalt)
+    );
+  }
 
-// ─── Execute ────────────────────────────────────────────────────
+  /**
+   * @description `keccak256` of the `Execute` type string:
+   * `Execute(bytes32 contractAddress,uint256 nonce,uint8 recipientKind,bytes32 recipient,bytes32 coinColor,uint256 amount)`
+   *
+   * @dev Written as a literal word. `compactc` emits a full keccak
+   * permutation even for a constant argument, so hashing the type string
+   * in-circuit would add ~4.2k rows to every `execute`. The spec checks this
+   * word against the type string above.
+   *
+   * @returns {Bytes<32>} The `Execute` type hash.
+   */
+  pure circuit EXECUTE_TYPEHASH(): Bytes<32> {
+    const typeHash: Vector<32, Uint<8>> = [
+      0x8e, 0x36, 0xc9, 0x78, 0xf2, 0x00, 0x15, 0xe8,
+      0x1d, 0x7a, 0x53, 0xef, 0xc3, 0x2e, 0x2b, 0x08,
+      0xf1, 0x24, 0x97, 0xa5, 0x05, 0x7c, 0x70, 0x20,
+      0x7f, 0x8b, 0xc4, 0xb7, 0xc6, 0xcf, 0x5e, 0x15
+    ];
 
-/**
- * @description Executes a shielded send authorized by threshold signatures.
- *
- * The circuit reads the current nonce from the ledger, increments it,
- * then reconstructs the message hash that signers must have signed
- * off-chain: `persistentHash([domain, kernel.self(), nonce,
- * persistentHash(to), coin color, amount])`. The digest is domain-separated
- * and bound to the contract instance and the full recipient (kind and
- * address), so a signature authorizes exactly one operation on one instance.
- *
- * Approvals are checked by `EcdsaSignerManager`, which derives each signer's
- * commitment from their public key and the instance salt, rejects duplicates,
- * and enforces the threshold.
- *
- * @circuitInfo k=17, rows=98061
- *
- * Requirements:
- *
- * - Both public keys must hash to registered signer commitments.
- * - Both signatures must be valid over the message hash and use the low-s
- *   encoding.
- * - Signers must not be duplicates.
- * - Coin value must be >= amount.
- *
- * @param {Proposal_Recipient} to - The recipient.
- * @param {Uint<128>} amount - The amount to send.
- * @param {QualifiedShieldedCoinInfo} coin - The coin to spend (from operator's pool).
- * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
- * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the operation.
- *
- * @returns {ShieldedSendResult} The send result including any change.
- */
-export circuit execute(
-  to: Proposal_Recipient,
-  amount: Uint<128>,
-  coin: QualifiedShieldedCoinInfo,
-  pubkeys: Vector<2, Secp256k1Point>,
-  signatures: Vector<2, Secp256k1EcdsaSignature>
-): ShieldedSendResult {
-  // Increment nonce
-  const currentNonce = _nonce;
-  _nonce.increment(1);
-
-  // Construct message hash
-  const msgHash = persistentHash<Vector<6, Bytes<32>>>([
-    pad(32, "multisig:execute:"),
-    kernel.self().bytes,
-    currentNonce as Bytes<32>,
-    persistentHash<Proposal_Recipient>(to),
-    coin.color,
-    amount as Bytes<32>
-  ]);
-
-  EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
-
-  // Execute transfer
-  const normalizedRecipient = Proposal_toShieldedRecipient(to);
-  return Treasury__send(coin, normalizedRecipient, amount);
-}
+    return typeHash as Bytes<32>;
+  }
 
-// ─── Commitments ────────────────────────────────────────────────
+  // ─── Deposit ────────────────────────────────────────────────────
 
-/**
- * @description Computes a signer commitment from a secp256k1 public key,
- * as `persistentHash(pkX, pkY, salt, "multisig:signer:")`.
- *
- * Pure, so the deployer can derive constructor commitments off-chain.
- *
- * Requirements:
- *
- * - `pk` must not be the secp256k1 identity point, which has no coordinates.
- *
- * @param {Secp256k1Point} pk - The secp256k1 public key.
- * @param {Bytes<32>} salt - The instance salt.
- *
- * @returns {Bytes<32>} The signer commitment.
- */
-export pure circuit _calculateSignerId(
-  pk: Secp256k1Point,
-  salt: Bytes<32>
-): Bytes<32> {
-  return EcdsaSignerManager_calculateSignerId(pk, salt);
-}
+  /**
+   * @description Receives a shielded coin into the multisig treasury.
+   *
+   * No access control which allows anyone to deposit. The coin is claimed at the
+   * protocol level through receiveShielded. No coin data is stored on the
+   * public ledger, preserving full balance privacy.
+   *
+   * The operator discovers the coin's Merkle tree index by subscribing
+   * to ZswapOutput events via the indexer, filtering by contract address,
+   * and extracting mt_index. Combined with the known ShieldedCoinInfo,
+   * this produces the QualifiedShieldedCoinInfo needed for spending.
+   *
+   * @constraints k=13, rows=5898 (zkir-v3)
+   *
+   * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
+   */
+  export circuit deposit(coin: ShieldedCoinInfo): [] {
+    receiveShielded(disclose(coin));
+  }
 
-// ─── View ───────────────────────────────────────────────────────
+  // ─── Execute ────────────────────────────────────────────────────
 
-/**
- * @description Returns the nonce the next `execute` digest will bind to.
- *
- * @circuitInfo k=6, rows=34
- *
- * @returns {Uint<64>} The current nonce.
- */
-export circuit getNonce(): Uint<64> {
-  return _nonce;
-}
+  /**
+   * @description Executes a shielded send authorized by threshold signatures.
+   *
+   * The circuit reads the current nonce from the ledger, increments it,
+   * then reconstructs the EIP-712 digest that signers must have signed
+   * off-chain: the `Execute` struct (contract address, nonce, recipient kind,
+   * recipient, coin color, amount) hashed under this deployment's domain
+   * separator. The digest is bound to the contract instance and the full recipient (kind and
+   * address), so a signature authorizes exactly one operation on one instance.
+   *
+   * Approvals are checked by `EcdsaSignerManager`, which derives each signer's
+   * commitment from their public key and the instance salt, rejects duplicates,
+   * and enforces the threshold.
+   *
+   * @constraints k=17, rows=104644 (zkir-v3)
+   *
+   * Requirements:
+   *
+   * - Both public keys must hash to registered signer commitments.
+   * - Both signatures must be valid over the message hash and use the low-s
+   *   encoding.
+   * - Signers must not be duplicates.
+   * - Coin value must be >= amount.
+   *
+   * @param {Proposal_Recipient} to - The recipient.
+   * @param {Uint<128>} amount - The amount to send.
+   * @param {QualifiedShieldedCoinInfo} coin - The coin to spend (from operator's pool).
+   * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
+   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the operation.
+   *
+   * @returns {ShieldedSendResult} The send result including any change.
+   */
+  export circuit execute(
+    to: Proposal_Recipient,
+    amount: Uint<128>,
+    coin: QualifiedShieldedCoinInfo,
+    pubkeys: Vector<2, Secp256k1Point>,
+    signatures: Vector<2, Secp256k1EcdsaSignature>
+  ): ShieldedSendResult {
+    // Increment nonce
+    const currentNonce = _nonce;
+    _nonce.increment(1);
 
-/**
- * @description Returns the number of registered signers.
- *
- * @circuitInfo k=6, rows=34
- *
- * @returns {Uint<8>} The signer count.
- */
-export circuit getSignerCount(): Uint<8> {
-  return EcdsaSignerManager_getSignerCount();
-}
+    // Construct message hash
+    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<7, Bytes<32>>>([
+      EXECUTE_TYPEHASH(),
+      // Binds the digest to this deployment. The domain cannot carry the
+      // address, so removing this word removes cross-instance replay
+      // protection.
+      kernel.self().bytes,
+      EvmAbi_uint64Word(currentNonce),
+      EvmAbi_uint8Word(to.kind as Uint<8>),
+      to.address,
+      coin.color,
+      EvmAbi_uint128Word(amount)
+    ]));
 
-/**
- * @description Returns the approval threshold.
- *
- * @circuitInfo k=6, rows=34
- *
- * @returns {Uint<8>} The threshold.
- */
-export circuit getThreshold(): Uint<8> {
-  return EcdsaSignerManager_getThreshold();
-}
+    EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
 
-/**
- * @description Returns whether the given commitment is a registered signer.
- *
- * @circuitInfo k=8, rows=129
- *
- * @param {Bytes<32>} commitment - The signer commitment to check.
- * @returns {Boolean} True if registered.
- */
-export circuit isSigner(commitment: Bytes<32>): Boolean {
-  return EcdsaSignerManager_isSigner(commitment);
+    // Execute transfer
+    const normalizedRecipient = Proposal_toShieldedRecipient(to);
+    return Treasury__send(coin, normalizedRecipient, amount);
+  }
+
+  // ─── Commitments ────────────────────────────────────────────────
+
+  /**
+   * @description Computes a signer commitment from a secp256k1 public key,
+   * as `persistentHash(pkX, pkY, salt, "multisig:signer:")`.
+   *
+   * Pure, so the deployer can derive constructor commitments off-chain.
+   *
+   * Requirements:
+   *
+   * - `pk` must not be the secp256k1 identity point, which has no coordinates.
+   *
+   * @param {Secp256k1Point} pk - The secp256k1 public key.
+   * @param {Bytes<32>} salt - The instance salt.
+   *
+   * @returns {Bytes<32>} The signer commitment.
+   */
+  export pure circuit _calculateSignerId(
+    pk: Secp256k1Point,
+    salt: Bytes<32>
+  ): Bytes<32> {
+    return EcdsaSignerManager_calculateSignerId(pk, salt);
+  }
+
+  // ─── View ───────────────────────────────────────────────────────
+
+  /**
+   * @description Returns the nonce the next `execute` digest will bind to.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<64>} The current nonce.
+   */
+  export circuit getNonce(): Uint<64> {
+    return _nonce;
+  }
+
+  /**
+   * @description Returns the number of registered signers.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<8>} The signer count.
+   */
+  export circuit getSignerCount(): Uint<8> {
+    return EcdsaSignerManager_getSignerCount();
+  }
+
+  /**
+   * @description Returns the approval threshold.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<8>} The threshold.
+   */
+  export circuit getThreshold(): Uint<8> {
+    return EcdsaSignerManager_getThreshold();
+  }
+
+  /**
+   * @description Returns whether the given commitment is a registered signer.
+   *
+   * @constraints k=8, rows=129 (zkir-v3)
+   *
+   * @param {Bytes<32>} commitment - The signer commitment to check.
+   * @returns {Boolean} True if registered.
+   */
+  export circuit isSigner(commitment: Bytes<32>): Boolean {
+    return EcdsaSignerManager_isSigner(commitment);
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.4.0-alpha.1",
+  "version": "0.4.0-alpha.2",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",
@@ -24,29 +24,30 @@
     "#test-utils/*": "./test-utils/*"
   },
   "scripts": {
-    "compile": "compact-compiler --exclude '*/archive/*'",
+    "compile": "compact-compiler --exclude '*/archive/*' --exclude '*/crypto/*' --exclude '*/multisig/*'",
     "compile:access": "compact-compiler --dir access",
     "compile:archive": "compact-compiler --dir archive",
-    "compile:crypto": "compact-compiler --dir crypto --feature-zkir-v3",
+    "compile:crypto": "compact-compiler --dir crypto --feature-zkir-v3 --exclude 'MockElGamal.compact' --exclude 'MockEcdhMask.compact' --exclude 'MockCurveOps.compact' && compact-compiler --dir crypto/test/mocks --exclude 'MockEcdsa.compact' --exclude 'MockEip712.compact'",
     "compile:multisig": "compact-compiler --dir multisig --feature-zkir-v3",
     "compile:security": "compact-compiler --dir security",
     "compile:token": "compact-compiler --dir token",
     "compile:utils": "compact-compiler --dir utils",
     "compile:integration": "compact-compiler --src test/integration/_mocks",
-    "build": "compact-builder --hierarchical --out dist --clean-dist --exclude '*/archive/*' --exclude 'Mock*' --exclude '*.mock.compact' --copy package.json --copy ../README.md && find dist -type d -empty -delete",
+    "build": "compact-builder --hierarchical --out dist --clean-dist --feature-zkir-v3 --exclude '*/archive/*' --exclude 'Mock*' --exclude '*.mock.compact' --copy package.json --copy ../README.md && find dist -type d -empty -delete",
     "test": "vitest run --project unit",
     "test:coverage": "vitest run --project unit --coverage",
     "test:integration": "vitest run --project integration",
     "test:harness": "vitest run --project harness",
     "test:harness:live": "MIDNIGHT_BACKEND=live vitest run --project harness-live",
+    "test:scripts": "vitest run --project scripts",
     "types": "tsc -p tsconfig.json --noEmit",
     "clean": "git clean -fXd"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "dependencies": {
-    "@openzeppelin/compact-cli": "^0.0.3"
+    "@openzeppelin/compact-cli": "^0.1.1"
   },
   "devDependencies": {
     "@midnight-ntwrk/compact-js": "2.5.5-rc.8",
@@ -59,16 +60,19 @@
     "@midnight-ntwrk/midnight-js-protocol": "5.0.0-beta.7",
     "@midnight-ntwrk/midnight-js-types": "5.0.0-beta.7",
     "@midnight-ntwrk/testkit-js": "5.0.0-beta.7",
-    "@midnightntwrk/ledger-v9": "1.0.0-rc.3",
+    "@midnightntwrk/ledger-v9": "1.0.0-rc.5",
     "@midnightntwrk/wallet-sdk-address-format": "4.0.0-beta.2",
     "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
     "@openzeppelin/compact-simulator": "^0.4.0",
     "@tsconfig/node24": "^24.0.5",
-    "@types/node": "26.4.0",
-    "@vitest/coverage-v8": "^4.1.11",
-    "fast-check": "^4.9.0",
+    "@types/node": "26.5.1",
+    "@vitest/coverage-v8": "^5.0.0",
+    "ethers": "^6.17.0",
+    "fast-check": "^4.10.1",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vite": "^8.3.0",
+    "vitest": "^5.0.0"
   }
 }

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (security/Allowlist.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -41,7 +41,7 @@ module Allowlist {
   /**
    * @description Returns whether `account` is currently allowed.
    *
-   * @circuitInfo k=9, rows=305
+   * @constraints k=9, rows=303
    *
    * @param {Bytes<32>} account - The account to query.
    * @return {Boolean} - True if `account` is a member of the allowlist.
@@ -58,7 +58,7 @@ module Allowlist {
    * @description Asserts that `account` is allowed. The composing contract
    * decides when this gate applies.
    *
-   * @circuitInfo k=9, rows=305
+   * @constraints k=9, rows=303
    *
    * Requirements:
    *
@@ -78,7 +78,7 @@ module Allowlist {
   /**
    * @description Adds `account` to the allowlist.
    *
-   * @circuitInfo k=9, rows=303
+   * @constraints k=9, rows=301
    *
    * @param {Bytes<32>} account - The account to allow.
    * @return {[]} - Empty tuple.
@@ -90,7 +90,7 @@ module Allowlist {
   /**
    * @description Removes `account` from the allowlist.
    *
-   * @circuitInfo k=9, rows=303
+   * @constraints k=9, rows=301
    *
    * @param {Bytes<32>} account - The account to disallow.
    * @return {[]} - Empty tuple.

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (security/Blocklist.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -39,7 +39,7 @@ module Blocklist {
   /**
    * @description Returns whether `account` is currently blocked.
    *
-   * @circuitInfo k=9, rows=305
+   * @constraints k=9, rows=303
    *
    * @param {Bytes<32>} account - The account to query.
    * @return {Boolean} - True if `account` is a member of the blocklist.
@@ -56,7 +56,7 @@ module Blocklist {
    * @description Asserts that `account` is not blocked. The composing contract
    * decides when this gate applies.
    *
-   * @circuitInfo k=9, rows=308
+   * @constraints k=9, rows=306
    *
    * Requirements:
    *
@@ -76,7 +76,7 @@ module Blocklist {
   /**
    * @description Adds `account` to the blocklist.
    *
-   * @circuitInfo k=9, rows=303
+   * @constraints k=9, rows=301
    *
    * @param {Bytes<32>} account - The account to block.
    * @return {[]} - Empty tuple.
@@ -88,7 +88,7 @@ module Blocklist {
   /**
    * @description Removes `account` from the blocklist.
    *
-   * @circuitInfo k=9, rows=303
+   * @constraints k=9, rows=301
    *
    * @param {Bytes<32>} account - The account to unblock.
    * @return {[]} - Empty tuple.

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (security/Initializable.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -26,12 +26,16 @@ pragma language_version >= 0.26.0;
 module Initializable {
   import CompactStandardLibrary;
 
+  /**
+   * @description Whether `initialize` has run. Guards against re-initialization
+   * and against use before initialization.
+   */
   export ledger _isInitialized: Boolean;
 
   /**
    * @description Initializes the state thus ensuring the calling circuit can only be called once.
    *
-   * @circuitInfo k=10, rows=38
+   * @constraints k=6, rows=28
    *
    * Requirements:
    *
@@ -47,7 +51,7 @@ module Initializable {
   /**
    * @description Asserts that the contract has been initialized, throwing an error if not.
    *
-   * @circuitInfo k=10, rows=31
+   * @constraints k=6, rows=25
    *
    * Requirements:
    *
@@ -62,7 +66,7 @@ module Initializable {
   /**
    * @description Asserts that the contract has not been initialized, throwing an error if it has.
    *
-   * @circuitInfo k=10, rows=35
+   * @constraints k=6, rows=28
    *
    * Requirements:
    *