feat: migrate util to metadata helper

[hieu-w]

Jira Link

Description

This PR migrates shared cryptographic and utility code from torus.js into @toruslabs/metadata-helpers and consumes it from there, reducing duplication and centralizing helpers used across Torus packages.

Dependency

• Add @toruslabs/metadata-helpers (^8.2.0) as a dependency.

Code moved to metadata-helpers (now consumed via the package)

• src/helpers/common.ts: Curve/crypto helpers (derivePubKey, generatePrivateKey, getSecp256k1, getEd25519, getKeyCurve), noble re-exports (bytesToHex, hexToBytes, invert, mod, etc.), encoding (utf8ToBytes, bytesToBase64, base64ToBytes), hashing (keccak256, keccak256Bytes), and utilities (kCombinations, thresholdSame, calculateMedian, toBigIntBE, bigintToHex) are now imported from @toruslabs/metadata-helpers and re-exported so existing consumers of common.ts are unchanged.
• src/helpers/keyUtils.ts: Helpers such as getEd25519ExtendedPublicKey, encodeEd25519Point, generateAddressFromPrivKey, generateAddressFromPubKey, getSecp256k1PublicKeyFromAffinePoint, getPostboxKeyFrom1OutOf1, and generateRandomPolynomial are now from metadata-helpers and re-exported.
• Point, Polynomial, Share: Local implementations in src/Point.ts, src/Polynomial.ts, src/Share.ts and src/helpers/langrangeInterpolatePoly.ts are removed; the package now re-exports Point, Polynomial, and Share from @toruslabs/metadata-helpers in src/index.ts. The langrangeInterpolatePoly helper is no longer exported from src/helpers/index.ts (replaced by metadata-helpers usage where needed).

Torus-specific logic retained in torus.js

• normalizeKeysResult, normalizeLookUpResult, ECIES param conversion (encParamsBufToHex, encParamsHexToBuf), getProxyCoordinatorEndpointIndex, and waitFor remain in common.ts.
• Key/nonce and metadata handling in keyUtils and metadataUtils that depend on Torus interfaces remain local; only the underlying crypto/number helpers were moved.

Other

• Dev dependency bumps: @toruslabs/eslint-config-typescript, @toruslabs/torus-scripts, dotenv, lint-staged, rimraf.
• Add .github/PULL_REQUEST_TEMPLATE.md for PRs.

Public API of torus.js is preserved via re-exports; existing callers of Point, Polynomial, Share, and the helpers from common/keyUtils do not need to change.

How has this been tested?

• Existing test suite (unit/integration) run locally.
• Confirm build and lint pass (npm run build, npm run lint).
• (If applicable) Manual verification that packages depending on torus.js still resolve and use the re-exported helpers correctly.

Screenshots (if appropriate)

N/A – no UI changes.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

(Refactor: internal migration to metadata-helpers with re-exports; public API unchanged.)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Medium Risk
Medium risk because it rewires core crypto/encoding/hash helpers and share-generation/lagrange interpolation to a new dependency, which could subtly change key/address derivation or node interoperability. Most changes are refactors with re-exports to preserve the public API surface.

Overview
Migrates shared crypto and polynomial/point utilities out of this repo and into @toruslabs/metadata-helpers. common.ts, keyUtils.ts, metadataUtils.ts, and nodeUtils.ts now import (and often re-export) hashing/encoding/curve helpers, address/key helpers, polynomial generation, and lagrangeInterpolation from the external package.

Removes local implementations of Point, Polynomial, Share, and langrangeInterpolatePoly, and updates the public exports to re-export Point, Polynomial, and Share from @toruslabs/metadata-helpers.

Adds a GitHub PR template, updates CODEOWNERS ownership casing/teams, bumps various tooling deps, and tweaks several integration tests to use longer timeouts and switch ED25519 base58 encoding to @scure/base.

^{Written by Cursor Bugbot for commit 22be1a0. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​toruslabs/​eslint-config-typescript@​5.0.0 ⏵ 5.0.1				+1
	@​toruslabs/​torus-scripts@​8.0.0 ⏵ 8.0.1				+1
	@​scure/​base@​2.0.0
	rimraf@​6.1.2 ⏵ 6.1.3	+1		+1
	@​toruslabs/​metadata-helpers@​8.2.0
	dotenv@​17.2.4 ⏵ 17.3.1
	lint-staged@​16.2.7 ⏵ 16.3.2	+1			+8

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code augments a meta-schema to permit remote dereferencing of keyword schemas via a hardcoded data.json resource. This introduces network dependency and potential changes to validation semantics at runtime. While not inherently malicious, the remote reference constitutes a notable security and reliability risk that should be mitigated with local fallbacks, input validation, and explicit remote-resource governance. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/eslint@9.39.2 → npm/ajv@6.14.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code is a straightforward build script to bundle and minify a specified package using Browserify and UglifyJS. The primary security concern is potential path manipulation: json.main is used to form a require path without validating that it stays within the target package directory. If a malicious or misconfigured package.json includes an absolute path or traversal outside the package, the script could bundle unintended files. Otherwise, the script does not perform network access, data exfiltration, or backdoor actions, and there is no hard-coded secrets or dynamic code execution beyond standard bundling/minification. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/eslint@9.39.2 → npm/ajv@6.14.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code implements a standard AJV-like dynamic parser generator for JTD schemas. There are no explicit malware indicators in this fragment. The primary security concern is the dynamic code generation and execution from external schemas, which introduces a medium risk if schemas are untrusted. With trusted schemas and proper schema management, the risk is typically acceptable within this pattern. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/@toruslabs/eslint-config-typescript@5.0.1 → npm/ajv@8.18.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: The code implements standard timestamp validation with clear logic for normal and leap years and leap seconds. There is no network, file, or execution of external code within this isolated fragment. The only anomalous aspect is assigning a string to validTimestamp.code, which could enable external tooling to inject behavior in certain environments, but this does not constitute active malicious behavior in this isolated snippet. Overall, low to moderate security risk in typical usage; no malware detected within the shown code. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/@toruslabs/eslint-config-typescript@5.0.1 → npm/ajv@8.18.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly Notes: This module generates JavaScript code at runtime via standaloneCode(...) and then immediately executes it with require-from-string. Because the generated code can incorporate user-supplied schemas or custom keywords without sanitization or sandboxing, an attacker who controls those inputs could inject arbitrary code and achieve remote code execution in the Node process. Users should audit and lock down the standaloneCode output or replace dynamic evaluation with a safer, static bundling approach. Confidence: 1.00 Severity: 0.60 From: package-lock.json → npm/@toruslabs/eslint-config-typescript@5.0.1 → npm/ajv@8.18.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Ignoring alerts on:

• glob@13.0.6

View full report

[hieu-w]

@SocketSecurity ignore npm/glob@13.0.6

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}