@aztec-labs/pxe 6.0.0-nightly.20260829

package/src/operation_lifecycle.ts

@@ -0,0 +1,99 @@
+import type { Logger } from '@aztec-labs/foundation/log';
+import { allToCompletion } from '@aztec-labs/foundation/promise';
+
+import type { ChangeSetId, StagedWriteCoordinator } from './storage/staged_write_coordinator.js';
+
+/**
+ * Contributes work to every synced operation (e.g. writes into its change set). The operation waits for a
+ * contributor's work to settle before deciding its change set, and informs it of the outcome.
+ */
+export interface OperationContributor {
+  /**
+   * Waits for any work the contributor still has in flight. Awaited before the operation's change set is decided, so
+   * that no contributor is still writing when it is committed or discarded. A rejection causes the operation to
+   * discard instead of commit.
+   */
+  settle?(changeSetId: ChangeSetId): Promise<void>;
+
+  /**
+   * Called once the operation's change set has been committed or discarded. A throw is logged and swallowed: the outcome is
+   * already decided by this point, so it cannot change it.
+   */
+  onOperationEnd(changeSetId: ChangeSetId, outcome: 'committed' | 'discarded'): void;
+}
+
+/**
+ * Runs `fn` as the operation's work and decides its change set.
+ *
+ * On success:
+ * 1. Waits for every contributor to settle. A rejection vetoes the commit and the failure path below runs instead.
+ * 2. Commits the change set.
+ * 3. Notifies contributors of the outcome.
+ *
+ * On failure:
+ * 1. Drains contributors, logging failures instead of propagating them so the discard runs to completion and the
+ *    error that aborted the operation is not masked.
+ * 2. Aborts the change set.
+ * 3. Notifies contributors of the outcome.
+ * 4. Rethrows.
+ */
+export async function runOperation<T>(args: RunOperationArgs, fn: () => Promise<T>): Promise<T> {
+  const { stagedWriteCoordinator, contributors, changeSetId, log } = args;
+  try {
+    const result = await fn();
+
+    // Settling must stay outside the commit transaction: it can take arbitrarily long.
+    await allToCompletion(contributors.map(contributor => contributor.settle?.(changeSetId)));
+    log.verbose(`Committing operation ${changeSetId}`, { changeSetId });
+
+    await stagedWriteCoordinator.commit(changeSetId);
+    notifyOperationEnd(args, 'committed');
+    return result;
+  } catch (err) {
+    log.verbose(`Aborting operation ${changeSetId}`, { changeSetId });
+    await settleContributorsLoggingFailures(args);
+    try {
+      stagedWriteCoordinator.abort(changeSetId);
+    } catch (abortErr) {
+      // Nothing here can undo a failed abort, so it is logged, but the error that ended the operation is the one
+      // reported.
+      log.error(`Failed to abort operation ${changeSetId}`, abortErr, { changeSetId });
+    }
+    notifyOperationEnd(args, 'discarded');
+    throw err;
+  }
+}
+
+function notifyOperationEnd(
+  { contributors, changeSetId, log }: RunOperationArgs,
+  outcome: 'committed' | 'discarded',
+): void {
+  for (const contributor of contributors) {
+    // The change set has already been decided at this point, so a failed notification must not turn a committed
+    // operation into a rejected one, nor mask the error that caused a discard.
+    try {
+      contributor.onOperationEnd(changeSetId, outcome);
+    } catch (err) {
+      log.warn(`Contributor failed to handle the end of operation ${changeSetId}`, { changeSetId, outcome, err });
+    }
+  }
+}
+
+async function settleContributorsLoggingFailures({ contributors, changeSetId, log }: RunOperationArgs): Promise<void> {
+  await allToCompletion(
+    contributors.map(contributor =>
+      contributor.settle?.(changeSetId).catch(err => {
+        log.warn(`Contributor failed to settle while discarding operation ${changeSetId}`, { changeSetId, err });
+      }),
+    ),
+  );
+}
+
+/** What {@link runOperation} needs to decide an operation's change set. */
+type RunOperationArgs = {
+  stagedWriteCoordinator: StagedWriteCoordinator;
+  contributors: OperationContributor[];
+  /** The change set the operation's writes are staged under, from {@link StagedWriteCoordinator.begin}. */
+  changeSetId: ChangeSetId;
+  log: Logger;
+};

package/src/operation_queue.ts

@@ -0,0 +1,149 @@
+import type { Logger } from '@aztec-labs/foundation/log';
+import { SerialQueue } from '@aztec-labs/foundation/queue';
+import { Timer } from '@aztec-labs/foundation/timer';
+import { SimulationError } from '@aztec-labs/stdlib/errors';
+import type { BlockHeader } from '@aztec-labs/stdlib/tx';
+
+import type { BlockSynchronizer } from './block_synchronizer/index.js';
+import type { Recording } from './node/benchmarked_node.js';
+import type { CachingAztecNode } from './node/caching_aztec_node.js';
+import { type OperationContributor, runOperation } from './operation_lifecycle.js';
+import type { AnchorBlockStore } from './storage/anchor_block_store/anchor_block_store.js';
+import type { ChangeSetId, StagedWriteCoordinator } from './storage/staged_write_coordinator.js';
+
+/** What a synced operation receives: its change set id, the anchor its sync established, and its instrumentation. */
+export type SyncedOperationContext = {
+  /**
+   * The change set the operation's writes are staged under. A synced operation runs inside exactly one change set,
+   * which is committed if it succeeds and discarded if it fails, so this ID doubles as the operation's identity:
+   * bookkeeping that must be kept or thrown away along with the operation is keyed on it, whether or not it lives in
+   * a store.
+   */
+  changeSetId: ChangeSetId;
+  /** Duration of the sync, for timing stats. */
+  syncTime: number;
+  anchorBlockHeader: BlockHeader;
+  /** Open recording of the node RPC calls made so far in this operation; `stats()` snapshots them for reporting. */
+  recording: Recording;
+  /** The operation's duration so far, including the sync. */
+  totalMs: () => number;
+};
+
+/**
+ * Serializes the PXE's operations, since concurrent execution is not supported: operations execute oracles that read
+ * and write the PXE stores, and concurrent runs would interfere with one another.
+ *
+ * Synced operations additionally run after a sync with the node and inside a staged-write session (see
+ * {@link StagedWriteCoordinator}): staged writes are committed if the operation succeeds and discarded if it throws.
+ */
+export class OperationQueue {
+  private readonly queue = new SerialQueue();
+  private readonly node: CachingAztecNode;
+  private readonly synchronizer: BlockSynchronizer;
+  private readonly anchorBlockStore: AnchorBlockStore;
+  private readonly stagedWriteCoordinator: StagedWriteCoordinator;
+  private readonly contributors: OperationContributor[];
+  private readonly autoSync: boolean;
+  private readonly log: Logger;
+
+  constructor(args: OperationQueueArgs) {
+    this.node = args.node;
+    this.synchronizer = args.synchronizer;
+    this.anchorBlockStore = args.anchorBlockStore;
+    this.stagedWriteCoordinator = args.stagedWriteCoordinator;
+    this.contributors = args.contributors;
+    this.autoSync = args.autoSync;
+    this.log = args.log;
+  }
+
+  public start(): void {
+    this.queue.start();
+  }
+
+  public async stop(): Promise<void> {
+    await this.queue.end();
+  }
+
+  /**
+   * Runs an operation once no other operations are running. Returns a promise that will resolve once the operation
+   * is complete.
+   *
+   * Useful for tasks that cannot run concurrently, such as contract function simulation.
+   */
+  public run<T>(fn: () => Promise<T>): Promise<T> {
+    // TODO(#12636): relax the conditions under which we forbid concurrency.
+    if (this.queue.length() != 0) {
+      this.log.warn(
+        `PXE is already processing ${this.queue.length()} operations, concurrent execution is not supported. Will run once those are complete.`,
+      );
+    }
+
+    return this.queue.put(fn);
+  }
+
+  /**
+   * Runs an operation (`fn`) after a sync with the node (skipped when the `autoSync` config flag is disabled, unless
+   * `forceSync` is set). If the operation succeeds, then all staged writes are committed. If it rejects, then all
+   * staged writes are discarded.
+   */
+  public runSynced<T>(
+    fn: (ctx: SyncedOperationContext) => Promise<T>,
+    { errorContext, forceSync = false }: { errorContext?: () => string[]; forceSync?: boolean } = {},
+  ): Promise<T> {
+    return this.run(async () => {
+      const totalTimer = new Timer();
+      const recording = this.node.startRecording();
+      try {
+        const syncTimer = new Timer();
+        if (forceSync || this.autoSync) {
+          await this.synchronizer.sync();
+        }
+        const syncTime = syncTimer.ms();
+        const anchorBlockHeader = await this.anchorBlockStore.getBlockHeader();
+
+        const changeSetId = this.stagedWriteCoordinator.begin();
+        this.log.verbose(`Beginning operation ${changeSetId}`, { changeSetId, syncMs: syncTime });
+
+        const operationArgs = {
+          stagedWriteCoordinator: this.stagedWriteCoordinator,
+          contributors: this.contributors,
+          changeSetId,
+          log: this.log,
+        };
+        return await runOperation(operationArgs, () =>
+          fn({ changeSetId, syncTime, anchorBlockHeader, recording, totalMs: () => totalTimer.ms() }),
+        );
+      } catch (err: any) {
+        throw errorContext ? this.#contextualizeError(err, ...errorContext()) : err;
+      } finally {
+        recording.stop();
+      }
+    });
+  }
+
+  #contextualizeError(err: Error, ...context: string[]): Error {
+    let contextStr = '';
+    if (context.length > 0) {
+      contextStr = `\nContext:\n${context.join('\n')}`;
+    }
+    if (err instanceof SimulationError) {
+      err.setAztecContext(contextStr);
+    } else {
+      this.log.error(err.name, err);
+      this.log.debug(contextStr);
+    }
+    return err;
+  }
+}
+
+/** Dependencies of the {@link OperationQueue}. */
+type OperationQueueArgs = {
+  node: CachingAztecNode;
+  synchronizer: BlockSynchronizer;
+  anchorBlockStore: AnchorBlockStore;
+  stagedWriteCoordinator: StagedWriteCoordinator;
+  contributors: OperationContributor[];
+  /** Whether synced operations sync with the node before running (see {@link OperationQueue.runSynced}). */
+  autoSync: boolean;
+  log: Logger;
+};

package/src/oracle_version.ts

@@ -0,0 +1,22 @@
+/// The oracle version constants are used to check that the oracle interface is in sync between PXE and Aztec.nr.
+/// We version the oracle interface as `major.minor` where:
+///   - `major` = backward-breaking changes (must match exactly between PXE and Aztec.nr)
+///   - `minor` = oracle additions (non-breaking; PXE minor >= contract minor)
+///
+/// The Noir counterparts are in `noir-projects/aztec-nr/aztec/src/oracle/version.nr`.
+///
+/// @dev Whenever a contract function or Noir test is run, the `aztec_misc_assertCompatibleOracleVersion` oracle is called.
+/// If the major version is incompatible, an error is thrown immediately. The minor version is recorded by the PXE and
+/// used to provide helpful error messages if a contract calls an oracle that doesn't exist. We don't throw immediately
+/// if AZTEC_NR_MINOR > PXE_MINOR because if a contract is updated to use a newer Aztec.nr dependency without actually
+/// using any of the new oracles then there is no reason to throw.
+export const ORACLE_VERSION_MAJOR = 30;
+export const ORACLE_VERSION_MINOR = 8;
+
+/// This hash is computed from `ORACLE_REGISTRY` (each oracle's name, ordered parameter names and
+/// types, and return type) and is used to detect when the oracle interface changes. When it does, you need to either:
+/// - increment `ORACLE_VERSION_MAJOR` and reset `ORACLE_VERSION_MINOR` to zero if the change is breaking, or
+/// - increment only `ORACLE_VERSION_MINOR` if the change is additive (a new oracle was added).
+///
+/// These constants must be kept in sync between this file and `noir-projects/aztec-nr/aztec/src/oracle/version.nr`.
+export const ORACLE_INTERFACE_HASH = '16a4ca6f5342a5b7a12fe9ec3aa88be16c40cf685f5a205a58187c2c41bb2661';

package/src/private_kernel/batch_planner.ts

@@ -0,0 +1,168 @@
+import type { Serializable, Tuple } from '@aztec-labs/foundation/serialize';
+import {
+  ClaimedLengthArray,
+  PrivateAccumulatedData,
+  PrivateKernelCircuitPublicInputs,
+  PrivateValidationRequests,
+  ScopedKeyValidationRequestAndSeparator,
+  ScopedPrivateLogData,
+} from '@aztec-labs/stdlib/kernel';
+import type { PrivateCallExecutionResult } from '@aztec-labs/stdlib/tx';
+import { VerificationKeyData } from '@aztec-labs/stdlib/vks';
+
+import { PrivateKernelResetPrivateInputsBuilder } from './hints/private_kernel_reset_private_inputs_builder.js';
+
+/**
+ * Decides how many apps from the top of the execution stack the next kernel iteration should
+ * absorb. The decision is made by keeping track of an app-by-app accumulator calling
+ * `PrivateKernelResetPrivateInputsBuilder.needsReset()` whether a reset would be required before
+ * taking each candidate.
+ *
+ * The K-batched kernels are mathematically equivalent to running K sequential `init`/`inner`
+ * iterations so a multi-app fit-check reduces to a sequence of single-app fit-checks against a rolling
+ * accumulator.
+ */
+export class BatchPlanner {
+  constructor(
+    private noteHashNullifierCounterMap: Map<number, number>,
+    private splitCounter: number,
+    private maxBatchSize: number,
+  ) {}
+
+  /**
+   * Returns the number of apps from the top of `stack` that the next kernel iteration should
+   * batch. Always at least 1 — the caller is expected to have run any pending resets first, so
+   * the next single app must always fit.
+   *
+   * The walk mirrors `consumeNextApp`'s stack manipulation (pop top, push reversed nested
+   * children, then DFS into them) on a copy of the stack, so the planner can look ahead past
+   * the parent's children without mutating the real prover stack.
+   */
+  decideBatchSize(currentAccumulator: PrivateKernelCircuitPublicInputs, stack: PrivateCallExecutionResult[]): number {
+    const virtualStack = [...stack];
+    let projected = currentAccumulator;
+    let chosen = 0;
+    for (let i = 0; i < this.maxBatchSize && virtualStack.length > 0; i++) {
+      const probe = new PrivateKernelResetPrivateInputsBuilder(
+        {
+          publicInputs: projected,
+          verificationKey: VerificationKeyData.empty(),
+          outputWitness: new Map(),
+          bytecode: Buffer.from([]),
+        },
+        virtualStack,
+        this.noteHashNullifierCounterMap,
+        this.splitCounter,
+      );
+      if (probe.needsReset()) {
+        break;
+      }
+      // Speculatively consume the top of the virtual stack the same way `consumeNextApp` does
+      // on the real stack: pop the candidate, push its reversed nested children so the next
+      // iteration's top is the next DFS app.
+      const candidate = virtualStack.pop()!;
+      virtualStack.push(...[...candidate.nestedExecutionResults].reverse());
+      projected = appendApp(projected, candidate);
+      chosen++;
+    }
+    return Math.max(1, chosen);
+  }
+}
+
+/**
+ * Returns a new `PrivateKernelCircuitPublicInputs` representing the accumulator after one kernel
+ * iteration has absorbed `app`. Mirrors the kernel composer's accumulator-update step
+ * (`PrivateKernelCircuitOutputComposer::scope_and_propagate_from_private_call`) for the six
+ * fields that `PrivateKernelResetPrivateInputsBuilder.needsReset()` inspects:
+ *
+ * - `validationRequests.noteHashReadRequests`              (already scoped per app; appended as-is)
+ * - `validationRequests.nullifierReadRequests`             (already scoped per app; appended as-is)
+ * - `validationRequests.scopedKeyValidationRequestsAndSeparators` (scope with call's contract address)
+ * - `end.noteHashes`                                       (scope)
+ * - `end.nullifiers`                                       (scope)
+ * - `end.privateLogs`                                      (scope)
+ *
+ * Other fields on `PrivateKernelCircuitPublicInputs` (constants, fee_payer, expiration_timestamp,
+ * public_call_requests, l2_to_l1_msgs, contract_class_logs_hashes, etc.) are not read by
+ * `needsReset()` and are carried over unchanged from `acc`.
+ */
+export function appendApp(
+  acc: PrivateKernelCircuitPublicInputs,
+  app: PrivateCallExecutionResult,
+): PrivateKernelCircuitPublicInputs {
+  const ca = app.publicInputs.callContext.contractAddress;
+  const appPi = app.publicInputs;
+
+  const newNoteHashReadRequests = cloneClaimedLengthArray(acc.validationRequests.noteHashReadRequests);
+  pushAll(newNoteHashReadRequests, appPi.noteHashReadRequests.getActiveItems());
+
+  const newNullifierReadRequests = cloneClaimedLengthArray(acc.validationRequests.nullifierReadRequests);
+  pushAll(newNullifierReadRequests, appPi.nullifierReadRequests.getActiveItems());
+
+  const newScopedKvrs = cloneClaimedLengthArray(acc.validationRequests.scopedKeyValidationRequestsAndSeparators);
+  pushAll(
+    newScopedKvrs,
+    appPi.keyValidationRequestsAndSeparators
+      .getActiveItems()
+      .map(kvr => new ScopedKeyValidationRequestAndSeparator(kvr, ca)),
+  );
+
+  const newNoteHashes = cloneClaimedLengthArray(acc.end.noteHashes);
+  pushAll(
+    newNoteHashes,
+    appPi.noteHashes.getActiveItems().map(nh => nh.scope(ca)),
+  );
+
+  const newNullifiers = cloneClaimedLengthArray(acc.end.nullifiers);
+  pushAll(
+    newNullifiers,
+    appPi.nullifiers.getActiveItems().map(n => n.scope(ca)),
+  );
+
+  const newPrivateLogs = cloneClaimedLengthArray(acc.end.privateLogs);
+  pushAll(
+    newPrivateLogs,
+    appPi.privateLogs.getActiveItems().map(pl => new ScopedPrivateLogData(pl, ca)),
+  );
+
+  const validationRequests = new PrivateValidationRequests(
+    newNoteHashReadRequests,
+    newNullifierReadRequests,
+    newScopedKvrs,
+  );
+
+  const end = new PrivateAccumulatedData(
+    newNoteHashes,
+    newNullifiers,
+    acc.end.l2ToL1Msgs,
+    newPrivateLogs,
+    acc.end.contractClassLogsHashes,
+    acc.end.publicCallRequests,
+    acc.end.privateCallStack,
+  );
+
+  return new PrivateKernelCircuitPublicInputs(
+    acc.constants,
+    acc.minRevertibleSideEffectCounter,
+    validationRequests,
+    end,
+    acc.publicTeardownCallRequest,
+    acc.feePayer,
+    acc.expirationTimestamp,
+    acc.isPrivateOnly,
+    acc.claimedRevertibleCounter,
+  );
+}
+
+function cloneClaimedLengthArray<T extends Serializable, N extends number>(
+  src: ClaimedLengthArray<T, N>,
+): ClaimedLengthArray<T, N> {
+  return new ClaimedLengthArray([...src.array] as Tuple<T, N>, src.claimedLength);
+}
+
+function pushAll<T extends Serializable, N extends number>(arr: ClaimedLengthArray<T, N>, items: T[]) {
+  for (const item of items) {
+    arr.array[arr.claimedLength] = item;
+    arr.claimedLength++;
+  }
+}

package/src/private_kernel/hints/compute_tx_expiration_timestamp.ts

@@ -0,0 +1,58 @@
+import { MAX_TX_LIFETIME } from '@aztec-labs/constants';
+import type { PrivateKernelCircuitPublicInputs } from '@aztec-labs/stdlib/kernel';
+import type { UInt64 } from '@aztec-labs/stdlib/types';
+
+const ROUNDED_DURATIONS = [
+  3600, // 1 hour
+  1800, // 30 mins
+  1, // 1 second
+];
+
+function roundTimestamp(blockTimestamp: bigint, expirationTimestamp: bigint): UInt64 {
+  return ROUNDED_DURATIONS.reduce((timestamp, duration) => {
+    if (timestamp <= blockTimestamp) {
+      // The timestamp must be greater than the block timestamp.
+      // If it is too small, round it down again using a smaller duration.
+      const totalDuration = expirationTimestamp - blockTimestamp;
+      const roundedDuration = totalDuration - (totalDuration % BigInt(duration));
+      return blockTimestamp + roundedDuration;
+    }
+    return timestamp;
+  }, 0n);
+}
+
+export function computeTxExpirationTimestamp(
+  previousKernel: PrivateKernelCircuitPublicInputs,
+  txLifetime = MAX_TX_LIFETIME,
+): UInt64 {
+  if (txLifetime > MAX_TX_LIFETIME) {
+    throw new Error(
+      `Custom tx lifetime cannot be greater than the max allowed. Max allowed: ${MAX_TX_LIFETIME}. Custom value: ${txLifetime}.`,
+    );
+  }
+
+  const anchorBlockTimestamp = previousKernel.constants.anchorBlockHeader.globalVariables.timestamp;
+  const maxTimestamp = anchorBlockTimestamp + BigInt(txLifetime);
+  const expirationTimestamp = previousKernel.expirationTimestamp;
+
+  // If the expirationTimestamp set during the tx execution is greater than or equal to the max allowed duration,
+  // use the maximum allowed timestamp.
+  // Note: It shouldn't be larger than the max allowed duration, but we check for it anyway.
+  if (expirationTimestamp >= maxTimestamp) {
+    return maxTimestamp;
+  }
+
+  // Round it down to the nearest hour/min/second to reduce precision and avoid revealing the exact value.
+  // This makes it harder for others to infer what function calls may have been used to produce a specific timestamp.
+  const roundedTimestamp = roundTimestamp(anchorBlockTimestamp, expirationTimestamp);
+
+  // The tx can't be published if the timestamp is the same or less than the anchor block's timestamp.
+  // Future blocks will have a greater timestamp, so the tx would never be included.
+  if (roundedTimestamp <= anchorBlockTimestamp) {
+    throw new Error(
+      `Include-by timestamp must be greater than the anchor block timestamp. Anchor block timestamp: ${anchorBlockTimestamp}. Include-by timestamp: ${expirationTimestamp}.`,
+    );
+  }
+
+  return roundedTimestamp;
+}

package/src/private_kernel/hints/index.ts

@@ -0,0 +1,2 @@
+export * from './private_kernel_reset_private_inputs_builder.js';
+export * from './compute_tx_expiration_timestamp.js';