@aztec-labs/stdlib 6.0.0-nightly.20260922 → 6.0.0-rc.1

package/dest/tx/tx_request.d.ts

@@ -16,7 +16,12 @@ export declare class TxRequest {
     txContext: TxContext;
     /** Function data representing the function to call. */
     functionData: FunctionData;
-    /** A salt to make the hash difficult to predict. The hash is used as the first nullifier if there is no nullifier emitted throughout the tx. */
+    /**
+     * A fresh random field drawn by the wallet, acting as the tx request's nonce. With `origin`, `chainId` and `version`
+     * it is the whole preimage of the protocol nullifier, so it keeps that nullifier unpredictable and unique. The kernel
+     * cannot check that it is random; draw it fresh for every transaction, since two requests with the same origin and
+     * salt are mutually exclusive.
+     */
     salt: Fr;
     constructor(
     /** Sender. */
@@ -27,7 +32,12 @@ export declare class TxRequest {
     txContext: TxContext, 
     /** Function data representing the function to call. */
     functionData: FunctionData, 
-    /** A salt to make the hash difficult to predict. The hash is used as the first nullifier if there is no nullifier emitted throughout the tx. */
+    /**
+     * A fresh random field drawn by the wallet, acting as the tx request's nonce. With `origin`, `chainId` and `version`
+     * it is the whole preimage of the protocol nullifier, so it keeps that nullifier unpredictable and unique. The kernel
+     * cannot check that it is random; draw it fresh for every transaction, since two requests with the same origin and
+     * salt are mutually exclusive.
+     */
     salt: Fr);
     static getFields(fields: FieldsOf<TxRequest>): readonly [AztecAddress, Fr, TxContext, FunctionData, Fr];
     static from(fields: FieldsOf<TxRequest>): TxRequest;
@@ -36,6 +46,17 @@ export declare class TxRequest {
      * @returns The buffer.
      */
     toBuffer(): Buffer<ArrayBufferLike>;
+    /**
+     * The unsiloed value of the protocol nullifier: the transaction's nonce commitment.
+     * The preimage is only `origin`, `chainId`, `version` and `salt`. Gas settings and the first call's arguments are
+     * left out so that a fee bump or a cancellation that reuses the salt produces the same nullifier.
+     */
+    computeProtocolNullifierValue(): Promise<Fr>;
+    /**
+     * The protocol nullifier as inserted into the nullifier tree, and as every private call receives it in
+     * `PrivateCircuitPublicInputs.protocolNullifier`: the value above siloed under `NULL_MSG_SENDER`.
+     */
+    computeProtocolNullifier(): Promise<Fr>;
     toFields(): Fr[];
     /**
      * Deserializes from a buffer or reader, corresponding to a write in cpp.
@@ -43,8 +64,7 @@ export declare class TxRequest {
      * @returns The deserialized TxRequest object.
      */
     static fromBuffer(buffer: Buffer | BufferReader): TxRequest;
-    hash(): Promise<Fr>;
     static empty(): TxRequest;
     isEmpty(): boolean;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHhfcmVxdWVzdC5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3R4L3R4X3JlcXVlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLEVBQUUsRUFBRSxNQUFNLHFDQUFxQyxDQUFDO0FBQ3pELE9BQU8sRUFBRSxZQUFZLEVBQXdDLE1BQU0sa0NBQWtDLENBQUM7QUFDdEcsT0FBTyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFN0QsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQ3pELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFFNUM7O0dBRUc7QUFDSCxxQkFBYSxTQUFTO0lBR2xCLGNBQWM7SUFDUCxNQUFNLEVBQUUsWUFBWTtJQUMzQiwyQ0FBMkM7SUFDcEMsUUFBUSxFQUFFLEVBQUU7SUFDbkIsMkJBQTJCO0lBQ3BCLFNBQVMsRUFBRSxTQUFTO0lBQzNCLHVEQUF1RDtJQUNoRCxZQUFZLEVBQUUsWUFBWTtJQUNqQyxnSkFBZ0o7SUFDekksSUFBSSxFQUFFLEVBQUU7SUFWakI7SUFDRSxjQUFjO0lBQ1AsTUFBTSxFQUFFLFlBQVk7SUFDM0IsMkNBQTJDO0lBQ3BDLFFBQVEsRUFBRSxFQUFFO0lBQ25CLDJCQUEyQjtJQUNwQixTQUFTLEVBQUUsU0FBUztJQUMzQix1REFBdUQ7SUFDaEQsWUFBWSxFQUFFLFlBQVk7SUFDakMsZ0pBQWdKO0lBQ3pJLElBQUksRUFBRSxFQUFFLEVBQ2I7SUFHSixNQUFNLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLDREQUUzQztJQUVELE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsR0FBRyxTQUFTLENBRWxEO0lBRUQ7OztPQUdHO0lBQ0gsUUFBUSw0QkFFUDtJQUVELFFBQVEsSUFBSSxFQUFFLEVBQUUsQ0FNZjtJQUVEOzs7O09BSUc7SUFDSCxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsWUFBWSxHQUFHLFNBQVMsQ0FTMUQ7SUFFRCxJQUFJLGdCQUVIO0lBRUQsTUFBTSxDQUFDLEtBQUssY0FFWDtJQUVELE9BQU8sWUFRTjtDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHhfcmVxdWVzdC5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3R4L3R4X3JlcXVlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLEVBQUUsRUFBRSxNQUFNLHFDQUFxQyxDQUFDO0FBQ3pELE9BQU8sRUFBRSxZQUFZLEVBQXdDLE1BQU0sa0NBQWtDLENBQUM7QUFDdEcsT0FBTyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFN0QsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBRXpELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFFNUM7O0dBRUc7QUFDSCxxQkFBYSxTQUFTO0lBR2xCLGNBQWM7SUFDUCxNQUFNLEVBQUUsWUFBWTtJQUMzQiwyQ0FBMkM7SUFDcEMsUUFBUSxFQUFFLEVBQUU7SUFDbkIsMkJBQTJCO0lBQ3BCLFNBQVMsRUFBRSxTQUFTO0lBQzNCLHVEQUF1RDtJQUNoRCxZQUFZLEVBQUUsWUFBWTtJQUNqQzs7Ozs7T0FLRztJQUNJLElBQUksRUFBRSxFQUFFO0lBZmpCO0lBQ0UsY0FBYztJQUNQLE1BQU0sRUFBRSxZQUFZO0lBQzNCLDJDQUEyQztJQUNwQyxRQUFRLEVBQUUsRUFBRTtJQUNuQiwyQkFBMkI7SUFDcEIsU0FBUyxFQUFFLFNBQVM7SUFDM0IsdURBQXVEO0lBQ2hELFlBQVksRUFBRSxZQUFZO0lBQ2pDOzs7OztPQUtHO0lBQ0ksSUFBSSxFQUFFLEVBQUUsRUFDYjtJQUdKLE1BQU0sQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsNERBRTNDO0lBRUQsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLFNBQVMsQ0FFbEQ7SUFFRDs7O09BR0c7SUFDSCxRQUFRLDRCQUVQO0lBRUQ7Ozs7T0FJRztJQUNILDZCQUE2QixJQUFJLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FLM0M7SUFFRDs7O09BR0c7SUFDRyx3QkFBd0IsSUFBSSxPQUFPLENBQUMsRUFBRSxDQUFDLENBRTVDO0lBRUQsUUFBUSxJQUFJLEVBQUUsRUFBRSxDQU1mO0lBRUQ7Ozs7T0FJRztJQUNILE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxZQUFZLEdBQUcsU0FBUyxDQVMxRDtJQUVELE1BQU0sQ0FBQyxLQUFLLGNBRVg7SUFFRCxPQUFPLFlBUU47Q0FDRiJ9

package/dest/tx/tx_request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tx_request.d.ts","sourceRoot":"","sources":["../../src/tx/tx_request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,MAAM,qCAAqC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAwC,MAAM,kCAAkC,CAAC;AACtG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;GAEG;AACH,qBAAa,SAAS;IAGlB,cAAc;IACP,MAAM,EAAE,YAAY;IAC3B,2CAA2C;IACpC,QAAQ,EAAE,EAAE;IACnB,2BAA2B;IACpB,SAAS,EAAE,SAAS;IAC3B,uDAAuD;IAChD,YAAY,EAAE,YAAY;IACjC,gJAAgJ;IACzI,IAAI,EAAE,EAAE;IAVjB;IACE,cAAc;IACP,MAAM,EAAE,YAAY;IAC3B,2CAA2C;IACpC,QAAQ,EAAE,EAAE;IACnB,2BAA2B;IACpB,SAAS,EAAE,SAAS;IAC3B,uDAAuD;IAChD,YAAY,EAAE,YAAY;IACjC,gJAAgJ;IACzI,IAAI,EAAE,EAAE,EACb;IAGJ,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,4DAE3C;IAED,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,CAElD;IAED;;;OAGG;IACH,QAAQ,4BAEP;IAED,QAAQ,IAAI,EAAE,EAAE,CAMf;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAS1D;IAED,IAAI,gBAEH;IAED,MAAM,CAAC,KAAK,cAEX;IAED,OAAO,YAQN;CACF"}
+{"version":3,"file":"tx_request.d.ts","sourceRoot":"","sources":["../../src/tx/tx_request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,MAAM,qCAAqC,CAAC;AACzD,OAAO,EAAE,YAAY,EAAwC,MAAM,kCAAkC,CAAC;AACtG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C;;GAEG;AACH,qBAAa,SAAS;IAGlB,cAAc;IACP,MAAM,EAAE,YAAY;IAC3B,2CAA2C;IACpC,QAAQ,EAAE,EAAE;IACnB,2BAA2B;IACpB,SAAS,EAAE,SAAS;IAC3B,uDAAuD;IAChD,YAAY,EAAE,YAAY;IACjC;;;;;OAKG;IACI,IAAI,EAAE,EAAE;IAfjB;IACE,cAAc;IACP,MAAM,EAAE,YAAY;IAC3B,2CAA2C;IACpC,QAAQ,EAAE,EAAE;IACnB,2BAA2B;IACpB,SAAS,EAAE,SAAS;IAC3B,uDAAuD;IAChD,YAAY,EAAE,YAAY;IACjC;;;;;OAKG;IACI,IAAI,EAAE,EAAE,EACb;IAGJ,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,4DAE3C;IAED,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,CAElD;IAED;;;OAGG;IACH,QAAQ,4BAEP;IAED;;;;OAIG;IACH,6BAA6B,IAAI,OAAO,CAAC,EAAE,CAAC,CAK3C;IAED;;;OAGG;IACG,wBAAwB,IAAI,OAAO,CAAC,EAAE,CAAC,CAE5C;IAED,QAAQ,IAAI,EAAE,EAAE,CAMf;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAS1D;IAED,MAAM,CAAC,KAAK,cAEX;IAED,OAAO,YAQN;CACF"}

package/dest/tx/tx_request.js

@@ -3,6 +3,7 @@ import { poseidon2HashWithSeparator } from '@aztec-labs/foundation/crypto/poseid
 import { Fr } from '@aztec-labs/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer, serializeToFields } from '@aztec-labs/foundation/serialize';
 import { AztecAddress } from '../aztec-address/index.js';
+import { computeProtocolNullifier } from '../hash/hash.js';
 import { FunctionData } from './function_data.js';
 import { TxContext } from './tx_context.js';
 /**
@@ -14,7 +15,12 @@ import { TxContext } from './tx_context.js';
     functionData;
     salt;
     // docs:start:constructor
-    constructor(/** Sender. */ origin, /** Pedersen hash of function arguments. */ argsHash, /** Transaction context. */ txContext, /** Function data representing the function to call. */ functionData, /** A salt to make the hash difficult to predict. The hash is used as the first nullifier if there is no nullifier emitted throughout the tx. */ salt){
+    constructor(/** Sender. */ origin, /** Pedersen hash of function arguments. */ argsHash, /** Transaction context. */ txContext, /** Function data representing the function to call. */ functionData, /**
+     * A fresh random field drawn by the wallet, acting as the tx request's nonce. With `origin`, `chainId` and `version`
+     * it is the whole preimage of the protocol nullifier, so it keeps that nullifier unpredictable and unique. The kernel
+     * cannot check that it is random; draw it fresh for every transaction, since two requests with the same origin and
+     * salt are mutually exclusive.
+     */ salt){
         this.origin = origin;
         this.argsHash = argsHash;
         this.txContext = txContext;
@@ -42,6 +48,24 @@ import { TxContext } from './tx_context.js';
             ...TxRequest.getFields(this)
         ]);
     }
+    /**
+   * The unsiloed value of the protocol nullifier: the transaction's nonce commitment.
+   * The preimage is only `origin`, `chainId`, `version` and `salt`. Gas settings and the first call's arguments are
+   * left out so that a fee bump or a cancellation that reuses the salt produces the same nullifier.
+   */ computeProtocolNullifierValue() {
+        return poseidon2HashWithSeparator([
+            this.origin.toField(),
+            this.txContext.chainId,
+            this.txContext.version,
+            this.salt
+        ], DomainSeparator.PROTOCOL_NULLIFIER);
+    }
+    /**
+   * The protocol nullifier as inserted into the nullifier tree, and as every private call receives it in
+   * `PrivateCircuitPublicInputs.protocolNullifier`: the value above siloed under `NULL_MSG_SENDER`.
+   */ async computeProtocolNullifier() {
+        return computeProtocolNullifier(await this.computeProtocolNullifierValue());
+    }
     toFields() {
         const fields = serializeToFields(...TxRequest.getFields(this));
         if (fields.length !== TX_REQUEST_LENGTH) {
@@ -57,9 +81,6 @@ import { TxContext } from './tx_context.js';
         const reader = BufferReader.asReader(buffer);
         return new TxRequest(reader.readObject(AztecAddress), Fr.fromBuffer(reader), reader.readObject(TxContext), reader.readObject(FunctionData), Fr.fromBuffer(reader));
     }
-    hash() {
-        return poseidon2HashWithSeparator(this.toFields(), DomainSeparator.TX_REQUEST);
-    }
     static empty() {
         return new TxRequest(AztecAddress.ZERO, Fr.zero(), TxContext.empty(), FunctionData.empty(), Fr.zero());
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec-labs/stdlib",
-  "version": "6.0.0-nightly.20260922",
+  "version": "6.0.0-rc.1",
   "type": "module",
   "inherits": [
     "../package.common.json",
@@ -92,12 +92,12 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.892.0",
-    "@aztec-foundation/bb.js": "6.0.0-nightly.20260921",
-    "@aztec-foundation/noir-noirc_abi": "6.0.0-nightly.20260921",
-    "@aztec-labs/blob-lib": "6.0.0-nightly.20260922",
-    "@aztec-labs/constants": "6.0.0-nightly.20260922",
-    "@aztec-labs/ethereum": "6.0.0-nightly.20260922",
-    "@aztec-labs/foundation": "6.0.0-nightly.20260922",
+    "@aztec-foundation/bb.js": "6.0.0-rc.1",
+    "@aztec-foundation/noir-noirc_abi": "6.0.0-rc.1",
+    "@aztec-labs/blob-lib": "6.0.0-rc.1",
+    "@aztec-labs/constants": "6.0.0-rc.1",
+    "@aztec-labs/ethereum": "6.0.0-rc.1",
+    "@aztec-labs/foundation": "6.0.0-rc.1",
     "@google-cloud/storage": "^7.15.0",
     "axios": "^1.15.1",
     "json-stringify-deterministic": "1.0.12",
@@ -108,7 +108,7 @@
     "msgpackr": "^1.11.2",
     "pako": "^2.1.0",
     "tslib": "^2.4.0",
-    "viem": "npm:@aztec/viem@2.38.2",
+    "viem": "npm:@aztec/viem@2.38.3",
     "zod": "~4.4.3"
   },
   "devDependencies": {

package/src/block/proposal/committee_attestation.ts

@@ -1,4 +1,5 @@
 import type { ViemCommitteeAttestation, ViemCommitteeAttestations } from '@aztec-labs/ethereum/contracts';
+import { Buffer32 } from '@aztec-labs/foundation/buffer';
 import { EthAddress } from '@aztec-labs/foundation/eth-address';
 import { Signature } from '@aztec-labs/foundation/eth-signature';
 import { BufferReader, serializeToBuffer } from '@aztec-labs/foundation/serialize';
@@ -76,10 +77,10 @@ export class CommitteeAttestation {
         }
 
         const v = dataBuffer[dataIndex];
-        const r = `0x${dataBuffer.subarray(dataIndex + 1, dataIndex + 33).toString('hex')}` as const;
-        const s = `0x${dataBuffer.subarray(dataIndex + 33, dataIndex + 65).toString('hex')}` as const;
+        const r = Buffer32.fromBuffer(dataBuffer.subarray(dataIndex + 1, dataIndex + 33));
+        const s = Buffer32.fromBuffer(dataBuffer.subarray(dataIndex + 33, dataIndex + 65));
 
-        const signature = Signature.fromViemSignature({ r, s, v });
+        const signature = new Signature(r, s, v);
 
         // For signed attestations, we use a zero address as the address is recovered from the signature
         attestations.push(new CommitteeAttestation(EthAddress.ZERO, signature));
@@ -90,8 +91,7 @@ export class CommitteeAttestation {
           throw new Error(`Insufficient data for address at position ${i}`);
         }
 
-        const addressBytes = dataBuffer.subarray(dataIndex, dataIndex + 20);
-        const address = EthAddress.fromString(`0x${addressBytes.toString('hex')}`);
+        const address = EthAddress.fromBuffer(dataBuffer.subarray(dataIndex, dataIndex + 20));
 
         // For address-only attestations, use empty signature
         attestations.push(new CommitteeAttestation(address, Signature.empty()));

package/src/block/test/l2_tips_store_test_suite.ts

@@ -3,6 +3,7 @@ import { times } from '@aztec-labs/foundation/collection';
 import { Fr } from '@aztec-labs/foundation/curves/bn254';
 import {
   type CheckpointId,
+  CommitteeAttestationsAndSigners,
   GENESIS_CHECKPOINT_HEADER_HASH,
   L2Block,
   type L2BlockId,
@@ -91,7 +92,12 @@ export function testL2TipsStore(makeTipsStore: () => Promise<L2TipsStore>) {
       blockToCheckpoint.set(block.number, checkpointNumber);
     }
 
-    return new PublishedCheckpoint(checkpoint, L1PublishedData.random(), []);
+    return new PublishedCheckpoint(
+      checkpoint,
+      L1PublishedData.random(),
+      [],
+      CommitteeAttestationsAndSigners.packAttestations([]),
+    );
   };
 
   /** Creates a thin chain-checkpointed event carrying the block + checkpoint ids of the checkpoint's last block. */

package/src/block/validate_block_result.ts

@@ -1,4 +1,7 @@
-import type { ViemCommitteeAttestations } from '@aztec-labs/ethereum/contracts';
+import {
+  type ViemCommitteeAttestations,
+  ViemCommitteeAttestationsSchema,
+} from '@aztec-labs/ethereum/contracts/committee-attestations';
 import { EpochNumber, EpochNumberSchema } from '@aztec-labs/foundation/branded-types';
 import { EthAddress } from '@aztec-labs/foundation/eth-address';
 import { type ZodFor, schemas } from '@aztec-labs/foundation/schemas';
@@ -71,12 +74,6 @@ export type ValidateCheckpointNegativeResult =
 /** Result type for validating checkpoint attestations */
 export type ValidateCheckpointResult = { valid: true } | ValidateCheckpointNegativeResult;
 
-/** Zod schema for the raw packed `CommitteeAttestations` viem tuple (two 0x-prefixed hex strings). */
-const ViemCommitteeAttestationsSchema: ZodFor<ViemCommitteeAttestations> = z.object({
-  signatureIndices: schemas.HexStringWith0x,
-  signaturesOrAddresses: schemas.HexStringWith0x,
-});
-
 export const ValidateCheckpointResultSchema: ZodFor<ValidateCheckpointResult> = z.union([
   z.object({ valid: z.literal(true) }),
   z.object({

package/src/checkpoint/checkpoint_data.ts

@@ -1,3 +1,7 @@
+import {
+  type ViemCommitteeAttestations,
+  ViemCommitteeAttestationsSchema,
+} from '@aztec-labs/ethereum/contracts/committee-attestations';
 import {
   BlockNumber,
   BlockNumberSchema,
@@ -24,6 +28,11 @@ export type CommonCheckpointData = {
 /** Data stored with checkpoint data after publishing on l1 */
 export type L1EnrichedCheckpointData = {
   attestations: CommitteeAttestation[];
+  /**
+   * The packed `CommitteeAttestations` tuple exactly as posted to L1. {@link attestations} is what this tuple
+   * decodes to; only the tuple reproduces the `attestationsHash` the rollup stored at propose time.
+   */
+  verbatimAttestations: ViemCommitteeAttestations;
   l1: L1PublishedData;
 };
 
@@ -86,6 +95,7 @@ export const CheckpointDataSchema = z
     blockCount: schemas.Integer,
     feeAssetPriceModifier: schemas.BigInt,
     attestations: z.array(CommitteeAttestation.schema),
+    verbatimAttestations: ViemCommitteeAttestationsSchema,
     l1: L1PublishedData.schema,
   })
   .transform(
@@ -98,6 +108,7 @@ export const CheckpointDataSchema = z
       blockCount: obj.blockCount,
       feeAssetPriceModifier: obj.feeAssetPriceModifier,
       attestations: obj.attestations,
+      verbatimAttestations: obj.verbatimAttestations,
       l1: obj.l1,
     }),
   );

package/src/checkpoint/published_checkpoint.ts

@@ -1,8 +1,13 @@
 // Ignoring import issue to fix portable inferred type issue in zod schema
+import {
+  type ViemCommitteeAttestations,
+  ViemCommitteeAttestationsSchema,
+} from '@aztec-labs/ethereum/contracts/committee-attestations';
 import { Buffer32 } from '@aztec-labs/foundation/buffer';
 import { randomBigInt } from '@aztec-labs/foundation/crypto/random';
 import { schemas } from '@aztec-labs/foundation/schemas';
 import { BufferReader, serializeToBuffer } from '@aztec-labs/foundation/serialize';
+import { bufferToHex, hexToBuffer } from '@aztec-labs/foundation/string';
 import type { FieldsOf } from '@aztec-labs/foundation/types';
 import { z } from 'zod';
 
@@ -60,6 +65,14 @@ export class PublishedCheckpoint {
     public l1: L1PublishedData,
     /** The attestations for the last block in the checkpoint. */
     public attestations: CommitteeAttestation[],
+    /**
+     * The packed `CommitteeAttestations` tuple exactly as it appeared in the propose calldata. The rollup
+     * stores `keccak256(abi.encode(tuple))` and re-checks it when an epoch proof or an invalidation is
+     * submitted, so the tuple can only be reproduced from these bytes: repacking the decoded
+     * {@link attestations} zeroes bitmap bits past the committee size and canonicalizes recovery bytes,
+     * neither of which any decoder reads but both of which the stored hash covers.
+     */
+    public verbatimAttestations: ViemCommitteeAttestations,
   ) {}
 
   static get schema() {
@@ -68,12 +81,13 @@ export class PublishedCheckpoint {
         checkpoint: Checkpoint.schema,
         l1: L1PublishedData.schema,
         attestations: z.array(CommitteeAttestation.schema),
+        verbatimAttestations: ViemCommitteeAttestationsSchema,
       })
       .transform(obj => PublishedCheckpoint.from(obj));
   }
 
   static getFields(fields: FieldsOf<PublishedCheckpoint>) {
-    return [fields.checkpoint, fields.l1, fields.attestations] as const;
+    return [fields.checkpoint, fields.l1, fields.attestations, fields.verbatimAttestations] as const;
   }
 
   static from(fields: FieldsOf<PublishedCheckpoint>) {
@@ -87,14 +101,21 @@ export class PublishedCheckpoint {
     const l1BlockHash = reader.readString(MAX_BLOCK_HASH_STRING_LENGTH);
     const l1Timestamp = reader.readBigInt();
     const attestations = reader.readVector(CommitteeAttestation, MAX_COMMITTEE_SIZE);
+    const verbatimAttestations: ViemCommitteeAttestations = {
+      signatureIndices: bufferToHex(reader.readBuffer()),
+      signaturesOrAddresses: bufferToHex(reader.readBuffer()),
+    };
     return new PublishedCheckpoint(
       checkpoint,
       new L1PublishedData(l1BlockNumber, l1Timestamp, l1BlockHash),
       attestations,
+      verbatimAttestations,
     );
   }
 
   public toBuffer(): Buffer {
+    const signatureIndices = hexToBuffer(this.verbatimAttestations.signatureIndices);
+    const signaturesOrAddresses = hexToBuffer(this.verbatimAttestations.signaturesOrAddresses);
     return serializeToBuffer(
       this.checkpoint,
       this.l1.blockNumber,
@@ -102,6 +123,10 @@ export class PublishedCheckpoint {
       this.l1.timestamp,
       this.attestations.length,
       this.attestations,
+      signatureIndices.length,
+      signatureIndices,
+      signaturesOrAddresses.length,
+      signaturesOrAddresses,
     );
   }
 }

package/src/hash/hash.ts

@@ -109,8 +109,8 @@ export async function computeSiloedPublicInitializationNullifier(contract: Aztec
  *
  * @dev Must match the implementation in noir-protocol-circuits/crates/types/src/hash.nr > compute_protocol_nullifier
  */
-export function computeProtocolNullifier(txRequestHash: Fr): Promise<Fr> {
-  return siloNullifier(AztecAddress.NULL_MSG_SENDER, txRequestHash);
+export function computeProtocolNullifier(protocolNullifierValue: Fr): Promise<Fr> {
+  return siloNullifier(AztecAddress.NULL_MSG_SENDER, protocolNullifierValue);
 }
 
 /** Domain-separates a raw log tag with the given domain separator. */

package/src/kernel/private_circuit_public_inputs.ts

@@ -145,10 +145,12 @@ export class PrivateCircuitPublicInputs {
      */
     public contractClassLogsHashes: ClaimedLengthArray<CountedLogHash, typeof MAX_CONTRACT_CLASS_LOGS_PER_CALL>,
     /**
-     * The tx request's salt. Keeps `tx_request.hash()` (the protocol nullifier) unpredictable, and lets the init
-     * kernel bind this proof to a specific tx request (it asserts this equals `tx_request.salt`).
+     * The transaction's siloed protocol nullifier: the value the init kernel inserts at index 0 of the transaction's
+     * nullifiers, identical on every private call. The init kernel asserts the first call's value equals the one
+     * derived from the tx request, binding this proof to that request; every later kernel asserts each nested call's
+     * value equals the transaction constant.
      */
-    public txRequestSalt: Fr,
+    public protocolNullifier: Fr,
   ) {}
 
   /**
@@ -287,7 +289,7 @@ export class PrivateCircuitPublicInputs {
       this.l2ToL1Msgs.isEmpty() &&
       this.privateLogs.isEmpty() &&
       this.contractClassLogsHashes.isEmpty() &&
-      this.txRequestSalt.isZero()
+      this.protocolNullifier.isZero()
     );
   }
 
@@ -321,7 +323,7 @@ export class PrivateCircuitPublicInputs {
       fields.l2ToL1Msgs,
       fields.privateLogs,
       fields.contractClassLogsHashes,
-      fields.txRequestSalt,
+      fields.protocolNullifier,
     ] as const;
   }
 
@@ -356,7 +358,7 @@ export class PrivateCircuitPublicInputs {
       this.l2ToL1Msgs,
       this.privateLogs,
       this.contractClassLogsHashes,
-      this.txRequestSalt,
+      this.protocolNullifier,
     ]);
   }
 

package/src/kernel/private_context_inputs.ts

@@ -11,7 +11,7 @@ export class PrivateContextInputs {
     public anchorBlockHeader: BlockHeader,
     public txContext: TxContext,
     public startSideEffectCounter: number,
-    public txRequestSalt: Fr,
+    public protocolNullifier: Fr,
   ) {}
 
   public static empty(): PrivateContextInputs {
@@ -24,7 +24,7 @@ export class PrivateContextInputs {
       this.anchorBlockHeader,
       this.txContext,
       this.startSideEffectCounter,
-      this.txRequestSalt,
+      this.protocolNullifier,
     ]);
   }
 }

package/src/tests/factories.ts

@@ -653,7 +653,7 @@ export function makePrivateCircuitPublicInputs(seed = 0): PrivateCircuitPublicIn
     anchorBlockHeader: makeBlockHeader(seed + 0xd00),
     txContext: makeTxContext(seed + 0x1400),
     isFeePayer: false,
-    txRequestSalt: fr(seed + 0x1500),
+    protocolNullifier: fr(seed + 0x1500),
   });
 }
 

package/src/tx/private_tx_constant_data.ts

@@ -24,13 +24,13 @@ export class PrivateTxConstantData {
      */
     public txContext: TxContext,
     /**
-     * Salt of the transaction request (`TxRequest.salt`).
+     * The transaction's siloed protocol nullifier.
      *
      * Bound to the user's `tx_request` by the Init circuit and kept constant by every subsequent kernel so that each
-     * app circuit's `txRequestSalt` public input can be checked against it. It is intentionally not carried into
-     * `TxConstantData`: it is dropped by the Tail circuits rather than being exposed by the final (hiding) kernel.
+     * app circuit's `protocolNullifier` public input can be checked against it. Not carried into `TxConstantData`:
+     * the value is already published as the transaction's first nullifier.
      */
-    public txRequestSalt: Fr,
+    public protocolNullifier: Fr,
     /**
      * Root of the vk tree for the protocol circuits.
      */
@@ -49,7 +49,7 @@ export class PrivateTxConstantData {
     return [
       fields.anchorBlockHeader,
       fields.txContext,
-      fields.txRequestSalt,
+      fields.protocolNullifier,
       fields.vkTreeRoot,
       fields.protocolContracts,
     ] as const;
@@ -105,7 +105,7 @@ export class PrivateTxConstantData {
     return (
       this.anchorBlockHeader.getSize() +
       this.txContext.getSize() +
-      this.txRequestSalt.size +
+      this.protocolNullifier.size +
       this.vkTreeRoot.size +
       this.protocolContracts.getSize()
     );

package/src/tx/tx_request.ts

@@ -5,6 +5,7 @@ import { BufferReader, serializeToBuffer, serializeToFields } from '@aztec-labs/
 import type { FieldsOf } from '@aztec-labs/foundation/types';
 
 import { AztecAddress } from '../aztec-address/index.js';
+import { computeProtocolNullifier } from '../hash/hash.js';
 import { FunctionData } from './function_data.js';
 import { TxContext } from './tx_context.js';
 
@@ -22,7 +23,12 @@ export class TxRequest {
     public txContext: TxContext,
     /** Function data representing the function to call. */
     public functionData: FunctionData,
-    /** A salt to make the hash difficult to predict. The hash is used as the first nullifier if there is no nullifier emitted throughout the tx. */
+    /**
+     * A fresh random field drawn by the wallet, acting as the tx request's nonce. With `origin`, `chainId` and `version`
+     * it is the whole preimage of the protocol nullifier, so it keeps that nullifier unpredictable and unique. The kernel
+     * cannot check that it is random; draw it fresh for every transaction, since two requests with the same origin and
+     * salt are mutually exclusive.
+     */
     public salt: Fr,
   ) {}
   // docs:end:constructor
@@ -43,6 +49,26 @@ export class TxRequest {
     return serializeToBuffer([...TxRequest.getFields(this)]);
   }
 
+  /**
+   * The unsiloed value of the protocol nullifier: the transaction's nonce commitment.
+   * The preimage is only `origin`, `chainId`, `version` and `salt`. Gas settings and the first call's arguments are
+   * left out so that a fee bump or a cancellation that reuses the salt produces the same nullifier.
+   */
+  computeProtocolNullifierValue(): Promise<Fr> {
+    return poseidon2HashWithSeparator(
+      [this.origin.toField(), this.txContext.chainId, this.txContext.version, this.salt],
+      DomainSeparator.PROTOCOL_NULLIFIER,
+    );
+  }
+
+  /**
+   * The protocol nullifier as inserted into the nullifier tree, and as every private call receives it in
+   * `PrivateCircuitPublicInputs.protocolNullifier`: the value above siloed under `NULL_MSG_SENDER`.
+   */
+  async computeProtocolNullifier(): Promise<Fr> {
+    return computeProtocolNullifier(await this.computeProtocolNullifierValue());
+  }
+
   toFields(): Fr[] {
     const fields = serializeToFields(...TxRequest.getFields(this));
     if (fields.length !== TX_REQUEST_LENGTH) {
@@ -67,10 +93,6 @@ export class TxRequest {
     );
   }
 
-  hash() {
-    return poseidon2HashWithSeparator(this.toFields(), DomainSeparator.TX_REQUEST);
-  }
-
   static empty() {
     return new TxRequest(AztecAddress.ZERO, Fr.zero(), TxContext.empty(), FunctionData.empty(), Fr.zero());
   }