@aztec/pxe 0.0.0-test.1 → 0.0.1-commit.5476d83

package/src/private_kernel/hints/compute_side_effect_uniqueness_hints.ts

@@ -0,0 +1,173 @@
+import {
+  GLOBAL_INDEX_CONTRACT_CLASS_LOG_HASH_OFFSET,
+  GLOBAL_INDEX_L2_TO_L1_MSG_OFFSET,
+  GLOBAL_INDEX_NOTE_HASH_OFFSET,
+  GLOBAL_INDEX_NOTE_HASH_READ_REQUEST_OFFSET,
+  GLOBAL_INDEX_NULLIFIER_OFFSET,
+  GLOBAL_INDEX_NULLIFIER_READ_REQUEST_OFFSET,
+  GLOBAL_INDEX_PRIVATE_CALL_REQUEST_OFFSET,
+  GLOBAL_INDEX_PRIVATE_LOG_OFFSET,
+  GLOBAL_INDEX_PUBLIC_CALL_REQUEST_OFFSET,
+  MAX_CONTRACT_CLASS_LOGS_PER_CALL,
+  MAX_ENQUEUED_CALLS_PER_CALL,
+  MAX_L2_TO_L1_MSGS_PER_CALL,
+  MAX_NOTE_HASHES_PER_CALL,
+  MAX_NOTE_HASH_READ_REQUESTS_PER_CALL,
+  MAX_NULLIFIERS_PER_CALL,
+  MAX_NULLIFIER_READ_REQUESTS_PER_CALL,
+  MAX_PRIVATE_CALL_STACK_LENGTH_PER_CALL,
+  MAX_PRIVATE_LOGS_PER_CALL,
+  TOTAL_COUNTED_SIDE_EFFECTS_PER_CALL,
+} from '@aztec/constants';
+import { makeTuple } from '@aztec/foundation/array';
+import { padArrayEnd } from '@aztec/foundation/collection';
+import type { Serializable } from '@aztec/foundation/serialize';
+import {
+  ClaimedLengthArray,
+  PrivateCallRequest,
+  type PrivateCircuitPublicInputs,
+  SideEffectCounterRange,
+  SideEffectUniquenessHints,
+} from '@aztec/stdlib/kernel';
+
+export function computeSideEffectUniquenessHints(publicInputs: PrivateCircuitPublicInputs): SideEffectUniquenessHints {
+  let sideEffectRanges: SideEffectCounterRange[] = [];
+
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.noteHashReadRequests,
+      GLOBAL_INDEX_NOTE_HASH_READ_REQUEST_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.nullifierReadRequests,
+      GLOBAL_INDEX_NULLIFIER_READ_REQUEST_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.noteHashes,
+      GLOBAL_INDEX_NOTE_HASH_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.nullifiers,
+      GLOBAL_INDEX_NULLIFIER_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.privateCallRequests,
+      GLOBAL_INDEX_PRIVATE_CALL_REQUEST_OFFSET,
+      createRangeFromPrivateCallRequest,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.publicCallRequests,
+      GLOBAL_INDEX_PUBLIC_CALL_REQUEST_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.l2ToL1Msgs,
+      GLOBAL_INDEX_L2_TO_L1_MSG_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.privateLogs,
+      GLOBAL_INDEX_PRIVATE_LOG_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+  sideEffectRanges = sideEffectRanges.concat(
+    createRangesFromClaimedLengthArray(
+      publicInputs.contractClassLogsHashes,
+      GLOBAL_INDEX_CONTRACT_CLASS_LOG_HASH_OFFSET,
+      createRangeFromCountedItem,
+    ),
+  );
+
+  sideEffectRanges.sort((a, b) => a.start - b.start);
+
+  const sideEffectRangeIndices = makeTuple(TOTAL_COUNTED_SIDE_EFFECTS_PER_CALL, () => 0);
+  for (let i = 0; i < sideEffectRanges.length; i++) {
+    const range = sideEffectRanges[i];
+    sideEffectRangeIndices[range.sideEffectGlobalIndex] = i;
+  }
+
+  const hints = SideEffectUniquenessHints.from({
+    sideEffectRanges: padArrayEnd(
+      sideEffectRanges,
+      SideEffectCounterRange.empty(),
+      TOTAL_COUNTED_SIDE_EFFECTS_PER_CALL,
+    ),
+    noteHashReadRequestIndices: makeTuple(
+      MAX_NOTE_HASH_READ_REQUESTS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_NOTE_HASH_READ_REQUEST_OFFSET],
+    ),
+    nullifierReadRequestIndices: makeTuple(
+      MAX_NULLIFIER_READ_REQUESTS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_NULLIFIER_READ_REQUEST_OFFSET],
+    ),
+    noteHashesIndices: makeTuple(
+      MAX_NOTE_HASHES_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_NOTE_HASH_OFFSET],
+    ),
+    nullifiersIndices: makeTuple(
+      MAX_NULLIFIERS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_NULLIFIER_OFFSET],
+    ),
+    privateCallRequestsIndices: makeTuple(
+      MAX_PRIVATE_CALL_STACK_LENGTH_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_PRIVATE_CALL_REQUEST_OFFSET],
+    ),
+    publicCallRequestsIndices: makeTuple(
+      MAX_ENQUEUED_CALLS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_PUBLIC_CALL_REQUEST_OFFSET],
+    ),
+    l2ToL1MsgsIndices: makeTuple(
+      MAX_L2_TO_L1_MSGS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_L2_TO_L1_MSG_OFFSET],
+    ),
+    privateLogsIndices: makeTuple(
+      MAX_PRIVATE_LOGS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_PRIVATE_LOG_OFFSET],
+    ),
+    contractClassLogsHashesIndices: makeTuple(
+      MAX_CONTRACT_CLASS_LOGS_PER_CALL,
+      i => sideEffectRangeIndices[i + GLOBAL_INDEX_CONTRACT_CLASS_LOG_HASH_OFFSET],
+    ),
+  });
+
+  return hints;
+}
+
+function createRangesFromClaimedLengthArray<T extends Serializable, N extends number>(
+  array: ClaimedLengthArray<T, N>,
+  globalIndexOffset: number,
+  rangeConstructor: (item: T, globalIndex: number) => SideEffectCounterRange,
+): SideEffectCounterRange[] {
+  const ranges = [];
+  for (let i = 0; i < array.claimedLength; i++) {
+    ranges.push(rangeConstructor(array.array[i], globalIndexOffset + i));
+  }
+  return ranges;
+}
+
+function createRangeFromCountedItem(item: { counter: number }, globalIndex: number): SideEffectCounterRange {
+  return new SideEffectCounterRange(item.counter, item.counter, globalIndex);
+}
+
+function createRangeFromPrivateCallRequest(item: PrivateCallRequest, globalIndex: number): SideEffectCounterRange {
+  return new SideEffectCounterRange(item.startSideEffectCounter, item.endSideEffectCounter, globalIndex);
+}

package/src/private_kernel/hints/compute_tx_include_by_timestamp.ts

@@ -0,0 +1,58 @@
+import { MAX_INCLUDE_BY_TIMESTAMP_DURATION } from '@aztec/constants';
+import type { PrivateKernelCircuitPublicInputs } from '@aztec/stdlib/kernel';
+import type { UInt64 } from '@aztec/stdlib/types';
+
+const ROUNDED_DURATIONS = [
+  3600, // 1 hour
+  1800, // 30 mins
+  1, // 1 second
+];
+
+function roundTimestamp(blockTimestamp: bigint, includeByTimestamp: bigint): UInt64 {
+  return ROUNDED_DURATIONS.reduce((timestamp, duration) => {
+    if (timestamp <= blockTimestamp) {
+      // The timestamp must be greater than the block timestamp.
+      // If it is too small, round it down again using a smaller duration.
+      const totalDuration = includeByTimestamp - blockTimestamp;
+      const roundedDuration = totalDuration - (totalDuration % BigInt(duration));
+      return blockTimestamp + roundedDuration;
+    }
+    return timestamp;
+  }, 0n);
+}
+
+export function computeTxIncludeByTimestamp(
+  previousKernel: PrivateKernelCircuitPublicInputs,
+  maxDuration = MAX_INCLUDE_BY_TIMESTAMP_DURATION,
+): UInt64 {
+  if (maxDuration > MAX_INCLUDE_BY_TIMESTAMP_DURATION) {
+    throw new Error(
+      `Custom max duration cannot be greater than the max allowed. Max allowed: ${MAX_INCLUDE_BY_TIMESTAMP_DURATION}. Custom value: ${maxDuration}.`,
+    );
+  }
+
+  const anchorBlockTimestamp = previousKernel.constants.anchorBlockHeader.globalVariables.timestamp;
+  const maxTimestamp = anchorBlockTimestamp + BigInt(maxDuration);
+  const includeByTimestamp = previousKernel.includeByTimestamp;
+
+  // If the includeByTimestamp set during the tx execution is greater than or equal to the max allowed duration,
+  // use the maximum allowed timestamp.
+  // Note: It shouldn't be larger than the max allowed duration, but we check for it anyway.
+  if (includeByTimestamp >= maxTimestamp) {
+    return maxTimestamp;
+  }
+
+  // Round it down to the nearest hour/min/second to reduce precision and avoid revealing the exact value.
+  // This makes it harder for others to infer what function calls may have been used to produce a specific timestamp.
+  const roundedTimestamp = roundTimestamp(anchorBlockTimestamp, includeByTimestamp);
+
+  // The tx can't be published if the timestamp is the same or less than the anchor block's timestamp.
+  // Future blocks will have a greater timestamp, so the tx would never be included.
+  if (roundedTimestamp <= anchorBlockTimestamp) {
+    throw new Error(
+      `Include-by timestamp must be greater than the anchor block timestamp. Anchor block timestamp: ${anchorBlockTimestamp}. Include-by timestamp: ${includeByTimestamp}.`,
+    );
+  }
+
+  return roundedTimestamp;
+}

package/src/{kernel_prover → private_kernel}/hints/index.ts

@@ -1 +1,2 @@
 export * from './build_private_kernel_reset_private_inputs.js';
+export * from './compute_tx_include_by_timestamp.js';

package/src/private_kernel/index.ts

@@ -0,0 +1,2 @@
+export * from './private_kernel_execution_prover.js';
+export * from './private_kernel_oracle.js';

package/src/private_kernel/private_kernel_execution_prover.ts

@@ -0,0 +1,436 @@
+import { vkAsFieldsMegaHonk } from '@aztec/foundation/crypto';
+import { Fr } from '@aztec/foundation/fields';
+import { createLogger } from '@aztec/foundation/log';
+import { pushTestData } from '@aztec/foundation/testing';
+import { Timer } from '@aztec/foundation/timer';
+import { getVKTreeRoot } from '@aztec/noir-protocol-circuits-types/vk-tree';
+import { ProtocolContractsList } from '@aztec/protocol-contracts';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { PrivateKernelProver } from '@aztec/stdlib/interfaces/client';
+import {
+  HidingKernelToPublicPrivateInputs,
+  HidingKernelToRollupPrivateInputs,
+  PaddedSideEffectAmounts,
+  PrivateCallData,
+  type PrivateExecutionStep,
+  PrivateKernelCircuitPublicInputs,
+  PrivateKernelData,
+  type PrivateKernelExecutionProofOutput,
+  PrivateKernelInitCircuitPrivateInputs,
+  PrivateKernelInnerCircuitPrivateInputs,
+  type PrivateKernelSimulateOutput,
+  PrivateKernelTailCircuitPrivateInputs,
+  type PrivateKernelTailCircuitPublicInputs,
+  PrivateVerificationKeyHints,
+} from '@aztec/stdlib/kernel';
+import { ChonkProof, ChonkProofWithPublicInputs } from '@aztec/stdlib/proofs';
+import {
+  type PrivateCallExecutionResult,
+  type PrivateExecutionResult,
+  TxRequest,
+  collectNoteHashLeafIndexMap,
+  collectNoteHashNullifierCounterMap,
+  getFinalMinRevertibleSideEffectCounter,
+} from '@aztec/stdlib/tx';
+import { VerificationKeyAsFields, VerificationKeyData, VkData } from '@aztec/stdlib/vks';
+
+import { PrivateKernelResetPrivateInputsBuilder } from './hints/build_private_kernel_reset_private_inputs.js';
+import { computeSideEffectUniquenessHints } from './hints/compute_side_effect_uniqueness_hints.js';
+import type { PrivateKernelOracle } from './private_kernel_oracle.js';
+
+const NULL_SIMULATE_OUTPUT: PrivateKernelSimulateOutput<PrivateKernelCircuitPublicInputs> = {
+  publicInputs: PrivateKernelCircuitPublicInputs.empty(),
+  verificationKey: VerificationKeyData.empty(),
+  outputWitness: new Map(),
+  bytecode: Buffer.from([]),
+};
+
+export interface PrivateKernelExecutionProverConfig {
+  simulate: boolean;
+  skipFeeEnforcement: boolean;
+  profileMode: 'gates' | 'execution-steps' | 'full' | 'none';
+}
+
+/**
+ * The PrivateKernelExecutionProver class is responsible for taking a transaction request and sequencing the
+ * the execution of the private functions within, sequenced with private kernel "glue" to check protocol rules.
+ * The result can be a chonk proof of the private transaction portion, or just a simulation that can e.g.
+ * inform state tree updates.
+ */
+export class PrivateKernelExecutionProver {
+  private log = createLogger('pxe:private-kernel-execution-prover');
+
+  constructor(
+    private oracle: PrivateKernelOracle,
+    private proofCreator: PrivateKernelProver,
+    private fakeProofs = false,
+  ) {}
+
+  /**
+   * Generate a proof for a given transaction request and execution result.
+   * The function iterates through the nested executions in the execution result, creates private call data,
+   * and generates a proof using the provided ProofCreator instance. It also maintains an index of new notes
+   * created during the execution and returns them as a part of the KernelProverOutput.
+   *
+   * @param txRequest - The authenticated transaction request object.
+   * @param executionResult - The execution result object containing nested executions and preimages.
+   * @param profile - Set true to profile the gate count for each circuit
+   * @returns A Promise that resolves to a KernelProverOutput object containing proof, public inputs, and output notes.
+   */
+  async proveWithKernels(
+    txRequest: TxRequest,
+    executionResult: PrivateExecutionResult,
+    { simulate, skipFeeEnforcement, profileMode }: PrivateKernelExecutionProverConfig = {
+      simulate: false,
+      skipFeeEnforcement: false,
+      profileMode: 'none',
+    },
+  ): Promise<PrivateKernelExecutionProofOutput<PrivateKernelTailCircuitPublicInputs>> {
+    const skipProofGeneration = this.fakeProofs || simulate;
+    const generateWitnesses = !skipProofGeneration || profileMode !== 'none';
+
+    const timer = new Timer();
+
+    const isPrivateOnlyTx = executionResult.publicFunctionCalldata.length === 0;
+
+    // Initialize an executionStack, beginning with the PrivateCallExecutionResult
+    // of the entrypoint function of the tx.
+    const executionStack = [executionResult.entrypoint];
+    let firstIteration = true;
+
+    let output = NULL_SIMULATE_OUTPUT;
+
+    const executionSteps: PrivateExecutionStep[] = [];
+
+    const noteHashLeafIndexMap = collectNoteHashLeafIndexMap(executionResult);
+    const noteHashNullifierCounterMap = collectNoteHashNullifierCounterMap(executionResult);
+    const minRevertibleSideEffectCounter = getFinalMinRevertibleSideEffectCounter(executionResult);
+    const splitCounter = isPrivateOnlyTx ? 0 : minRevertibleSideEffectCounter;
+
+    while (executionStack.length) {
+      if (!firstIteration) {
+        let resetBuilder = new PrivateKernelResetPrivateInputsBuilder(
+          output,
+          executionStack,
+          noteHashNullifierCounterMap,
+          splitCounter,
+        );
+        while (resetBuilder.needsReset()) {
+          const witgenTimer = new Timer();
+          const privateInputs = await resetBuilder.build(this.oracle, noteHashLeafIndexMap);
+          output = generateWitnesses
+            ? await this.proofCreator.generateResetOutput(privateInputs)
+            : await this.proofCreator.simulateReset(privateInputs);
+          executionSteps.push({
+            functionName: 'private_kernel_reset',
+            bytecode: output.bytecode,
+            witness: output.outputWitness,
+            vk: output.verificationKey.keyAsBytes,
+            timings: {
+              witgen: witgenTimer.ms(),
+            },
+          });
+          resetBuilder = new PrivateKernelResetPrivateInputsBuilder(
+            output,
+            executionStack,
+            noteHashNullifierCounterMap,
+            splitCounter,
+          );
+        }
+      }
+
+      const currentExecution = executionStack.pop()!;
+
+      executionStack.push(...[...currentExecution.nestedExecutionResults].reverse());
+
+      const functionName = await this.oracle.getDebugFunctionName(
+        currentExecution.publicInputs.callContext.contractAddress,
+        currentExecution.publicInputs.callContext.functionSelector,
+      );
+
+      executionSteps.push({
+        functionName: functionName!,
+        bytecode: currentExecution.acir,
+        witness: currentExecution.partialWitness,
+        vk: currentExecution.vk,
+        timings: {
+          witgen: currentExecution.profileResult?.timings.witgen ?? 0,
+          oracles: currentExecution.profileResult?.timings.oracles,
+        },
+      });
+
+      const privateCallData = await this.createPrivateCallData(currentExecution);
+
+      if (firstIteration) {
+        const witgenTimer = new Timer();
+
+        const proofInput = new PrivateKernelInitCircuitPrivateInputs(
+          txRequest,
+          getVKTreeRoot(),
+          ProtocolContractsList,
+          privateCallData,
+          isPrivateOnlyTx,
+          executionResult.firstNullifier,
+          minRevertibleSideEffectCounter,
+        );
+        this.log.debug(
+          `Calling private kernel init with isPrivateOnly ${isPrivateOnlyTx} and firstNullifierHint ${proofInput.firstNullifierHint}`,
+        );
+
+        pushTestData('private-kernel-inputs-init', proofInput);
+
+        output = generateWitnesses
+          ? await this.proofCreator.generateInitOutput(proofInput)
+          : await this.proofCreator.simulateInit(proofInput);
+
+        executionSteps.push({
+          functionName: 'private_kernel_init',
+          bytecode: output.bytecode,
+          witness: output.outputWitness,
+          vk: output.verificationKey.keyAsBytes,
+          timings: {
+            witgen: witgenTimer.ms(),
+          },
+        });
+      } else {
+        const witgenTimer = new Timer();
+        const vkData = await this.getVkData(output.verificationKey);
+        const previousKernelData = new PrivateKernelData(output.publicInputs, vkData);
+        const proofInput = new PrivateKernelInnerCircuitPrivateInputs(previousKernelData, privateCallData);
+
+        pushTestData('private-kernel-inputs-inner', proofInput);
+        output = generateWitnesses
+          ? await this.proofCreator.generateInnerOutput(proofInput)
+          : await this.proofCreator.simulateInner(proofInput);
+
+        executionSteps.push({
+          functionName: 'private_kernel_inner',
+          bytecode: output.bytecode,
+          witness: output.outputWitness,
+          vk: output.verificationKey.keyAsBytes,
+          timings: {
+            witgen: witgenTimer.ms(),
+          },
+        });
+      }
+      firstIteration = false;
+    }
+
+    // Reset.
+    let resetBuilder = new PrivateKernelResetPrivateInputsBuilder(
+      output,
+      [],
+      noteHashNullifierCounterMap,
+      splitCounter,
+    );
+    while (resetBuilder.needsReset()) {
+      const witgenTimer = new Timer();
+      const privateInputs = await resetBuilder.build(this.oracle, noteHashLeafIndexMap);
+      output = generateWitnesses
+        ? await this.proofCreator.generateResetOutput(privateInputs)
+        : await this.proofCreator.simulateReset(privateInputs);
+
+      executionSteps.push({
+        functionName: 'private_kernel_reset',
+        bytecode: output.bytecode,
+        witness: output.outputWitness,
+        vk: output.verificationKey.keyAsBytes,
+        timings: {
+          witgen: witgenTimer.ms(),
+        },
+      });
+
+      resetBuilder = new PrivateKernelResetPrivateInputsBuilder(output, [], noteHashNullifierCounterMap, splitCounter);
+    }
+
+    if (output.publicInputs.feePayer.isZero() && skipFeeEnforcement) {
+      if (!skipProofGeneration) {
+        throw new Error('Fee payment must be enforced when creating real proof.');
+      }
+      output.publicInputs.feePayer = new AztecAddress(Fr.MAX_FIELD_VALUE);
+    }
+    // Private tail.
+    const vkData = await this.getVkData(output.verificationKey);
+    const previousKernelData = new PrivateKernelData(output.publicInputs, vkData);
+
+    this.log.debug(
+      `Calling private kernel tail with hwm ${previousKernelData.publicInputs.minRevertibleSideEffectCounter}`,
+    );
+
+    // TODO: Enable padding once we better understand the final amounts to pad to.
+    const paddedSideEffectAmounts = PaddedSideEffectAmounts.empty();
+
+    // Use the aggregated includeByTimestamp set throughout the tx execution.
+    // TODO: Call `computeTxIncludeByTimestamp` to round the value down and reduce precision, improving privacy.
+    const includeByTimestampUpperBound = previousKernelData.publicInputs.includeByTimestamp;
+    const anchorBlockTimestamp = previousKernelData.publicInputs.constants.anchorBlockHeader.globalVariables.timestamp;
+    if (includeByTimestampUpperBound <= anchorBlockTimestamp) {
+      throw new Error(
+        `Include-by timestamp must be greater than the anchor block timestamp. Anchor block timestamp: ${anchorBlockTimestamp}. Include-by timestamp: ${includeByTimestampUpperBound}.`,
+      );
+    }
+
+    const privateInputs = new PrivateKernelTailCircuitPrivateInputs(
+      previousKernelData,
+      paddedSideEffectAmounts,
+      includeByTimestampUpperBound,
+    );
+
+    const witgenTimer = new Timer();
+    const tailOutput = generateWitnesses
+      ? await this.proofCreator.generateTailOutput(privateInputs)
+      : await this.proofCreator.simulateTail(privateInputs);
+
+    executionSteps.push({
+      functionName: 'private_kernel_tail',
+      bytecode: tailOutput.bytecode,
+      witness: tailOutput.outputWitness,
+      vk: tailOutput.verificationKey.keyAsBytes,
+      timings: {
+        witgen: witgenTimer.ms(),
+      },
+    });
+
+    // Hiding circuit is only executed if we are generating witnesses.
+    // For simulation, we can end with the tail, since the hiding circuit will simply return the same tail output.
+    if (generateWitnesses) {
+      const previousKernelVkData = await this.getVkData(tailOutput.verificationKey);
+
+      const witgenTimer = new Timer();
+      let hidingOutput: PrivateKernelSimulateOutput<PrivateKernelTailCircuitPublicInputs>;
+      if (tailOutput.publicInputs.forPublic) {
+        const privateInputs = new HidingKernelToPublicPrivateInputs(
+          tailOutput.publicInputs.toPrivateToPublicKernelCircuitPublicInputs(),
+          previousKernelVkData,
+        );
+        hidingOutput = await this.proofCreator.generateHidingToPublicOutput(privateInputs);
+      } else {
+        const privateInputs = new HidingKernelToRollupPrivateInputs(
+          tailOutput.publicInputs.toPrivateToRollupKernelCircuitPublicInputs(),
+          previousKernelVkData,
+        );
+        hidingOutput = await this.proofCreator.generateHidingToRollupOutput(privateInputs);
+      }
+
+      executionSteps.push({
+        functionName: 'hiding_kernel',
+        bytecode: hidingOutput.bytecode,
+        witness: hidingOutput.outputWitness,
+        vk: hidingOutput.verificationKey.keyAsBytes,
+        timings: {
+          witgen: witgenTimer.ms(),
+        },
+      });
+    }
+
+    if (profileMode == 'gates' || profileMode == 'full') {
+      for (const entry of executionSteps) {
+        const gateCountTimer = new Timer();
+        const gateCount = await this.proofCreator.computeGateCountForCircuit(entry.bytecode, entry.functionName);
+        entry.gateCount = gateCount;
+        entry.timings.gateCount = gateCountTimer.ms();
+      }
+    }
+    if (profileMode === 'gates') {
+      for (const entry of executionSteps) {
+        // These buffers are often a few megabytes in size - prevent accidentally serializing them if not requested.
+        entry.bytecode = Buffer.from([]);
+        entry.witness = new Map();
+      }
+    }
+
+    if (generateWitnesses) {
+      this.log.info(`Private kernel witness generation took ${timer.ms()}ms`);
+    }
+
+    let chonkProof: ChonkProof;
+    // TODO(#7368) how do we 'bincode' encode these inputs?
+    let provingTime;
+    if (!skipProofGeneration) {
+      const provingTimer = new Timer();
+      const proofWithPublicInputs = await this.proofCreator.createChonkProof(executionSteps);
+      provingTime = provingTimer.ms();
+      this.ensurePublicInputsMatch(proofWithPublicInputs, tailOutput.publicInputs);
+      chonkProof = proofWithPublicInputs.removePublicInputs();
+    } else {
+      chonkProof = ChonkProof.random();
+    }
+
+    return {
+      publicInputs: tailOutput.publicInputs,
+      executionSteps,
+      chonkProof,
+      timings: provingTime ? { proving: provingTime } : undefined,
+    };
+  }
+
+  /**
+   * Checks that the public inputs of the chonk proof match the public inputs of the tail circuit.
+   * This can only mismatch if there is a circuit / noir / bb bug.
+   * @param chonkProof - The chonk proof with public inputs.
+   * @param tailPublicInputs - The public inputs resulting from witness generation of the tail circuit.
+   */
+  private ensurePublicInputsMatch(
+    chonkProof: ChonkProofWithPublicInputs,
+    tailPublicInputs: PrivateKernelTailCircuitPublicInputs,
+  ) {
+    const serializedChonkProofPublicInputs = chonkProof.getPublicInputs();
+    const serializedTailPublicInputs = tailPublicInputs.publicInputs().toFields();
+    if (serializedChonkProofPublicInputs.length !== serializedTailPublicInputs.length) {
+      throw new Error(
+        `Public inputs length mismatch: ${serializedChonkProofPublicInputs.length} !== ${serializedTailPublicInputs.length}`,
+      );
+    }
+    if (
+      !serializedChonkProofPublicInputs.every((input: Fr, index: number) =>
+        input.equals(serializedTailPublicInputs[index]),
+      )
+    ) {
+      throw new Error(`Public inputs mismatch between kernel and chonk proof`);
+    }
+  }
+
+  private async getVkData(verificationKey: VerificationKeyData) {
+    const previousVkMembershipWitness = await this.oracle.getVkMembershipWitness(verificationKey.keyAsFields);
+    return new VkData(
+      verificationKey,
+      Number(previousVkMembershipWitness.leafIndex),
+      previousVkMembershipWitness.siblingPath,
+    );
+  }
+
+  private async createPrivateCallData({ publicInputs, vk: vkAsBuffer }: PrivateCallExecutionResult) {
+    const { contractAddress, functionSelector } = publicInputs.callContext;
+
+    const vkAsFields = await vkAsFieldsMegaHonk(vkAsBuffer);
+    const vk = await VerificationKeyAsFields.fromKey(vkAsFields);
+
+    const { currentContractClassId, publicKeys, saltedInitializationHash } =
+      await this.oracle.getContractAddressPreimage(contractAddress);
+    const functionLeafMembershipWitness = await this.oracle.getFunctionMembershipWitness(
+      currentContractClassId,
+      functionSelector,
+    );
+
+    const { artifactHash: contractClassArtifactHash, publicBytecodeCommitment: contractClassPublicBytecodeCommitment } =
+      await this.oracle.getContractClassIdPreimage(currentContractClassId);
+
+    const updatedClassIdHints = await this.oracle.getUpdatedClassIdHints(contractAddress);
+
+    const sideEffectUniquenessHints = computeSideEffectUniquenessHints(publicInputs);
+
+    return PrivateCallData.from({
+      publicInputs,
+      vk,
+      verificationKeyHints: PrivateVerificationKeyHints.from({
+        publicKeys,
+        contractClassArtifactHash,
+        contractClassPublicBytecodeCommitment,
+        saltedInitializationHash,
+        functionLeafMembershipWitness,
+        updatedClassIdHints,
+      }),
+      sideEffectUniquenessHints,
+    });
+  }
+}