@aztec/stdlib 0.0.1-commit.3fd054f6 → 0.0.1-commit.42ee6df9b

package/src/logs/extended_directional_app_tagging_secret.ts

@@ -23,14 +23,14 @@ import { computeAddressSecret, computePreaddress } from '../keys/derivation.js';
  * doesn't seem to be a good way around this.
  */
 export class ExtendedDirectionalAppTaggingSecret {
-  private constructor(
+  constructor(
     public readonly secret: Fr,
     public readonly app: AztecAddress,
   ) {}
 
   /**
    * Derives shared tagging secret and from that, the app address and recipient derives the directional app tagging
-   * secret.
+   * secret. Returns undefined if `externalAddress` is an invalid address.
    *
    * @param localAddress - The complete address of entity A in the shared tagging secret derivation scheme
    * @param localIvsk - The incoming viewing secret key of entity A
@@ -45,8 +45,12 @@ export class ExtendedDirectionalAppTaggingSecret {
     externalAddress: AztecAddress,
     app: AztecAddress,
     recipient: AztecAddress,
-  ): Promise<ExtendedDirectionalAppTaggingSecret> {
+  ): Promise<ExtendedDirectionalAppTaggingSecret | undefined> {
     const taggingSecretPoint = await computeSharedTaggingSecret(localAddress, localIvsk, externalAddress);
+    if (!taggingSecretPoint) {
+      return undefined;
+    }
+
     const appTaggingSecret = await poseidon2Hash([taggingSecretPoint.x, taggingSecretPoint.y, app]);
     const directionalAppTaggingSecret = await poseidon2Hash([appTaggingSecret, recipient]);
 
@@ -63,18 +67,25 @@ export class ExtendedDirectionalAppTaggingSecret {
   }
 }
 
-// Returns shared tagging secret computed with Diffie-Hellman key exchange.
+// Returns shared tagging secret computed with Diffie-Hellman key exchange, or undefined if `externalAddress` is an
+// invalid address.
 async function computeSharedTaggingSecret(
   localAddress: CompleteAddress,
   localIvsk: Fq,
   externalAddress: AztecAddress,
-): Promise<Point> {
-  const knownPreaddress = await computePreaddress(await localAddress.publicKeys.hash(), localAddress.partialAddress);
-  // TODO: #8970 - Computation of address point from x coordinate might fail
-  const externalAddressPoint = await externalAddress.toAddressPoint();
+): Promise<Point | undefined> {
   // Given A (local complete address) -> B (external address) and h == preaddress
   // Compute shared secret as S = (h_A + local_ivsk_A) * Addr_Point_B
 
+  const knownPreaddress = await computePreaddress(await localAddress.publicKeys.hash(), localAddress.partialAddress);
+
+  // An invalid address has no corresponding address point
+  if (!(await externalAddress.isValid())) {
+    return undefined;
+  }
+
+  const externalAddressPoint = await externalAddress.toAddressPoint();
+
   // Beware! h_a + local_ivsk_a (also known as the address secret) can lead to an address point with a negative
   // y-coordinate, since there's two possible candidates computeAddressSecret takes care of selecting the one that
   // leads to a positive y-coordinate, which is the only valid address point

package/src/logs/message_context.ts

@@ -1,8 +1,7 @@
 import { MAX_NOTE_HASHES_PER_TX } from '@aztec/constants';
+import { range } from '@aztec/foundation/array';
 import { Fr } from '@aztec/foundation/curves/bn254';
 
-import type { AztecAddress } from '../aztec-address/index.js';
-import type { TxEffect } from '../tx/tx_effect.js';
 import type { TxHash } from '../tx/tx_hash.js';
 
 /**
@@ -19,7 +18,6 @@ export class MessageContext {
     public txHash: TxHash,
     public uniqueNoteHashesInTx: Fr[],
     public firstNullifierInTx: Fr,
-    public recipient: AztecAddress,
   ) {}
 
   toFields(): Fr[] {
@@ -27,7 +25,6 @@ export class MessageContext {
       this.txHash.hash,
       ...serializeBoundedVec(this.uniqueNoteHashesInTx, MAX_NOTE_HASHES_PER_TX),
       this.firstNullifierInTx,
-      this.recipient.toField(),
     ];
   }
 
@@ -37,13 +34,22 @@ export class MessageContext {
       tx_hash: this.txHash.hash,
       unique_note_hashes_in_tx: this.uniqueNoteHashesInTx,
       first_nullifier_in_tx: this.firstNullifierInTx,
-      recipient: this.recipient,
     };
     /* eslint-enable camelcase */
   }
 
-  static fromTxEffectAndRecipient(txEffect: TxEffect, recipient: AztecAddress): MessageContext {
-    return new MessageContext(txEffect.txHash, txEffect.noteHashes, txEffect.nullifiers[0], recipient);
+  static toEmptyFields(): Fr[] {
+    const serializationLen =
+      1 /* txHash */ + MAX_NOTE_HASHES_PER_TX + 1 /* uniqueNoteHashesInTx BVec */ + 1; /* firstNullifierInTx */
+    return range(serializationLen).map(_ => Fr.zero());
+  }
+
+  static toSerializedOption(response: MessageContext | null): Fr[] {
+    if (response) {
+      return [new Fr(1), ...response.toFields()];
+    } else {
+      return [new Fr(0), ...MessageContext.toEmptyFields()];
+    }
   }
 }
 
@@ -55,6 +61,10 @@ export class MessageContext {
  * @dev Copied over from pending_tagged_log.ts.
  */
 function serializeBoundedVec(values: Fr[], maxLength: number): Fr[] {
+  if (values.length > maxLength) {
+    throw new Error(`Attempted to serialize ${values} values into a BoundedVec with max length ${maxLength}`);
+  }
+
   const lengthDiff = maxLength - values.length;
   const zeroPaddingArray = Array(lengthDiff).fill(Fr.ZERO);
   const storage = values.concat(zeroPaddingArray);

package/src/logs/pending_tagged_log.ts

@@ -1,7 +1,6 @@
 import { PRIVATE_LOG_SIZE_IN_FIELDS } from '@aztec/constants';
 import { Fr } from '@aztec/foundation/curves/bn254';
 
-import type { AztecAddress } from '../aztec-address/index.js';
 import type { TxHash } from '../tx/tx_hash.js';
 import { MessageContext } from './message_context.js';
 
@@ -17,9 +16,8 @@ export class PendingTaggedLog {
     txHash: TxHash,
     uniqueNoteHashesInTx: Fr[],
     firstNullifierInTx: Fr,
-    recipient: AztecAddress,
   ) {
-    this.context = new MessageContext(txHash, uniqueNoteHashesInTx, firstNullifierInTx, recipient);
+    this.context = new MessageContext(txHash, uniqueNoteHashesInTx, firstNullifierInTx);
   }
 
   toFields(): Fr[] {

package/src/logs/shared_secret_derivation.ts

@@ -1,26 +1,37 @@
+import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
-import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 
+import type { AztecAddress } from '../aztec-address/index.js';
 import type { PublicKey } from '../keys/public_key.js';
 
 /**
- * Derive an Elliptic Curve Diffie-Hellman (ECDH) Shared Secret.
- * The function takes in an ECDH public key, a private key, and a Grumpkin instance to compute
- * the shared secret.
+ * Derives an app-siloed ECDH shared secret.
+ *
+ * Computes the raw ECDH shared secret `S = secretKey * publicKey`, then app-silos it:
+ * `s_app = h(DOM_SEP__APP_SILOED_ECDH_SHARED_SECRET, S.x, S.y, contractAddress)`
  *
  * @param secretKey - The secret key used to derive shared secret.
  * @param publicKey - The public key used to derive shared secret.
- * @returns A derived shared secret.
+ * @param contractAddress - The address of the calling contract, used for app-siloing.
+ * @returns The app-siloed shared secret as a Field.
  * @throws If the publicKey is zero.
- *
- * TODO(#12656): This function is kept around because of the utilityGetSharedSecret oracle. Nuke this once returning
- * the app-siloed secret.
  */
-export function deriveEcdhSharedSecret(secretKey: GrumpkinScalar, publicKey: PublicKey): Promise<Point> {
+export async function deriveAppSiloedSharedSecret(
+  secretKey: GrumpkinScalar,
+  publicKey: PublicKey,
+  contractAddress: AztecAddress,
+): Promise<Fr> {
   if (publicKey.isZero()) {
     throw new Error(
       `Attempting to derive a shared secret with a zero public key. You have probably passed a zero public key in your Noir code somewhere thinking that the note won't be broadcast... but it was.`,
     );
   }
-  return Grumpkin.mul(publicKey, secretKey);
+  const rawSharedSecret = await Grumpkin.mul(publicKey, secretKey);
+  return poseidon2HashWithSeparator(
+    [rawSharedSecret.x, rawSharedSecret.y, contractAddress],
+    DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET,
+  );
 }

package/src/logs/siloed_tag.ts

@@ -1,8 +1,9 @@
+import { DomainSeparator } from '@aztec/constants';
 import type { Fr } from '@aztec/foundation/curves/bn254';
 import type { ZodFor } from '@aztec/foundation/schemas';
 
 import type { AztecAddress } from '../aztec-address/index.js';
-import { computeSiloedPrivateLogFirstField } from '../hash/hash.js';
+import { computeLogTag, computeSiloedPrivateLogFirstField } from '../hash/hash.js';
 import { schemas } from '../schemas/schemas.js';
 import type { PreTag } from './pre_tag.js';
 import { Tag } from './tag.js';
@@ -24,9 +25,13 @@ export class SiloedTag {
 
   static async compute(preTag: PreTag): Promise<SiloedTag> {
     const tag = await Tag.compute(preTag);
-    return SiloedTag.computeFromTagAndApp(tag, preTag.extendedSecret.app);
+    const logTag = await computeLogTag(tag.value, DomainSeparator.UNCONSTRAINED_MSG_LOG_TAG);
+    return SiloedTag.computeFromTagAndApp(new Tag(logTag), preTag.extendedSecret.app);
   }
 
+  /**
+   * Unlike `compute`, this expects a tag whose value is already domain-separated.
+   */
   static async computeFromTagAndApp(tag: Tag, app: AztecAddress): Promise<SiloedTag> {
     const siloedTag = await computeSiloedPrivateLogFirstField(app, tag.value);
     return new SiloedTag(siloedTag);

package/src/messaging/l1_to_l2_message.ts

@@ -6,6 +6,7 @@ import { bufferToHex } from '@aztec/foundation/string';
 import { SiblingPath } from '@aztec/foundation/trees';
 
 import type { AztecAddress } from '../aztec-address/index.js';
+import type { BlockParameter } from '../block/block_parameter.js';
 import { computeL1ToL2MessageNullifier } from '../hash/hash.js';
 import type { AztecNode } from '../interfaces/aztec-node.js';
 import { MerkleTreeId } from '../trees/merkle_tree_id.js';
@@ -79,20 +80,22 @@ export async function getNonNullifiedL1ToL2MessageWitness(
   contractAddress: AztecAddress,
   messageHash: Fr,
   secret: Fr,
+  referenceBlock: BlockParameter = 'latest',
 ): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
-  const response = await node.getL1ToL2MessageMembershipWitness('latest', messageHash);
-  if (!response) {
-    throw new Error(`No L1 to L2 message found for message hash ${messageHash.toString()}`);
-  }
+  const messageNullifier = await computeL1ToL2MessageNullifier(contractAddress, messageHash, secret);
 
-  const [messageIndex, siblingPath] = response;
+  const [l1ToL2Response, nullifierResponse] = await Promise.all([
+    node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash),
+    node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [messageNullifier]),
+  ]);
 
-  const messageNullifier = await computeL1ToL2MessageNullifier(contractAddress, messageHash, secret);
+  if (!l1ToL2Response) {
+    throw new Error(`No L1 to L2 message found for message hash ${messageHash.toString()}`);
+  }
 
-  const [nullifierIndex] = await node.findLeavesIndexes('latest', MerkleTreeId.NULLIFIER_TREE, [messageNullifier]);
-  if (nullifierIndex !== undefined) {
+  if (nullifierResponse[0] !== undefined) {
     throw new Error(`No non-nullified L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
-  return [messageIndex, siblingPath];
+  return l1ToL2Response;
 }

package/src/note/note_dao.ts

@@ -1,6 +1,5 @@
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { Point } from '@aztec/foundation/curves/grumpkin';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { Note } from '@aztec/stdlib/note';
@@ -148,9 +147,7 @@ export class NoteDao {
    * @returns - Its size in bytes.
    */
   public getSize() {
-    const noteSize = 4 + this.note.items.length * Fr.SIZE_IN_BYTES;
-    // 2 numbers for txIndexInBlock and noteIndexInTx (4 bytes each)
-    return noteSize + AztecAddress.SIZE_IN_BYTES * 2 + Fr.SIZE_IN_BYTES * 4 + TxHash.SIZE + Point.SIZE_IN_BYTES + 8;
+    return this.toBuffer().length;
   }
 
   static async random({

package/src/proofs/chonk_proof.ts

@@ -1,21 +1,41 @@
+import { BarretenbergSync, flattenChonkProofFields } from '@aztec/bb.js';
 import { CHONK_PROOF_LENGTH } from '@aztec/constants';
 import { times } from '@aztec/foundation/collection';
 import { randomBytes } from '@aztec/foundation/crypto/random';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { bufferSchemaFor } from '@aztec/foundation/schemas';
-import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
+import { BufferReader, numToUInt32BE, serializeToBuffer } from '@aztec/foundation/serialize';
+
+/**
+ * Serialization format detection for ChonkProof is size-based:
+ *   - UNCOMPRESSED (legacy): [field_count=1632: uint32] [fields...]  → total ≈ 52KB (>= 40KB)
+ *   - COMPRESSED:            [byte_count: uint32] [compressed_bytes] → total ≈ 35KB (< 40KB)
+ *
+ * Detection: if the first uint32 equals CHONK_PROOF_LENGTH (1632), it's legacy format
+ * (field count). Otherwise, it's compressed format (byte count). The old uncompressed
+ * format is never smaller than 40KB; compressed proofs are always smaller than 40KB.
+ */
 
 // CHONK: "Client Honk" - An UltraHonk variant with incremental folding and delayed non-native arithmetic.
 export class ChonkProof {
+  /**
+   * Optional compressed proof bytes from chonk compression (point compression + u256 encoding).
+   * When set, toBuffer() will serialize in compressed format (~1.7x smaller).
+   * When reading from compressed format, this is populated and fields are decompressed on demand.
+   */
+  public compressedProof?: Buffer;
+
   constructor(
     // The proof fields.
     // For native verification, attach public inputs via `attachPublicInputs(publicInputs)`.
     // Not using Tuple here due to the length being too high.
     public fields: Fr[],
+    compressedProof?: Buffer,
   ) {
     if (fields.length !== CHONK_PROOF_LENGTH) {
       throw new Error(`Invalid ChonkProof length: ${fields.length}`);
     }
+    this.compressedProof = compressedProof;
   }
 
   public attachPublicInputs(publicInputs: Fr[]) {
@@ -53,19 +73,84 @@ export class ChonkProof {
     return this.toBuffer();
   }
 
+  /**
+   * Deserialize a ChonkProof from a buffer.
+   * Supports both legacy (field elements) and compressed (chonk compression) formats.
+   *
+   * Size-based format detection:
+   *   - First uint32 == CHONK_PROOF_LENGTH (1632): legacy format, read field elements
+   *     Total proof data ≈ 52KB (always >= 40KB)
+   *   - Otherwise: compressed format, first uint32 is byte count of compressed data
+   *     Total proof data ≈ 35KB (always < 40KB)
+   */
   static fromBuffer(buffer: Buffer | BufferReader): ChonkProof {
     const reader = BufferReader.asReader(buffer);
-    const proofLength = reader.readNumber();
-    const proof = reader.readArray(proofLength, Fr);
-    return new ChonkProof(proof);
+    const firstUint32 = reader.readNumber();
+
+    if (firstUint32 === CHONK_PROOF_LENGTH) {
+      // Legacy format: firstUint32 is the field count (1632)
+      // Widen to `number` to prevent TS from narrowing to literal 1632,
+      // which would cause Tuple<Fr, 1632> to exceed the recursion limit.
+      const fieldCount: number = firstUint32;
+      const proof = reader.readArray(fieldCount, Fr);
+      return new ChonkProof(proof);
+    }
+
+    // Compressed format: firstUint32 is the compressed byte count
+    const compressedBytes = reader.readBytes(firstUint32);
+    return ChonkProof.fromCompressedBytes(Buffer.from(compressedBytes));
+  }
+
+  /**
+   * Create a ChonkProof from compressed bytes by decompressing via the BarretenbergSync API.
+   * The compressed format uses point compression and u256 encoding (from PR #20645).
+   *
+   * @param compressed - Compressed proof bytes from chonk compression
+   * @returns ChonkProof with both fields and compressed bytes populated
+   */
+  static fromCompressedBytes(compressed: Buffer): ChonkProof {
+    const api = BarretenbergSync.getSingleton();
+    const result = api.chonkDecompressProof({ compressedProof: new Uint8Array(compressed) });
+
+    // Flatten the structured bb.js ChonkProof into flat Fr[] field elements
+    const flatFields = flattenChonkProofFields(result.proof);
+    const fields = flatFields.map(f => Fr.fromBuffer(Buffer.from(f)));
+
+    // The decompressed proof includes public inputs in hidingOinkProof.
+    // Since ChonkProof stores fields WITHOUT public inputs, strip them.
+    // The number of public inputs = total fields - CHONK_PROOF_LENGTH
+    if (fields.length > CHONK_PROOF_LENGTH) {
+      const numPubInputs = fields.length - CHONK_PROOF_LENGTH;
+      const proofFields = fields.slice(numPubInputs);
+      return new ChonkProof(proofFields, compressed);
+    }
+
+    return new ChonkProof(fields, compressed);
   }
 
+  /**
+   * Serialize the proof to a buffer.
+   * If compressed bytes are available, uses the compressed format (~1.7x smaller).
+   * Otherwise falls back to legacy field element format.
+   */
   public toBuffer() {
+    if (this.compressedProof) {
+      // Compressed format: [compressed_byte_count: uint32] [compressed_bytes]
+      return Buffer.concat([numToUInt32BE(this.compressedProof.length), this.compressedProof]);
+    }
+    // Legacy format: [field_count=1632: uint32] [fields...]
     return serializeToBuffer(this.fields.length, this.fields);
   }
 }
 
 export class ChonkProofWithPublicInputs {
+  /**
+   * Optional compressed proof bytes (covers the full proof WITH public inputs).
+   * Set by the prover when using chonk compression. Flows through to ChonkProof
+   * via removePublicInputs() so the Tx can serialize in compressed format.
+   */
+  public compressedProof?: Buffer;
+
   constructor(
     // The proof fields with public inputs.
     // For recursive verification, use without public inputs via `removePublicInputs()`.
@@ -83,7 +168,8 @@ export class ChonkProofWithPublicInputs {
 
   public removePublicInputs() {
     const numPublicInputs = this.fieldsWithPublicInputs.length - CHONK_PROOF_LENGTH;
-    return new ChonkProof(this.fieldsWithPublicInputs.slice(numPublicInputs));
+    // Flow compressed proof bytes through so the ChonkProof can serialize efficiently
+    return new ChonkProof(this.fieldsWithPublicInputs.slice(numPublicInputs), this.compressedProof);
   }
 
   public isEmpty() {

package/src/tests/factories.ts

@@ -1715,6 +1715,10 @@ export function makeL2Tips(
       block: { number: bn, hash },
       checkpoint: { number: cpn, hash: cph },
     },
+    proposedCheckpoint: {
+      block: { number: bn, hash },
+      checkpoint: { number: cpn, hash: cph },
+    },
     proven: {
       block: { number: bn, hash },
       checkpoint: { number: cpn, hash: cph },

package/src/tx/capsule.ts

@@ -19,6 +19,8 @@ export class Capsule {
     public readonly storageSlot: Fr,
     /** Data passed to the contract  */
     public readonly data: Fr[],
+    /** Optional namespace for the capsule contents */
+    public readonly scope?: AztecAddress,
   ) {}
 
   static get schema() {
@@ -30,12 +32,18 @@ export class Capsule {
   }
 
   toBuffer() {
-    return serializeToBuffer(this.contractAddress, this.storageSlot, new Vector(this.data));
+    return this.scope
+      ? serializeToBuffer(this.contractAddress, this.storageSlot, new Vector(this.data), true, this.scope)
+      : serializeToBuffer(this.contractAddress, this.storageSlot, new Vector(this.data), false);
   }
 
   static fromBuffer(buffer: Buffer | BufferReader): Capsule {
     const reader = BufferReader.asReader(buffer);
-    return new Capsule(AztecAddress.fromBuffer(reader), Fr.fromBuffer(reader), reader.readVector(Fr));
+    const contractAddress = AztecAddress.fromBuffer(reader);
+    const storageSlot = Fr.fromBuffer(reader);
+    const data = reader.readVector(Fr);
+    const hasScope = reader.readBoolean();
+    return new Capsule(contractAddress, storageSlot, data, hasScope ? AztecAddress.fromBuffer(reader) : undefined);
   }
 
   toString() {

package/src/tx/global_variable_builder.ts

@@ -1,3 +1,5 @@
+import type { FeeHeader } from '@aztec/ethereum/contracts';
+import type { CheckpointNumber } from '@aztec/foundation/branded-types';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import type { SlotNumber } from '@aztec/foundation/schemas';
 
@@ -6,6 +8,18 @@ import type { GasFees } from '../gas/gas_fees.js';
 import type { UInt32 } from '../types/index.js';
 import type { CheckpointGlobalVariables, GlobalVariables } from './global_variables.js';
 
+/** Fee header fields needed for pipelining overrides. */
+export type ForceProposedFeeHeader = {
+  checkpointNumber: CheckpointNumber;
+  feeHeader: FeeHeader;
+};
+
+/** Options for building checkpoint global variables during pipelining. */
+export type BuildCheckpointGlobalVariablesOpts = {
+  forcePendingCheckpointNumber?: CheckpointNumber;
+  forceProposedFeeHeader?: ForceProposedFeeHeader;
+};
+
 /**
  * Interface for building global variables for Aztec blocks.
  */
@@ -32,5 +46,6 @@ export interface GlobalVariableBuilder {
     coinbase: EthAddress,
     feeRecipient: AztecAddress,
     slotNumber: SlotNumber,
+    opts?: BuildCheckpointGlobalVariablesOpts,
   ): Promise<CheckpointGlobalVariables>;
 }