@aztec/stdlib 0.0.1-commit.993d52e → 0.0.1-commit.9a89641

package/src/checkpoint/checkpoint_reexecution_tracker.ts

@@ -0,0 +1,167 @@
+import type { CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+
+/**
+ * Outcome of attempting to re-execute a checkpoint proposal locally.
+ *
+ * - `valid`        — re-execution succeeded and the computed checkpoint matched the proposal.
+ * - `invalid`      — the proposal disagreed with the computed checkpoint, or violated a deterministic
+ *                    constraint (limits, signatures, etc).
+ * - `unvalidated`  — the local node could not complete validation for non-deterministic reasons
+ *                    (missing blocks/txs, timeouts, infra errors). Treated as proposer-fault for
+ *                    slashing but surfaced separately for telemetry.
+ */
+export type ReexecutionOutcome = 'valid' | 'invalid' | 'unvalidated';
+
+/**
+ * Tracks two pieces of per-slot state collected during proposal handling:
+ *
+ *  1. Whether each block proposal's transactions were successfully collected locally
+ *     (keyed by `slot` + `indexWithinCheckpoint`). Consumed by the data-withholding watcher.
+ *  2. The outcome of locally re-executing each checkpoint proposal (keyed by
+ *     `(checkpointNumber, archiveRoot)` and by `slot`). Consumed by the data-withholding
+ *     watcher (via `hasReexecuted`) and the sentinel (via `getOutcomeForSlot`).
+ *
+ * Both pieces of state live on the same per-slot `Entry`, so cleanup via `removeBefore`
+ * naturally drops everything for a pruned slot in one step.
+ */
+interface Entry {
+  // Set by recordOutcome — these may be undefined until the checkpoint proposal has been
+  // evaluated. recordTxsCollected may create an Entry before any of them are known.
+  checkpointNumber: CheckpointNumber | undefined;
+  archiveRoot: string | undefined;
+  outcome: ReexecutionOutcome | undefined;
+
+  slot: SlotNumber;
+
+  // Per block-proposal at this slot: indexWithinCheckpoint → true (collected) | false (failed to collect).
+  txsCollected: Map<number, boolean>;
+}
+
+export class CheckpointReexecutionTracker {
+  private readonly byCheckpoint = new Map<CheckpointNumber, Map<string, Entry>>();
+  private readonly bySlot = new Map<SlotNumber, Entry>();
+
+  /**
+   * Record the outcome of evaluating a checkpoint proposal.
+   * @param slot - Slot the proposal was for. Always required.
+   * @param archiveRoot - Archive root in the proposal.
+   * @param outcome - Outcome of evaluation.
+   * @param checkpointNumber - Checkpoint number, if known. Required for `valid` outcomes; optional
+   *   for `invalid`/`unvalidated` because some early rejections fire before blocks are loaded.
+   */
+  public recordOutcome(
+    slot: SlotNumber,
+    archiveRoot: Fr,
+    outcome: ReexecutionOutcome,
+    checkpointNumber?: CheckpointNumber,
+  ): void {
+    const archiveRootStr = archiveRoot.toString();
+
+    // Preserve any per-block txsCollected already accumulated for this slot.
+    const existing = this.bySlot.get(slot);
+    const entry: Entry = {
+      checkpointNumber,
+      archiveRoot: archiveRootStr,
+      slot,
+      outcome,
+      txsCollected: existing?.txsCollected ?? new Map(),
+    };
+
+    if (checkpointNumber !== undefined) {
+      let archives = this.byCheckpoint.get(checkpointNumber);
+      if (!archives) {
+        archives = new Map();
+        this.byCheckpoint.set(checkpointNumber, archives);
+      }
+      archives.set(archiveRootStr, entry);
+    }
+
+    this.bySlot.set(slot, entry);
+  }
+
+  /**
+   * Record whether the local node successfully collected the transactions for a block proposal.
+   * Called from the validator's proposal handler immediately after tx collection completes
+   * (regardless of whether re-execution will subsequently succeed). The data-withholding
+   * watcher consults these records as an authoritative signal: tx availability now is too
+   * weak (txs may have been evicted from the mempool by the time the watcher runs), but a
+   * record that the txs *were* available at proposal time still vouches for the proposer.
+   *
+   * @param slot - Slot the block proposal was for.
+   * @param indexWithinCheckpoint - Index of the block within its enclosing checkpoint.
+   * @param collected - True if every tx in the proposal was collected locally before deadline.
+   */
+  public recordTxsCollected(slot: SlotNumber, indexWithinCheckpoint: number, collected: boolean): void {
+    let entry = this.bySlot.get(slot);
+    if (!entry) {
+      entry = {
+        checkpointNumber: undefined,
+        archiveRoot: undefined,
+        slot,
+        outcome: undefined,
+        txsCollected: new Map(),
+      };
+      this.bySlot.set(slot, entry);
+    }
+    entry.txsCollected.set(indexWithinCheckpoint, collected);
+  }
+
+  /**
+   * Returns true if the given (checkpoint number, archive root) has been successfully
+   * re-executed locally (outcome `valid`).
+   */
+  public hasReexecuted(checkpointNumber: CheckpointNumber, archiveRoot: Fr): boolean {
+    return this.byCheckpoint.get(checkpointNumber)?.get(archiveRoot.toString())?.outcome === 'valid';
+  }
+
+  /** Returns the recorded outcome for a given slot, or undefined if no proposal was evaluated. */
+  public getOutcomeForSlot(slot: SlotNumber): ReexecutionOutcome | undefined {
+    return this.bySlot.get(slot)?.outcome;
+  }
+
+  /**
+   * Returns the recorded tx-collection result for a block proposal at the given slot and
+   * `indexWithinCheckpoint`, or `undefined` if no record exists.
+   *
+   * Three-valued by design:
+   *   - `true`      — we collected every tx for this block proposal before the deadline.
+   *   - `false`     — we tried and failed (missing txs at the deadline).
+   *   - `undefined` — no record (e.g. we never saw the block proposal). Callers should fall
+   *                   back to a current-state check (e.g. mempool probe) for this case.
+   */
+  public getTxsCollectedRecord(slot: SlotNumber, indexWithinCheckpoint: number): boolean | undefined {
+    return this.bySlot.get(slot)?.txsCollected.get(indexWithinCheckpoint);
+  }
+
+  /** Drops entries for checkpoints with `number < checkpointNumber`. */
+  public removeBefore(checkpointNumber: CheckpointNumber): void {
+    // Track the highest slot among checkpoints we're pruning. Once we know it, any slot
+    // strictly below that watermark is older than the most recently pruned checkpoint and
+    // can be dropped from `bySlot` too — including slot-only entries (no checkpoint number)
+    // which would otherwise leak, because removing by checkpoint number can't reach them.
+    let maxRemovedSlot: SlotNumber | undefined;
+    for (const [n, archives] of this.byCheckpoint) {
+      if (n < checkpointNumber) {
+        for (const entry of archives.values()) {
+          // Only drop the slot index if it still points at the entry we're removing.
+          if (this.bySlot.get(entry.slot) === entry) {
+            this.bySlot.delete(entry.slot);
+          }
+          if (maxRemovedSlot === undefined || entry.slot > maxRemovedSlot) {
+            maxRemovedSlot = entry.slot;
+          }
+        }
+        this.byCheckpoint.delete(n);
+      }
+    }
+
+    if (maxRemovedSlot !== undefined) {
+      for (const slot of [...this.bySlot.keys()]) {
+        if (slot < maxRemovedSlot) {
+          this.bySlot.delete(slot);
+        }
+      }
+    }
+  }
+}

package/src/checkpoint/digest.ts

@@ -0,0 +1,28 @@
+import type { Buffer32 } from '@aztec/foundation/buffer';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+
+import { ConsensusPayload } from '../p2p/consensus_payload.js';
+import { type CoordinationSignatureContext, getHashedSignaturePayloadTypedData } from '../p2p/signature_utils.js';
+import { CheckpointHeader } from '../rollup/checkpoint_header.js';
+
+/**
+ * Computes the EIP-712 payload digest for a checkpoint proposal — the digest validators sign
+ * and the L1 contract verifies during `propose()`. Mirrors `ProposeLib.digest(ProposePayload)` on L1.
+ *
+ * The result is the same `bytes32` that gets stored in `tempCheckpointLogs[checkpointNumber].payloadDigest`,
+ * so this helper is also reused when constructing simulation state overrides for pipelined proposals.
+ */
+export function computeCheckpointPayloadDigest(args: {
+  header: CheckpointHeader;
+  archiveRoot: Fr;
+  feeAssetPriceModifier: bigint;
+  signatureContext: CoordinationSignatureContext;
+}): Buffer32 {
+  const consensusPayload = new ConsensusPayload(
+    args.header,
+    args.archiveRoot,
+    args.feeAssetPriceModifier,
+    args.signatureContext,
+  );
+  return getHashedSignaturePayloadTypedData(consensusPayload);
+}

package/src/checkpoint/index.ts

@@ -1,4 +1,9 @@
 export * from './checkpoint.js';
 export * from './checkpoint_data.js';
 export * from './checkpoint_info.js';
+export * from './checkpoint_reexecution_tracker.js';
+export * from './digest.js';
+export * from './previous_checkpoint_out_hashes.js';
 export * from './published_checkpoint.js';
+export * from './simulation_overrides.js';
+export * from './validate.js';

package/src/checkpoint/previous_checkpoint_out_hashes.ts

@@ -0,0 +1,61 @@
+import { CheckpointNumber, type EpochNumber } from '@aztec/foundation/branded-types';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { Logger } from '@aztec/foundation/log';
+
+import type { L2BlockSource } from '../block/l2_block_source.js';
+import { type L1RollupConstants, getEpochAtSlot } from '../epoch-helpers/index.js';
+import type { ProposedCheckpointData } from './checkpoint_data.js';
+
+/**
+ * Returns the out hashes (in epoch order) of all checkpoints in `epoch` that precede
+ * `checkpointNumber`, used to compute the `epochOutHash` baked into that checkpoint's header.
+ *
+ * Under proposer pipelining the parent checkpoint may not be confirmed on L1 by the time the
+ * builder runs, so the on-chain archiver query (`getCheckpointsData`) is missing it and the
+ * resulting `epochOutHash` would diverge from what other validators (and L1) compute after the
+ * parent lands. To avoid that, the parent's `checkpointOutHash` is spliced in from the locally
+ * known proposed checkpoint when:
+ *   - pipelining is enabled,
+ *   - the archiver lookup is genuinely short (its last entry is not already cp `N-1`),
+ *   - and the proposed cp `N-1` is in the same target epoch (otherwise we're at an epoch boundary
+ *     and the previous-epoch cps must be excluded).
+ *
+ * Callers may either pass the already-loaded `proposedCheckpointData` (the proposer has it on
+ * hand) or leave it undefined, in which case it's fetched via `getProposedCheckpointData`.
+ */
+export async function getPreviousCheckpointOutHashes(input: {
+  blockSource: Pick<L2BlockSource, 'getCheckpointsData' | 'getProposedCheckpointData'>;
+  epoch: EpochNumber;
+  checkpointNumber: CheckpointNumber;
+  l1Constants: Pick<L1RollupConstants, 'epochDuration'>;
+  pipeliningEnabled: boolean;
+  proposedCheckpointData?: ProposedCheckpointData;
+  log?: Logger;
+}): Promise<Fr[]> {
+  const { blockSource, epoch, checkpointNumber, l1Constants, pipeliningEnabled, log } = input;
+
+  const checkpointed = (await blockSource.getCheckpointsData({ epoch }))
+    .filter(c => c.checkpointNumber < checkpointNumber)
+    .sort((a, b) => a.checkpointNumber - b.checkpointNumber);
+
+  if (!pipeliningEnabled || checkpointNumber === 0) {
+    return checkpointed.map(c => c.checkpointOutHash);
+  }
+
+  const parentCheckpoint = CheckpointNumber(checkpointNumber - 1);
+  if (checkpointed.at(-1)?.checkpointNumber === parentCheckpoint) {
+    return checkpointed.map(c => c.checkpointOutHash);
+  }
+
+  const proposedParent =
+    input.proposedCheckpointData ?? (await blockSource.getProposedCheckpointData({ number: parentCheckpoint }));
+  if (!proposedParent || proposedParent.checkpointNumber !== parentCheckpoint) {
+    return checkpointed.map(c => c.checkpointOutHash);
+  }
+  if (getEpochAtSlot(proposedParent.header.slotNumber, l1Constants) !== epoch) {
+    return checkpointed.map(c => c.checkpointOutHash);
+  }
+
+  log?.debug(`Splicing pipelined parent cp ${parentCheckpoint} outHash for cp ${checkpointNumber}`);
+  return [...checkpointed.map(c => c.checkpointOutHash), proposedParent.checkpointOutHash];
+}

package/src/checkpoint/simulation_overrides.ts

@@ -0,0 +1,171 @@
+import {
+  type FeeHeader,
+  RollupContract,
+  SimulationOverridesBuilder,
+  type SimulationOverridesPlan,
+} from '@aztec/ethereum/contracts';
+import { CheckpointNumber } from '@aztec/foundation/branded-types';
+import type { Logger } from '@aztec/foundation/log';
+
+import type { CoordinationSignatureContext } from '../p2p/signature_utils.js';
+import type { ProposedCheckpointData } from './checkpoint_data.js';
+import { computeCheckpointPayloadDigest } from './digest.js';
+
+type CheckpointSimulationOverridesPlanInput = {
+  /** Target rollup contract. */
+  rollup: RollupContract;
+  /** Checkpoint number to be proposed. */
+  checkpointNumber: CheckpointNumber;
+  /** Logger instance. */
+  log: Logger;
+  /**
+   * The proposed parent checkpoint when pipelining. Its `checkpointNumber` must equal
+   * `checkpointNumber - 1`; the helper enforces this. Mutually exclusive with
+   * `invalidateToPendingCheckpointNumber`.
+   */
+  proposedCheckpointData?: ProposedCheckpointData;
+  /**
+   * The pending checkpoint number we'll end up at after invalidation lands. Mutually exclusive
+   * with `proposedCheckpointData`.
+   */
+  invalidateToPendingCheckpointNumber?: CheckpointNumber;
+  /**
+   * The real on-chain pending checkpoint number (typically `syncedTo.checkpointedCheckpointNumber`).
+   * Used as the snapshot we pin both `pending` and `proven` to avoid prunes in simulation.
+   */
+  checkpointedCheckpointNumber: CheckpointNumber;
+  /**
+   * Chain-level consensus signature context. Used to recompute the parent's `payloadDigest` for the
+   * pipelined simulation override so it matches what `propose` will write into `tempCheckpointLogs[parent]`
+   * once the parent lands.
+   */
+  signatureContext: CoordinationSignatureContext;
+};
+
+/**
+ * Builds the SimulationOverridesPlan describing the simulated L1 rollup state for a checkpoint's
+ * enqueue-time simulations: `canProposeAt` (in Sequencer.doWork) and the propose-related sims
+ * (validateBlockHeader, simulateProposeTx). The plan reflects "as if our pipelined parent
+ * checkpoint has landed and any required invalidation has executed" — the gap that needs to be
+ * bridged at enqueue time.
+ *
+ * Pipelining (`proposedCheckpointData`) and invalidation (`invalidateToPendingCheckpointNumber`)
+ * are mutually exclusive; passing both throws.
+ */
+export async function buildCheckpointSimulationOverridesPlan(
+  input: CheckpointSimulationOverridesPlanInput,
+): Promise<SimulationOverridesPlan | undefined> {
+  if (input.proposedCheckpointData && input.invalidateToPendingCheckpointNumber !== undefined) {
+    throw new Error(
+      'Error in buildCheckpointSimulationOverridesPlan: proposedCheckpointData and invalidateToPendingCheckpointNumber are mutually exclusive',
+    );
+  }
+
+  const builder = new SimulationOverridesBuilder();
+  const pendingCheckpointNumber = derivePendingCheckpointNumber(input);
+
+  // Override the latest checkpoint number when invalidating or pipelining, so our checkpoint
+  // follows from it. We also override the proven chain tip so we dont need to worry about
+  // prunes kicking in that would break out simulation if there's a prune pending. We always
+  // assume that a proof will land in time. If we don't have a pending checkpoint number to force,
+  // we still set both tips to the current checkpoint number to avoid the prune trigger.
+  const overridenChainTip = pendingCheckpointNumber ?? input.checkpointedCheckpointNumber;
+  builder.withChainTips({ pending: overridenChainTip, proven: overridenChainTip });
+
+  if (input.proposedCheckpointData) {
+    const { header, archive, checkpointOutHash, feeAssetPriceModifier } = input.proposedCheckpointData;
+    builder.withPendingArchive(archive.root);
+    // Override every locally-derivable `tempCheckpointLogs[parent]` field that L1 will eventually
+    // write. `slotNumber` is load-bearing for `STFLib.canPruneAtTime`: without it the cell reads
+    // slotNumber 0, the contract treats the pending tip as belonging to an expired epoch, and
+    // `getEffectivePendingCheckpointNumber` silently collapses pending back to proven — producing
+    // a spurious `Rollup__InvalidArchive` against the on-chain genesis archive. The other fields
+    // (headerHash, outHash, payloadDigest) are not strictly load-bearing for `canProposeAt` /
+    // `validateBlockHeader`, but mirroring the full cell keeps the simulation byte-faithful with
+    // what the actual `propose()` send will observe, which is a defense against future reads
+    // taking dependencies on them.
+    builder.withPendingTempCheckpointLogFields({
+      headerHash: header.hash(),
+      outHash: checkpointOutHash,
+      slotNumber: header.slotNumber,
+      payloadDigest: computeCheckpointPayloadDigest({
+        header,
+        archiveRoot: archive.root,
+        feeAssetPriceModifier,
+        signatureContext: input.signatureContext,
+      }),
+    });
+
+    const feeHeader = await computePipelinedParentFeeHeader({
+      checkpointNumber: input.checkpointNumber,
+      proposedCheckpointData: input.proposedCheckpointData,
+      rollup: input.rollup,
+      log: input.log,
+    });
+    if (feeHeader) {
+      builder.withPendingFeeHeader(feeHeader);
+    }
+  }
+
+  return builder.build();
+}
+
+function derivePendingCheckpointNumber(input: CheckpointSimulationOverridesPlanInput): CheckpointNumber | undefined {
+  if (input.invalidateToPendingCheckpointNumber !== undefined) {
+    return input.invalidateToPendingCheckpointNumber;
+  }
+  if (!input.proposedCheckpointData) {
+    return undefined;
+  }
+  if (input.checkpointNumber < 1) {
+    throw new Error(`Cannot build simulation override for checkpoint ${input.checkpointNumber}: no parent exists`);
+  }
+  const expectedParent = CheckpointNumber(input.checkpointNumber - 1);
+  if (input.proposedCheckpointData.checkpointNumber !== expectedParent) {
+    throw new Error(
+      `Cannot build simulation override for checkpoint ${input.checkpointNumber}: proposedCheckpointData.checkpointNumber (${input.proposedCheckpointData.checkpointNumber}) does not match expected parent ${expectedParent}`,
+    );
+  }
+  return expectedParent;
+}
+
+type PipelinedParentFeeHeaderInput = {
+  checkpointNumber: CheckpointNumber;
+  proposedCheckpointData: ProposedCheckpointData;
+  rollup: RollupContract;
+  log: Logger;
+};
+
+/**
+ * Derives the pending parent fee header used during pipelined proposal simulation. Returns
+ * `undefined` only when no grandparent exists (i.e. the proposed parent is the genesis
+ * checkpoint); all other failure modes (missing grandparent state, missing fee header, RPC
+ * errors) throw so callers don't silently desync the fee-header override.
+ */
+export async function computePipelinedParentFeeHeader(
+  input: PipelinedParentFeeHeaderInput,
+): Promise<FeeHeader | undefined> {
+  if (input.checkpointNumber < 2) {
+    return undefined;
+  }
+
+  const grandparentCheckpointNumber = CheckpointNumber(input.checkpointNumber - 2);
+
+  const [grandparentCheckpoint, manaTarget] = await Promise.all([
+    input.rollup.getCheckpoint(grandparentCheckpointNumber),
+    input.rollup.getManaTarget(),
+  ]);
+
+  if (!grandparentCheckpoint?.feeHeader) {
+    throw new Error(
+      `Grandparent checkpoint or feeHeader missing for checkpoint ${grandparentCheckpointNumber.toString()}`,
+    );
+  }
+
+  return RollupContract.computeChildFeeHeader(
+    grandparentCheckpoint.feeHeader,
+    input.proposedCheckpointData.totalManaUsed,
+    input.proposedCheckpointData.feeAssetPriceModifier,
+    manaTarget,
+  );
+}

package/src/checkpoint/validate.ts

@@ -0,0 +1,240 @@
+import { BLOBS_PER_CHECKPOINT, FIELDS_PER_BLOB, MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT } from '@aztec/constants';
+import type { CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { sum } from '@aztec/foundation/collection';
+
+import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT } from '../deserialization/index.js';
+import type { Checkpoint } from './checkpoint.js';
+
+export class CheckpointValidationError extends Error {
+  constructor(
+    message: string,
+    public readonly checkpointNumber: CheckpointNumber,
+    public readonly slot: SlotNumber,
+  ) {
+    super(message);
+    this.name = 'CheckpointValidationError';
+  }
+}
+
+/**
+ * Validates a checkpoint. Throws a CheckpointValidationError if any validation fails.
+ * - Validates structural integrity (non-empty, block count, sequential numbers, archive chaining, slot consistency)
+ * - Validates checkpoint blob field count against maxBlobFields limit
+ * - Validates total L2 gas used by checkpoint blocks against the Rollup contract mana limit
+ * - Validates total DA gas used by checkpoint blocks against MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT
+ * - Validates individual block L2 gas and DA gas against maxL2BlockGas and maxDABlockGas limits
+ */
+export function validateCheckpoint(
+  checkpoint: Checkpoint,
+  opts: {
+    rollupManaLimit?: number;
+    maxL2BlockGas?: number;
+    maxDABlockGas?: number;
+    maxTxsPerCheckpoint?: number;
+    maxTxsPerBlock?: number;
+    /**
+     * Max blocks per checkpoint. Defaults to {@link MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT}; the L1-sync
+     * ingest path passes `MAX_CAPACITY_BLOCKS_PER_CHECKPOINT` to tolerate larger checkpoints already
+     * accepted by L1.
+     */
+    maxBlocksPerCheckpoint?: number;
+  },
+): void {
+  validateCheckpointStructure(checkpoint, { maxBlocksPerCheckpoint: opts.maxBlocksPerCheckpoint });
+  validateCheckpointLimits(checkpoint, opts);
+  validateCheckpointBlocksLimits(checkpoint, opts);
+}
+
+/**
+ * Validates structural integrity of a checkpoint.
+ * - Non-empty block list
+ * - Block count within `maxBlocksPerCheckpoint` (default {@link MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT})
+ * - Checkpoint slot matches the first block's slot
+ * - Checkpoint lastArchiveRoot matches the first block's lastArchive root
+ * - Sequential block numbers without gaps
+ * - Sequential indexWithinCheckpoint starting at 0
+ * - Archive root chaining between consecutive blocks
+ * - Consistent slot number across all blocks
+ * - Global variables (slot, timestamp, coinbase, feeRecipient, gasFees) match checkpoint header for each block
+ */
+export function validateCheckpointStructure(
+  checkpoint: Checkpoint,
+  opts: { maxBlocksPerCheckpoint?: number } = {},
+): void {
+  const { maxBlocksPerCheckpoint = MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT } = opts;
+  const { blocks, number, slot } = checkpoint;
+
+  if (blocks.length === 0) {
+    throw new CheckpointValidationError('Checkpoint has no blocks', number, slot);
+  }
+
+  if (blocks.length > maxBlocksPerCheckpoint) {
+    throw new CheckpointValidationError(
+      `Checkpoint has ${blocks.length} blocks, exceeding limit of ${maxBlocksPerCheckpoint}`,
+      number,
+      slot,
+    );
+  }
+
+  const firstBlock = blocks[0];
+
+  if (!checkpoint.header.lastArchiveRoot.equals(firstBlock.header.lastArchive.root)) {
+    throw new CheckpointValidationError(
+      `Checkpoint lastArchiveRoot does not match first block's lastArchive root`,
+      number,
+      slot,
+    );
+  }
+
+  for (let i = 0; i < blocks.length; i++) {
+    const block = blocks[i];
+
+    if (block.indexWithinCheckpoint !== i) {
+      throw new CheckpointValidationError(
+        `Block at index ${i} has indexWithinCheckpoint ${block.indexWithinCheckpoint}, expected ${i}`,
+        number,
+        slot,
+      );
+    }
+
+    if (block.slot !== slot) {
+      throw new CheckpointValidationError(
+        `Block ${block.number} has slot ${block.slot}, expected ${slot} (all blocks must share the same slot)`,
+        number,
+        slot,
+      );
+    }
+
+    if (!checkpoint.header.matchesGlobalVariables(block.header.globalVariables)) {
+      throw new CheckpointValidationError(
+        `Block ${block.number} global variables (slot, timestamp, coinbase, feeRecipient, gasFees) do not match checkpoint header`,
+        number,
+        slot,
+      );
+    }
+
+    if (i > 0) {
+      const prev = blocks[i - 1];
+      if (block.number !== prev.number + 1) {
+        throw new CheckpointValidationError(
+          `Block numbers are not sequential: block at index ${i - 1} has number ${prev.number}, block at index ${i} has number ${block.number}`,
+          number,
+          slot,
+        );
+      }
+
+      if (!block.header.lastArchive.root.equals(prev.archive.root)) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} lastArchive root does not match archive root of block ${prev.number}`,
+          number,
+          slot,
+        );
+      }
+    }
+  }
+}
+
+/** Validates checkpoint blocks gas limits */
+function validateCheckpointBlocksLimits(
+  checkpoint: Checkpoint,
+  opts: {
+    maxL2BlockGas?: number;
+    maxDABlockGas?: number;
+    maxTxsPerBlock?: number;
+  },
+): void {
+  const { maxL2BlockGas, maxDABlockGas, maxTxsPerBlock } = opts;
+
+  if (maxL2BlockGas !== undefined) {
+    for (const block of checkpoint.blocks) {
+      const blockL2Gas = block.header.totalManaUsed.toNumber();
+      if (blockL2Gas > maxL2BlockGas) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} in checkpoint has L2 gas used ${blockL2Gas} exceeding limit of ${maxL2BlockGas}`,
+          checkpoint.number,
+          checkpoint.slot,
+        );
+      }
+    }
+  }
+
+  if (maxDABlockGas !== undefined) {
+    for (const block of checkpoint.blocks) {
+      const blockDAGas = block.computeDAGasUsed();
+      if (blockDAGas > maxDABlockGas) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} in checkpoint has DA gas used ${blockDAGas} exceeding limit of ${maxDABlockGas}`,
+          checkpoint.number,
+          checkpoint.slot,
+        );
+      }
+    }
+  }
+
+  if (maxTxsPerBlock !== undefined) {
+    for (const block of checkpoint.blocks) {
+      const blockTxCount = block.body.txEffects.length;
+      if (blockTxCount > maxTxsPerBlock) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} in checkpoint has ${blockTxCount} txs exceeding limit of ${maxTxsPerBlock}`,
+          checkpoint.number,
+          checkpoint.slot,
+        );
+      }
+    }
+  }
+}
+
+/** Validates checkpoint max blob fields, gas limits, and tx limits */
+function validateCheckpointLimits(
+  checkpoint: Checkpoint,
+  opts: {
+    rollupManaLimit?: number;
+    maxTxsPerCheckpoint?: number;
+  },
+): void {
+  const { rollupManaLimit, maxTxsPerCheckpoint } = opts;
+
+  const maxBlobFields = BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB;
+  const maxDAGas = MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT;
+
+  if (rollupManaLimit !== undefined) {
+    const checkpointMana = sum(checkpoint.blocks.map(block => block.header.totalManaUsed.toNumber()));
+    if (checkpointMana > rollupManaLimit) {
+      throw new CheckpointValidationError(
+        `Checkpoint mana cost ${checkpointMana} exceeds rollup limit of ${rollupManaLimit}`,
+        checkpoint.number,
+        checkpoint.slot,
+      );
+    }
+  }
+
+  const checkpointDAGas = sum(checkpoint.blocks.map(block => block.computeDAGasUsed()));
+  if (checkpointDAGas > maxDAGas) {
+    throw new CheckpointValidationError(
+      `Checkpoint DA gas cost ${checkpointDAGas} exceeds limit of ${maxDAGas}`,
+      checkpoint.number,
+      checkpoint.slot,
+    );
+  }
+
+  const checkpointBlobFields = checkpoint.toBlobFields().length;
+  if (checkpointBlobFields > maxBlobFields) {
+    throw new CheckpointValidationError(
+      `Checkpoint blob field count ${checkpointBlobFields} exceeds limit of ${maxBlobFields}`,
+      checkpoint.number,
+      checkpoint.slot,
+    );
+  }
+
+  if (maxTxsPerCheckpoint !== undefined) {
+    const checkpointTxCount = sum(checkpoint.blocks.map(block => block.body.txEffects.length));
+    if (checkpointTxCount > maxTxsPerCheckpoint) {
+      throw new CheckpointValidationError(
+        `Checkpoint tx count ${checkpointTxCount} exceeds limit of ${maxTxsPerCheckpoint}`,
+        checkpoint.number,
+        checkpoint.slot,
+      );
+    }
+  }
+}