@aztec/stdlib 0.0.1-commit.c2eed6949 → 0.0.1-commit.c52d6e7

package/src/logs/shared_secret_derivation.ts

@@ -1,22 +1,18 @@
+import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
-import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import { GrumpkinScalar, type Point } from '@aztec/foundation/curves/grumpkin';
 
+import type { AztecAddress } from '../aztec-address/index.js';
 import type { PublicKey } from '../keys/public_key.js';
 
 /**
- * Derive an Elliptic Curve Diffie-Hellman (ECDH) Shared Secret.
- * The function takes in an ECDH public key, a private key, and a Grumpkin instance to compute
- * the shared secret.
+ * Derives the raw ECDH shared secret point `S = secretKey * publicKey`.
  *
- * @param secretKey - The secret key used to derive shared secret.
- * @param publicKey - The public key used to derive shared secret.
- * @returns A derived shared secret.
  * @throws If the publicKey is zero.
- *
- * TODO(#12656): This function is kept around because of the utilityGetSharedSecret oracle. Nuke this once returning
- * the app-siloed secret.
  */
-export function deriveEcdhSharedSecret(secretKey: GrumpkinScalar, publicKey: PublicKey): Promise<Point> {
+export function deriveEcdhSharedSecretPoint(secretKey: GrumpkinScalar, publicKey: PublicKey): Promise<Point> {
   if (publicKey.isZero()) {
     throw new Error(
       `Attempting to derive a shared secret with a zero public key. You have probably passed a zero public key in your Noir code somewhere thinking that the note won't be broadcast... but it was.`,
@@ -24,3 +20,51 @@ export function deriveEcdhSharedSecret(secretKey: GrumpkinScalar, publicKey: Pub
   }
   return Grumpkin.mul(publicKey, secretKey);
 }
+
+/**
+ * Derives an app-siloed ECDH shared secret from keys: ECDHs `S = secretKey * publicKey` via
+ * {@link deriveEcdhSharedSecretPoint}, then app-silos it via {@link appSiloEcdhSharedSecretPoint}.
+ *
+ * @param secretKey - The secret key used to derive shared secret.
+ * @param publicKey - The public key used to derive shared secret.
+ * @param contractAddress - The address of the calling contract, used for app-siloing.
+ * @returns The app-siloed shared secret as a Field.
+ * @throws If the publicKey is zero.
+ */
+export async function appSiloEcdhSharedSecret(
+  secretKey: GrumpkinScalar,
+  publicKey: PublicKey,
+  contractAddress: AztecAddress,
+): Promise<Fr> {
+  const rawSharedSecret = await deriveEcdhSharedSecretPoint(secretKey, publicKey);
+  return appSiloEcdhSharedSecretPoint(rawSharedSecret, contractAddress);
+}
+
+/**
+ * App-silos a shared secret point: `s_app = h(DOM_SEP__APP_SILOED_ECDH_SHARED_SECRET, S.x, S.y, app)`.
+ *
+ * Mirrors `compute_app_siloed_shared_secret` in aztec-nr.
+ *
+ * @param point - The raw shared secret point `S`.
+ * @param app - The contract address to silo to.
+ */
+export function appSiloEcdhSharedSecretPoint(point: Point, app: AztecAddress): Promise<Fr> {
+  return poseidon2HashWithSeparator([point.x, point.y, app], DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET);
+}
+
+/**
+ * Protects a handshake's shared secret from being forged by the recipient: `S' = hash(ephPk, recipientPoint) * S`.
+ *
+ * Mirrors aztec-nr's `protect_from_forgery` and must stay byte-compatible with it.
+ *
+ * @param secret - The raw shared secret `S` to protect.
+ * @param ephPk - The handshake's ephemeral public key.
+ * @param recipientPoint - The recipient's address point.
+ */
+export async function protectFromForgery(secret: Point, ephPk: Point, recipientPoint: Point): Promise<Point> {
+  const scalar = await poseidon2HashWithSeparator(
+    [ephPk.x, ephPk.y, recipientPoint.x, recipientPoint.y],
+    DomainSeparator.HANDSHAKE_FORGERY_PROTECTION,
+  );
+  return Grumpkin.mul(secret, new GrumpkinScalar(scalar.toBigInt()));
+}

package/src/logs/siloed_tag.ts

@@ -1,32 +1,37 @@
-import type { Fr } from '@aztec/foundation/curves/bn254';
+import { DomainSeparator } from '@aztec/constants';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import type { ZodFor } from '@aztec/foundation/schemas';
 
 import type { AztecAddress } from '../aztec-address/index.js';
-import { computeSiloedPrivateLogFirstField } from '../hash/hash.js';
+import { computeLogTag, computeSiloedPrivateLogFirstField } from '../hash/hash.js';
 import { schemas } from '../schemas/schemas.js';
+import { AppTaggingSecretKind } from './app_tagging_secret_kind.js';
 import type { PreTag } from './pre_tag.js';
 import { Tag } from './tag.js';
 
-/* eslint-disable @typescript-eslint/no-unsafe-declaration-merging */
-
-/** Branding to ensure fields are not interchangeable types. */
-export interface SiloedTag {
-  /** Brand. */
-  _branding: 'SiloedTag';
-}
-
 /**
  * Represents a tag used in private log as it "appears on the chain" - that is the tag is siloed with a contract
  * address that emitted the log.
  */
 export class SiloedTag {
+  /** Branding for nominal typing. */
+  declare private readonly _branding: 'SiloedTag';
+
   constructor(public readonly value: Fr) {}
 
   static async compute(preTag: PreTag): Promise<SiloedTag> {
     const tag = await Tag.compute(preTag);
-    return SiloedTag.computeFromTagAndApp(tag, preTag.extendedSecret.app);
+    const domainSeparator =
+      preTag.extendedSecret.kind === AppTaggingSecretKind.CONSTRAINED
+        ? DomainSeparator.CONSTRAINED_MSG_LOG_TAG
+        : DomainSeparator.UNCONSTRAINED_MSG_LOG_TAG;
+    const logTag = await computeLogTag(tag.value, domainSeparator);
+    return SiloedTag.computeFromTagAndApp(new Tag(logTag), preTag.extendedSecret.app);
   }
 
+  /**
+   * Unlike `compute`, this expects a tag whose value is already domain-separated.
+   */
   static async computeFromTagAndApp(tag: Tag, app: AztecAddress): Promise<SiloedTag> {
     const siloedTag = await computeSiloedPrivateLogFirstField(app, tag.value);
     return new SiloedTag(siloedTag);
@@ -44,6 +49,10 @@ export class SiloedTag {
     return this.value.equals(other.value);
   }
 
+  static random(): SiloedTag {
+    return new SiloedTag(Fr.random());
+  }
+
   static get schema(): ZodFor<SiloedTag> {
     return schemas.Fr.transform((fr: Fr) => new SiloedTag(fr));
   }

package/src/logs/tag.ts

@@ -1,22 +1,18 @@
 import { poseidon2Hash } from '@aztec/foundation/crypto/poseidon';
-import type { Fr } from '@aztec/foundation/curves/bn254';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import type { ZodFor } from '@aztec/foundation/schemas';
 
 import { schemas } from '../schemas/schemas.js';
 import type { PreTag } from './pre_tag.js';
 
-/* eslint-disable @typescript-eslint/no-unsafe-declaration-merging */
-
-export interface Tag {
-  /** Brand. */
-  _branding: 'Tag';
-}
-
 /**
  * Represents a tag of a private log. This is not the tag that "appears" on the chain as this tag is first siloed
  * with a contract address by kernels before being included in the final log.
  */
 export class Tag {
+  /** Branding for nominal typing. */
+  declare private readonly _branding: 'Tag';
+
   constructor(public readonly value: Fr) {}
 
   static async compute(preTag: PreTag): Promise<Tag> {
@@ -36,6 +32,10 @@ export class Tag {
     return this.value.equals(other.value);
   }
 
+  static random(): Tag {
+    return new Tag(Fr.random());
+  }
+
   static get schema(): ZodFor<Tag> {
     return schemas.Fr.transform((fr: Fr) => new Tag(fr));
   }

package/src/logs/tagging_index_range.ts

@@ -2,23 +2,17 @@ import { schemas } from '@aztec/foundation/schemas';
 
 import { z } from 'zod';
 
-import {
-  type ExtendedDirectionalAppTaggingSecret,
-  ExtendedDirectionalAppTaggingSecretSchema,
-} from './extended_directional_app_tagging_secret.js';
+import { type AppTaggingSecret, AppTaggingSecretSchema } from './app_tagging_secret.js';
 
-/**
- * Represents a range of tagging indexes for a given extended directional app tagging secret. Used to track the lowest
- * and highest indexes used in a transaction for a given (sender, recipient, app/contract) tuple.
- */
+/** Represents a range of tagging indexes for a given app tagging secret. */
 export type TaggingIndexRange = {
-  extendedSecret: ExtendedDirectionalAppTaggingSecret;
+  extendedSecret: AppTaggingSecret;
   lowestIndex: number;
   highestIndex: number;
 };
 
 export const TaggingIndexRangeSchema = z.object({
-  extendedSecret: ExtendedDirectionalAppTaggingSecretSchema,
+  extendedSecret: AppTaggingSecretSchema,
   lowestIndex: schemas.Integer,
   highestIndex: schemas.Integer,
 });

package/src/messaging/append_l1_to_l2_messages.ts

@@ -0,0 +1,21 @@
+import { NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP } from '@aztec/constants';
+import { padArrayEnd } from '@aztec/foundation/collection';
+import { Fr } from '@aztec/foundation/curves/bn254';
+
+import type { MerkleTreeWriteOperations } from '../interfaces/merkle_tree_operations.js';
+import { MerkleTreeId } from '../trees/merkle_tree_id.js';
+
+/**
+ * Pads `l1ToL2Messages` to `NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP` and appends them to the
+ * L1→L2 message tree of `db`. Use whenever a fork at "state before the first block of a
+ * checkpoint" needs to mirror what the world-state synchronizer inserts at sync time.
+ */
+export async function appendL1ToL2MessagesToTree(db: MerkleTreeWriteOperations, l1ToL2Messages: Fr[]): Promise<void> {
+  const padded = padArrayEnd<Fr, number>(
+    l1ToL2Messages,
+    Fr.ZERO,
+    NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP,
+    'Too many L1 to L2 messages',
+  );
+  await db.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, padded);
+}

package/src/messaging/index.ts

@@ -1,3 +1,4 @@
+export * from './append_l1_to_l2_messages.js';
 export * from './in_hash.js';
 export * from './inbox_leaf.js';
 export * from './l1_to_l2_message.js';

package/src/messaging/l1_to_l2_message.ts

@@ -1,4 +1,5 @@
-import type { L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { DomainSeparator, type L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { sha256ToField } from '@aztec/foundation/crypto/sha256';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
@@ -7,7 +8,7 @@ import { SiblingPath } from '@aztec/foundation/trees';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { BlockParameter } from '../block/block_parameter.js';
-import { computeL1ToL2MessageNullifier } from '../hash/hash.js';
+import { siloNullifier } from '../hash/hash.js';
 import type { AztecNode } from '../interfaces/aztec-node.js';
 import { MerkleTreeId } from '../trees/merkle_tree_id.js';
 import { L1Actor } from './l1_actor.js';
@@ -74,28 +75,65 @@ export class L1ToL2Message {
   }
 }
 
-// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
-export async function getNonNullifiedL1ToL2MessageWitness(
+/**
+ * The unsiloed nullifier a message consumer derives, together with the contract address needed to silo it.
+ */
+export interface UnsiloedMessageNullifier {
+  contractAddress: AztecAddress;
+  nullifier: Fr;
+}
+
+/**
+ * Computes the unsiloed nullifier that the fee juice contract (and any consumer following the same scheme) derives when
+ * consuming an L1 to L2 message.
+ *
+ * This is not a general-purpose utility: other contracts may derive the secret hash and hence the nullifier
+ * differently. The result is unsiloed — callers silo it (with the consuming contract's address) before looking it up
+ * in the nullifier tree.
+ */
+export function computeFeeJuiceMessageNullifier(messageHash: Fr, secret: Fr): Promise<Fr> {
+  return poseidon2HashWithSeparator([messageHash, secret], DomainSeparator.MESSAGE_NULLIFIER);
+}
+
+/**
+ * Fetches the membership witness of an L1 to L2 message. When `unsiloedNullifier` is provided, the message is
+ * additionally required to be un-nullified.
+ */
+export async function getL1ToL2MessageWitness(
   node: AztecNode,
-  contractAddress: AztecAddress,
   messageHash: Fr,
-  secret: Fr,
+  unsiloedNullifier?: UnsiloedMessageNullifier,
   referenceBlock: BlockParameter = 'latest',
 ): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
-  const messageNullifier = await computeL1ToL2MessageNullifier(contractAddress, messageHash, secret);
-
-  const [l1ToL2Response, nullifierResponse] = await Promise.all([
-    node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash),
-    node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [messageNullifier]),
-  ]);
+  // Both requests are dispatched before awaiting so they run concurrently.
+  const l1ToL2ResponsePromise = node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash);
+  const nullifierResponsePromise = unsiloedNullifier
+    ? siloNullifier(unsiloedNullifier.contractAddress, unsiloedNullifier.nullifier).then(siloed =>
+        node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [siloed]),
+      )
+    : undefined;
 
+  const l1ToL2Response = await l1ToL2ResponsePromise;
   if (!l1ToL2Response) {
     throw new Error(`No L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
-  if (nullifierResponse[0] !== undefined) {
+  const nullifierResponse = await nullifierResponsePromise;
+  if (nullifierResponse?.[0] !== undefined) {
     throw new Error(`No non-nullified L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
   return l1ToL2Response;
 }
+
+// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
+export async function getNonNullifiedL1ToL2MessageWitness(
+  node: AztecNode,
+  contractAddress: AztecAddress,
+  messageHash: Fr,
+  secret: Fr,
+  referenceBlock: BlockParameter = 'latest',
+): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
+  const nullifier = await computeFeeJuiceMessageNullifier(messageHash, secret);
+  return getL1ToL2MessageWitness(node, messageHash, { contractAddress, nullifier }, referenceBlock);
+}

package/src/messaging/l2_to_l1_membership.ts

@@ -1,10 +1,28 @@
-import { OUT_HASH_TREE_LEAF_COUNT } from '@aztec/constants';
-import type { EpochNumber } from '@aztec/foundation/branded-types';
+import { MAX_CHECKPOINTS_PER_EPOCH, OUT_HASH_TREE_LEAF_COUNT } from '@aztec/constants';
+import { type EpochNumber, EpochNumberSchema } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { SiblingPath, UnbalancedMerkleTreeCalculator, computeUnbalancedShaRoot } from '@aztec/foundation/trees';
 
+import { z } from 'zod';
+
 import type { AztecNode } from '../interfaces/aztec-node.js';
+import { schemas } from '../schemas/schemas.js';
 import { TxHash } from '../tx/tx_hash.js';
+import type { TxReceipt } from '../tx/tx_receipt.js';
+
+/**
+ * Provides access to the L1 Outbox's per-epoch roots so the witness helper can pick the smallest
+ * partial-proof root that covers a tx's checkpoint. Implemented by `OutboxContract` in the
+ * ethereum package.
+ */
+export interface OutboxRootsReader {
+  /**
+   * Returns the array of roots stored for `epoch`. Slot `i` holds the root inserted for
+   * `numCheckpointsInEpoch = i + 1`, or `Fr.ZERO` if no proof of that depth has landed yet. The
+   * returned array length is `MAX_CHECKPOINTS_PER_EPOCH`.
+   */
+  getRoots(epoch: EpochNumber): Promise<Fr[]>;
+}
 
 /**
  * # L2-to-L1 Message Tree Structure and Leaf IDs
@@ -96,44 +114,73 @@ export function getL2ToL1MessageLeafId(
 }
 
 export type L2ToL1MembershipWitness = {
+  epochNumber: EpochNumber;
+  /**
+   * The number of checkpoints covered by the partial-proof root this witness was built against
+   * (1-indexed; equal to `roots-array-index + 1` on the Outbox). Pass this through to
+   * `Outbox.consume` so the contract reads the matching root slot.
+   */
+  numCheckpointsInEpoch: number;
   root: Fr;
   leafIndex: bigint;
   siblingPath: SiblingPath<number>;
-  epochNumber: EpochNumber;
 };
 
+/**
+ * Zod schema for {@link L2ToL1MembershipWitness}. The sibling-path length varies with the shape of
+ * the per-epoch tree, so we use the unsized `SiblingPath.schema` here rather than a fixed-height
+ * `schemaFor`.
+ */
+export const L2ToL1MembershipWitnessSchema = z.object({
+  epochNumber: EpochNumberSchema,
+  numCheckpointsInEpoch: schemas.Integer,
+  root: schemas.Fr,
+  leafIndex: schemas.BigInt,
+  siblingPath: SiblingPath.schema,
+}) as unknown as z.ZodType<L2ToL1MembershipWitness>;
+
 /**
  * Computes the L2 to L1 membership witness for a given message in a transaction.
  *
+ * Queries the L1 Outbox to find the smallest partial-proof root that covers the tx's checkpoint,
+ * then builds the witness against that root by including only the first `numCheckpointsInEpoch`
+ * checkpoints of the epoch in the tree (the remaining slots are zero-padded, matching the shape
+ * the rollup proved). Returns `undefined` if the tx is not yet in a block/epoch or if the Outbox
+ * holds no root yet that covers the tx's checkpoint.
+ *
  * @param node - The Aztec node to query for block/tx/epoch data.
+ * @param outboxOrRoots - Either an `OutboxRootsReader` (the helper will fetch the per-epoch roots),
+ *   or an already-resolved roots array of length `MAX_CHECKPOINTS_PER_EPOCH`. Pass the array when
+ *   you already read the outbox (e.g. inside a tight loop that resolves witnesses for many
+ *   messages in the same epoch) to avoid redundant L1 reads.
  * @param message - The L2 to L1 message hash to prove membership of.
- * @param txHash - The hash of the transaction that emitted the message.
+ * @param txHashOrReceipt - Either the tx hash, or the already-fetched `TxReceipt`. Passing the
+ *   receipt skips an internal `getTxReceipt` call.
  * @param messageIndexInTx - Optional index of the message within the transaction's L2-to-L1 messages.
  *   If not provided, the message is found by scanning the tx's messages (throws if duplicates exist).
- * @returns The membership witness and epoch number, or undefined if the tx is not yet in a block/epoch.
  */
 export async function computeL2ToL1MembershipWitness(
-  node: Pick<
-    AztecNode,
-    'getL2ToL1Messages' | 'getTxReceipt' | 'getTxEffect' | 'getBlock' | 'getCheckpointsDataForEpoch'
-  >,
+  node: Pick<AztecNode, 'getL2ToL1Messages' | 'getTxReceipt' | 'getBlock' | 'getCheckpointsData'>,
+  outboxOrRoots: OutboxRootsReader | Fr[],
   message: Fr,
-  txHash: TxHash,
+  txHashOrReceipt: TxHash | Pick<TxReceipt, 'txHash' | 'epochNumber' | 'blockNumber' | 'txIndexInBlock'>,
   messageIndexInTx?: number,
 ): Promise<L2ToL1MembershipWitness | undefined> {
-  const { epochNumber, blockNumber } = await node.getTxReceipt(txHash);
-  if (epochNumber === undefined || blockNumber === undefined) {
+  const receipt =
+    'txHash' in txHashOrReceipt ? txHashOrReceipt : await node.getTxReceipt(txHashOrReceipt, { includeTxEffect: true });
+
+  const { epochNumber, blockNumber, txIndexInBlock } = receipt;
+  if (epochNumber === undefined || blockNumber === undefined || txIndexInBlock === undefined) {
     return undefined;
   }
 
-  const [messagesInEpoch, block, txEffect, checkpointsData] = await Promise.all([
+  const [messagesInEpoch, block, checkpointsData] = await Promise.all([
     node.getL2ToL1Messages(epochNumber),
     node.getBlock(blockNumber),
-    node.getTxEffect(txHash),
-    node.getCheckpointsDataForEpoch(epochNumber),
+    node.getCheckpointsData({ epoch: epochNumber }),
   ]);
 
-  if (messagesInEpoch.length === 0 || !block || !txEffect) {
+  if (messagesInEpoch.length === 0 || !block) {
     return undefined;
   }
 
@@ -143,17 +190,59 @@ export async function computeL2ToL1MembershipWitness(
   }
 
   const blockIndex = block.indexWithinCheckpoint;
-  const txIndex = txEffect.txIndexInBlock;
+  const txIndex = txIndexInBlock;
+
+  // Pick the smallest partial-proof root on the Outbox that covers checkpointIndex. The Outbox
+  // stores roots keyed by `numCheckpointsInEpoch - 1`, so to cover a tx in checkpoint at index
+  // `checkpointIndex` we need a non-zero entry at array index >= checkpointIndex.
+  const roots = Array.isArray(outboxOrRoots)
+    ? (outboxOrRoots as Fr[])
+    : await (outboxOrRoots as OutboxRootsReader).getRoots(epochNumber);
+  const numCheckpointsInEpoch = findSmallestCoveringRootCount(roots, checkpointIndex);
+  if (numCheckpointsInEpoch === undefined) {
+    return undefined;
+  }
+
+  // Build the witness against the first `numCheckpointsInEpoch` checkpoints. The inner builder
+  // pads to OUT_HASH_TREE_LEAF_COUNT internally, so slicing the outer array narrows the real-leaf
+  // prefix and grows the zero suffix — exactly the shape the rollup proved against.
+  const messagesInPartialEpoch = messagesInEpoch.slice(0, numCheckpointsInEpoch);
 
   const { root, leafIndex, siblingPath } = computeL2ToL1MembershipWitnessFromMessagesInEpoch(
-    messagesInEpoch,
+    messagesInPartialEpoch,
     message,
     checkpointIndex,
     blockIndex,
     txIndex,
     messageIndexInTx,
   );
-  return { epochNumber, root, leafIndex, siblingPath };
+
+  // Cross-check: the recomputed root must equal the root the Outbox is holding for this depth.
+  // A mismatch means the node and L1 disagree about the epoch's contents; fail loud rather than
+  // return a witness that will revert on chain.
+  const expected = roots[numCheckpointsInEpoch - 1];
+  if (!root.equals(expected)) {
+    throw new Error(
+      `Local epoch out-hash does not match Outbox at epoch ${epochNumber} numCheckpointsInEpoch ` +
+        `${numCheckpointsInEpoch}: local=${root.toString()} outbox=${expected.toString()}`,
+    );
+  }
+
+  return { epochNumber, numCheckpointsInEpoch, root, leafIndex, siblingPath };
+}
+
+/**
+ * Returns the smallest `numCheckpointsInEpoch` (1-indexed) for which the Outbox holds a root that
+ * covers the message at `checkpointIndex` (0-indexed). Returns `undefined` if no covering root has
+ * been inserted yet.
+ */
+function findSmallestCoveringRootCount(roots: Fr[], checkpointIndex: number): number | undefined {
+  for (let i = checkpointIndex; i < Math.min(roots.length, MAX_CHECKPOINTS_PER_EPOCH); i++) {
+    if (!roots[i].isZero()) {
+      return i + 1;
+    }
+  }
+  return undefined;
 }
 
 /**

package/src/messaging/l2_to_l1_message.ts

@@ -1,7 +1,7 @@
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { schemas } from '@aztec/foundation/schemas';
-import { BufferReader, FieldReader, serializeToBuffer, serializeToFields } from '@aztec/foundation/serialize';
+import { BufferReader, BufferSink, FieldReader, serializeToFields, serializeToSink } from '@aztec/foundation/serialize';
 
 import { z } from 'zod';
 
@@ -54,8 +54,13 @@ export class L2ToL1Message {
    * Serialize this as a buffer.
    * @returns The buffer.
    */
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.recipient, this.content);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.recipient, this.content);
   }
 
   /**
@@ -127,8 +132,13 @@ export class CountedL2ToL1Message {
     return new CountedL2ToL1Message(reader.readObject(L2ToL1Message), reader.readNumber());
   }
 
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.message, this.counter);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.message, this.counter);
   }
 
   static fromFields(fields: Fr[] | FieldReader) {
@@ -187,8 +197,13 @@ export class ScopedL2ToL1Message {
     return new ScopedL2ToL1Message(reader.readObject(L2ToL1Message), reader.readObject(AztecAddress));
   }
 
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.message, this.contractAddress);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.message, this.contractAddress);
   }
 
   static fromFields(fields: Fr[] | FieldReader) {
@@ -229,8 +244,13 @@ export class ScopedCountedL2ToL1Message {
     return new ScopedCountedL2ToL1Message(reader.readObject(CountedL2ToL1Message), reader.readObject(AztecAddress));
   }
 
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.inner, this.contractAddress);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.inner, this.contractAddress);
   }
 
   static fromFields(fields: Fr[] | FieldReader) {

package/src/noir/index.ts

@@ -2,6 +2,7 @@ import type {
   ABIParameter,
   ABIParameterVisibility,
   AbiErrorType,
+  AbiNamedValue,
   AbiType,
   AbiValue,
   DebugFileMap,
@@ -64,6 +65,8 @@ interface NoirFunctionEntry {
 export interface NoirCompiledContract {
   /** The name of the contract. */
   name: string;
+  /** The version of the Aztec stack that compiled this contract. */
+  aztec_version: string;
   /** Is the contract's public bytecode transpiled? */
   transpiled?: boolean;
   /** The functions of the contract. */
@@ -71,7 +74,7 @@ export interface NoirCompiledContract {
   /** The events of the contract */
   outputs: {
     structs: Record<string, AbiType[]>;
-    globals: Record<string, AbiValue[]>;
+    globals: Record<string, (AbiNamedValue | AbiValue)[]>;
   };
   /** The map of file ID to the source code and path of the file. */
   file_map: DebugFileMap;

package/src/note/note_dao.ts

@@ -1,6 +1,5 @@
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { Point } from '@aztec/foundation/curves/grumpkin';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { Note } from '@aztec/stdlib/note';
@@ -148,9 +147,7 @@ export class NoteDao {
    * @returns - Its size in bytes.
    */
   public getSize() {
-    const noteSize = 4 + this.note.items.length * Fr.SIZE_IN_BYTES;
-    // 2 numbers for txIndexInBlock and noteIndexInTx (4 bytes each)
-    return noteSize + AztecAddress.SIZE_IN_BYTES * 2 + Fr.SIZE_IN_BYTES * 4 + TxHash.SIZE + Point.SIZE_IN_BYTES + 8;
+    return this.toBuffer().length;
   }
 
   static async random({

package/src/p2p/attestation_utils.ts

@@ -1,3 +1,4 @@
+import { normalizeSignature } from '@aztec/foundation/crypto/secp256k1-signer';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 
 import { CommitteeAttestation } from '../block/index.js';
@@ -18,9 +19,15 @@ export function orderAttestations(
   for (const attestation of attestations) {
     const sender = attestation.getSender();
     if (sender) {
+      // Canonicalize the recovery byte to v ∈ {27, 28} before it reaches the L1 bundle. A committee
+      // member (or a peer mutating the byte in flight) can emit an equivalent signature in yParity form
+      // (v = 0/1); left as-is it makes `packAttestations` (empty iff v === 0) and `getSigners` (empty iff
+      // r,s,v all zero) disagree, reverting `propose()` with SignersSizeMismatch, and a v = 1 byte would
+      // later revert epoch proving in ECDSA.recover. `sender` recovered, so the signature is non-empty
+      // and low-s, and normalizeSignature preserves the recovered address.
       attestationMap.set(
         sender.toString(),
-        CommitteeAttestation.fromAddressAndSignature(sender, attestation.signature),
+        CommitteeAttestation.fromAddressAndSignature(sender, normalizeSignature(attestation.signature)),
       );
     }
   }