@aztec/stdlib 5.0.0-nightly.20260713 → 5.0.0-nightly.20260714

package/dest/logs/shared_secret_derivation.d.ts

@@ -1,5 +1,5 @@
 import type { Fr } from '@aztec/foundation/curves/bn254';
-import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
+import { GrumpkinScalar, type Point } from '@aztec/foundation/curves/grumpkin';
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { PublicKey } from '../keys/public_key.js';
 /**
@@ -28,4 +28,14 @@ export declare function appSiloEcdhSharedSecret(secretKey: GrumpkinScalar, publi
  * @param app - The contract address to silo to.
  */
 export declare function appSiloEcdhSharedSecretPoint(point: Point, app: AztecAddress): Promise<Fr>;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkX3NlY3JldF9kZXJpdmF0aW9uLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbG9ncy9zaGFyZWRfc2VjcmV0X2Rlcml2YXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxLQUFLLEVBQUUsRUFBRSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDekQsT0FBTyxLQUFLLEVBQUUsY0FBYyxFQUFFLEtBQUssRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBRS9FLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQzlELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRXZEOzs7O0dBSUc7QUFDSCx3QkFBZ0IsMkJBQTJCLENBQUMsU0FBUyxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FPM0c7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCx3QkFBc0IsdUJBQXVCLENBQzNDLFNBQVMsRUFBRSxjQUFjLEVBQ3pCLFNBQVMsRUFBRSxTQUFTLEVBQ3BCLGVBQWUsRUFBRSxZQUFZLEdBQzVCLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FHYjtBQUVEOzs7Ozs7O0dBT0c7QUFDSCx3QkFBZ0IsNEJBQTRCLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FFekYifQ==
+/**
+ * Protects a handshake's shared secret from being forged by the recipient: `S' = hash(ephPk, recipientPoint) * S`.
+ *
+ * Mirrors aztec-nr's `protect_from_forgery` and must stay byte-compatible with it.
+ *
+ * @param secret - The raw shared secret `S` to protect.
+ * @param ephPk - The handshake's ephemeral public key.
+ * @param recipientPoint - The recipient's address point.
+ */
+export declare function protectFromForgery(secret: Point, ephPk: Point, recipientPoint: Point): Promise<Point>;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2hhcmVkX3NlY3JldF9kZXJpdmF0aW9uLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbG9ncy9zaGFyZWRfc2VjcmV0X2Rlcml2YXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxLQUFLLEVBQUUsRUFBRSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDekQsT0FBTyxFQUFFLGNBQWMsRUFBRSxLQUFLLEtBQUssRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBRS9FLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQzlELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRXZEOzs7O0dBSUc7QUFDSCx3QkFBZ0IsMkJBQTJCLENBQUMsU0FBUyxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsU0FBUyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FPM0c7QUFFRDs7Ozs7Ozs7O0dBU0c7QUFDSCx3QkFBc0IsdUJBQXVCLENBQzNDLFNBQVMsRUFBRSxjQUFjLEVBQ3pCLFNBQVMsRUFBRSxTQUFTLEVBQ3BCLGVBQWUsRUFBRSxZQUFZLEdBQzVCLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FHYjtBQUVEOzs7Ozs7O0dBT0c7QUFDSCx3QkFBZ0IsNEJBQTRCLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FFekY7QUFFRDs7Ozs7Ozs7R0FRRztBQUNILHdCQUFzQixrQkFBa0IsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsY0FBYyxFQUFFLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLENBTTNHIn0=

package/dest/logs/shared_secret_derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared_secret_derivation.d.ts","sourceRoot":"","sources":["../../src/logs/shared_secret_derivation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAO3G;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,YAAY,GAC5B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,CAEzF"}
+{"version":3,"file":"shared_secret_derivation.d.ts","sourceRoot":"","sources":["../../src/logs/shared_secret_derivation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAE/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAO3G;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,YAAY,GAC5B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,CAEzF;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAM3G"}

package/dest/logs/shared_secret_derivation.js

@@ -1,6 +1,7 @@
 import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
 import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 /**
  * Derives the raw ECDH shared secret point `S = secretKey * publicKey`.
  *
@@ -38,3 +39,20 @@ import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
         app
     ], DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET);
 }
+/**
+ * Protects a handshake's shared secret from being forged by the recipient: `S' = hash(ephPk, recipientPoint) * S`.
+ *
+ * Mirrors aztec-nr's `protect_from_forgery` and must stay byte-compatible with it.
+ *
+ * @param secret - The raw shared secret `S` to protect.
+ * @param ephPk - The handshake's ephemeral public key.
+ * @param recipientPoint - The recipient's address point.
+ */ export async function protectFromForgery(secret, ephPk, recipientPoint) {
+    const scalar = await poseidon2HashWithSeparator([
+        ephPk.x,
+        ephPk.y,
+        recipientPoint.x,
+        recipientPoint.y
+    ], DomainSeparator.HANDSHAKE_FORGERY_PROTECTION);
+    return Grumpkin.mul(secret, new GrumpkinScalar(scalar.toBigInt()));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/stdlib",
-  "version": "5.0.0-nightly.20260713",
+  "version": "5.0.0-nightly.20260714",
   "type": "module",
   "inherits": [
     "../package.common.json",
@@ -92,13 +92,13 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.892.0",
-    "@aztec/bb.js": "5.0.0-nightly.20260713",
-    "@aztec/blob-lib": "5.0.0-nightly.20260713",
-    "@aztec/constants": "5.0.0-nightly.20260713",
-    "@aztec/ethereum": "5.0.0-nightly.20260713",
-    "@aztec/foundation": "5.0.0-nightly.20260713",
-    "@aztec/l1-artifacts": "5.0.0-nightly.20260713",
-    "@aztec/noir-noirc_abi": "5.0.0-nightly.20260713",
+    "@aztec/bb.js": "5.0.0-nightly.20260714",
+    "@aztec/blob-lib": "5.0.0-nightly.20260714",
+    "@aztec/constants": "5.0.0-nightly.20260714",
+    "@aztec/ethereum": "5.0.0-nightly.20260714",
+    "@aztec/foundation": "5.0.0-nightly.20260714",
+    "@aztec/l1-artifacts": "5.0.0-nightly.20260714",
+    "@aztec/noir-noirc_abi": "5.0.0-nightly.20260714",
     "@google-cloud/storage": "^7.15.0",
     "axios": "^1.15.1",
     "json-stringify-deterministic": "1.0.12",

package/src/gas/README.md

@@ -1,47 +1,69 @@
 # Aztec Gas and Fee Model
 
 The minimum fee per mana and its components are computed on L1 in
-`l1-contracts/src/core/libraries/rollup/FeeLib.sol`. This document describes the
-formulas, the oracle lag/lifetime mechanism, and the TypeScript types in this directory.
+`l1-contracts/src/core/libraries/rollup/FeeLib.sol` (`fee_math.ts` in this directory is a
+TypeScript port of those formulas, used to predict fees a few slots ahead). This document
+describes the formulas, the oracle lag/lifetime mechanism, how a transaction's fee is
+derived from them, the gas and data limits, and the TypeScript types in this directory.
 
 ## Mana
 
-Aztec uses **mana** as its unit of work (analogous to Ethereum gas). Transactions consume
-mana in two dimensions: **DA** (data availability) and **L2** (execution). The total fee
-is `gasUsed * feePerMana` summed across both dimensions.
+Aztec meters work as gas in two dimensions: **DA** (data availability, i.e. blob data
+published to L1) and **L2** (execution). The L2 dimension is called **mana** (analogous to
+Ethereum gas): block headers track `totalManaUsed`, and the fee model below prices one unit
+of mana. The total fee is `gasUsed * feePerGas` summed across both dimensions.
+
+### The DA dimension is priced at zero
+
+Only the L2 dimension currently carries a price. When building checkpoint global variables,
+the sequencer sets `feePerDaGas = 0` and sets `feePerL2Gas` to the L1-computed minimum fee
+per mana (`sequencer-client/src/global_variable_builder/global_builder.ts` and
+`fee_provider.ts` in the same directory). The cost of publishing data is still recovered:
+the blob gas a checkpoint pays on L1 is part of the *sequencer cost* component of the mana
+fee below. DA gas remains fully metered and limited (see
+[Gas and Data Limits](#gas-and-data-limits)) — it bounds how much data a tx or checkpoint
+may publish — it just contributes nothing to the fee today.
 
 ## Fee Components
 
-The minimum fee per mana has four components:
+The minimum fee per mana has four components. All are computed in ETH (wei) per mana and
+converted to the fee asset at the end (see [Fee Asset Price](#fee-asset-price)).
 
 ### Sequencer Cost
 
 L1 cost to propose a checkpoint (calldata gas + blob data), amortized over `manaTarget`:
 
 ```
-sequencerCost = ((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
+sequencerCost = ceil(((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
               + (BLOBS_PER_CHECKPOINT * BLOB_GAS_PER_BLOB * blobFee))
-              / manaTarget
+              / manaTarget)
 ```
 
+Note that `BLOBS_PER_CHECKPOINT` here is FeeLib's own constant (3), not the protocol blob
+capacity of the same name (6) — see the note under [Key Constants](#key-constants).
+
 ### Prover Cost
 
 L1 cost to verify an epoch proof, amortized over epoch duration and `manaTarget`, plus a
 governance-set proving cost that compensates for off-chain proof generation:
 
 ```
-proverCost = (L1_GAS_PER_EPOCH_VERIFIED * baseFee / epochDuration) / manaTarget
+proverCost = ceil(ceil((L1_GAS_PER_EPOCH_VERIFIED * baseFee) / epochDuration) / manaTarget)
            + provingCostPerMana
 ```
 
+Updates to `provingCostPerMana` are rate-limited on L1 (`FeeLib.updateProvingCostPerMana`):
+at most one update every 30 days, each moving the value by at most ×1.5 (or ÷1.5), with a
+floor of 2 wei per mana.
+
 ### Congestion Cost
 
 An exponential surcharge when the network is congested (inspired by EIP-1559; the
 implementation uses the `fakeExponential` Taylor series approximation from EIP-4844):
 
 ```
-baseCost          = sequencerCost + proverCost
-congestionCost    = baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER - baseCost
+baseCost       = sequencerCost + proverCost
+congestionCost = floor(baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER) - baseCost
 ```
 
 When there is no congestion the multiplier equals `MINIMUM_CONGESTION_MULTIPLIER` (1e9)
@@ -50,11 +72,15 @@ and congestion cost is zero.
 ### Congestion Multiplier
 
 ```
-excessMana          = max(0, prevExcessMana + prevManaUsed - manaTarget)
-congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER, excessMana, denominator)
+excessMana           = max(0, prevExcessMana + prevManaUsed - manaTarget)
+denominator          = manaTarget * 854,700,854 / 1e8    ≈ 8.547 * manaTarget
+congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER,
+                                       min(excessMana, 100 * denominator), denominator)
 ```
 
-Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
+Each additional `manaTarget` of excess mana multiplies the fee by `e^(1/8.547) ≈ 1.124`,
+i.e. ~12.5%. The exponent is capped at 100 (multiplier ≤ ~2.7e43 × the minimum) to keep
+the Taylor series from overflowing.
 
 ### Total
 
@@ -62,6 +88,11 @@ Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
 minFeePerMana = sequencerCost + proverCost + congestionCost
 ```
 
+Each component is converted from ETH to the fee asset individually (rounding up) before
+summing. The sum is capped at `type(uint128).max` (`FeeLib.summedMinFee`) so it always fits
+the proposal header's `feePerL2Gas` field — without the cap, extreme congestion could
+produce a fee no valid header can represent, halting the chain.
+
 ## L1 Gas Oracle: Lag and Lifetime
 
 The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a two-phase
@@ -70,9 +101,9 @@ The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a t
 - **LAG = 2 slots** — when new L1 fees are observed, they activate `LAG` slots later
   (`slotOfChange = currentSlot + LAG`). This gives mempool transactions time to land
   before fees change.
-- **LIFETIME = 5 slots** — after an oracle update, the next update is rejected until
-  `slotOfChange + (LIFETIME - LAG)` = 3 more slots have passed. This rate-limits how
-  frequently L1 fee data can change.
+- **LIFETIME = 5 slots** — after an oracle update, further updates are ignored
+  (`updateL1GasFeeOracle` returns without effect) until `slotOfChange + (LIFETIME - LAG)`
+  = 3 more slots have passed. This rate-limits how frequently L1 fee data can change.
 
 Fee resolution at a given timestamp:
 
@@ -84,6 +115,12 @@ else                    →  use post (new fees)
 **Net effect**: L1 fee changes reach L2 with a 2-slot delay and can update at most once
 every 5 slots.
 
+Because queued values only activate `LAG` slots later, the min fee for the next `LAG`
+slots is fully determined by current on-chain state. `fee_math.ts` ports the FeeLib
+formulas so the sequencer can predict min fees over that window (`FeePredictor` in
+`sequencer-client/src/global_variable_builder`), under a configurable mana-usage
+assumption (`ManaUsageEstimate`: none / target / limit).
+
 ### Worked Example
 
 Suppose the oracle is updated at slot 10 with new L1 fees. Here is the timeline:
@@ -117,34 +154,68 @@ Key observations:
 
 ## Fee Asset Price
 
-Fees are computed in ETH internally but converted to the fee asset (Fee Juice) via
-`ethPerFeeAsset` (1e12 precision). The price updates at most ±1% (±100 bps) per
-checkpoint:
+Fees are computed in ETH (wei) internally and converted to the fee asset (Fee Juice) via
+`ethPerFeeAsset` (1e12 precision), rounding up (`PriceLib.toFeeAsset` in
+`l1-contracts/src/core/libraries/compressed-data/fees/FeeConfig.sol`).
+
+Each checkpoint proposal carries a fee-asset price modifier (`OracleInput`) chosen by the
+proposer, bounded to ±1% (±100 bps) per checkpoint:
 
 ```
 newPrice = currentPrice * (10000 + modifierBps) / 10000
 ```
 
+The result is clamped to [`MIN_ETH_PER_FEE_ASSET` = 100, `MAX_ETH_PER_FEE_ASSET` = 1e14],
+i.e. 1e-10 to 100 ETH per fee asset. The floor of 100 guarantees a ±1% step always moves
+the integer price by at least 1.
+
+## Transaction Fees
+
+The checkpoint's `gasFees` (the L1-computed min fee per mana, with DA priced at zero) act
+as a base fee. Senders declare `GasSettings`: gas limits, teardown gas limits,
+`maxFeesPerGas`, and `maxPriorityFeesPerGas`. A tx is only includable if `maxFeesPerGas`
+covers the checkpoint's `gasFees` in both dimensions. The effective fee adds an
+EIP-1559-style priority fee on top of the base, capped by the max
+(`computeEffectiveGasFees` in `stdlib/src/fees/transaction_fee.ts`):
+
+```
+effectiveFeePerGas = gasFees + min(maxPriorityFeePerGas, maxFeesPerGas - gasFees)   (per dimension)
+transactionFee     = billedGas.daGas * effectiveFeePerDaGas + billedGas.l2Gas * effectiveFeePerL2Gas
+```
+
+`billedGas` is actual consumption except for the teardown phase, which is billed at the
+declared `teardownGasLimits` rather than actual usage — the fee is charged during teardown
+itself, before actual teardown consumption is known.
+
 ## Maximum Fee Change Rate
 
-| Component              | Bound                                                   |
-| ---------------------- | ------------------------------------------------------- |
-| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)            |
-| Fee asset price        | ±1% per checkpoint                                      |
+| Component              | Bound                                                    |
+| ---------------------- | -------------------------------------------------------- |
+| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)             |
+| Fee asset price        | ±1% per checkpoint                                       |
+| Proving cost per mana  | At most ×1.5 (or ÷1.5) per update, one update per 30 days |
 | Congestion multiplier  | Depends on excess mana accumulation/drain per checkpoint |
-| Sequencer/prover costs | Scale linearly with L1 fees                             |
+| Sequencer/prover costs | Scale linearly with L1 fees                              |
 
 ## Key Constants
 
-| Constant                       | Value          |
-| ------------------------------ | -------------- |
-| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000      |
-| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000    |
-| `BLOBS_PER_CHECKPOINT`          | 3            |
-| `BLOB_GAS_PER_BLOB`             | 2^17         |
-| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9          |
-| `LAG`                           | 2 slots      |
-| `LIFETIME`                      | 5 slots      |
+| Constant                        | Value          |
+| ------------------------------- | -------------- |
+| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000       |
+| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000      |
+| `BLOBS_PER_CHECKPOINT` (FeeLib) | 3              |
+| `BLOB_GAS_PER_BLOB`             | 2^17           |
+| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9            |
+| `LAG`                           | 2 slots        |
+| `LIFETIME`                      | 5 slots        |
+| `MIN_ETH_PER_FEE_ASSET`         | 100 (1e-10 ETH) |
+| `MAX_ETH_PER_FEE_ASSET`         | 1e14 (100 ETH) |
+
+⚠️ Name clash: `FeeLib.sol` (and its port `fee_math.ts`) defines `BLOBS_PER_CHECKPOINT = 3`,
+used only to price the sequencer's blob costs. The protocol constant of the same name in
+`@aztec/constants` is **6** — the actual blob capacity of a checkpoint, used throughout the
+limits section below. The FeeLib value is a holdover from the pre-checkpoint
+`BLOBS_PER_BLOCK`, so the fee model prices half of a full checkpoint's blobs.
 
 ## Gas and Data Limits
 
@@ -196,7 +267,7 @@ advertises them in `NodeInfo.txsLimits` (a required field); wallets read it and
 `GasSettings.fallback` as the default gas limits when sending without explicit limits, and they are enforced
 by `GasLimitsValidator` (clamped to the per-tx protocol maxima) at three points: RPC tx acceptance
 (`aztec-node/src/aztec-node/server.ts`), gossip validation (`p2p/src/services/libp2p/libp2p_service.ts`),
-and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at reqresp or
+and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at req/resp or
 block-proposal validation — admission is relay policy, not block validity.
 
 ### Per-block builder budgets
@@ -240,7 +311,8 @@ The outermost limits, enforced as proposal validity in `validateCheckpointLimits
 
 ## TypeScript Types
 
-- **`Gas`** — mana quantity in two dimensions (`daGas`, `l2Gas`).
+- **`Gas`** — gas quantity in two dimensions (`daGas`, `l2Gas`).
 - **`GasFees`** — per-unit price in each dimension (`feePerDaGas`, `feePerL2Gas`).
 - **`GasSettings`** — sender-chosen fee parameters: gas limits, teardown limits, max fees, priority fees.
 - **`GasUsed`** — actual consumption after execution. Note: `billedGas` uses the teardown gas *limit*, not actual usage.
+- **`fee_math.ts`** — TypeScript port of the FeeLib formulas, used for fee prediction over the oracle LAG window.

package/src/logs/shared_secret_derivation.ts

@@ -2,7 +2,7 @@ import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
 import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import type { Fr } from '@aztec/foundation/curves/bn254';
-import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
+import { GrumpkinScalar, type Point } from '@aztec/foundation/curves/grumpkin';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { PublicKey } from '../keys/public_key.js';
@@ -51,3 +51,20 @@ export async function appSiloEcdhSharedSecret(
 export function appSiloEcdhSharedSecretPoint(point: Point, app: AztecAddress): Promise<Fr> {
   return poseidon2HashWithSeparator([point.x, point.y, app], DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET);
 }
+
+/**
+ * Protects a handshake's shared secret from being forged by the recipient: `S' = hash(ephPk, recipientPoint) * S`.
+ *
+ * Mirrors aztec-nr's `protect_from_forgery` and must stay byte-compatible with it.
+ *
+ * @param secret - The raw shared secret `S` to protect.
+ * @param ephPk - The handshake's ephemeral public key.
+ * @param recipientPoint - The recipient's address point.
+ */
+export async function protectFromForgery(secret: Point, ephPk: Point, recipientPoint: Point): Promise<Point> {
+  const scalar = await poseidon2HashWithSeparator(
+    [ephPk.x, ephPk.y, recipientPoint.x, recipientPoint.y],
+    DomainSeparator.HANDSHAKE_FORGERY_PROTECTION,
+  );
+  return Grumpkin.mul(secret, new GrumpkinScalar(scalar.toBigInt()));
+}