@aztec/stdlib 6.0.0-nightly.20260723 → 6.0.0-nightly.20260724

package/dest/world-state/genesis_data.d.ts

@@ -1,8 +1,16 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
 import type { PublicDataTreeLeaf } from '../trees/index.js';
 /** Data used to initialize the genesis block, including prefilled public state and an optional timestamp. */
 export type GenesisData = {
     /** Public data tree leaves to pre-populate in the genesis state (e.g. fee juice balances). */
     prefilledPublicData: PublicDataTreeLeaf[];
+    /**
+     * Nullifiers to pre-insert into the genesis nullifier tree. Optional; defaults to an empty list, which leaves the
+     * nullifier tree at its canonical empty-genesis state so that production genesis roots are unchanged. When non-empty,
+     * the leaves must be unique and strictly increasing in field value (the native world state enforces this before
+     * construction). Test networks pass a non-empty list to seed e.g. standard-contract registration nullifiers.
+     */
+    prefilledNullifiers?: Fr[];
     /** Timestamp for the genesis block header. Defaults to 0 (canonical empty genesis) in production. */
     genesisTimestamp: bigint;
 };
@@ -10,4 +18,4 @@ export type GenesisData = {
 export declare const EMPTY_GENESIS_DATA: GenesisData;
 /** Returns if an object looks like genesis data */
 export declare function isGenesisData(obj: any): obj is GenesisData;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXNpc19kYXRhLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvd29ybGQtc3RhdGUvZ2VuZXNpc19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFFNUQsNkdBQTZHO0FBQzdHLE1BQU0sTUFBTSxXQUFXLEdBQUc7SUFDeEIsOEZBQThGO0lBQzlGLG1CQUFtQixFQUFFLGtCQUFrQixFQUFFLENBQUM7SUFDMUMscUdBQXFHO0lBQ3JHLGdCQUFnQixFQUFFLE1BQU0sQ0FBQztDQUMxQixDQUFDO0FBRUYsMEVBQTBFO0FBQzFFLGVBQU8sTUFBTSxrQkFBa0IsRUFBRSxXQUdoQyxDQUFDO0FBRUYsbURBQW1EO0FBQ25ELHdCQUFnQixhQUFhLENBQUMsR0FBRyxFQUFFLEdBQUcsR0FBRyxHQUFHLElBQUksV0FBVyxDQVMxRCJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2VuZXNpc19kYXRhLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvd29ybGQtc3RhdGUvZ2VuZXNpc19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLEVBQUUsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBRXpELE9BQU8sS0FBSyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFFNUQsNkdBQTZHO0FBQzdHLE1BQU0sTUFBTSxXQUFXLEdBQUc7SUFDeEIsOEZBQThGO0lBQzlGLG1CQUFtQixFQUFFLGtCQUFrQixFQUFFLENBQUM7SUFDMUM7Ozs7O09BS0c7SUFDSCxtQkFBbUIsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO0lBQzNCLHFHQUFxRztJQUNyRyxnQkFBZ0IsRUFBRSxNQUFNLENBQUM7Q0FDMUIsQ0FBQztBQUVGLDBFQUEwRTtBQUMxRSxlQUFPLE1BQU0sa0JBQWtCLEVBQUUsV0FJaEMsQ0FBQztBQUVGLG1EQUFtRDtBQUNuRCx3QkFBZ0IsYUFBYSxDQUFDLEdBQUcsRUFBRSxHQUFHLEdBQUcsR0FBRyxJQUFJLFdBQVcsQ0FTMUQifQ==

package/dest/world-state/genesis_data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"genesis_data.d.ts","sourceRoot":"","sources":["../../src/world-state/genesis_data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,6GAA6G;AAC7G,MAAM,MAAM,WAAW,GAAG;IACxB,8FAA8F;IAC9F,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,qGAAqG;IACrG,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,EAAE,WAGhC,CAAC;AAEF,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,WAAW,CAS1D"}
+{"version":3,"file":"genesis_data.d.ts","sourceRoot":"","sources":["../../src/world-state/genesis_data.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,6GAA6G;AAC7G,MAAM,MAAM,WAAW,GAAG;IACxB,8FAA8F;IAC9F,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC;IAC3B,qGAAqG;IACrG,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,EAAE,WAIhC,CAAC;AAEF,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,WAAW,CAS1D"}

package/dest/world-state/genesis_data.js

@@ -1,5 +1,6 @@
 /** An empty genesis data with no prefilled state and a zero timestamp. */ export const EMPTY_GENESIS_DATA = {
     prefilledPublicData: [],
+    prefilledNullifiers: [],
     genesisTimestamp: 0n
 };
 /** Returns if an object looks like genesis data */ export function isGenesisData(obj) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/stdlib",
-  "version": "6.0.0-nightly.20260723",
+  "version": "6.0.0-nightly.20260724",
   "type": "module",
   "inherits": [
     "../package.common.json",
@@ -92,13 +92,13 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.892.0",
-    "@aztec/bb.js": "6.0.0-nightly.20260723",
-    "@aztec/blob-lib": "6.0.0-nightly.20260723",
-    "@aztec/constants": "6.0.0-nightly.20260723",
-    "@aztec/ethereum": "6.0.0-nightly.20260723",
-    "@aztec/foundation": "6.0.0-nightly.20260723",
-    "@aztec/l1-artifacts": "6.0.0-nightly.20260723",
-    "@aztec/noir-noirc_abi": "6.0.0-nightly.20260723",
+    "@aztec/bb.js": "6.0.0-nightly.20260724",
+    "@aztec/blob-lib": "6.0.0-nightly.20260724",
+    "@aztec/constants": "6.0.0-nightly.20260724",
+    "@aztec/ethereum": "6.0.0-nightly.20260724",
+    "@aztec/foundation": "6.0.0-nightly.20260724",
+    "@aztec/l1-artifacts": "6.0.0-nightly.20260724",
+    "@aztec/noir-noirc_abi": "6.0.0-nightly.20260724",
     "@google-cloud/storage": "^7.15.0",
     "axios": "^1.15.1",
     "json-stringify-deterministic": "1.0.12",

package/src/abi/abi.ts

@@ -27,6 +27,14 @@ export type AbiValue =
   | IntegerValue
   | StructValue;
 
+/** An exported value together with the name of the global that produced it. */
+export interface AbiNamedValue {
+  /** The name of the exported global. */
+  name: string;
+  /** The exported value. */
+  value: AbiValue;
+}
+
 export const AbiValueSchema: z.ZodType<AbiValue> = z.discriminatedUnion('kind', [
   z.object({ kind: z.literal('boolean'), value: z.boolean() }),
   z.object({ kind: z.literal('string'), value: z.string() }),

package/src/abi/contract_artifact.ts

@@ -13,7 +13,9 @@ import {
   type ABIParameter,
   type ABIParameterVisibility,
   ARTIFACT_VERSION_BEFORE_INJECTION,
+  type AbiNamedValue,
   type AbiType,
+  type AbiValue,
   type BasicValue,
   type ContractArtifact,
   ContractArtifactSchema,
@@ -246,20 +248,24 @@ function hasKernelFunctionInputs(params: ABIParameter[]): boolean {
 
 /**
  * Generates a storage layout for the contract artifact.
- * @param input - The compiled noir contract to get storage layout for
+ * @param contractName - The name of the compiled Noir contract.
+ * @param globals - The normalized globals exported by the contract.
  * @returns A storage layout for the contract.
  */
-function getStorageLayout(input: NoirCompiledContract) {
+function getStorageLayout(contractName: string, globals: Record<string, AbiValue[]>) {
   // If another contract is imported by the main contract, its storage layout its going to also show up here.
   // The layout export includes the contract name, so here we can find the one that belongs to the current one and
   // ignore the rest.
-  const storageExports = input.outputs.globals.storage ? (input.outputs.globals.storage as StructValue[]) : [];
-  const storageForContract = storageExports.find(storageExport => {
+  const storageExports = globals.storage ?? [];
+  const storageForContract = storageExports.find((storageExport): storageExport is StructValue => {
+    if (storageExport.kind !== 'struct') {
+      return false;
+    }
     const contractNameField = storageExport.fields.find(field => field.name === 'contract_name')?.value as BasicValue<
       'string',
       string
     >;
-    return contractNameField.value === input.name;
+    return contractNameField.value === contractName;
   });
   const storageFields = storageForContract
     ? ((storageForContract.fields.find(field => field.name == 'fields') as TypedStructFieldValue<StructValue>).value
@@ -280,6 +286,22 @@ function getStorageLayout(input: NoirCompiledContract) {
   }, {});
 }
 
+function isAbiNamedValue(value: AbiNamedValue | AbiValue): value is AbiNamedValue {
+  return 'name' in value;
+}
+
+function normalizeContractOutputs(outputs: NoirCompiledContract['outputs']): ContractArtifact['outputs'] {
+  return {
+    structs: outputs.structs,
+    globals: Object.fromEntries(
+      Object.entries(outputs.globals).map(([tag, values]) => [
+        tag,
+        values.map(value => (isAbiNamedValue(value) ? value.value : value)),
+      ]),
+    ),
+  };
+}
+
 /**
  * Given a post-processed Nargo output defined as `contract` generates an Aztec-compatible contract artifact.
  *
@@ -290,6 +312,7 @@ function generateContractArtifact(contract: NoirCompiledContract): ContractArtif
     if (!contract.transpiled) {
       throw new Error("Contract's public bytecode has not been transpiled");
     }
+    const outputs = normalizeContractOutputs(contract.outputs);
     return ContractArtifactSchema.parse({
       name: contract.name,
       aztecVersion: contract.aztec_version,
@@ -297,8 +320,8 @@ function generateContractArtifact(contract: NoirCompiledContract): ContractArtif
       nonDispatchPublicFunctions: contract.functions
         .filter(f => !retainBytecode(f))
         .map(f => generateFunctionAbi(f, contract)),
-      outputs: contract.outputs,
-      storageLayout: getStorageLayout(contract),
+      outputs,
+      storageLayout: getStorageLayout(contract.name, outputs.globals),
       fileMap: contract.file_map,
     });
   } catch (err) {
@@ -313,6 +336,7 @@ function generateContractArtifact(contract: NoirCompiledContract): ContractArtif
  */
 function generateContractArtifactForPublic(contract: NoirCompiledContract): ContractArtifact {
   try {
+    const outputs = normalizeContractOutputs(contract.outputs);
     return ContractArtifactSchema.parse({
       name: contract.name,
       aztecVersion: contract.aztec_version,
@@ -320,8 +344,8 @@ function generateContractArtifactForPublic(contract: NoirCompiledContract): Cont
       nonDispatchPublicFunctions: contract.functions
         .filter(f => !retainBytecode(f))
         .map(f => generateFunctionAbi(f, contract)),
-      outputs: contract.outputs,
-      storageLayout: getStorageLayout(contract),
+      outputs,
+      storageLayout: getStorageLayout(contract.name, outputs.globals),
       fileMap: contract.file_map,
     });
   } catch (err) {

package/src/gas/README.md

@@ -1,47 +1,69 @@
 # Aztec Gas and Fee Model
 
 The minimum fee per mana and its components are computed on L1 in
-`l1-contracts/src/core/libraries/rollup/FeeLib.sol`. This document describes the
-formulas, the oracle lag/lifetime mechanism, and the TypeScript types in this directory.
+`l1-contracts/src/core/libraries/rollup/FeeLib.sol` (`fee_math.ts` in this directory is a
+TypeScript port of those formulas, used to predict fees a few slots ahead). This document
+describes the formulas, the oracle lag/lifetime mechanism, how a transaction's fee is
+derived from them, the gas and data limits, and the TypeScript types in this directory.
 
 ## Mana
 
-Aztec uses **mana** as its unit of work (analogous to Ethereum gas). Transactions consume
-mana in two dimensions: **DA** (data availability) and **L2** (execution). The total fee
-is `gasUsed * feePerMana` summed across both dimensions.
+Aztec meters work as gas in two dimensions: **DA** (data availability, i.e. blob data
+published to L1) and **L2** (execution). The L2 dimension is called **mana** (analogous to
+Ethereum gas): block headers track `totalManaUsed`, and the fee model below prices one unit
+of mana. The total fee is `gasUsed * feePerGas` summed across both dimensions.
+
+### The DA dimension is priced at zero
+
+Only the L2 dimension currently carries a price. When building checkpoint global variables,
+the sequencer sets `feePerDaGas = 0` and sets `feePerL2Gas` to the L1-computed minimum fee
+per mana (`sequencer-client/src/global_variable_builder/global_builder.ts` and
+`fee_provider.ts` in the same directory). The cost of publishing data is still recovered:
+the blob gas a checkpoint pays on L1 is part of the *sequencer cost* component of the mana
+fee below. DA gas remains fully metered and limited (see
+[Gas and Data Limits](#gas-and-data-limits)) — it bounds how much data a tx or checkpoint
+may publish — it just contributes nothing to the fee today.
 
 ## Fee Components
 
-The minimum fee per mana has four components:
+The minimum fee per mana has four components. All are computed in ETH (wei) per mana and
+converted to the fee asset at the end (see [Fee Asset Price](#fee-asset-price)).
 
 ### Sequencer Cost
 
 L1 cost to propose a checkpoint (calldata gas + blob data), amortized over `manaTarget`:
 
 ```
-sequencerCost = ((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
+sequencerCost = ceil(((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
               + (BLOBS_PER_CHECKPOINT * BLOB_GAS_PER_BLOB * blobFee))
-              / manaTarget
+              / manaTarget)
 ```
 
+Note that `BLOBS_PER_CHECKPOINT` here is FeeLib's own constant (3), not the protocol blob
+capacity of the same name (6) — see the note under [Key Constants](#key-constants).
+
 ### Prover Cost
 
 L1 cost to verify an epoch proof, amortized over epoch duration and `manaTarget`, plus a
 governance-set proving cost that compensates for off-chain proof generation:
 
 ```
-proverCost = (L1_GAS_PER_EPOCH_VERIFIED * baseFee / epochDuration) / manaTarget
+proverCost = ceil(ceil((L1_GAS_PER_EPOCH_VERIFIED * baseFee) / epochDuration) / manaTarget)
            + provingCostPerMana
 ```
 
+Updates to `provingCostPerMana` are rate-limited on L1 (`FeeLib.updateProvingCostPerMana`):
+at most one update every 30 days, each moving the value by at most ×1.5 (or ÷1.5), with a
+floor of 2 wei per mana.
+
 ### Congestion Cost
 
 An exponential surcharge when the network is congested (inspired by EIP-1559; the
 implementation uses the `fakeExponential` Taylor series approximation from EIP-4844):
 
 ```
-baseCost          = sequencerCost + proverCost
-congestionCost    = baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER - baseCost
+baseCost       = sequencerCost + proverCost
+congestionCost = floor(baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER) - baseCost
 ```
 
 When there is no congestion the multiplier equals `MINIMUM_CONGESTION_MULTIPLIER` (1e9)
@@ -50,11 +72,15 @@ and congestion cost is zero.
 ### Congestion Multiplier
 
 ```
-excessMana          = max(0, prevExcessMana + prevManaUsed - manaTarget)
-congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER, excessMana, denominator)
+excessMana           = max(0, prevExcessMana + prevManaUsed - manaTarget)
+denominator          = manaTarget * 854,700,854 / 1e8    ≈ 8.547 * manaTarget
+congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER,
+                                       min(excessMana, 100 * denominator), denominator)
 ```
 
-Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
+Each additional `manaTarget` of excess mana multiplies the fee by `e^(1/8.547) ≈ 1.124`,
+i.e. ~12.5%. The exponent is capped at 100 (multiplier ≤ ~2.7e43 × the minimum) to keep
+the Taylor series from overflowing.
 
 ### Total
 
@@ -62,6 +88,11 @@ Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
 minFeePerMana = sequencerCost + proverCost + congestionCost
 ```
 
+Each component is converted from ETH to the fee asset individually (rounding up) before
+summing. The sum is capped at `type(uint128).max` (`FeeLib.summedMinFee`) so it always fits
+the proposal header's `feePerL2Gas` field — without the cap, extreme congestion could
+produce a fee no valid header can represent, halting the chain.
+
 ## L1 Gas Oracle: Lag and Lifetime
 
 The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a two-phase
@@ -70,9 +101,9 @@ The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a t
 - **LAG = 2 slots** — when new L1 fees are observed, they activate `LAG` slots later
   (`slotOfChange = currentSlot + LAG`). This gives mempool transactions time to land
   before fees change.
-- **LIFETIME = 5 slots** — after an oracle update, the next update is rejected until
-  `slotOfChange + (LIFETIME - LAG)` = 3 more slots have passed. This rate-limits how
-  frequently L1 fee data can change.
+- **LIFETIME = 5 slots** — after an oracle update, further updates are ignored
+  (`updateL1GasFeeOracle` returns without effect) until `slotOfChange + (LIFETIME - LAG)`
+  = 3 more slots have passed. This rate-limits how frequently L1 fee data can change.
 
 Fee resolution at a given timestamp:
 
@@ -84,6 +115,12 @@ else                    →  use post (new fees)
 **Net effect**: L1 fee changes reach L2 with a 2-slot delay and can update at most once
 every 5 slots.
 
+Because queued values only activate `LAG` slots later, the min fee for the next `LAG`
+slots is fully determined by current on-chain state. `fee_math.ts` ports the FeeLib
+formulas so the sequencer can predict min fees over that window (`FeePredictor` in
+`sequencer-client/src/global_variable_builder`), under a configurable mana-usage
+assumption (`ManaUsageEstimate`: none / target / limit).
+
 ### Worked Example
 
 Suppose the oracle is updated at slot 10 with new L1 fees. Here is the timeline:
@@ -117,34 +154,68 @@ Key observations:
 
 ## Fee Asset Price
 
-Fees are computed in ETH internally but converted to the fee asset (Fee Juice) via
-`ethPerFeeAsset` (1e12 precision). The price updates at most ±1% (±100 bps) per
-checkpoint:
+Fees are computed in ETH (wei) internally and converted to the fee asset (Fee Juice) via
+`ethPerFeeAsset` (1e12 precision), rounding up (`PriceLib.toFeeAsset` in
+`l1-contracts/src/core/libraries/compressed-data/fees/FeeConfig.sol`).
+
+Each checkpoint proposal carries a fee-asset price modifier (`OracleInput`) chosen by the
+proposer, bounded to ±1% (±100 bps) per checkpoint:
 
 ```
 newPrice = currentPrice * (10000 + modifierBps) / 10000
 ```
 
+The result is clamped to [`MIN_ETH_PER_FEE_ASSET` = 100, `MAX_ETH_PER_FEE_ASSET` = 1e14],
+i.e. 1e-10 to 100 ETH per fee asset. The floor of 100 guarantees a ±1% step always moves
+the integer price by at least 1.
+
+## Transaction Fees
+
+The checkpoint's `gasFees` (the L1-computed min fee per mana, with DA priced at zero) act
+as a base fee. Senders declare `GasSettings`: gas limits, teardown gas limits,
+`maxFeesPerGas`, and `maxPriorityFeesPerGas`. A tx is only includable if `maxFeesPerGas`
+covers the checkpoint's `gasFees` in both dimensions. The effective fee adds an
+EIP-1559-style priority fee on top of the base, capped by the max
+(`computeEffectiveGasFees` in `stdlib/src/fees/transaction_fee.ts`):
+
+```
+effectiveFeePerGas = gasFees + min(maxPriorityFeePerGas, maxFeesPerGas - gasFees)   (per dimension)
+transactionFee     = billedGas.daGas * effectiveFeePerDaGas + billedGas.l2Gas * effectiveFeePerL2Gas
+```
+
+`billedGas` is actual consumption except for the teardown phase, which is billed at the
+declared `teardownGasLimits` rather than actual usage — the fee is charged during teardown
+itself, before actual teardown consumption is known.
+
 ## Maximum Fee Change Rate
 
-| Component              | Bound                                                   |
-| ---------------------- | ------------------------------------------------------- |
-| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)            |
-| Fee asset price        | ±1% per checkpoint                                      |
+| Component              | Bound                                                    |
+| ---------------------- | -------------------------------------------------------- |
+| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)             |
+| Fee asset price        | ±1% per checkpoint                                       |
+| Proving cost per mana  | At most ×1.5 (or ÷1.5) per update, one update per 30 days |
 | Congestion multiplier  | Depends on excess mana accumulation/drain per checkpoint |
-| Sequencer/prover costs | Scale linearly with L1 fees                             |
+| Sequencer/prover costs | Scale linearly with L1 fees                              |
 
 ## Key Constants
 
-| Constant                       | Value          |
-| ------------------------------ | -------------- |
-| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000      |
-| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000    |
-| `BLOBS_PER_CHECKPOINT`          | 3            |
-| `BLOB_GAS_PER_BLOB`             | 2^17         |
-| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9          |
-| `LAG`                           | 2 slots      |
-| `LIFETIME`                      | 5 slots      |
+| Constant                        | Value          |
+| ------------------------------- | -------------- |
+| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000       |
+| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000      |
+| `BLOBS_PER_CHECKPOINT` (FeeLib) | 3              |
+| `BLOB_GAS_PER_BLOB`             | 2^17           |
+| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9            |
+| `LAG`                           | 2 slots        |
+| `LIFETIME`                      | 5 slots        |
+| `MIN_ETH_PER_FEE_ASSET`         | 100 (1e-10 ETH) |
+| `MAX_ETH_PER_FEE_ASSET`         | 1e14 (100 ETH) |
+
+⚠️ Name clash: `FeeLib.sol` (and its port `fee_math.ts`) defines `BLOBS_PER_CHECKPOINT = 3`,
+used only to price the sequencer's blob costs. The protocol constant of the same name in
+`@aztec/constants` is **6** — the actual blob capacity of a checkpoint, used throughout the
+limits section below. The FeeLib value is a holdover from the pre-checkpoint
+`BLOBS_PER_BLOCK`, so the fee model prices half of a full checkpoint's blobs.
 
 ## Gas and Data Limits
 
@@ -196,7 +267,7 @@ advertises them in `NodeInfo.txsLimits` (a required field); wallets read it and
 `GasSettings.fallback` as the default gas limits when sending without explicit limits, and they are enforced
 by `GasLimitsValidator` (clamped to the per-tx protocol maxima) at three points: RPC tx acceptance
 (`aztec-node/src/aztec-node/server.ts`), gossip validation (`p2p/src/services/libp2p/libp2p_service.ts`),
-and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at reqresp or
+and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at req/resp or
 block-proposal validation — admission is relay policy, not block validity.
 
 ### Per-block builder budgets
@@ -240,7 +311,8 @@ The outermost limits, enforced as proposal validity in `validateCheckpointLimits
 
 ## TypeScript Types
 
-- **`Gas`** — mana quantity in two dimensions (`daGas`, `l2Gas`).
+- **`Gas`** — gas quantity in two dimensions (`daGas`, `l2Gas`).
 - **`GasFees`** — per-unit price in each dimension (`feePerDaGas`, `feePerL2Gas`).
 - **`GasSettings`** — sender-chosen fee parameters: gas limits, teardown limits, max fees, priority fees.
 - **`GasUsed`** — actual consumption after execution. Note: `billedGas` uses the teardown gas *limit*, not actual usage.
+- **`fee_math.ts`** — TypeScript port of the FeeLib formulas, used for fee prediction over the oracle LAG window.

package/src/hash/hash.ts

@@ -188,14 +188,6 @@ export function computeSecretHash(secret: Fr): Promise<Fr> {
   return poseidon2HashWithSeparator([secret], DomainSeparator.SECRET_HASH);
 }
 
-export async function computeL1ToL2MessageNullifier(contract: AztecAddress, messageHash: Fr, secret: Fr) {
-  const innerMessageNullifier = await poseidon2HashWithSeparator(
-    [messageHash, secret],
-    DomainSeparator.MESSAGE_NULLIFIER,
-  );
-  return siloNullifier(contract, innerMessageNullifier);
-}
-
 /**
  * Calculates a siloed hash of a scoped l2 to l1 message.
  * @returns Fr containing 248 bits of information of sha256 hash.

package/src/interfaces/archiver.ts

@@ -68,6 +68,13 @@ export type ArchiverSpecificConfig = {
 
   /** Skip pruning orphan proposed blocks that have no matching proposed checkpoint. */
   skipOrphanProposedBlockPruning?: boolean;
+
+  /**
+   * Preload the standard contracts (AuthRegistry, PublicChecks, HandshakeRegistry) into the contract store at block 0.
+   * For test environments only: it must only be set when genesis also seeds the matching registration/deployment
+   * nullifiers, otherwise a later on-chain publish of a preloaded class would collide with the block-0 preload.
+   */
+  testPreloadStandardContracts?: boolean;
 };
 
 export const ArchiverSpecificConfigSchema = z.object({
@@ -82,6 +89,7 @@ export const ArchiverSpecificConfigSchema = z.object({
   skipPromoteProposedCheckpointDuringL1Sync: z.boolean().optional(),
   orphanPruneNoProposalTolerance: schemas.Integer.optional(),
   skipOrphanProposedBlockPruning: z.boolean().optional(),
+  testPreloadStandardContracts: z.boolean().optional(),
 });
 
 export type ArchiverApi = Omit<

package/src/logs/app_tagging_secret.ts

@@ -89,29 +89,20 @@ export class AppTaggingSecret {
   }
 
   toString(): string {
-    // TODO(F-680): Migrate stored tagging keys and remove the legacy unconstrained format.
-    if (this.kind === AppTaggingSecretKind.UNCONSTRAINED) {
-      return `${this.secret.toString()}:${this.app.toString()}`;
-    }
     return `${this.kind}:${this.secret.toString()}:${this.app.toString()}`;
   }
 
   static fromString(str: string): AppTaggingSecret {
     const parts = str.split(':');
-    if (parts.length === 2) {
-      // TODO(F-680): Remove legacy two-part parsing after stored tagging keys are migrated.
-      const [secretStr, appStr] = parts;
-      return new AppTaggingSecret(Fr.fromString(secretStr), AztecAddress.fromStringUnsafe(appStr));
-    }
-    if (parts.length === 3) {
-      const [kindStr, secretStr, appStr] = parts;
-      return new AppTaggingSecret(
-        Fr.fromString(secretStr),
-        AztecAddress.fromStringUnsafe(appStr),
-        appTaggingSecretKindFromString(kindStr),
-      );
+    if (parts.length !== 3) {
+      throw new Error(`Invalid AppTaggingSecret string: ${str}`);
     }
-    throw new Error(`Invalid AppTaggingSecret string: ${str}`);
+    const [kindStr, secretStr, appStr] = parts;
+    return new AppTaggingSecret(
+      Fr.fromString(secretStr),
+      AztecAddress.fromStringUnsafe(appStr),
+      appTaggingSecretKindFromString(kindStr),
+    );
   }
 }
 

package/src/logs/shared_secret_derivation.ts

@@ -2,7 +2,7 @@ import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
 import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import type { Fr } from '@aztec/foundation/curves/bn254';
-import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
+import { GrumpkinScalar, type Point } from '@aztec/foundation/curves/grumpkin';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { PublicKey } from '../keys/public_key.js';
@@ -51,3 +51,20 @@ export async function appSiloEcdhSharedSecret(
 export function appSiloEcdhSharedSecretPoint(point: Point, app: AztecAddress): Promise<Fr> {
   return poseidon2HashWithSeparator([point.x, point.y, app], DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET);
 }
+
+/**
+ * Protects a handshake's shared secret from being forged by the recipient: `S' = hash(ephPk, recipientPoint) * S`.
+ *
+ * Mirrors aztec-nr's `protect_from_forgery` and must stay byte-compatible with it.
+ *
+ * @param secret - The raw shared secret `S` to protect.
+ * @param ephPk - The handshake's ephemeral public key.
+ * @param recipientPoint - The recipient's address point.
+ */
+export async function protectFromForgery(secret: Point, ephPk: Point, recipientPoint: Point): Promise<Point> {
+  const scalar = await poseidon2HashWithSeparator(
+    [ephPk.x, ephPk.y, recipientPoint.x, recipientPoint.y],
+    DomainSeparator.HANDSHAKE_FORGERY_PROTECTION,
+  );
+  return Grumpkin.mul(secret, new GrumpkinScalar(scalar.toBigInt()));
+}

package/src/messaging/l1_to_l2_message.ts

@@ -1,4 +1,5 @@
-import type { L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { DomainSeparator, type L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { sha256ToField } from '@aztec/foundation/crypto/sha256';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
@@ -7,7 +8,7 @@ import { SiblingPath } from '@aztec/foundation/trees';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { BlockParameter } from '../block/block_parameter.js';
-import { computeL1ToL2MessageNullifier } from '../hash/hash.js';
+import { siloNullifier } from '../hash/hash.js';
 import type { AztecNode } from '../interfaces/aztec-node.js';
 import { MerkleTreeId } from '../trees/merkle_tree_id.js';
 import { L1Actor } from './l1_actor.js';
@@ -74,28 +75,65 @@ export class L1ToL2Message {
   }
 }
 
-// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
-export async function getNonNullifiedL1ToL2MessageWitness(
+/**
+ * The unsiloed nullifier a message consumer derives, together with the contract address needed to silo it.
+ */
+export interface UnsiloedMessageNullifier {
+  contractAddress: AztecAddress;
+  nullifier: Fr;
+}
+
+/**
+ * Computes the unsiloed nullifier that the fee juice contract (and any consumer following the same scheme) derives when
+ * consuming an L1 to L2 message.
+ *
+ * This is not a general-purpose utility: other contracts may derive the secret hash and hence the nullifier
+ * differently. The result is unsiloed — callers silo it (with the consuming contract's address) before looking it up
+ * in the nullifier tree.
+ */
+export function computeFeeJuiceMessageNullifier(messageHash: Fr, secret: Fr): Promise<Fr> {
+  return poseidon2HashWithSeparator([messageHash, secret], DomainSeparator.MESSAGE_NULLIFIER);
+}
+
+/**
+ * Fetches the membership witness of an L1 to L2 message. When `unsiloedNullifier` is provided, the message is
+ * additionally required to be un-nullified.
+ */
+export async function getL1ToL2MessageWitness(
   node: AztecNode,
-  contractAddress: AztecAddress,
   messageHash: Fr,
-  secret: Fr,
+  unsiloedNullifier?: UnsiloedMessageNullifier,
   referenceBlock: BlockParameter = 'latest',
 ): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
-  const messageNullifier = await computeL1ToL2MessageNullifier(contractAddress, messageHash, secret);
-
-  const [l1ToL2Response, nullifierResponse] = await Promise.all([
-    node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash),
-    node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [messageNullifier]),
-  ]);
+  // Both requests are dispatched before awaiting so they run concurrently.
+  const l1ToL2ResponsePromise = node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash);
+  const nullifierResponsePromise = unsiloedNullifier
+    ? siloNullifier(unsiloedNullifier.contractAddress, unsiloedNullifier.nullifier).then(siloed =>
+        node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [siloed]),
+      )
+    : undefined;
 
+  const l1ToL2Response = await l1ToL2ResponsePromise;
   if (!l1ToL2Response) {
     throw new Error(`No L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
-  if (nullifierResponse[0] !== undefined) {
+  const nullifierResponse = await nullifierResponsePromise;
+  if (nullifierResponse?.[0] !== undefined) {
     throw new Error(`No non-nullified L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
   return l1ToL2Response;
 }
+
+// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
+export async function getNonNullifiedL1ToL2MessageWitness(
+  node: AztecNode,
+  contractAddress: AztecAddress,
+  messageHash: Fr,
+  secret: Fr,
+  referenceBlock: BlockParameter = 'latest',
+): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
+  const nullifier = await computeFeeJuiceMessageNullifier(messageHash, secret);
+  return getL1ToL2MessageWitness(node, messageHash, { contractAddress, nullifier }, referenceBlock);
+}

package/src/noir/index.ts

@@ -2,6 +2,7 @@ import type {
   ABIParameter,
   ABIParameterVisibility,
   AbiErrorType,
+  AbiNamedValue,
   AbiType,
   AbiValue,
   DebugFileMap,
@@ -73,7 +74,7 @@ export interface NoirCompiledContract {
   /** The events of the contract */
   outputs: {
     structs: Record<string, AbiType[]>;
-    globals: Record<string, AbiValue[]>;
+    globals: Record<string, (AbiNamedValue | AbiValue)[]>;
   };
   /** The map of file ID to the source code and path of the file. */
   file_map: DebugFileMap;