@aztec/stdlib 6.0.0-nightly.20260810 → 6.0.0-nightly.20260821

package/src/block/l2_block_stream/event_driven_l2_block_stream.ts

@@ -1,156 +1,51 @@
-import { type Logger, createLogger } from '@aztec/foundation/log';
+import { createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
 
-import type { BlockData } from '../block_data.js';
-import type { L2Block } from '../l2_block.js';
 import {
   type ArchiverEmitter,
-  type BlockQuery,
-  type BlocksQuery,
   type L2BlockSource,
   type L2BlockSourceEventEmitter,
   L2BlockSourceEvents,
-  type L2BlockSourceUpdatedEvent,
-  type L2Tips,
 } from '../l2_block_source.js';
-import { type L2BlockStreamEventHandler, type L2BlockStreamLocalDataProvider, localTipsMatch } from './interfaces.js';
-import { L2BlockStream, type L2BlockStreamOptions, type L2BlockStreamSource } from './l2_block_stream.js';
-
-/** Derives the metadata-only {@link BlockData} view of a hydrated {@link L2Block}. */
-async function l2BlockToBlockData(block: L2Block): Promise<BlockData> {
-  return {
-    header: block.header,
-    archive: block.archive,
-    blockHash: await block.hash(),
-    checkpointNumber: block.checkpointNumber,
-    indexWithinCheckpoint: block.indexWithinCheckpoint,
-  };
-}
+import type { L2BlockStreamEventHandler, L2BlockStreamLocalDataProvider } from './interfaces.js';
+import { L2BlockStream, type L2BlockStreamOptions } from './l2_block_stream.js';
 
 /** Returns the event emitter of a source that exposes one, or undefined for plain (e.g. RPC-backed) sources. */
 function getEmitter(source: L2BlockSource | L2BlockSourceEventEmitter): ArchiverEmitter | undefined {
   return 'events' in source ? source.events : undefined;
 }
 
-/** Fast-path context for a single sync pass: blocks to serve by number, plus the tips to report as the source's. */
-type ActiveUpdate = { byNumber: Map<number, L2Block>; toTips: L2Tips };
-
-/**
- * Wraps a block source so a single sync pass can be served from blocks delivered by an aggregate update event,
- * avoiding round-trips to archiver storage. The fast path is only armed (via {@link activate}) for a pass that is
- * confirmed caught up to the event's pre-pass tips: in that case the event's `blocksAdded` contiguously cover the
- * pass's download range and `toTips` is the exact post-pass tip, so `getL2Tips` can report it without querying the
- * source. When the fast path is not armed, every read delegates to the source, so a stale or partial cache never
- * changes the sync outcome.
- */
-class HotBlockSourceAdapter implements L2BlockStreamSource {
-  /** Set for the duration of one fast-path pass; undefined when reads must delegate to the source. */
-  private active: ActiveUpdate | undefined;
-
-  constructor(
-    private readonly source: L2BlockStreamSource,
-    private readonly log: Logger,
-  ) {}
-
-  /** Arms the fast path for the current pass: serve these blocks and report `toTips` as the source tips. */
-  public activate(blocks: readonly L2Block[], toTips: L2Tips): void {
-    const byNumber = new Map<number, L2Block>();
-    for (const block of blocks) {
-      byNumber.set(block.number, block);
-    }
-    this.active = { byNumber, toTips };
-    this.log.trace(`Armed hot-block fast path`, { blocks: byNumber.size, toTips });
-  }
-
-  /** Disarms the fast path so subsequent reads delegate to the source again. */
-  public deactivate(): void {
-    this.active = undefined;
-  }
-
-  public getL2Tips(): Promise<L2Tips> {
-    return this.active ? Promise.resolve(this.active.toTips) : this.source.getL2Tips();
-  }
-
-  public getBlocks(query: BlocksQuery): Promise<L2Block[]> {
-    const served = this.active ? this.tryServeBlocksFromCache(query) : undefined;
-    return served ? Promise.resolve(served) : this.source.getBlocks(query);
-  }
-
-  public getBlockData(query: BlockQuery): Promise<BlockData | undefined> {
-    if (this.active && 'number' in query) {
-      const block = this.active.byNumber.get(query.number);
-      if (block) {
-        return l2BlockToBlockData(block);
-      }
-    }
-    return this.source.getBlockData(query);
-  }
-
-  /** Serves a block range from the cache only when it is fully covered by contiguous cached blocks. */
-  private tryServeBlocksFromCache(query: BlocksQuery): L2Block[] | undefined {
-    // Only the by-range form is cacheable, and only for the full (not checkpointed-only) chain: the cache may hold
-    // uncheckpointed blocks that an onlyCheckpointed query must not receive.
-    if (!this.active || !('from' in query) || query.onlyCheckpointed) {
-      return undefined;
-    }
-    const from = query.from;
-    const to = from + query.limit - 1;
-    const blocks: L2Block[] = [];
-    for (let n = from; n <= to; n++) {
-      const block = this.active.byNumber.get(n);
-      if (!block) {
-        // A gap inside the requested range: bail out and let the source serve the whole range.
-        return undefined;
-      }
-      blocks.push(block);
-    }
-    return blocks;
-  }
-}
-
 /**
  * Event-driven wrapper around {@link L2BlockStream}. Subscribes to the source's aggregate `l2BlockSourceUpdated`
- * event (when the source exposes one) to trigger an immediate reconciliation, while keeping the periodic poll as
- * the correctness fallback. Subsystems keep consuming the same {@link L2BlockStreamEvent}s; the archiver aggregate
- * event is handled entirely here.
- *
- * The event is passed through to the sync pass via {@link RunningPromise.trigger}. If, at the time the pass runs,
- * the stream's local tips match the event's `fromTips` (it is caught up to where the event began), the event's
- * hydrated blocks are served back through a hot-block cache and the event's `toTips` is reported as the source tips
- * — so the triggered sync re-reads neither block bodies nor tips from the archiver. Otherwise the pass delegates
- * entirely to the source, and the periodic poll guarantees eventual catch-up.
+ * event (when the source exposes one) and uses it purely as a doorbell: each event triggers an immediate
+ * reconciliation pass instead of waiting for the next tick, while the periodic poll remains the correctness
+ * fallback. Every pass reads tips and blocks authoritatively from the source, so a missed, stale, or duplicated
+ * event only affects latency. Subsystems keep consuming the same {@link L2BlockStreamEvent}s; the archiver
+ * aggregate event is handled entirely here.
  */
 export class EventDrivenL2BlockStream {
-  private readonly adapter: HotBlockSourceAdapter;
   private readonly blockStream: L2BlockStream;
-  private readonly runningPromise: RunningPromise<L2BlockSourceUpdatedEvent>;
+  private readonly runningPromise: RunningPromise;
   private readonly emitter: ArchiverEmitter | undefined;
   private started = false;
 
-  private readonly onSourceUpdated = (event: L2BlockSourceUpdatedEvent) => {
+  private readonly onSourceUpdated = () => {
     // Fire-and-forget: trigger coalesces with any in-flight or periodic pass (see RunningPromise.trigger), so a
     // burst of events does not run passes concurrently. Errors are swallowed by the inner stream's own handler.
-    void this.runningPromise
-      .trigger(event)
-      .catch(err => this.log.error(`Error in event-triggered block stream sync`, err));
+    void this.runningPromise.trigger().catch(err => this.log.error(`Error in event-triggered block stream sync`, err));
   };
 
   constructor(
     source: L2BlockSource | L2BlockSourceEventEmitter,
-    private readonly localData: L2BlockStreamLocalDataProvider,
+    localData: L2BlockStreamLocalDataProvider,
     handler: L2BlockStreamEventHandler,
     private readonly log = createLogger('types:event_driven_block_stream'),
     opts: L2BlockStreamOptions = {},
   ) {
-    this.adapter = new HotBlockSourceAdapter(source, log);
     // The inner stream's own RunningPromise is never started; this wrapper owns the polling loop and drives the
     // stream through `sync()` (which runs `work()` directly when the inner loop is stopped).
-    this.blockStream = new L2BlockStream(this.adapter, localData, handler, log, opts);
-    this.runningPromise = new RunningPromise<L2BlockSourceUpdatedEvent>(
-      this.runPass.bind(this),
-      log,
-      opts.pollIntervalMS ?? 1000,
-    );
+    this.blockStream = new L2BlockStream(source, localData, handler, log, opts);
+    this.runningPromise = new RunningPromise(() => this.blockStream.sync(), log, opts.pollIntervalMS ?? 1000);
     this.emitter = getEmitter(source);
   }
 
@@ -176,32 +71,11 @@ export class EventDrivenL2BlockStream {
   }
 
   /**
-   * Runs a synchronization pass now, bypassing the poll interval, and resolves once that pass completes. Concurrent
-   * callers and periodic ticks coalesce onto a single pass; a caller that coalesces onto an already in-flight pass
-   * can resolve against a pass that began just before it, so this guarantees freshness only up to that coalescing
-   * window. The periodic poll and per-pass reorg handling make the gap a latency effect, never a correctness one.
+   * Runs a synchronization pass now, bypassing the poll interval. Resolves once a pass that started after this call
+   * completes, so the caller observes state at least as fresh as the moment it asked. Concurrent callers coalesce
+   * onto a single such pass. Rejects if the stream is stopped before that pass runs.
    */
   public sync(): Promise<void> {
     return this.runningPromise.trigger();
   }
-
-  /**
-   * Runs a single pass over the underlying block stream. When triggered by an aggregate event and the stream is
-   * caught up to the event's pre-pass tips, the event's blocks and tips serve the pass directly; the fast path is
-   * always disarmed afterwards so a subsequent poll-driven pass reads from the source.
-   */
-  private async runPass(event?: L2BlockSourceUpdatedEvent): Promise<void> {
-    if (event) {
-      const localTips = await this.localData.getL2Tips();
-      if (localTipsMatch(localTips, event.fromTips)) {
-        this.adapter.activate(event.blocksAdded, event.toTips);
-      }
-    }
-
-    try {
-      await this.blockStream.sync();
-    } finally {
-      this.adapter.deactivate();
-    }
-  }
 }

package/src/checkpoint/checkpoint_data.ts

@@ -42,6 +42,18 @@ export type ProposedOnlyCheckpointData = {
   feeAssetPriceModifier: bigint;
 };
 
+/** Inbox consumption record of a proposed checkpoint, mirroring what `propose` writes for it on L1. */
+export type ProposedInboxConsumption = {
+  /**
+   * Cumulative Inbox message count consumed as of this checkpoint: its last block's L1-to-L2 message tree leaf count
+   * under compact indexing. L1 records this per checkpoint and reads it back as the parent total
+   * when validating the next checkpoint's consumption, so a simulation against a not-yet-mined parent must override
+   * the parent's cell with it — otherwise the parent reads as having consumed nothing and the child's consumption
+   * looks larger than it is.
+   */
+  inboxMsgTotal: bigint;
+};
+
 /** Lightweight checkpoint metadata without full block data. */
 export type CheckpointData = CommonCheckpointData & StorageEnrichedCheckpointData & L1EnrichedCheckpointData;
 
@@ -51,7 +63,7 @@ export type ProposedCheckpointInput = CommonCheckpointData & ProposedOnlyCheckpo
 
 /** Full data for a proposed checkpoint (proposed but not yet L1-confirmed).
  *  Includes fee-relevant fields used during pipelining to compute the fee header override. */
-export type ProposedCheckpointData = ProposedCheckpointInput & StorageEnrichedCheckpointData;
+export type ProposedCheckpointData = ProposedCheckpointInput & StorageEnrichedCheckpointData & ProposedInboxConsumption;
 
 export const ProposedCheckpointDataSchema = z.object({
   checkpointNumber: CheckpointNumberSchema,
@@ -62,6 +74,7 @@ export const ProposedCheckpointDataSchema = z.object({
   blockCount: z.number(),
   totalManaUsed: schemas.BigInt,
   feeAssetPriceModifier: schemas.BigInt,
+  inboxMsgTotal: schemas.BigInt,
 });
 
 export const CheckpointDataSchema = z

package/src/checkpoint/index.ts

@@ -3,6 +3,7 @@ export * from './checkpoint_data.js';
 export * from './checkpoint_info.js';
 export * from './checkpoint_reexecution_tracker.js';
 export * from './digest.js';
+export * from './previous_checkpoint_inbox_rolling_hash.js';
 export * from './previous_checkpoint_out_hashes.js';
 export * from './published_checkpoint.js';
 export * from './simulation_overrides.js';

package/src/checkpoint/previous_checkpoint_inbox_rolling_hash.ts

@@ -0,0 +1,46 @@
+import { CheckpointNumber } from '@aztec/foundation/branded-types';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { Logger } from '@aztec/foundation/log';
+
+import type { L2BlockSource } from '../block/l2_block_source.js';
+import type { ProposedCheckpointData } from './checkpoint_data.js';
+
+/**
+ * Returns the inbox rolling hash chain-start for `checkpointNumber`: the `inboxRollingHash` of the immediately
+ * preceding checkpoint. Unlike the epoch out-hash tree, the rolling-hash chain is continuous across epoch boundaries,
+ * so the parent is always `checkpointNumber - 1` regardless of epoch. The genesis checkpoint (and the first checkpoint
+ * built on it) starts the chain at zero.
+ *
+ * Under proposer pipelining the parent may not be confirmed on L1 yet, so the locally-known proposed checkpoint is
+ * preferred when it is the parent, mirroring `getPreviousCheckpointOutHashes`.
+ */
+export async function getPreviousCheckpointInboxRollingHash(input: {
+  blockSource: Pick<L2BlockSource, 'getCheckpointData' | 'getProposedCheckpointData'>;
+  checkpointNumber: CheckpointNumber;
+  proposedCheckpointData?: ProposedCheckpointData;
+  log?: Logger;
+}): Promise<Fr> {
+  const { blockSource, checkpointNumber, proposedCheckpointData, log } = input;
+  if (checkpointNumber <= 1) {
+    return Fr.ZERO;
+  }
+
+  const parent = CheckpointNumber(checkpointNumber - 1);
+
+  if (proposedCheckpointData?.checkpointNumber === parent) {
+    log?.debug(`Using pipelined parent cp ${parent} inbox rolling hash for cp ${checkpointNumber}`);
+    return proposedCheckpointData.header.inboxRollingHash;
+  }
+
+  const confirmed = await blockSource.getCheckpointData({ number: parent });
+  if (confirmed) {
+    return confirmed.header.inboxRollingHash;
+  }
+
+  const proposed = await blockSource.getProposedCheckpointData({ number: parent });
+  if (proposed) {
+    return proposed.header.inboxRollingHash;
+  }
+
+  throw new Error(`Cannot source inbox rolling hash for parent checkpoint ${parent} of checkpoint ${checkpointNumber}`);
+}

package/src/checkpoint/simulation_overrides.ts

@@ -45,7 +45,7 @@ type CheckpointSimulationOverridesPlanInput = {
 /**
  * Builds the SimulationOverridesPlan describing the simulated L1 rollup state for a checkpoint's
  * enqueue-time simulations: `canProposeAt` (in Sequencer.doWork) and the propose-related sims
- * (validateBlockHeader, simulateProposeTx). The plan reflects "as if our pipelined parent
+ * (validateCheckpointHeader, simulateProposeTx). The plan reflects "as if our pipelined parent
  * checkpoint has landed and any required invalidation has executed" — the gap that needs to be
  * bridged at enqueue time.
  *
@@ -73,21 +73,24 @@ export async function buildCheckpointSimulationOverridesPlan(
   builder.withChainTips({ pending: overridenChainTip, proven: overridenChainTip });
 
   if (input.proposedCheckpointData) {
-    const { header, archive, checkpointOutHash, feeAssetPriceModifier } = input.proposedCheckpointData;
+    const { header, archive, checkpointOutHash, feeAssetPriceModifier, inboxMsgTotal } = input.proposedCheckpointData;
     builder.withPendingArchive(archive.root);
     // Override every locally-derivable `tempCheckpointLogs[parent]` field that L1 will eventually
-    // write. `slotNumber` is load-bearing for `STFLib.canPruneAtTime`: without it the cell reads
+    // write. `slotNumber` is required by `STFLib.canPruneAtTime`: without it the cell reads
     // slotNumber 0, the contract treats the pending tip as belonging to an expired epoch, and
     // `getEffectivePendingCheckpointNumber` silently collapses pending back to proven — producing
-    // a spurious `Rollup__InvalidArchive` against the on-chain genesis archive. The other fields
-    // (headerHash, outHash, payloadDigest) are not strictly load-bearing for `canProposeAt` /
-    // `validateBlockHeader`, but mirroring the full cell keeps the simulation byte-faithful with
-    // what the actual `propose()` send will observe, which is a defense against future reads
-    // taking dependencies on them.
+    // a spurious `Rollup__InvalidArchive` against the on-chain genesis archive. `inboxMsgTotal` is
+    // read by `ProposeLib.validateInboxConsumption` as the parent's consumed total: left at zero it
+    // makes our consumption look like the Inbox's entire history and trips
+    // `Rollup__TooManyInboxMessagesConsumed`. The remaining fields (headerHash, outHash,
+    // payloadDigest) are not read by `canProposeAt` / `validateCheckpointHeader`, but mirroring the full
+    // cell keeps the simulation byte-faithful with what the actual `propose()` send will observe,
+    // which is a defense against future reads taking dependencies on them.
     builder.withPendingTempCheckpointLogFields({
       headerHash: header.hash(),
       outHash: checkpointOutHash,
       slotNumber: header.slotNumber,
+      inboxMsgTotal,
       payloadDigest: computeCheckpointPayloadDigest({
         header,
         archiveRoot: archive.root,

package/src/config/network-consensus-config.ts

@@ -1,7 +1,9 @@
 import { type L1ContractsConfig, l1ContractsConfigMappings, validateSlotDurations } from '@aztec/ethereum/config';
 import { type EnvVar, pickConfigMappings } from '@aztec/foundation/config';
 
+import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT } from '../deserialization/index.js';
 import type { SequencerConfig } from '../interfaces/configs.js';
+import { MIN_BLOCKS_FOR_INBOX_CATCHUP } from '../messaging/inbox_consumption.js';
 import {
   DEFAULT_CHECKPOINT_PROPOSAL_INIT_TIME,
   DEFAULT_CHECKPOINT_PROPOSAL_PREPARE_TIME,
@@ -47,7 +49,6 @@ export const NETWORK_CONSENSUS_ENV_VARS = [
   'AZTEC_EJECTION_THRESHOLD',
   'AZTEC_LOCAL_EJECTION_THRESHOLD',
   'AZTEC_EXIT_DELAY_SECONDS',
-  'AZTEC_INBOX_LAG',
   'AZTEC_PROOF_SUBMISSION_EPOCHS',
   'AZTEC_MANA_TARGET',
   'AZTEC_PROVING_COST_PER_MANA',
@@ -142,7 +143,8 @@ export function getConsensusConfigFromNetworkEnv(
  * The check requires `maxBlocksPerCheckpoint` to be *exactly* what a {@link ProposerTimetable} built from the
  * same slot timings and the production default budgets derives. This exact-equality requirement ensures the
  * published network value is precisely what the production default budgets produce, so every node running those
- * defaults agrees on the per-checkpoint block count without clamping.
+ * defaults agrees on the per-checkpoint block count without clamping. It must also be at least
+ * {@link MIN_BLOCKS_FOR_INBOX_CATCHUP}, without which the network is permanently haltable.
  */
 export function validateNetworkConsensusConfig(config: NetworkConsensusConfig): string[] {
   const errors: string[] = [];
@@ -165,8 +167,19 @@ export function validateNetworkConsensusConfig(config: NetworkConsensusConfig):
       `blockDurationMs (${config.blockDurationMs}ms) exceeds aztecSlotDuration (${config.aztecSlotDuration}s)`,
     );
   }
-  if (config.maxBlocksPerCheckpoint < 1) {
-    errors.push(`maxBlocksPerCheckpoint must be at least 1 (got ${config.maxBlocksPerCheckpoint})`);
+  if (config.maxBlocksPerCheckpoint < MIN_BLOCKS_FOR_INBOX_CATCHUP) {
+    errors.push(
+      `maxBlocksPerCheckpoint must be at least ${MIN_BLOCKS_FOR_INBOX_CATCHUP} so a checkpoint can always clear a ` +
+        `mandatory streaming-Inbox backlog (got ${config.maxBlocksPerCheckpoint}); lower the block duration or raise ` +
+        `the slot duration so the proposer budgets derive at least that many blocks`,
+    );
+  }
+  if (config.maxBlocksPerCheckpoint > MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT) {
+    errors.push(
+      `maxBlocksPerCheckpoint (${config.maxBlocksPerCheckpoint}) exceeds the ` +
+        `${MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT} blocks nodes will build or attest to, so the network would ` +
+        `reject block indices its own configuration admits`,
+    );
   }
   if (config.checkpointProposalSyncGraceSeconds < 0) {
     errors.push(

package/src/config/node-rpc-config.ts

@@ -1,7 +1,13 @@
-import { type ConfigMappingsType, numberConfigHelper } from '@aztec/foundation/config';
+import { type ConfigMappingsType, booleanConfigHelper, numberConfigHelper } from '@aztec/foundation/config';
 
 import { DEFAULT_MAX_DEBUG_LOG_MEMORY_READS } from '../avm/avm.js';
 
+const parseCommaSeparatedList = (value: string) =>
+  value
+    .split(',')
+    .map(item => item.trim())
+    .filter(Boolean);
+
 export const nodeRpcConfigMappings: ConfigMappingsType<NodeRPCConfig> = {
   rpcSimulatePublicMaxGasLimit: {
     env: 'RPC_SIMULATE_PUBLIC_MAX_GAS_LIMIT',
@@ -24,6 +30,33 @@ export const nodeRpcConfigMappings: ConfigMappingsType<NodeRPCConfig> = {
     description: 'Maximum allowed batch size for JSON RPC batch requests.',
     defaultValue: '1mb',
   },
+  rpcHttpKeepAliveTimeoutMs: {
+    env: 'RPC_HTTP_KEEP_ALIVE_TIMEOUT_MS',
+    description: 'HTTP keep-alive timeout for JSON RPC connections in milliseconds.',
+    ...numberConfigHelper(5_000),
+  },
+  rpcHttpHeadersTimeoutMs: {
+    env: 'RPC_HTTP_HEADERS_TIMEOUT_MS',
+    description: 'Timeout for receiving complete HTTP headers on JSON RPC connections in milliseconds.',
+    ...numberConfigHelper(60_000),
+  },
+  rpcCorsAllowedOrigins: {
+    env: 'RPC_CORS_ALLOWED_ORIGINS',
+    description: 'Origins allowed to make credentialed cross-origin JSON RPC requests, separated by commas.',
+    parseEnv: parseCommaSeparatedList,
+    defaultValue: [],
+  },
+  rpcCorsAllowedHeaders: {
+    env: 'RPC_CORS_ALLOWED_HEADERS',
+    description: 'Headers allowed in cross-origin JSON RPC requests, separated by commas.',
+    parseEnv: parseCommaSeparatedList,
+    defaultValue: [],
+  },
+  rpcCorsAllowAnyOrigin: {
+    env: 'RPC_CORS_ALLOW_ANY_ORIGIN',
+    description: 'Allow credentialed cross-origin JSON RPC requests from any origin.',
+    ...booleanConfigHelper(false),
+  },
 };
 
 export type NodeRPCConfig = {
@@ -35,4 +68,21 @@ export type NodeRPCConfig = {
   rpcMaxBatchSize: number;
   /** The maximum body size the RPC server will accept */
   rpcMaxBodySize: string;
+  /** HTTP keep-alive timeout for JSON RPC connections in milliseconds. */
+  rpcHttpKeepAliveTimeoutMs: number;
+  /** Timeout for receiving complete HTTP headers on JSON RPC connections in milliseconds. */
+  rpcHttpHeadersTimeoutMs: number;
+  /** Origins allowed to make credentialed cross-origin requests to the RPC server. */
+  rpcCorsAllowedOrigins: string[];
+  /** Headers allowed in cross-origin requests to the RPC server. */
+  rpcCorsAllowedHeaders: string[];
+  /** Whether to allow credentialed cross-origin requests from any origin. */
+  rpcCorsAllowAnyOrigin: boolean;
 };
+
+/** Resolves the CORS origin policy for an RPC server. */
+export function getRpcCorsAllowedOrigins(
+  config: Pick<NodeRPCConfig, 'rpcCorsAllowedOrigins' | 'rpcCorsAllowAnyOrigin'>,
+): string[] {
+  return config.rpcCorsAllowAnyOrigin ? ['*'] : config.rpcCorsAllowedOrigins;
+}

package/src/deserialization/index.ts

@@ -3,7 +3,7 @@
  * These constants define maximum allowed sizes during deserialization
  * to prevent DoS attacks via maliciously crafted messages.
  */
-import { BLOBS_PER_CHECKPOINT, FIELDS_PER_BLOB } from '@aztec/constants';
+import { BLOBS_PER_CHECKPOINT, FIELDS_PER_BLOB, MAX_BLOCKS_PER_CHECKPOINT } from '@aztec/constants';
 
 /** Max transactions per block for deserialization validation */
 export const MAX_TXS_PER_BLOCK = 2 ** 16;
@@ -17,35 +17,35 @@ export const MAX_COMMITTEE_SIZE = 2048;
  *
  * This MUST be >= the number of blocks the proving system can carry, or a structurally-valid, provable
  * checkpoint that L1 accepts would be rejected on ingest (`validateCheckpoint`) and wedge the archiver.
- * The circuits and L1 impose no explicit per-checkpoint block count; the ceiling comes from the
- * blob-field budget:
+ * The checkpoint root circuit caps a checkpoint at {@link MAX_BLOCKS_PER_CHECKPOINT} blocks, well under
+ * the looser ceiling the blob-field budget imposes:
  *
  *   budget = BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB = 6 * 4096 = 24,576 fields
  *
- *   per-block minimal blob footprint:
- *     first block  (may be empty)   = 7 fields   (NUM_FIRST_BLOCK_END_BLOB_FIELDS)
- *     every other  (needs >= 1 tx)  = 6 + 4 = 10 fields
+ *   per-block minimal blob footprint (every block carries a per-block l1-to-l2 root):
+ *     a block with no txs           = 7 fields   (NUM_BLOCK_END_BLOB_FIELDS)
+ *     a block with one minimal tx   = 7 + 4 = 11 fields
  *                                     (NUM_BLOCK_END_BLOB_FIELDS + a 4-field minimal tx:
  *                                      tx start marker + tx hash + fee + 1 mandatory nullifier)
  *     + 1 checkpoint-end marker      (NUM_CHECKPOINT_END_MARKER_FIELDS)
  *
- *   max N:  7 + 10*(N - 1) + 1 <= 24,576  =>  10*(N - 1) <= 24,568  =>  N <= 2,457
+ *   max N:  7 + 11*(N - 1) + 1 <= 24,576  =>  11*(N - 1) <= 24,568  =>  N <= 2,234
  *
- * Only the first block may be empty; every other block needs >= 1 tx (the circuits have no empty-tx
- * variant for non-first blocks), so 2457 is the largest provable checkpoint. The blob format can encode
- * more blocks than this (up to ~4095 with all-empty blocks), but such a checkpoint is unprovable and
- * can only reach L1 with a malicious committee supermajority — a terminal network compromise where a
- * wedged archiver is an acceptable outcome. We therefore bound ingest to the provable maximum.
- * Invariant checked by the unit test in deserialization.test.ts.
+ * 2234 is kept as the deserialization bound: it is far above the circuit cap, so it never rejects a
+ * provable checkpoint, while still bounding how much a malformed blob payload can allocate. L1 carries
+ * no block count of its own, so an over-cap (and therefore unprovable) checkpoint can only reach it with
+ * a malicious committee supermajority — a terminal network compromise. Invariant checked by the unit
+ * test in deserialization.test.ts.
  */
-export const MAX_CAPACITY_BLOCKS_PER_CHECKPOINT = 2457;
+export const MAX_CAPACITY_BLOCKS_PER_CHECKPOINT = 2234;
 
 /**
- * Max blocks per checkpoint we are willing to build or attest to (conservative client policy, and the
- * default block-count limit for `validateCheckpoint`). Distinct from {@link MAX_CAPACITY_BLOCKS_PER_CHECKPOINT},
- * which is the higher ceiling we tolerate when deserializing checkpoints already accepted by L1.
+ * Max blocks per checkpoint we are willing to build or attest to, and the default block-count limit for
+ * `validateCheckpoint`. This is the protocol cap the checkpoint root circuit enforces: anything above it
+ * is unprovable, so a node must never build or attest to it. Distinct from
+ * {@link MAX_CAPACITY_BLOCKS_PER_CHECKPOINT}, the looser bound used when deserializing untrusted payloads.
  */
-export const MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT = 72;
+export const MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT = MAX_BLOCKS_PER_CHECKPOINT;
 
 /** Max tx effects per body (based on blob capacity per checkpoint) */
 export const MAX_TX_EFFECTS_PER_BODY = BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB;

package/src/gas/README.md

@@ -226,7 +226,8 @@ must also be buildable into a block and fit a valid checkpoint.
 ### Per-tx protocol maxima
 
 Hard ceilings on what any single tx may declare, independent of network configuration. Declaring more is
-rejected everywhere a tx is validated.
+rejected by `GasLimitsValidator` at every tx validation entry point except simulation, which is exempt
+because gas estimation deliberately declares limits above the per-tx maximum.
 
 - **`MAX_TX_DA_GAS`** (271,200) — `MAX_TX_BLOB_DATA_SIZE_IN_FIELDS` (8,475) × `DA_GAS_PER_FIELD` (32). This
   is the most DA a single tx's effects can encode into a blob, so it is the most DA gas a tx could ever use.
@@ -300,8 +301,8 @@ The outermost limits, enforced as proposal validity in `validateCheckpointLimits
 
 | Limit                                   | Value (mainnet defaults)        | Scope         | Where enforced                                              |
 | --------------------------------------- | ------------------------------- | ------------- | ----------------------------------------------------------- |
-| `MAX_TX_DA_GAS`                         | 271,200                         | per-tx        | every gas validator (hard ceiling)                          |
-| `MAX_PROCESSABLE_L2_GAS`                | 6,540,000                       | per-tx        | every gas validator (hard ceiling)                          |
+| `MAX_TX_DA_GAS`                         | 271,200                         | per-tx        | `GasLimitsValidator` (hard ceiling; simulation exempt)      |
+| `MAX_PROCESSABLE_L2_GAS`                | 6,540,000                       | per-tx        | `GasLimitsValidator` (hard ceiling; simulation exempt)      |
 | Network DA admission limit              | min(271,200, ceil(784,448/10×1.5)) = 117,668 | per-tx (relay) | RPC, gossip, pending pool (`GasLimitsValidator`)         |
 | Network L2 admission limit              | min(6,540,000, ceil(manaLimit/10×1.2)) | per-tx (relay) | RPC, gossip, pending pool (`GasLimitsValidator`)         |
 | Per-block fair share + caps             | remaining budget / blocks × multiplier, min absolute caps & blob-field cap | per-block | `CheckpointBuilder.capLimitsByCheckpointBudgets`         |

package/src/gas/gas_settings.ts

@@ -20,9 +20,13 @@ export const GAS_ESTIMATION_DA_GAS_LIMIT = GAS_ESTIMATION_TEARDOWN_DA_GAS_LIMIT
 /** Gas usage and fees limits set by the transaction sender for different dimensions and phases. */
 export class GasSettings {
   constructor(
+    /** Total gas the tx may consume across all phases, teardown included. */
     public readonly gasLimits: Gas,
+    /** Portion of gasLimits reserved for the teardown phase, billed in full when the tx has a teardown call. */
     public readonly teardownGasLimits: Gas,
+    /** Maximum fees per gas unit the sender is willing to pay. */
     public readonly maxFeesPerGas: GasFees,
+    /** Maximum priority fees per gas unit the sender is willing to pay on top of the base fee. */
     public readonly maxPriorityFeesPerGas: GasFees,
   ) {}
   // docs:end:gas_settings_vars
@@ -132,9 +136,9 @@ export class GasSettings {
    * the effective gas available for app logic is gasLimits - teardownGasLimits - privateOverhead.
    * To ensure estimation never hits gas caps, we set both limits above what the protocol allows:
    * teardown gets MAX_PROCESSABLE and gasLimits gets teardown + MAX_PROCESSABLE, so the full
-   * processable amount remains available for each phase independently. To be used in conjunction
-   * with skipTxValidation: true during public simulation, or the node would reject the transaction
-   * outright due to gas limits being above protocol max.
+   * processable amount remains available for each phase independently. Tx validation exempts
+   * simulated txs from gas-limit admission (`isValidTx` with `isSimulation: true`), so these
+   * inflated limits pass validation; the wallet clamps the real tx to the admission limit afterward.
    */
   static forEstimation(overrides: {
     gasLimits?: Gas;

package/src/gas/tx_gas_limits.ts

@@ -1,8 +1,4 @@
-import {
-  NUM_BLOCK_END_BLOB_FIELDS,
-  NUM_CHECKPOINT_END_MARKER_FIELDS,
-  NUM_FIRST_BLOCK_END_BLOB_FIELDS,
-} from '@aztec/blob-lib/encoding';
+import { NUM_BLOCK_END_BLOB_FIELDS, NUM_CHECKPOINT_END_MARKER_FIELDS } from '@aztec/blob-lib/encoding';
 import {
   BLOBS_PER_CHECKPOINT,
   DA_GAS_PER_FIELD,
@@ -38,9 +34,8 @@ export const MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER = 1.5;
  * raw blob capacity (`BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB * DA_GAS_PER_FIELD`) minus the fields the blob
  * encoding reserves for overhead that no tx pays DA gas for:
  *
- * - one checkpoint-end marker field (`NUM_CHECKPOINT_END_MARKER_FIELDS`),
- * - the first block's block-end fields (`NUM_FIRST_BLOCK_END_BLOB_FIELDS`, 7), and
- * - `NUM_BLOCK_END_BLOB_FIELDS` (6) for each of the `blocks - 1` subsequent blocks.
+ * - one checkpoint-end marker field (`NUM_CHECKPOINT_END_MARKER_FIELDS`), and
+ * - `NUM_BLOCK_END_BLOB_FIELDS` (7, including the per-block l1-to-l2 root) for each of the `blocks` blocks.
  *
  * Subtracting the overhead for every block (not just the first) keeps the network DA admission limit at or
  * below the builder's first-block blob-field cap at every geometry. The builder is the MOST generous for the
@@ -57,10 +52,7 @@ export function getDaCheckpointBudgetForTxs(maxBlocksPerCheckpoint: number): num
   // raw blob capacity, which would otherwise yield a negative advertised DA budget.
   const fields = Math.max(
     0,
-    BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB -
-      NUM_CHECKPOINT_END_MARKER_FIELDS -
-      NUM_FIRST_BLOCK_END_BLOB_FIELDS -
-      (blocks - 1) * NUM_BLOCK_END_BLOB_FIELDS,
+    BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB - NUM_CHECKPOINT_END_MARKER_FIELDS - blocks * NUM_BLOCK_END_BLOB_FIELDS,
   );
   return fields * DA_GAS_PER_FIELD;
 }