@aztec/validator-client 6.0.0-nightly.20260810 → 6.0.0-nightly.20260821

package/dest/proposal_handler.js

@@ -64,7 +64,7 @@ function _ts_dispose_resources(env) {
     })(env);
 }
 import { encodeCheckpointBlobDataFromBlocks, getBlobsPerL1Block } from '@aztec/blob-lib';
-import { INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
+import { INITIAL_L2_BLOCK_NUM, MAX_BLOCKS_PER_CHECKPOINT, MAX_L1_TO_L2_MSGS_PER_BLOCK, MAX_L1_TO_L2_MSGS_PER_CHECKPOINT } from '@aztec/constants';
 import { validateFeeAssetPriceModifier } from '@aztec/ethereum/contracts';
 import { BlockNumber, CheckpointNumber } from '@aztec/foundation/branded-types';
 import { pick } from '@aztec/foundation/collection';
@@ -75,13 +75,14 @@ import { createLogger } from '@aztec/foundation/log';
 import { retryUntil } from '@aztec/foundation/retry';
 import { DateProvider, Timer } from '@aztec/foundation/timer';
 import { isErrorClass } from '@aztec/foundation/types';
-import { getPreviousCheckpointOutHashes, validateCheckpoint } from '@aztec/stdlib/checkpoint';
+import { getPreviousCheckpointInboxRollingHash, getPreviousCheckpointOutHashes, validateCheckpoint } from '@aztec/stdlib/checkpoint';
 import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
 import { Gas } from '@aztec/stdlib/gas';
-import { accumulateCheckpointOutHashes, computeInHashFromL1ToL2Messages } from '@aztec/stdlib/messaging';
+import { accumulateCheckpointOutHashes, getInboxCutoffTimestamp, isInboxConsumptionSufficient } from '@aztec/stdlib/messaging';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
 import { InvalidBlockProposalTxsError, ReExFailedTxsError, ReExInitialStateMismatchError, ReExStateMismatchError, ReExTimeoutError, TransactionsNotAvailableError } from '@aztec/stdlib/validators';
 import { getTelemetryClient } from '@aztec/telemetry-client';
+import { checkStreamingBlockProposalMetadata, getStreamingBlockBundle } from './streaming_inbox_checks.js';
 /**
  * Mapping from a checkpoint-proposal validation failure reason to the tracker outcome that
  * `handleCheckpointProposal` should record. `undefined` means do not record (signature
@@ -100,6 +101,7 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     checkpoint_header_mismatch: 'invalid',
     archive_mismatch: 'invalid',
     out_hash_mismatch: 'invalid',
+    inbox_consumption_insufficient: 'invalid',
     checkpoint_validation_failed: 'invalid'
 };
 const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
@@ -109,7 +111,6 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
     'global_variables_mismatch',
     'invalid_proposal',
     'parent_block_wrong_slot',
-    'in_hash_mismatch',
     'duplicate_txs',
     'invalid_embedded_txs'
 ];
@@ -126,6 +127,9 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
     ['checkpoint_validation_failed']: true,
     ['last_block_archive_mismatch']: true,
     // disabled
+    // Streaming Inbox last-block censorship: kept out of slashing while the streaming path is new; L1 `propose` is the
+    // authoritative reject (Rollup__UnconsumedInboxMessages).
+    ['inbox_consumption_insufficient']: false,
     ['invalid_signature']: false,
     ['last_block_not_found']: false,
     ['block_fetch_error']: false,
@@ -146,7 +150,6 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
     blockSource;
     l1ToL2MessageSource;
     txProvider;
-    blockProposalValidator;
     epochCache;
     timetable;
     config;
@@ -165,13 +168,12 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
     checkpointProposalValidationFailureCallback;
     /** Slots at which a slashable invalid block or checkpoint proposal was observed. */ slotsWithInvalidProposals;
     /** Slots at which a proposal equivocation was observed; suppresses attested-to-invalid-proposal slashing. */ slotsWithProposalEquivocation;
-    constructor(checkpointsBuilder, worldState, blockSource, l1ToL2MessageSource, txProvider, blockProposalValidator, epochCache, timetable, config, blobClient, reexecutionTracker, metrics, dateProvider = new DateProvider(), telemetry = getTelemetryClient(), log = createLogger('validator:proposal-handler')){
+    constructor(checkpointsBuilder, worldState, blockSource, l1ToL2MessageSource, txProvider, epochCache, timetable, config, blobClient, reexecutionTracker, metrics, dateProvider = new DateProvider(), telemetry = getTelemetryClient(), log = createLogger('validator:proposal-handler')){
         this.checkpointsBuilder = checkpointsBuilder;
         this.worldState = worldState;
         this.blockSource = blockSource;
         this.l1ToL2MessageSource = l1ToL2MessageSource;
         this.txProvider = txProvider;
-        this.blockProposalValidator = blockProposalValidator;
         this.epochCache = epochCache;
         this.timetable = timetable;
         this.config = config;
@@ -337,7 +339,13 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
         p2pClient.registerAllNodesCheckpointProposalHandler(checkpointHandler);
         return this;
     }
-    async handleBlockProposal(proposal, proposalSender, shouldReexecute) {
+    /**
+   * Processes a block proposal: collects its txs and, if requested, re-executes them to check the resulting
+   * block against the proposal. Expects the proposal to have already passed p2p ingress validation (signature
+   * context, signature, expected proposer, index within checkpoint, tx field checks, and the receive-window
+   * timeliness check) — none of those are re-applied here, and only deterministic properties of the payload
+   * are validated before processing.
+   */ async handleBlockProposal(proposal, proposalSender, shouldReexecute) {
         const slotNumber = proposal.slotNumber;
         const proposer = proposal.getSender();
         // Reject proposals with invalid signatures
@@ -358,16 +366,9 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
             ...proposalInfo,
             txHashes: proposal.txHashes.map((t)=>t.toString())
         });
-        // Check that the proposal is from the current proposer, or the next proposer
-        // This should have been handled by the p2p layer, but we double check here out of caution
-        const validationResult = await this.blockProposalValidator.validate(proposal);
-        if (validationResult.result !== 'accept') {
-            this.log.warn(`Proposal is not valid, skipping processing`, proposalInfo);
-            return {
-                isValid: false,
-                reason: 'invalid_proposal'
-            };
-        }
+        // The receive-window check from p2p ingress is deliberately not re-applied here: its outcome depends on
+        // the wall clock at evaluation time, so re-running it turned node-local processing latency into an
+        // invalid-proposal verdict against an honest proposer, which then fed the invalid-block slashing path.
         // A tx can only appear once in a block: the second copy would emit nullifiers already emitted by the
         // first. This is not a relaying-peer fault, so it passes gossip validation and is classified here as
         // proposer misbehavior. Tx collection also reconciles a deduplicated hash set against the full list,
@@ -440,9 +441,35 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
                 reason: 'block_number_already_exists'
             };
         }
+        // Streaming Inbox: run the metadata checks before committing to any network work. They are point lookups
+        // against our own Inbox view, so a proposal carrying a bucket reference that does not resolve locally is
+        // rejected without a proposer being able to make us spend the validation window collecting its txs.
+        const streamingMetadata = await this.checkStreamingBlockMetadata(proposal, blockNumber, parentBlock);
+        if (!streamingMetadata.accepted) {
+            this.log.warn(`Streaming Inbox block acceptance check failed, skipping processing`, {
+                reason: streamingMetadata.reason,
+                bucketRef: proposal.bucketRef?.toInspect(),
+                ...proposalInfo
+            });
+            return {
+                isValid: false,
+                blockNumber,
+                reason: streamingMetadata.reason
+            };
+        }
         // Collect txs from the proposal. We start doing this as early as possible,
         // and we do it even if we don't plan to re-execute the txs, so that we have them if another node needs them.
-        const collected = await this.collectProposalTxs(proposal, blockNumber, proposalSender, proposalInfo);
+        // The block's message bundle is an independent read, so derive it concurrently with the collection.
+        const txsPromise = this.collectProposalTxs(proposal, blockNumber, proposalSender, proposalInfo);
+        const bundlePromise = getStreamingBlockBundle(this.l1ToL2MessageSource, streamingMetadata);
+        // Promise.all settles on the first rejection, so without a handler of its own the loser's later rejection
+        // would surface as an unhandled rejection. Awaiting below still observes whichever rejected first.
+        txsPromise.catch(()=>{});
+        bundlePromise.catch(()=>{});
+        const [collected, l1ToL2Messages] = await Promise.all([
+            txsPromise,
+            bundlePromise
+        ]);
         if (collected === 'invalid_embedded_txs') {
             return {
                 isValid: false,
@@ -472,22 +499,6 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
         }
         const checkpointNumber = checkpointResult.checkpointNumber;
         proposalInfo.checkpointNumber = checkpointNumber;
-        // Check that I have the same set of l1ToL2Messages as the proposal
-        const l1ToL2Messages = await this.l1ToL2MessageSource.getL1ToL2Messages(checkpointNumber);
-        const computedInHash = computeInHashFromL1ToL2Messages(l1ToL2Messages);
-        const proposalInHash = proposal.inHash;
-        if (!computedInHash.equals(proposalInHash)) {
-            this.log.warn(`L1 to L2 messages in hash mismatch, skipping processing`, {
-                proposalInHash: proposalInHash.toString(),
-                computedInHash: computedInHash.toString(),
-                ...proposalInfo
-            });
-            return {
-                isValid: false,
-                blockNumber,
-                reason: 'in_hash_mismatch'
-            };
-        }
         // Check that all of the transactions in the proposal are available
         if (missingTxs.length > 0) {
             this.log.warn(`Missing ${missingTxs.length} txs to process proposal`, {
@@ -512,11 +523,16 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
             pipeliningEnabled: true,
             log: this.log
         });
+        const previousInboxRollingHash = await getPreviousCheckpointInboxRollingHash({
+            blockSource: this.blockSource,
+            checkpointNumber,
+            log: this.log
+        });
         // Try re-executing the transactions in the proposal if needed
         let reexecutionResult;
         try {
             this.log.verbose(`Re-executing transactions in the proposal`, proposalInfo);
-            reexecutionResult = await this.reexecuteTransactions(proposal, blockNumber, checkpointNumber, txs, l1ToL2Messages, previousCheckpointOutHashes);
+            reexecutionResult = await this.reexecuteTransactions(proposal, blockNumber, checkpointNumber, txs, l1ToL2Messages, previousCheckpointOutHashes, previousInboxRollingHash);
         } catch (error) {
             this.log.error(`Error reexecuting txs while processing block proposal`, error, proposalInfo);
             const reason = this.getReexecuteFailureReason(error);
@@ -829,7 +845,99 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
             return 'unknown_error';
         }
     }
-    async reexecuteTransactions(proposal, blockNumber, checkpointNumber, txs, l1ToL2Messages, previousCheckpointOutHashes) {
+    /**
+   * Runs the streaming-Inbox per-block metadata checks for a block proposal, returning the bucket range its message
+   * bundle derives from or a rejection reason. The parent block's consumed total and the checkpoint's starting total
+   * are derived from L1-to-L2 tree leaf counts; a parent whose count does not sit on a bucket boundary is rejected
+   * inside {@link checkStreamingBlockProposalMetadata}.
+   */ async checkStreamingBlockMetadata(proposal, blockNumber, parentBlock) {
+        const parentTotalMsgCount = this.getConsumedMsgTotal(parentBlock);
+        const checkpointStartTotalMsgCount = await this.resolveCheckpointStartTotal(blockNumber, proposal.indexWithinCheckpoint, parentTotalMsgCount);
+        if (checkpointStartTotalMsgCount === undefined) {
+            // The block before the checkpoint's first block has not synced locally, so the per-checkpoint cap origin is
+            // unavailable: treat as an unknown local view. There is no bounded wait for the missing block yet.
+            return {
+                accepted: false,
+                reason: 'bucket_unknown'
+            };
+        }
+        const nowSeconds = BigInt(Math.floor(this.dateProvider.now() / 1000));
+        return checkStreamingBlockProposalMetadata({
+            messageSource: this.l1ToL2MessageSource,
+            bucketRef: proposal.bucketRef,
+            parentTotalMsgCount,
+            checkpointStartTotalMsgCount,
+            nowSeconds,
+            minBucketAgeSeconds: this.epochCache.getL1Constants().ethereumSlotDuration,
+            perBlockCap: MAX_L1_TO_L2_MSGS_PER_BLOCK,
+            perCheckpointCap: MAX_L1_TO_L2_MSGS_PER_CHECKPOINT
+        });
+    }
+    /** A block's L1-to-L2 message tree leaf count: the cumulative Inbox message count it consumed through. */ blockLeafCount(block) {
+        return BigInt(block.header.state.l1ToL2MessageTree.nextAvailableLeafIndex);
+    }
+    /** The cumulative Inbox message count consumed through a block: its L1-to-L2 tree leaf count (0 at genesis). */ getConsumedMsgTotal(block) {
+        return block === 'genesis' ? 0n : this.blockLeafCount(block);
+    }
+    /**
+   * The cumulative Inbox message count consumed as of the parent checkpoint (the per-checkpoint cap origin). For a
+   * checkpoint's first block this is the parent block's total; for a later block it is the leaf count of the block
+   * before the checkpoint's first block. Returns undefined when that block has not synced locally.
+   */ resolveCheckpointStartTotal(blockNumber, indexWithinCheckpoint, parentTotalMsgCount) {
+        return indexWithinCheckpoint === 0 ? Promise.resolve(parentTotalMsgCount) : this.getPreBlockConsumedTotal(blockNumber - indexWithinCheckpoint);
+    }
+    /**
+   * The cumulative Inbox message count consumed as of the block immediately before `firstBlockNumber` (its L1-to-L2
+   * tree leaf count): 0 when that block is genesis, undefined when it has not synced locally.
+   */ async getPreBlockConsumedTotal(firstBlockNumber) {
+        const preBlockNumber = firstBlockNumber - 1;
+        if (preBlockNumber < INITIAL_L2_BLOCK_NUM) {
+            return 0n;
+        }
+        const preBlock = await this.blockSource.getBlockData({
+            number: BlockNumber(preBlockNumber)
+        });
+        return preBlock === undefined ? undefined : this.blockLeafCount(preBlock);
+    }
+    /**
+   * Enforces the streaming-Inbox last-block minimum-consumption (censorship) rule for a checkpoint, mirroring
+   * `ProposeLib.validateInboxConsumption`: the first bucket the checkpoint left unconsumed must be absent, past the
+   * cutoff, or a cap-escape. Returns true (sufficient) when the checkpoint's consumption cannot be resolved against
+   * the local Inbox view, deferring to L1 `propose` as the authoritative reject.
+   */ async isLastBlockConsumptionSufficient(slot, blocks) {
+        const lastBlockTotal = this.blockLeafCount(blocks[blocks.length - 1]);
+        const checkpointStartTotal = await this.getPreBlockConsumedTotal(blocks[0].number);
+        const lastConsumedBucket = await this.l1ToL2MessageSource.getInboxBucketByTotalMsgCount(lastBlockTotal);
+        if (checkpointStartTotal === undefined || lastConsumedBucket === undefined) {
+            return true;
+        }
+        const nextBucket = await this.l1ToL2MessageSource.getInboxBucket(lastConsumedBucket.seq + 1n);
+        const cutoffTimestamp = getInboxCutoffTimestamp(slot, this.epochCache.getL1Constants());
+        return isInboxConsumptionSufficient({
+            nextBucket,
+            cutoffTimestamp,
+            checkpointStartTotalMsgCount: checkpointStartTotal,
+            perCheckpointCap: MAX_L1_TO_L2_MSGS_PER_CHECKPOINT
+        });
+    }
+    /**
+   * Derives the ordered list of L1-to-L2 messages a checkpoint consumed across its blocks, from the Inbox buckets
+   * between the parent checkpoint's consumed position and the checkpoint's last block. Empty when
+   * the checkpoint consumed nothing or its consumption cannot be resolved against the local Inbox view.
+   */ async deriveCheckpointConsumedMessages(blocks) {
+        const checkpointStartTotal = await this.getPreBlockConsumedTotal(blocks[0].number);
+        const lastBlockTotal = this.blockLeafCount(blocks[blocks.length - 1]);
+        if (checkpointStartTotal === undefined || lastBlockTotal <= checkpointStartTotal) {
+            return [];
+        }
+        const startBucket = await this.l1ToL2MessageSource.getInboxBucketByTotalMsgCount(checkpointStartTotal);
+        const endBucket = await this.l1ToL2MessageSource.getInboxBucketByTotalMsgCount(lastBlockTotal);
+        if (startBucket === undefined || endBucket === undefined) {
+            return [];
+        }
+        return this.l1ToL2MessageSource.getL1ToL2MessagesBetweenBuckets(startBucket.seq, endBucket.seq);
+    }
+    async reexecuteTransactions(proposal, blockNumber, checkpointNumber, txs, l1ToL2Messages, previousCheckpointOutHashes, previousInboxRollingHash) {
         const env = {
             stack: [],
             error: void 0,
@@ -869,8 +977,9 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
                 feeRecipient: blockHeader.globalVariables.feeRecipient,
                 gasFees: blockHeader.globalVariables.gasFees
             };
-            // Create checkpoint builder with prior blocks
-            const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(checkpointNumber, constants, 0n, l1ToL2Messages, previousCheckpointOutHashes, fork, priorBlocks, this.log.getBindings());
+            // Create checkpoint builder with prior blocks. The messages the prior blocks consumed are not needed: this path
+            // only re-executes and compares the new block, never completing the checkpoint (whose rolling hash they seed).
+            const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(checkpointNumber, constants, 0n, [], previousCheckpointOutHashes, previousInboxRollingHash, fork, priorBlocks, this.log.getBindings());
             // Build the new block
             const deadline = this.getReexecutionDeadline(slot);
             const maxBlockGas = this.config.validateMaxL2BlockGas !== undefined || this.config.validateMaxDABlockGas !== undefined ? new Gas(this.config.validateMaxDABlockGas ?? Infinity, this.config.validateMaxL2BlockGas ?? Infinity) : undefined;
@@ -880,7 +989,8 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
                 deadline,
                 expectedEndState: blockHeader.state,
                 maxTransactions: this.config.validateMaxTxsPerBlock,
-                maxBlockGas
+                maxBlockGas,
+                l1ToL2Messages
             });
             const { block, failedTxs } = result;
             const numFailedTxs = failedTxs.length;
@@ -934,6 +1044,8 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
    * Validates a checkpoint proposal, caches the result, and uploads blobs if configured.
    * Returns a cached result if the same proposal (archive + slot) was already validated.
    * Used by both the all-nodes callback (via register) and the validator client (via delegation).
+   * Expects the proposal to have already passed p2p ingress validation (expected proposer and receive-window
+   * timeliness); only deterministic properties of the signed payload are checked here.
    */ async handleCheckpointProposal(proposal, proposalInfo) {
         const slot = proposal.slotNumber;
         const payloadHash = proposal.getPayloadHash();
@@ -1069,9 +1181,12 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
                     checkpointNumber: lastBlockData.checkpointNumber
                 };
             }
-            // Note this condition should never trigger, since we dont process block proposals that exceed indexWithinCheckpoint
-            const maxBlocksPerCheckpoint = this.config.maxBlocksPerCheckpoint;
-            if (maxBlocksPerCheckpoint !== undefined && blocks.length > maxBlocksPerCheckpoint) {
+            // The checkpoint root circuit caps how many blocks a checkpoint may contain, and L1 cannot check it when the
+            // checkpoint is proposed (`ProposedHeader` carries no block count, only `blockHeadersHash`). An over-cap
+            // checkpoint would therefore be accepted on L1 and then be unprovable, forcing an epoch reorg, so validators
+            // reject it before attesting. An operator-configured limit may only tighten the protocol cap, never relax it.
+            const maxBlocksPerCheckpoint = Math.min(this.config.maxBlocksPerCheckpoint ?? MAX_BLOCKS_PER_CHECKPOINT, MAX_BLOCKS_PER_CHECKPOINT);
+            if (blocks.length > maxBlocksPerCheckpoint) {
                 this.log.warn(`Checkpoint proposal exceeds maxBlocksPerCheckpoint`, {
                     ...proposalInfo,
                     blocksInProposal: blocks.length,
@@ -1091,8 +1206,23 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
             const firstBlock = blocks[0];
             const constants = this.extractCheckpointConstants(firstBlock);
             const checkpointNumber = firstBlock.checkpointNumber;
-            // Get L1-to-L2 messages for this checkpoint
-            const l1ToL2Messages = await this.l1ToL2MessageSource.getL1ToL2Messages(checkpointNumber);
+            // Streaming Inbox: on the last block of a checkpoint, enforce the minimum-consumption
+            // (censorship) rule before attesting. Reject (no attestation) if a mandatory bucket was left unconsumed.
+            if (!await this.isLastBlockConsumptionSufficient(slot, blocks)) {
+                this.log.warn(`Streaming Inbox last-block censorship check failed, refusing to attest`, {
+                    ...proposalInfo,
+                    checkpointNumber
+                });
+                return {
+                    isValid: false,
+                    reason: 'inbox_consumption_insufficient',
+                    checkpointNumber
+                };
+            }
+            // Derive the checkpoint's consumed L1-to-L2 message list from the Inbox buckets between the parent checkpoint's
+            // consumed position and the last block's (compact indexing). The messages are already in the db from per-block
+            // validation; this list only drives the checkpoint's rolling-hash recomputation in completeCheckpoint.
+            const l1ToL2Messages = await this.deriveCheckpointConsumedMessages(blocks);
             // Collect the out hashes of all the checkpoints before this one in the same epoch.
             // See note on the analogous block-proposal site: the helper handles pipelining lag.
             const epoch = getEpochAtSlot(slot, this.epochCache.getL1Constants());
@@ -1104,6 +1234,11 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
                 pipeliningEnabled: true,
                 log: this.log
             });
+            const previousInboxRollingHash = await getPreviousCheckpointInboxRollingHash({
+                blockSource: this.blockSource,
+                checkpointNumber,
+                log: this.log
+            });
             // Fork world state at the block before the first block. getFork syncs world state to the parent block
             // first (see its doc): the block source (archiver) can already hold the block while world state still
             // trails it by one, and forking a not-yet-applied block throws a raw tree error that would otherwise
@@ -1149,7 +1284,7 @@ const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
                 };
             }
             // Create checkpoint builder with all existing blocks
-            const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(checkpointNumber, constants, proposal.feeAssetPriceModifier, l1ToL2Messages, previousCheckpointOutHashes, fork, blocks, this.log.getBindings());
+            const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(checkpointNumber, constants, proposal.feeAssetPriceModifier, l1ToL2Messages, previousCheckpointOutHashes, previousInboxRollingHash, fork, blocks, this.log.getBindings());
             // Complete the checkpoint to get computed values
             const computedCheckpoint = await checkpointBuilder.completeCheckpoint();
             // Compare checkpoint header with proposal

package/dest/streaming_inbox_checks.d.ts

@@ -0,0 +1,103 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { InboxBucket, InboxBucketRef, L1ToL2MessageSource } from '@aztec/stdlib/messaging';
+/**
+ * Reason a streaming-Inbox block proposal fails the per-block acceptance checks. Follows the
+ * handler's existing `{ isValid, reason }` string style.
+ */
+export type StreamingBlockCheckReason = 'bucket_unknown' | 'bucket_hash_mismatch' | 'parent_bucket_unresolved' | 'bucket_moves_backwards' | 'bucket_too_new' | 'bundle_over_block_cap' | 'checkpoint_over_msg_cap';
+/** The subset of the archiver's Inbox-bucket queries the per-block streaming checks need. */
+export type StreamingInboxBucketSource = Pick<L1ToL2MessageSource, 'getInboxBucket' | 'getInboxBucketByTotalMsgCount' | 'getL1ToL2MessagesBetweenBuckets'>;
+/** Inputs to the per-block streaming Inbox metadata checks. */
+export type StreamingBlockMetadataCheckInput = {
+    /** Archiver Inbox-bucket queries (resolved against this node's own Inbox view). */
+    messageSource: Pick<StreamingInboxBucketSource, 'getInboxBucket' | 'getInboxBucketByTotalMsgCount'>;
+    /** The proposal's bucket reference: `bucketSeq` is the lookup hint, `inboxRollingHash` the expected commitment. */
+    bucketRef: InboxBucketRef | undefined;
+    /** Cumulative Inbox message count consumed through the parent block (its L1-to-L2 tree leaf count; 0 at genesis). */
+    parentTotalMsgCount: bigint;
+    /** Cumulative Inbox message count consumed as of the parent checkpoint; the per-checkpoint cap origin. */
+    checkpointStartTotalMsgCount: bigint;
+    /** Validation-time wall clock in seconds; the lag-eligibility anchor. */
+    nowSeconds: bigint;
+    /**
+     * Minimum bucket age in seconds for a bucket to be lag-eligible: one configured Ethereum slot, the same value the
+     * sequencer's selection uses.
+     *
+     * Age in seconds is a proxy for L1 reorg depth, and only an exact one when no L1 slot is missed: with missed slots a
+     * bucket can be a full Ethereum slot old and still sit in the latest L1 block. A block-depth rule would be
+     * stronger — require at least one later L1 block to have synced — and is implementable without new L1 state, since
+     * the archiver records each bucket's `l1BlockNumber`.
+     */
+    minBucketAgeSeconds: number;
+    /** Maximum number of messages this block may consume (`MAX_L1_TO_L2_MSGS_PER_BLOCK`). */
+    perBlockCap: number;
+    /** Maximum number of messages the checkpoint may consume in total (`MAX_L1_TO_L2_MSGS_PER_CHECKPOINT`). */
+    perCheckpointCap: number;
+};
+/** Inputs to the full per-block streaming Inbox acceptance checks, metadata plus bundle derivation. */
+export type StreamingBlockCheckInput = Omit<StreamingBlockMetadataCheckInput, 'messageSource'> & {
+    messageSource: StreamingInboxBucketSource;
+};
+/** The buckets a passing block proposal consumes between; the input to bundle derivation. */
+export type StreamingBlockBucketRange = {
+    /** The bucket the block consumes through, resolved from this node's own Inbox view. */
+    bucket: InboxBucket;
+    /** The bucket the parent block consumed through. Equal to `bucket` when the block consumes nothing. */
+    parentBucket: InboxBucket;
+};
+/** Result of the per-block streaming Inbox metadata checks. */
+export type StreamingBlockMetadataCheckResult = ({
+    /** Every metadata check passed; the block's bundle can be derived from the returned bucket range. */
+    accepted: true;
+} & StreamingBlockBucketRange) | {
+    /** A check failed; `reason` mirrors the L1 acceptance condition that would have rejected the proposal. */
+    accepted: false;
+    reason: StreamingBlockCheckReason;
+};
+/** Result of the per-block streaming Inbox acceptance checks. */
+export type StreamingBlockCheckResult = {
+    /** All checks passed; `bundle` is the message-leaf bundle this block consumes, for re-execution. */
+    accepted: true;
+    bundle: Fr[];
+} | {
+    /** A check failed; `reason` mirrors the L1 acceptance condition that would have rejected the proposal. */
+    accepted: false;
+    reason: StreamingBlockCheckReason;
+};
+/**
+ * Runs the metadata half of the per-block acceptance checks a validator applies to a streaming block proposal:
+ * every check that is a bounded number of point lookups against the local Inbox view, with no message data read.
+ * Mirrors the L1 acceptance conditions:
+ *
+ * 1. **Exists**: the referenced bucket resolves in this node's own Inbox view, and its consensus rolling hash matches
+ *    the reference. An unknown bucket is an immediate reject here (there is no bounded wait yet); a hash
+ *    mismatch means the wire reference disagrees with the local bucket. The reference is trusted only as a `bucketSeq`
+ *    lookup hint — timestamp and message counts are read from the locally resolved bucket, never from the wire.
+ * 2. **Moves forward**: the bucket's cumulative total is at least the parent block's, so consumption never rewinds.
+ *    Equal totals mean the block consumes nothing (empty bundle).
+ * 3. **Not too new**: the bucket is at least `minBucketAgeSeconds` old at validation time
+ *    (`timestamp <= now - minBucketAgeSeconds`, inclusive — a bucket exactly that old is eligible, matching L1's
+ *    strict `>` "too new" test).
+ * 4. **Caps**: the per-block message count and the running per-checkpoint total fit their respective caps.
+ * 5. **Parent boundary**: the parent block's cumulative total sits on a bucket boundary, so the consumed range is
+ *    well defined.
+ *
+ * Because this phase is cheap and needs nothing off the network, a caller can run it before committing to any
+ * expensive work on a proposal — notably before collecting the proposal's transactions over P2P.
+ *
+ * The reject branch is a single function so a future bounded wait can wrap `bucket_unknown`.
+ */
+export declare function checkStreamingBlockProposalMetadata(input: StreamingBlockMetadataCheckInput): Promise<StreamingBlockMetadataCheckResult>;
+/**
+ * Derives the message-leaf bundle a streaming block proposal consumes (for re-execution): the leaves between the
+ * parent bucket and the proposed one, bounded by the per-block cap that
+ * {@link checkStreamingBlockProposalMetadata} already enforced.
+ */
+export declare function getStreamingBlockBundle(messageSource: Pick<StreamingInboxBucketSource, 'getL1ToL2MessagesBetweenBuckets'>, range: StreamingBlockBucketRange): Promise<Fr[]>;
+/**
+ * Runs the per-block acceptance checks a validator applies to a streaming block proposal, and derives the
+ * message-leaf bundle the block consumes. Composes {@link checkStreamingBlockProposalMetadata} with
+ * {@link getStreamingBlockBundle} for callers that have no use for running the two phases separately.
+ */
+export declare function checkStreamingBlockProposal(input: StreamingBlockCheckInput): Promise<StreamingBlockCheckResult>;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RyZWFtaW5nX2luYm94X2NoZWNrcy5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3N0cmVhbWluZ19pbmJveF9jaGVja3MudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEVBQUUsRUFBRSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDekQsT0FBTyxLQUFLLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRWhHOzs7R0FHRztBQUNILE1BQU0sTUFBTSx5QkFBeUIsR0FDakMsZ0JBQWdCLEdBQ2hCLHNCQUFzQixHQUN0QiwwQkFBMEIsR0FDMUIsd0JBQXdCLEdBQ3hCLGdCQUFnQixHQUNoQix1QkFBdUIsR0FDdkIseUJBQXlCLENBQUM7QUFFOUIsNkZBQTZGO0FBQzdGLE1BQU0sTUFBTSwwQkFBMEIsR0FBRyxJQUFJLENBQzNDLG1CQUFtQixFQUNuQixnQkFBZ0IsR0FBRywrQkFBK0IsR0FBRyxpQ0FBaUMsQ0FDdkYsQ0FBQztBQUVGLCtEQUErRDtBQUMvRCxNQUFNLE1BQU0sZ0NBQWdDLEdBQUc7SUFDN0MsbUZBQW1GO0lBQ25GLGFBQWEsRUFBRSxJQUFJLENBQUMsMEJBQTBCLEVBQUUsZ0JBQWdCLEdBQUcsK0JBQStCLENBQUMsQ0FBQztJQUNwRyxtSEFBbUg7SUFDbkgsU0FBUyxFQUFFLGNBQWMsR0FBRyxTQUFTLENBQUM7SUFDdEMscUhBQXFIO0lBQ3JILG1CQUFtQixFQUFFLE1BQU0sQ0FBQztJQUM1QiwwR0FBMEc7SUFDMUcsNEJBQTRCLEVBQUUsTUFBTSxDQUFDO0lBQ3JDLHlFQUF5RTtJQUN6RSxVQUFVLEVBQUUsTUFBTSxDQUFDO0lBQ25COzs7Ozs7OztPQVFHO0lBQ0gsbUJBQW1CLEVBQUUsTUFBTSxDQUFDO0lBQzVCLHlGQUF5RjtJQUN6RixXQUFXLEVBQUUsTUFBTSxDQUFDO0lBQ3BCLDJHQUEyRztJQUMzRyxnQkFBZ0IsRUFBRSxNQUFNLENBQUM7Q0FDMUIsQ0FBQztBQUVGLHVHQUF1RztBQUN2RyxNQUFNLE1BQU0sd0JBQXdCLEdBQUcsSUFBSSxDQUFDLGdDQUFnQyxFQUFFLGVBQWUsQ0FBQyxHQUFHO0lBQy9GLGFBQWEsRUFBRSwwQkFBMEIsQ0FBQztDQUMzQyxDQUFDO0FBRUYsNkZBQTZGO0FBQzdGLE1BQU0sTUFBTSx5QkFBeUIsR0FBRztJQUN0Qyx1RkFBdUY7SUFDdkYsTUFBTSxFQUFFLFdBQVcsQ0FBQztJQUNwQix1R0FBdUc7SUFDdkcsWUFBWSxFQUFFLFdBQVcsQ0FBQztDQUMzQixDQUFDO0FBRUYsK0RBQStEO0FBQy9ELE1BQU0sTUFBTSxpQ0FBaUMsR0FDekMsQ0FBQztJQUNDLHFHQUFxRztJQUNyRyxRQUFRLEVBQUUsSUFBSSxDQUFDO0NBQ2hCLEdBQUcseUJBQXlCLENBQUMsR0FDOUI7SUFDRSwwR0FBMEc7SUFDMUcsUUFBUSxFQUFFLEtBQUssQ0FBQztJQUNoQixNQUFNLEVBQUUseUJBQXlCLENBQUM7Q0FDbkMsQ0FBQztBQUVOLGlFQUFpRTtBQUNqRSxNQUFNLE1BQU0seUJBQXlCLEdBQ2pDO0lBQ0Usb0dBQW9HO0lBQ3BHLFFBQVEsRUFBRSxJQUFJLENBQUM7SUFDZixNQUFNLEVBQUUsRUFBRSxFQUFFLENBQUM7Q0FDZCxHQUNEO0lBQ0UsMEdBQTBHO0lBQzFHLFFBQVEsRUFBRSxLQUFLLENBQUM7SUFDaEIsTUFBTSxFQUFFLHlCQUF5QixDQUFDO0NBQ25DLENBQUM7QUFFTjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXNCRztBQUNILHdCQUFzQixtQ0FBbUMsQ0FDdkQsS0FBSyxFQUFFLGdDQUFnQyxHQUN0QyxPQUFPLENBQUMsaUNBQWlDLENBQUMsQ0F3RDVDO0FBRUQ7Ozs7R0FJRztBQUNILHdCQUFnQix1QkFBdUIsQ0FDckMsYUFBYSxFQUFFLElBQUksQ0FBQywwQkFBMEIsRUFBRSxpQ0FBaUMsQ0FBQyxFQUNsRixLQUFLLEVBQUUseUJBQXlCLEdBQy9CLE9BQU8sQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUtmO0FBRUQ7Ozs7R0FJRztBQUNILHdCQUFzQiwyQkFBMkIsQ0FBQyxLQUFLLEVBQUUsd0JBQXdCLEdBQUcsT0FBTyxDQUFDLHlCQUF5QixDQUFDLENBTXJIIn0=

package/dest/streaming_inbox_checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming_inbox_checks.d.ts","sourceRoot":"","sources":["../src/streaming_inbox_checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEhG;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GACjC,gBAAgB,GAChB,sBAAsB,GACtB,0BAA0B,GAC1B,wBAAwB,GACxB,gBAAgB,GAChB,uBAAuB,GACvB,yBAAyB,CAAC;AAE9B,6FAA6F;AAC7F,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,mBAAmB,EACnB,gBAAgB,GAAG,+BAA+B,GAAG,iCAAiC,CACvF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,gCAAgC,GAAG;IAC7C,mFAAmF;IACnF,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,GAAG,+BAA+B,CAAC,CAAC;IACpG,mHAAmH;IACnH,SAAS,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,qHAAqH;IACrH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0GAA0G;IAC1G,4BAA4B,EAAE,MAAM,CAAC;IACrC,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,2GAA2G;IAC3G,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,uGAAuG;AACvG,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,gCAAgC,EAAE,eAAe,CAAC,GAAG;IAC/F,aAAa,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,yBAAyB,GAAG;IACtC,uFAAuF;IACvF,MAAM,EAAE,WAAW,CAAC;IACpB,uGAAuG;IACvG,YAAY,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,iCAAiC,GACzC,CAAC;IACC,qGAAqG;IACrG,QAAQ,EAAE,IAAI,CAAC;CAChB,GAAG,yBAAyB,CAAC,GAC9B;IACE,0GAA0G;IAC1G,QAAQ,EAAE,KAAK,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;CACnC,CAAC;AAEN,iEAAiE;AACjE,MAAM,MAAM,yBAAyB,GACjC;IACE,oGAAoG;IACpG,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,EAAE,EAAE,CAAC;CACd,GACD;IACE,0GAA0G;IAC1G,QAAQ,EAAE,KAAK,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;CACnC,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,mCAAmC,CACvD,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,iCAAiC,CAAC,CAwD5C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,IAAI,CAAC,0BAA0B,EAAE,iCAAiC,CAAC,EAClF,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,EAAE,EAAE,CAAC,CAKf;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAMrH"}

package/dest/streaming_inbox_checks.js

@@ -0,0 +1,112 @@
+/**
+ * Runs the metadata half of the per-block acceptance checks a validator applies to a streaming block proposal:
+ * every check that is a bounded number of point lookups against the local Inbox view, with no message data read.
+ * Mirrors the L1 acceptance conditions:
+ *
+ * 1. **Exists**: the referenced bucket resolves in this node's own Inbox view, and its consensus rolling hash matches
+ *    the reference. An unknown bucket is an immediate reject here (there is no bounded wait yet); a hash
+ *    mismatch means the wire reference disagrees with the local bucket. The reference is trusted only as a `bucketSeq`
+ *    lookup hint — timestamp and message counts are read from the locally resolved bucket, never from the wire.
+ * 2. **Moves forward**: the bucket's cumulative total is at least the parent block's, so consumption never rewinds.
+ *    Equal totals mean the block consumes nothing (empty bundle).
+ * 3. **Not too new**: the bucket is at least `minBucketAgeSeconds` old at validation time
+ *    (`timestamp <= now - minBucketAgeSeconds`, inclusive — a bucket exactly that old is eligible, matching L1's
+ *    strict `>` "too new" test).
+ * 4. **Caps**: the per-block message count and the running per-checkpoint total fit their respective caps.
+ * 5. **Parent boundary**: the parent block's cumulative total sits on a bucket boundary, so the consumed range is
+ *    well defined.
+ *
+ * Because this phase is cheap and needs nothing off the network, a caller can run it before committing to any
+ * expensive work on a proposal — notably before collecting the proposal's transactions over P2P.
+ *
+ * The reject branch is a single function so a future bounded wait can wrap `bucket_unknown`.
+ */ export async function checkStreamingBlockProposalMetadata(input) {
+    const { messageSource, bucketRef, parentTotalMsgCount, checkpointStartTotalMsgCount, nowSeconds, minBucketAgeSeconds, perBlockCap, perCheckpointCap } = input;
+    // A streaming proposal must carry a bucket reference to derive its bundle from.
+    if (bucketRef === undefined) {
+        return {
+            accepted: false,
+            reason: 'bucket_unknown'
+        };
+    }
+    // Check 1: exists in our own Inbox view, and the resolved rolling hash matches the reference.
+    const bucket = await messageSource.getInboxBucket(bucketRef.bucketSeq);
+    if (bucket === undefined) {
+        return {
+            accepted: false,
+            reason: 'bucket_unknown'
+        };
+    }
+    if (!bucket.inboxRollingHash.equals(bucketRef.inboxRollingHash)) {
+        return {
+            accepted: false,
+            reason: 'bucket_hash_mismatch'
+        };
+    }
+    // Check 2: consumption moves forward relative to the parent block.
+    if (bucket.totalMsgCount < parentTotalMsgCount) {
+        return {
+            accepted: false,
+            reason: 'bucket_moves_backwards'
+        };
+    }
+    // Check 3: the bucket is at least `minBucketAgeSeconds` old at validation time.
+    if (bucket.timestamp > nowSeconds - BigInt(minBucketAgeSeconds)) {
+        return {
+            accepted: false,
+            reason: 'bucket_too_new'
+        };
+    }
+    // Check 4a: the per-block message count fits the per-block cap.
+    const blockCount = bucket.totalMsgCount - parentTotalMsgCount;
+    if (blockCount > BigInt(perBlockCap)) {
+        return {
+            accepted: false,
+            reason: 'bundle_over_block_cap'
+        };
+    }
+    // Check 4b: the running per-checkpoint total fits the per-checkpoint cap.
+    const checkpointCount = bucket.totalMsgCount - checkpointStartTotalMsgCount;
+    if (checkpointCount > BigInt(perCheckpointCap)) {
+        return {
+            accepted: false,
+            reason: 'checkpoint_over_msg_cap'
+        };
+    }
+    // Check 5: the parent bucket is the one whose cumulative total equals the parent block's leaf count (messages are
+    // indexed compactly, with no padding); a parent whose count does not sit on a bucket boundary is unresolvable.
+    const parentBucket = await messageSource.getInboxBucketByTotalMsgCount(parentTotalMsgCount);
+    if (parentBucket === undefined) {
+        return {
+            accepted: false,
+            reason: 'parent_bucket_unresolved'
+        };
+    }
+    return {
+        accepted: true,
+        bucket,
+        parentBucket
+    };
+}
+/**
+ * Derives the message-leaf bundle a streaming block proposal consumes (for re-execution): the leaves between the
+ * parent bucket and the proposed one, bounded by the per-block cap that
+ * {@link checkStreamingBlockProposalMetadata} already enforced.
+ */ export function getStreamingBlockBundle(messageSource, range) {
+    const { bucket, parentBucket } = range;
+    return parentBucket.seq === bucket.seq ? Promise.resolve([]) : messageSource.getL1ToL2MessagesBetweenBuckets(parentBucket.seq, bucket.seq);
+}
+/**
+ * Runs the per-block acceptance checks a validator applies to a streaming block proposal, and derives the
+ * message-leaf bundle the block consumes. Composes {@link checkStreamingBlockProposalMetadata} with
+ * {@link getStreamingBlockBundle} for callers that have no use for running the two phases separately.
+ */ export async function checkStreamingBlockProposal(input) {
+    const metadata = await checkStreamingBlockProposalMetadata(input);
+    if (!metadata.accepted) {
+        return metadata;
+    }
+    return {
+        accepted: true,
+        bundle: await getStreamingBlockBundle(input.messageSource, metadata)
+    };
+}