feat(standard-contracts): add v4-style pin-build mechanism for standard contracts

docs/docs-developers/docs/resources/migration_notes.md

@@ -61,7 +61,28 @@ After the `auth_registry`, `public_checks`, and `multi_call_entrypoint` demotion
 
 ### [Aztec.nr] `multi_call_entrypoint` demoted from protocol contract
 
-`multi_call_entrypoint` is no longer a protocol contract. Its address is now derived from its artifact rather than hardcoded at `6`. PXE no longer auto-registers it; `EmbeddedWallet` registers it on creation via `registerMultiCallEntrypoint`. Other PXE consumers using `DefaultMultiCallEntrypoint` (including `DeployAccountMethod`'s `NO_FROM` self-deploy path) must register the contract themselves with `pxe.registerContract({ instance, artifact })` from `getStandardMultiCallEntrypoint()`.
+`multi_call_entrypoint` is no longer a protocol contract; its address is derived from its artifact rather than hardcoded at `6`, and PXE no longer auto-registers it. It is now a standard contract that PXE *preloads*: both `createPXE` and `EmbeddedWallet` preload the standard MultiCallEntrypoint automatically (and `EmbeddedWallet` additionally preloads `AuthRegistry`). **If you use the standard PXE or `EmbeddedWallet`, no changes are needed** — multicall keeps working out of the box.
+
+To preload a different set of standard contracts (for example to also preload `PublicChecks`, which is not preloaded by default), a wallet or app passes its own `preloadedContractsProvider` through the wallet's PXE options:
+
+```ts
+const wallet = await EmbeddedWallet.create(node, {
+  pxe: {
+    preloadedContractsProvider: {
+      // EmbeddedWallet's built-in default preloads only MultiCallEntrypoint + AuthRegistry.
+      // A custom provider REPLACES that default (it is not additive), so re-list the ones you
+      // still want and add the extras — here, PublicChecks.
+      getPreloadedContracts: async () => [
+        await getStandardMultiCallEntrypoint(),
+        await getStandardAuthRegistry(),
+        await getStandardPublicChecks(),
+      ],
+    },
+  },
+});
+```
+
+The provider *replaces* the default list (it is not additive), so include every standard contract you want available.
 
 ### [Aztec.nr] `public_checks` demoted from protocol contract
 
@@ -72,7 +93,7 @@ After the `auth_registry`, `public_checks`, and `multi_call_entrypoint` demotion
 + use crate::standard_addresses::STANDARD_PUBLIC_CHECKS_ADDRESS;
 ```
 
-If your contract uses `privately_check_timestamp` or `privately_check_block_number`, you must deploy `PublicChecks` on your network and register it with PXE:
+Unlike MultiCallEntrypoint and AuthRegistry, `PublicChecks` is **not** preloaded by `createPXE` or `EmbeddedWallet`. If your contract uses `privately_check_timestamp` or `privately_check_block_number`, `PublicChecks` must be deployed and made available to your PXE — either include it in a custom `preloadedContractsProvider` (see the `multi_call_entrypoint` note above) or register it directly:
 
 ```ts
 import { getStandardPublicChecks } from '@aztec/standard-contracts/public-checks';
@@ -94,7 +115,7 @@ Deploy `PublicChecks` once per fresh rollup: `aztec-wallet deploy public_checks_
 + use crate::standard_addresses::STANDARD_AUTH_REGISTRY_ADDRESS;
 ```
 
-PXE no longer auto-registers `AuthRegistry` on startup. If your wallet needs it, register it explicitly (as the `EmbeddedWallet` entrypoints do):
+PXE no longer auto-registers `AuthRegistry` on startup. `EmbeddedWallet` preloads it automatically (alongside the MultiCallEntrypoint — see the `multi_call_entrypoint` note above), so apps using the standard wallet need no changes. If you use a PXE setup that doesn't preload it, add it to a custom `preloadedContractsProvider` or register it explicitly:
 
 ```ts
 import { getStandardAuthRegistry } from '@aztec/standard-contracts/auth-registry';

noir-projects/noir-contracts/bootstrap.sh

@@ -144,7 +144,18 @@ function build {
 
   if [ "$#" -eq 0 ]; then
     rm -rf target
+    mkdir -p target
     local contracts=$(grep -oP "(?<=$folder_name/)[^\"]+" Nargo.toml)
+
+    # If a pinned standard-contracts archive is present, extract it into target/ and skip
+    # recompilation of those contracts. The archive pins the canonical standard-contract
+    # artifacts so their deterministic addresses can never silently drift; when it is absent,
+    # everything compiles fresh.
+    if [ -f pinned-standard-contracts.tar.gz ]; then
+      echo_stderr "Using pinned-standard-contracts.tar.gz for pinned standard contracts."
+      tar xzf pinned-standard-contracts.tar.gz -C target
+      contracts=$(echo "$contracts" | grep -vE "^standard/")
+    fi
   else
     local contracts="$@"
   fi
@@ -217,6 +228,23 @@ function format {
   $NARGO fmt
 }
 
+# Force-builds standard contracts and tar-balls their artifacts into pinned-standard-contracts.tar.gz.
+# Run this to (re)pin the standard-contract artifacts, then commit the resulting tarball. Re-run and
+# re-commit whenever the canonical standard-contract artifacts are intended to change.
+# Mirrors the v4 `pin-build` mechanism that pins protocol contracts.
+function pin-standard-build {
+  rm -f pinned-standard-contracts.tar.gz
+  local standard_contracts=$(grep -oP '(?<=contracts/)[^"]+' Nargo.toml | grep "^standard/")
+  build $standard_contracts || { echo_stderr "Build failed; refusing to create tarball."; return 1; }
+  local standard_artifacts=$(jq -r '.[]' standard_contracts.json | sed 's/$/.json/')
+  for a in $standard_artifacts; do
+    [ -f "target/$a" ] || { echo_stderr "Missing artifact target/$a; refusing to create tarball."; return 1; }
+  done
+  echo_stderr "Creating pinned-standard-contracts.tar.gz..."
+  (cd target && tar czf ../pinned-standard-contracts.tar.gz $standard_artifacts)
+  echo_stderr "Done. pinned-standard-contracts.tar.gz created. Commit it to pin these artifacts."
+}
+
 case "$cmd" in
   "clean-keys")
     for artifact in target/*.json; do
@@ -231,6 +259,9 @@ case "$cmd" in
   "compile")
     VERBOSE=${VERBOSE:-1} build "$@"
     ;;
+  "pin-standard-build")
+    pin-standard-build
+    ;;
   *)
     default_cmd_handler "$@"
     ;;

noir-projects/noir-contracts/standard_contracts.json

@@ -0,0 +1,5 @@
+[
+  "auth_registry_contract-AuthRegistry",
+  "public_checks_contract-PublicChecks",
+  "multi_call_entrypoint_contract-MultiCallEntrypoint"
+]