account for non self proof width in wrap domain selection

CHANGELOG.md

@@ -20,13 +20,13 @@
 
 ### Added
 
-- Native Kimchi access from Node.js with x2 prover performance boost. 
+- Native Kimchi access from Node.js with x2 prover performance boost.
   https://github.com/o1-labs/o1js/pull/2823
 - Enabled chunking through Native prover enabling x4 larger circuits on Node.js.
   https://github.com/o1-labs/o1js/pull/2823
 - Expose `Client.getZkappCommandCommitments` and
-  `Client.getZkappCommandCommitmentsFromJSON` on `mina-signer` for computing
-  the commitment and full commitment of a zkApp transaction.
+  `Client.getZkappCommandCommitmentsFromJSON` on `mina-signer` for computing the
+  commitment and full commitment of a zkApp transaction.
   https://github.com/o1-labs/o1js/pull/2869
 
 ## [3.0.0-mesa.0](https://github.com/o1-labs/o1js/compare/ff6c201b...v3.0.0-mesa.0) - 2026-03-26
@@ -70,7 +70,7 @@
   still at the default (`none()`), preserving any custom permissions set in
   `init()`.
 - Hardened WASM thread pool lifecycle: added startup guards, proper error
   handling, and re-entrancy protection for `initThreadPool` / `exitThreadPool`.
 - Web worker WASM bootstrap updated to use canonical module memory.
 - Cache reads now return `undefined` on missing files instead of throwing, and
   log cache misses with the `persistentId` instead of a stack trace.

flake.nix

@@ -286,6 +286,8 @@
           name = "export_test_vectors";
           version = "0.1.0";
           CARGO_TARGET_DIR = "./target";
+          cargoBuildFlags = [ "--features" "o1-utils/std" ];
+          cargoTestFlags = [ "--features" "o1-utils/std" ];
           cargoLock = {
             lockFile = ./src/mina/src/lib/crypto/proof-systems/Cargo.lock;
             outputHashes = narHashesFromCargoLock

npmDepsHash

@@ -1 +1 @@
-sha256-ZCfyinpdAHM7LTcyCjOqbKc9AI3G41pDV6BSHM39HI0=
+sha256-NYTcfClNuqJNCQgC4/YPyMt6Z3umTwo4w+pn4MHQ5Ts=

package.json

@@ -1,7 +1,7 @@
 {
   "name": "o1js",
   "description": "TypeScript framework for zk-SNARKs and zkApps",
-  "version": "3.0.0-mesa.final",
+  "version": "3.0.0-mesa.final.pr2888.0",
   "license": "Apache-2.0",
   "homepage": "https://github.com/o1-labs/o1js/",
   "repository": {
@@ -83,6 +83,7 @@
     "clean": "./scripts/clean/clean.sh",
     "clean:artifacts": "./scripts/clean/clean-artifacts.sh",
     "clean:all": "./scripts/clean/clean-all.sh",
+    "cleanPackageLock": "./scripts/clean/clean-package-lock.sh",
     "lint": "oxlint",
     "lint:fix": "oxlint --fix --fix-suggestions",
     "lint:strict": "oxlint --max-warnings 0",
@@ -145,9 +146,9 @@
     "tslib": "^2.3.0"
   },
   "o1js-internal": {
-    "native-version": "3.0.0-mesa.final"
+    "native-version": "3.0.0-mesa.final.pr2888.0"
   },
   "optionalDependencies": {
-    "@o1js/native": "3.0.0-mesa.final"
+    "@o1js/native": "3.0.0-mesa.final.pr2888.0"
   }
 }

run-ci-tests.sh

@@ -10,6 +10,7 @@ case $TEST_TYPE in
   ./run src/examples/zkapps/composability.ts --bundle
   ./run src/tests/fake-proof.ts
   ./run src/tests/inductive-proofs-internal.ts --bundle
+  ./run src/tests/mesa-minimal-large-method-repro.ts --bundle
   ./run tests/vk-regression/diverse-zk-program-run.ts --bundle
   ;;
 

scripts/check-version-sync.mjs

@@ -8,7 +8,15 @@
 
 import { readFileSync } from 'node:fs';
 
+const nativePackages = [
+  ['@o1js/native-darwin-arm64', { cpu: ['arm64'], os: ['darwin'] }],
+  ['@o1js/native-darwin-x64', { cpu: ['x64'], os: ['darwin'] }],
+  ['@o1js/native-linux-arm64', { cpu: ['arm64'], os: ['linux'] }],
+  ['@o1js/native-linux-x64', { cpu: ['x64'], os: ['linux'] }],
+];
+
 let pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+let lock = JSON.parse(readFileSync(new URL('../package-lock.json', import.meta.url), 'utf8'));
 
 let rootVersion = pkg.version;
 let nativeVersion = pkg['o1js-internal']?.['native-version'];
@@ -23,12 +31,62 @@ if (optionalNative !== rootVersion) {
     `optionalDependencies["@o1js/native"] (${optionalNative}) !== version (${rootVersion})`
   );
 }
+if (lock.version !== rootVersion) {
+  mismatches.push(`package-lock.json version (${lock.version}) !== version (${rootVersion})`);
+}
+if (lock.packages?.['']?.version !== rootVersion) {
+  mismatches.push(
+    `package-lock packages[""].version (${lock.packages?.['']?.version}) !== version (${rootVersion})`
+  );
+}
+if (lock.packages?.['']?.optionalDependencies?.['@o1js/native'] !== rootVersion) {
+  mismatches.push(
+    `package-lock packages[""].optionalDependencies["@o1js/native"] (${lock.packages?.['']?.optionalDependencies?.['@o1js/native']}) !== version (${rootVersion})`
+  );
+}
+
+let nativeLock = lock.packages?.['node_modules/@o1js/native'];
+if (nativeLock?.version !== rootVersion) {
+  mismatches.push(
+    `package-lock node_modules/@o1js/native version (${nativeLock?.version}) !== version (${rootVersion})`
+  );
+}
+if (nativeLock?.optional !== true) {
+  mismatches.push('package-lock node_modules/@o1js/native must be optional');
+}
+for (let [name, target] of nativePackages) {
+  if (nativeLock?.optionalDependencies?.[name] !== rootVersion) {
+    mismatches.push(
+      `package-lock node_modules/@o1js/native optionalDependencies["${name}"] (${nativeLock?.optionalDependencies?.[name]}) !== version (${rootVersion})`
+    );
+  }
+
+  let entry = lock.packages?.[`node_modules/${name}`];
+  if (entry?.version !== rootVersion) {
+    mismatches.push(
+      `package-lock node_modules/${name} version (${entry?.version}) !== version (${rootVersion})`
+    );
+  }
+  if (entry?.optional !== true) {
+    mismatches.push(`package-lock node_modules/${name} must be optional`);
+  }
+  if (JSON.stringify(entry?.cpu) !== JSON.stringify(target.cpu)) {
+    mismatches.push(
+      `package-lock node_modules/${name} cpu (${JSON.stringify(entry?.cpu)}) !== ${JSON.stringify(target.cpu)}`
+    );
+  }
+  if (JSON.stringify(entry?.os) !== JSON.stringify(target.os)) {
+    mismatches.push(
+      `package-lock node_modules/${name} os (${JSON.stringify(entry?.os)}) !== ${JSON.stringify(target.os)}`
+    );
+  }
+}
 
 if (mismatches.length > 0) {
-  console.error('version drift detected in package.json:');
+  console.error('version drift detected in package.json/package-lock.json:');
   for (let m of mismatches) console.error(`  - ${m}`);
   console.error('\nrun `npm run sync:native-version` to fix.');
   process.exit(1);
 }
 
-console.log(`ok: o1js, @o1js/native, native-version all = ${rootVersion}`);
+console.log(`ok: o1js, @o1js/native, native-version, package-lock all = ${rootVersion}`);

scripts/clean/clean-package-lock.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Strip the gitignored, locally-built native/<platform> packages out of
+# package-lock.json WITHOUT changing any dependency versions.
+#
+# `npm run build:native` produces a local @o1js/native-<platform> package
+# (version 0.0.0, os/cpu-locked) under ./native/<slug>/. A subsequent `npm
+# install` records it in the lockfile as an `extraneous` "native/<slug>" entry.
+# On another platform `npm ci` then tries to install e.g.
+# @o1js/native-darwin-arm64 and fails with EBADPLATFORM (this breaks linux CI).
+# Only the registry @o1js/native-* packages (optional: true) belong in the lock.
+#
+# This deletes just those `native/<slug>` lockfile entries. It deliberately does
+# NOT `rm package-lock.json` + reinstall: that would re-resolve every ^/~ range
+# to its newest version (e.g. typescript 5.4 -> 5.9) and break unrelated builds.
+set -Eeuo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$ROOT"
+
+echo "stripping local native/* entries from package-lock.json..."
+node -e '
+  const fs = require("fs");
+  const l = JSON.parse(fs.readFileSync("package-lock.json", "utf8"));
+  let removed = [];
+  for (const k of Object.keys(l.packages ?? {})) {
+    if (/^native\//.test(k)) { delete l.packages[k]; removed.push(k); }
+  }
+  fs.writeFileSync("package-lock.json", JSON.stringify(l, null, 2) + "\n");
+  console.log(removed.length ? "removed: " + removed.join(", ") : "nothing to strip");
+'
+
+# fail loudly if anything local-native remains
+if grep -Eq '"native/[a-z0-9_-]+":|"extraneous": true' package-lock.json; then
+  echo "ERROR: package-lock.json still references local native/* packages:" >&2
+  grep -nE '"native/[a-z0-9_-]+":|"extraneous": true' package-lock.json | head >&2
+  exit 1
+fi
+
+# sanity: lockfile must still satisfy the npm ci sync check (the gate CI runs)
+echo "verifying npm ci sync..."
+npm ci --dry-run >/dev/null
+echo "package-lock.json cleaned (no native/* leak, versions unchanged, npm-ci-consistent)"

scripts/sync-native-version.mjs

@@ -1,9 +1,16 @@
 #!/usr/bin/env node
-// rewrites package.json so o1js-internal.native-version and
+// rewrites package.json/package-lock.json so o1js-internal.native-version and
 // optionalDependencies["@o1js/native"] match the root `version`.
 // run after bumping the root version (e.g. npm version patch).
 
-import { readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+
+const nativePackages = [
+  ['@o1js/native-darwin-arm64', { cpu: ['arm64'], os: ['darwin'] }],
+  ['@o1js/native-darwin-x64', { cpu: ['x64'], os: ['darwin'] }],
+  ['@o1js/native-linux-arm64', { cpu: ['arm64'], os: ['linux'] }],
+  ['@o1js/native-linux-x64', { cpu: ['x64'], os: ['linux'] }],
+];
 
 let pkgPath = new URL('../package.json', import.meta.url);
 let raw = readFileSync(pkgPath, 'utf8');
@@ -32,3 +39,41 @@ if (changed) {
 } else {
   console.log(`already in sync at ${rootVersion}`);
 }
+
+let lockPath = new URL('../package-lock.json', import.meta.url);
+if (existsSync(lockPath)) {
+  let lockRaw = readFileSync(lockPath, 'utf8');
+  let lock = JSON.parse(lockRaw);
+
+  lock.version = rootVersion;
+  lock.packages ??= {};
+
+  let rootPackage = (lock.packages[''] ??= {});
+  rootPackage.version = rootVersion;
+  if (pkg.optionalDependencies?.['@o1js/native'] !== undefined) {
+    rootPackage.optionalDependencies ??= {};
+    rootPackage.optionalDependencies['@o1js/native'] = rootVersion;
+  }
+
+  lock.packages['node_modules/@o1js/native'] = {
+    version: rootVersion,
+    optional: true,
+    optionalDependencies: Object.fromEntries(nativePackages.map(([name]) => [name, rootVersion])),
+  };
+
+  for (let [name, target] of nativePackages) {
+    lock.packages[`node_modules/${name}`] = {
+      version: rootVersion,
+      cpu: target.cpu,
+      optional: true,
+      os: target.os,
+    };
+  }
+
+  let trailing = lockRaw.endsWith('\n') ? '\n' : '';
+  let nextLockRaw = JSON.stringify(lock, null, 2) + trailing;
+  if (nextLockRaw !== lockRaw) {
+    writeFileSync(lockPath, nextLockRaw);
+    console.log(`synced package-lock native versions to ${rootVersion}`);
+  }
+}