feat: add generated aztec-vm-sim package setup by charlielye · Pull Request #23084 · AztecProtocol/aztec-packages

charlielye · 2026-05-08T09:59:46Z

Summary

Adds the standalone aztec-vm-sim C++ binary and generated TypeScript package infrastructure that the AVM cutover PR consumes.

This PR is intentionally mostly inert for yarn-project: it creates the binary/package/release plumbing, but does not switch the simulator call sites away from the existing path. The cutover happens in #23697.

Stack

feat(ipc): add /ipc-codegen and /ipc-runtime foundation packages #23610 cl/ipc-foundation
refactor(wsdb): migrate aztec-wsdb to ipc-codegen + ipc-runtime #23611 cl/ipc-wsdb-migrate
refactor(bbapi): migrate bb binary to ipc-codegen + ipc-runtime #23612 cl/ipc-bb-migrate
refactor(barretenberg-rs): migrate to ipc-codegen + ipc-runtime; drop PipeBackend #23613 cl/ipc-bb-rs-migrate
refactor(bb.js): migrate to ipc-codegen + ipc-runtime; delete legacy bb::ipc #23614 cl/ipc-bb-js-migrate
refactor: cut TS world state and NAPI AVM over to WSDB IPC; delete NAPI WSDB #23036 cl/ipc-3-avm-wsdb-cutover
feat: add generated aztec-vm-sim package setup #23084 cl/ipc-4-avm-binary — this PR
feat: cut simulator over to generated aztec-vm-sim IPC service #23697 cl/ipc-5-avm-cutover

What changes

C++

Adds barretenberg/cpp/src/barretenberg/avm/ with the aztec-vm-sim service binary.
Adds barretenberg/cpp/src/barretenberg/cdb/ with the CDB schema and generated-client support used by the AVM service to call back into TypeScript-hosted contract data.
Wires the new binary target into the barretenberg CMake/build graph.

TypeScript packages

Moves the handwritten bb.js package to barretenberg/ts/bb.js, so barretenberg/ts can own multiple packages.
Adds generation/release plumbing for a generated @aztec/aztec-vm-sim package that follows the wrapper + arch-package pattern used elsewhere in the IPC stack.
Updates package resolutions and release/docker ignore paths so local development uses portal packages while release builds can publish the generated package set.

Build plumbing

Extends Makefile/bootstrap paths for the new first-class AVM simulator package.
Keeps generated package outputs out of source control; they are produced by the bootstrap/generation step.

Validation

Validated while restacking this branch and the cutover branch above it:

make aztec-vm-sim
cmake --build build --target aztec-vm-sim nodejs_module from barretenberg/cpp
yarn build from yarn-project
focused simulator Jest coverage on the cutover branch

…C server Replaces the in-process NAPI AVM with the standalone aztec-avm binary (spawned via AvmBackend from PR 3a) and a TS-hosted CdbIpcServer for the contract data callbacks. Stacked on top of PR 2b (cl/ipc-3-avm-wsdb-cutover, #23036) and PR 3a (cl/ipc-4-avm-binary, #23084).

socket-security · 2026-06-18T15:58:02Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Critical CVE: Handlebars.js has JavaScript Injection via AST Type Confusion CVE: GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion (CRITICAL) Affected versions: >= 4.0.0 < 4.7.9 Patched version: 4.7.9 From: barretenberg/ts/bb.js/package-lock.json → `npm/ts-jest@29.4.5` → `npm/handlebars@4.7.8` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/handlebars@4.7.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Medium CVE: Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry CVE: GHSA-7rx3-28cr-v5wh Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry (MODERATE) Affected versions: >= 4.6.0 < 4.7.9 Patched version: 4.7.9 From: barretenberg/ts/bb.js/package-lock.json → `npm/ts-jest@29.4.5` → `npm/handlebars@4.7.8` ℹ Read more on: This package \| This alert \| What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/handlebars@4.7.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Medium CVE: Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection CVE: GHSA-2qvq-rjwj-gvw9 Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection (MODERATE) Affected versions: >= 4.0.0 < 4.7.9 Patched version: 4.7.9 From: barretenberg/ts/bb.js/package-lock.json → `npm/ts-jest@29.4.5` → `npm/handlebars@4.7.8` ℹ Read more on: This package \| This alert \| What is a medium CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known medium severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/handlebars@4.7.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

charlielye force-pushed the cl/ipc-4-avm-binary branch 3 times, most recently from edd565a to 8c3b744 Compare May 11, 2026 13:25

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch from 40f01c8 to b06f6b1 Compare May 11, 2026 13:31

charlielye force-pushed the cl/ipc-4-avm-binary branch from 8c3b744 to 2d519b5 Compare May 11, 2026 13:32

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch 2 times, most recently from 67d3c6c to d904a74 Compare May 11, 2026 13:59

charlielye force-pushed the cl/ipc-4-avm-binary branch 3 times, most recently from 39287d6 to b07d757 Compare May 11, 2026 15:32

This was referenced May 11, 2026

feat: AVM cutover — delete NAPI AVM, wire IPC simulator pool + CDB IPC server [PR 3b] #23154

Closed

feat(ipc): MPSC shared-memory transport with multi-client echo test #23040

Merged

charlielye force-pushed the cl/ipc-4-avm-binary branch from b07d757 to 9e78217 Compare May 12, 2026 13:52

charlielye mentioned this pull request May 12, 2026

feat: AVM cutover — delete NAPI AVM, wire IPC simulator pool + CDB IPC server [PR 3b] #23196

Merged

charlielye marked this pull request as ready for review May 12, 2026 20:17

charlielye requested review from IlyasRidhuan, MirandaWood and jeanmon as code owners May 12, 2026 20:17

charlielye removed request for IlyasRidhuan, MirandaWood and jeanmon May 12, 2026 20:18

charlielye mentioned this pull request May 13, 2026

feat: kv-store over IPC; aztec-kvdb binary; LMDBStore NAPI scaffold [PR 4] #23238

Closed

5 tasks

charlielye added the ci-no-squash label May 13, 2026

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch from 0d58c3e to 679c622 Compare May 29, 2026 13:54

charlielye force-pushed the cl/ipc-4-avm-binary branch from 479d6a6 to 6867e96 Compare May 29, 2026 13:55

This was referenced May 29, 2026

feat: cut simulator over to generated aztec-vm-sim IPC service #23697

Open

feat: kv-store over IPC; aztec-kvdb binary; LMDBStore NAPI scaffold [PR 4] #23698

Open

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch from bedd8b6 to d886c60 Compare June 4, 2026 10:55

charlielye force-pushed the cl/ipc-4-avm-binary branch from 389063c to 99d5f60 Compare June 4, 2026 10:55

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch from d886c60 to 46639a1 Compare June 9, 2026 13:48

charlielye force-pushed the cl/ipc-4-avm-binary branch from 99d5f60 to 68071f7 Compare June 9, 2026 13:48

charlielye force-pushed the cl/ipc-4-avm-binary branch 2 times, most recently from e5e6200 to e441fa4 Compare June 9, 2026 16:15

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch from 3a9289a to 6042327 Compare June 9, 2026 16:15

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch from 6042327 to 14392b8 Compare June 9, 2026 17:00

charlielye force-pushed the cl/ipc-4-avm-binary branch from e441fa4 to 96f42ca Compare June 9, 2026 17:00

charlielye force-pushed the cl/ipc-4-avm-binary branch from 96f42ca to ace5b21 Compare June 10, 2026 13:37

charlielye force-pushed the cl/ipc-3-avm-wsdb-cutover branch 2 times, most recently from 011106a to f46984b Compare June 10, 2026 13:44

charlielye force-pushed the cl/ipc-4-avm-binary branch from ace5b21 to 62d51d9 Compare June 10, 2026 13:44

charlielye force-pushed the cl/ipc-4-avm-binary branch from 62d51d9 to cfc6ad9 Compare June 10, 2026 14:11

feat(avm): add generated simulator package setup

c4a4709

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add generated aztec-vm-sim package setup#23084

feat: add generated aztec-vm-sim package setup#23084
charlielye wants to merge 1 commit into
cl/ipc-3-avm-wsdb-cutoverfrom
cl/ipc-4-avm-binary

charlielye commented May 8, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 18, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

charlielye commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Stack

What changes

C++

TypeScript packages

Build plumbing

Validation

Uh oh!

socket-security Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

charlielye commented May 8, 2026 •

edited

Loading

socket-security Bot commented Jun 18, 2026 •

edited

Loading