chore: Accumulated backports to v4-next

Makefile

@@ -88,7 +88,10 @@ avm-transpiler-cross-arm64-macos:
 avm-transpiler-cross-arm64-linux:
 	$(call build,$@,avm-transpiler,build_cross arm64-linux)
 
-avm-transpiler-cross: avm-transpiler-cross-amd64-macos avm-transpiler-cross-arm64-macos avm-transpiler-cross-arm64-linux
+avm-transpiler-cross-amd64-windows:
+	$(call build,$@,avm-transpiler,build_cross amd64-windows)
+
+avm-transpiler-cross: avm-transpiler-cross-amd64-macos avm-transpiler-cross-arm64-macos avm-transpiler-cross-arm64-linux avm-transpiler-cross-amd64-windows
 
 #==============================================================================
 # Barretenberg
@@ -150,7 +153,14 @@ bb-cpp-cross-amd64-macos: bb-cpp-cross-amd64-macos-objects avm-transpiler-cross-
 bb-cpp-cross-arm64-macos: bb-cpp-cross-arm64-macos-objects avm-transpiler-cross-arm64-macos
 	$(call build,$@,barretenberg/cpp,build_cross arm64-macos)
 
-bb-cpp-cross: bb-cpp-cross-arm64-linux bb-cpp-cross-amd64-macos bb-cpp-cross-arm64-macos
+bb-cpp-cross-amd64-windows-objects:
+	$(call build,$@,barretenberg/cpp,build_cross_objects amd64-windows)
+
+# Cross-compile for AMD64 Windows (release only)
+bb-cpp-cross-amd64-windows: bb-cpp-cross-amd64-windows-objects avm-transpiler-cross-amd64-windows
+	$(call build,$@,barretenberg/cpp,build_cross_windows amd64-windows)
+
+bb-cpp-cross: bb-cpp-cross-arm64-linux bb-cpp-cross-amd64-macos bb-cpp-cross-arm64-macos bb-cpp-cross-amd64-windows
 
 # GCC syntax check (CI only, non-release)
 bb-cpp-gcc:

avm-transpiler/bootstrap.sh

@@ -48,6 +48,9 @@ function build_cross {
       arm64-macos)
         rust_target=aarch64-apple-darwin
         ;;
+      amd64-windows)
+        rust_target=x86_64-pc-windows-gnu
+        ;;
       *)
         echo_stderr "Unknown target: $target"
         exit 1

aztec-up/bin/0.0.1/aztec-install

@@ -3,6 +3,9 @@
 # This script installs aztec-up and then delegates to it for version installation.
 # Usage: bash -i <(curl -s https://install.aztec.network)
 #    or: VERSION=0.85.0 bash -i <(curl -s https://install.aztec.network)
+
+# Guard against truncated curl downloads: bash must parse the entire {} block before executing any of it.
+{
 set -euo pipefail
 
 # Colors
@@ -28,6 +31,32 @@ VERSION="${VERSION:-nightly}"
 # Install URI (root, not version-specific)
 INSTALL_URI="${INSTALL_URI:-https://install.aztec-labs.com}"
 
+# Check if version string is valid semver
+function is_semver {
+  local version="$1"
+  local semver_regex='^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.]+)?$'
+  [[ "$version" =~ $semver_regex ]]
+}
+
+# Resolve alias (like "nightly") to actual version number.
+function resolve_version {
+  local version="$1"
+  # Strip leading v from semver-like inputs (v0.85.0 -> 0.85.0), but not aliases (v4-nightly)
+  local stripped="${version#v}"
+  if is_semver "$stripped"; then
+    echo "$stripped"
+  else
+    local resolved
+    if ! resolved=$(curl -fsSL "$INSTALL_URI/aliases/$version" 2>/dev/null); then
+      echo "Error: Could not resolve alias '$version'" >&2
+      exit 1
+    fi
+    echo "$resolved"
+  fi
+}
+
+VERSION=$(resolve_version "$VERSION")
+
 # Add color to the AZTEC ascii art.
 function print_colored() {
   local b=$'\033[34m' # Blue
@@ -166,7 +195,7 @@ function update_path_env_var {
   if grep -q '\.aztec' "$shell_profile" 2>/dev/null; then
     # Remove old aztec PATH entries.
     local tmp_file=$(mktemp)
-    grep -Ev 'export PATH=.*/\.aztec/' "$shell_profile" > "$tmp_file" || true
+    grep -Ev 'export PATH="\$(HOME/\.aztec/|PATH:.*\.aztec/)' "$shell_profile" > "$tmp_file" || true
     mv "$tmp_file" "$shell_profile"
   fi
 
@@ -212,3 +241,7 @@ function main {
 }
 
 main "$@"
+
+# Explicit exit prevents bash from reading past the closing brace.
+exit
+}

aztec-up/bin/0.0.1/aztec-up

@@ -102,8 +102,10 @@ function is_semver {
 # Resolve alias (like "nightly") to actual version number
 function resolve_version {
   local version="$1"
-  if is_semver "$version"; then
-    echo "$version"
+  # Strip leading v from semver-like inputs (v0.85.0 -> 0.85.0), but not aliases (v4-nightly)
+  local stripped="${version#v}"
+  if is_semver "$stripped"; then
+    echo "$stripped"
   else
     # Fetch alias file to get actual version
     local resolved
@@ -313,6 +315,11 @@ function cmd_uninstall {
     exit 1
   fi
 
+  if ! is_semver "$version"; then
+    echo "Error: Invalid version '$version'. Expected a semver string (e.g. 0.85.0)."
+    exit 1
+  fi
+
   local current_version
   current_version=$(get_current_version)
 

aztec-up/bin/0.0.1/install

@@ -2,6 +2,9 @@
 # Per-version installer script
 # This script is called by aztec-up to install a specific version of the Aztec toolchain.
 # It expects VERSION and INSTALL_URI to be set.
+
+# Guard against truncated curl downloads: bash must parse the entire {} block before executing any of it.
+{
 set -euo pipefail
 
 # Colors
@@ -261,3 +264,7 @@ function main {
 }
 
 main "$@"
+
+# Explicit exit prevents bash from reading past the closing brace.
+exit
+}

barretenberg/cpp/CMakeLists.txt

@@ -108,6 +108,11 @@ if(CMAKE_SYSTEM_PROCESSOR MATCHES "wasm32")
     endif()
 endif()
 
+if(WIN32)
+    message(STATUS "Cross-compiling for Windows (MinGW)")
+    link_libraries(ws2_32 bcrypt psapi)
+endif()
+
 set(CMAKE_C_STANDARD 11)
 set(CMAKE_C_EXTENSIONS ON)
 set(CMAKE_CXX_STANDARD 20)

barretenberg/cpp/CMakePresets.json

@@ -534,6 +534,24 @@
         "HAVE_STD_REGEX": "ON"
       }
     },
+    {
+      "name": "zig-amd64-windows",
+      "displayName": "Build for Windows amd64 with Zig",
+      "description": "Cross-compile for Windows x86_64 using Zig (MinGW). Excludes ipc/lmdb/world_state/nodejs_module (no Windows support).",
+      "inherits": "zig-base",
+      "environment": {
+        "CC": "zig cc -target x86_64-windows-gnu",
+        "CXX": "zig c++ -target x86_64-windows-gnu",
+        "LDFLAGS": "-s"
+      },
+      "cacheVariables": {
+        "CMAKE_SYSTEM_NAME": "Windows",
+        "CMAKE_SYSTEM_PROCESSOR": "x86_64",
+        "TARGET_ARCH": "skylake",
+        "MOBILE": "ON",
+        "AVM_TRANSPILER_LIB": "${sourceDir}/../../avm-transpiler/target/x86_64-pc-windows-gnu/release/libavm_transpiler.a"
+      }
+    },
     {
       "name": "zig-arm64-ios",
       "displayName": "iOS arm64 static library (Zig)",
@@ -785,6 +803,11 @@
       "configurePreset": "zig-arm64-macos",
       "inheritConfigureEnvironment": true
     },
+    {
+      "name": "zig-amd64-windows",
+      "configurePreset": "zig-amd64-windows",
+      "inheritConfigureEnvironment": true
+    },
     {
       "name": "zig-arm64-ios",
       "configurePreset": "zig-arm64-ios",

barretenberg/cpp/bootstrap.sh

@@ -85,7 +85,13 @@ function build_cross_objects {
   set -eu
   target=$1
   if ! cache_exists barretenberg-$target-$hash.zst; then
-    build_preset zig-$target --target barretenberg nodejs_module vm2_stub circuit_checker honk
+    if [[ "$target" == *-windows ]]; then
+      # Windows builds exclude nodejs_module (N-API requires MSVC, not MinGW)
+      AVM_TRANSPILER=0 build_preset zig-$target --target barretenberg vm2_stub circuit_checker honk
+    else
+      (flock -x 200 && cd src/barretenberg/nodejs_module && yarn --immutable) 200>/tmp/bb-yarn.lock
+      build_preset zig-$target --target barretenberg nodejs_module vm2_stub circuit_checker honk
+    fi
   fi
 }
 
@@ -107,6 +113,19 @@ function build_cross {
   fi
 }
 
+# Cross compile Windows binary (bb.exe only, no nodejs_module).
+# Arg is target arch-os e.g. amd64-windows.
+function build_cross_windows {
+  set -eu
+  target=$1
+  if ! cache_download barretenberg-$target-$hash.zst; then
+    AVM_TRANSPILER=0 build_preset zig-$target --target bb --target bb-external
+    cache_upload barretenberg-$target-$hash.zst build-zig-$target/{bin,lib}
+  fi
+  # Always inject version (even for cached binaries) to ensure correct version on release
+  inject_version build-zig-$target/bin/bb.exe
+}
+
 # Build static library (.a) for iOS using Zig cross-compilation from Linux.
 # Only produces static libraries (bb-external) — Zig cannot link iOS executables
 # due to lack of TBD/dylib support. Requires iOS SDK headers (downloaded automatically).
@@ -251,6 +270,11 @@ function build_release_dir {
   # Package amd64-macos
   tar -czf build-release/barretenberg-amd64-darwin.tar.gz -C build-zig-amd64-macos/bin bb
 
+  # Package amd64-windows
+  if [ -f build-zig-amd64-windows/bin/bb.exe ]; then
+    tar -czf build-release/barretenberg-amd64-windows.tar.gz -C build-zig-amd64-windows/bin bb.exe
+  fi
+
   # Package static libraries for FFI bindings
   if [ -f build/lib/libbb-external.a ]; then
     tar -czf build-release/barretenberg-static-amd64-linux.tar.gz -C build/lib libbb-external.a
@@ -264,6 +288,9 @@ function build_release_dir {
   if [ -f build-zig-arm64-macos/lib/libbb-external.a ]; then
     tar -czf build-release/barretenberg-static-arm64-darwin.tar.gz -C build-zig-arm64-macos/lib libbb-external.a
   fi
+  if [ -f build-zig-amd64-windows/lib/libbb-external.a ]; then
+    tar -czf build-release/barretenberg-static-amd64-windows.tar.gz -C build-zig-amd64-windows/lib libbb-external.a
+  fi
 
   # Package iOS static libraries (cross-compiled with Zig from Linux)
   if [ -f build-zig-arm64-ios/lib/libbb-external.a ]; then
@@ -282,7 +309,7 @@ function build_release_dir {
   fi
 }
 
-export -f build_preset build_native_objects build_cross_objects build_native build_cross build_ios build_android build_asan_fast build_wasm build_wasm_threads build_gcc_syntax_check_only build_fuzzing_syntax_check_only build_smt_verification inject_version
+export -f build_preset build_native_objects build_cross_objects build_native build_cross build_cross_windows build_ios build_android build_asan_fast build_wasm build_wasm_threads build_gcc_syntax_check_only build_fuzzing_syntax_check_only build_smt_verification inject_version
 
 function build {
   echo_header "bb cpp build"
@@ -306,6 +333,7 @@ function build {
       "build_cross arm64-linux" \
       "build_cross amd64-macos true" \
       "build_cross arm64-macos true" \
+      "build_cross_windows amd64-windows" \
       "build_ios zig-arm64-ios" \
       "build_ios zig-arm64-ios-sim" \
       "build_android zig-arm64-android" \

barretenberg/cpp/src/barretenberg/api/CMakeLists.txt

@@ -5,6 +5,6 @@ if(AVM_TRANSPILER_LIB)
     target_link_libraries(api_objects PRIVATE avm_transpiler)
 endif()
 
-if(NOT WASM)
+if(NOT WASM AND NOT MOBILE)
     target_link_libraries(api_objects PRIVATE ipc)
 endif()

barretenberg/cpp/src/barretenberg/api/api_chonk.cpp

@@ -134,7 +134,7 @@ bool ChonkAPI::prove_and_verify(const std::filesystem::path& input_path)
 void ChonkAPI::gates(const Flags& flags, const std::filesystem::path& bytecode_path)
 {
     BB_BENCH_NAME("ChonkAPI::gates");
-    chonk_gate_count(bytecode_path, flags.include_gates_per_opcode);
+    chonk_gate_count(bytecode_path.string(), flags.include_gates_per_opcode);
 }
 
 void ChonkAPI::write_solidity_verifier([[maybe_unused]] const Flags& flags,

barretenberg/cpp/src/barretenberg/api/api_msgpack.cpp

@@ -8,7 +8,7 @@
 #include <string>
 #include <vector>
 
-#ifndef __wasm__
+#if !defined(__wasm__) && !defined(_WIN32)
 #include "barretenberg/ipc/ipc_server.hpp"
 #include <csignal>
 #include <thread>
@@ -104,7 +104,7 @@ int process_msgpack_commands(std::istream& input_stream)
     return 0;
 }
 
-#ifndef __wasm__
+#if !defined(__wasm__) && !defined(_WIN32)
 // Set up platform-specific parent death monitoring
 // This ensures the bb process exits when the parent (Node.js) dies
 static void setup_parent_death_monitoring()
@@ -285,7 +285,7 @@ int execute_msgpack_run(const std::string& msgpack_input_file,
                         [[maybe_unused]] size_t request_ring_size,
                         [[maybe_unused]] size_t response_ring_size)
 {
-#ifndef __wasm__
+#if !defined(__wasm__) && !defined(_WIN32)
     // Check if this is a shared memory path (ends with .shm)
     if (!msgpack_input_file.empty() && msgpack_input_file.size() >= 4 &&
         msgpack_input_file.substr(msgpack_input_file.size() - 4) == ".shm") {

barretenberg/cpp/src/barretenberg/api/file_io.hpp

@@ -52,7 +52,7 @@ inline std::vector<uint8_t> read_file(const std::string& filename, size_t bytes
     // Create a vector preallocated with enough space for the file data and read it.
     auto to_read = bytes == 0 ? size : bytes;
     std::vector<uint8_t> fileData(to_read);
-    file.read(reinterpret_cast<char*>(fileData.data()), (std::streamsize)to_read);
+    file.read(reinterpret_cast<char*>(fileData.data()), static_cast<std::streamsize>(to_read));
     return fileData;
 }
 
@@ -69,7 +69,7 @@ inline void write_file(const std::string& filename, std::vector<uint8_t> const&
         size_t total_written = 0;
         size_t data_size = data.size();
         while (total_written < data_size) {
-            ssize_t written = ::write(fd, data.data() + total_written, data_size - total_written);
+            auto written = ::write(fd, data.data() + total_written, data_size - total_written);
             if (written == -1) {
                 close(fd);
                 THROW std::runtime_error("Failed to write to file descriptor: " + filename);
@@ -112,12 +112,32 @@ template <typename Fr> inline std::string field_elements_to_json(const std::vect
 inline std::vector<uint8_t> read_vk_file(const std::filesystem::path& vk_path)
 {
     try {
-        return read_file(vk_path);
+        return read_file(vk_path.string());
     } catch (const std::runtime_error&) {
         THROW std::runtime_error("Unable to open file: " + vk_path.string() +
                                  "\nGenerate a vk during proving by running `bb prove` with an additional `--write_vk` "
                                  "flag, or run `bb write_vk` to generate a standalone vk."
                                  "\nIf you already have a vk file, specify its path with `--vk_path <path>`.");
     }
 }
+
+// On Windows, std::filesystem::path uses wide strings (wchar_t) and doesn't implicitly convert
+// to std::string. On Linux/macOS (libstdc++), the conversion is implicit so these aren't needed.
+#ifdef _WIN32
+inline size_t get_file_size(const std::filesystem::path& filename)
+{
+    return get_file_size(filename.string());
+}
+
+inline std::vector<uint8_t> read_file(const std::filesystem::path& filename, size_t bytes = 0)
+{
+    return read_file(filename.string(), bytes);
+}
+
+inline void write_file(const std::filesystem::path& filename, std::vector<uint8_t> const& data)
+{
+    write_file(filename.string(), data);
+}
+#endif
+
 } // namespace bb

barretenberg/cpp/src/barretenberg/bb/CMakeLists.txt

@@ -22,7 +22,7 @@ if (NOT(FUZZING))
     if(AVM_TRANSPILER_LIB)
         target_link_libraries(bb PRIVATE ${AVM_TRANSPILER_LIB})
     endif()
-    if(NOT WASM)
+    if(NOT WASM AND NOT MOBILE)
         target_link_libraries(bb PRIVATE ipc)
     endif()
     if(ENABLE_STACKTRACES)
@@ -62,7 +62,7 @@ if (NOT(FUZZING))
         if(AVM_TRANSPILER_LIB)
             target_link_libraries(bb-avm PRIVATE ${AVM_TRANSPILER_LIB})
         endif()
-        if(NOT WASM)
+        if(NOT WASM AND NOT MOBILE)
             target_link_libraries(bb-avm PRIVATE ipc)
         endif()
         if(ENABLE_STACKTRACES)

barretenberg/cpp/src/barretenberg/common/compiler_hints.hpp

@@ -1,7 +1,7 @@
 #pragma once
 
 #ifdef _WIN32
-#define BB_INLINE __forceinline inline
+#define BB_INLINE __forceinline
 #else
 #define BB_INLINE __attribute__((always_inline)) inline
 #endif

barretenberg/cpp/src/barretenberg/common/get_bytecode.hpp

@@ -16,3 +16,12 @@ std::vector<uint8_t> gunzip(const std::string& path);
 
 // Get bytecode from various file formats
 std::vector<uint8_t> get_bytecode(const std::string& bytecode_path);
+
+#ifdef _WIN32
+// Overload accepting std::filesystem::path (implicit conversion path->string is
+// deleted on MinGW/libstdc++).
+inline std::vector<uint8_t> get_bytecode(const std::filesystem::path& bytecode_path)
+{
+    return get_bytecode(bytecode_path.string());
+}
+#endif