@aztec/pxe 0.0.1-commit.2448fdb → 0.0.1-commit.2606882

package/dest/entrypoints/server/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/server/utils.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,KAAK,kBAAkB,EAAyB,MAAM,4BAA4B,CAAC;AAE5F,KAAK,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,GAAG,WAAW,GAAG,kBAAkB,GAAG,eAAe,CAAC,CAAC;AAEpH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,wBAAwB,EAChC,OAAO,GAAE,kBAAoC,gBAmD9C"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/entrypoints/server/utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAOjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,KAAK,kBAAkB,EAAyB,MAAM,4BAA4B,CAAC;AAE5F,KAAK,wBAAwB,GAAG,IAAI,CAClC,SAAS,EACT,WAAW,GAAG,kBAAkB,GAAG,eAAe,GAAG,MAAM,mBAAmB,CAC/E,CAAC;AAEF,wBAAsB,SAAS,CAC7B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,wBAAwB,EAChC,OAAO,GAAE,kBAAoC,gBAwD9C"}

package/dest/entrypoints/server/utils.js

@@ -4,6 +4,7 @@ import { createStore } from '@aztec/kv-store/lmdb-v2';
 import { BundledProtocolContractsProvider } from '@aztec/protocol-contracts/providers/bundle';
 import { MemoryCircuitRecorder, SimulatorRecorderWrapper, WASMSimulator } from '@aztec/simulator/client';
 import { FileCircuitRecorder } from '@aztec/simulator/testing';
+import { getStandardMultiCallEntrypoint } from '@aztec/standard-contracts/multi-call-entrypoint';
 import { PXE } from '../../pxe.js';
 import { PXE_DATA_SCHEMA_VERSION } from '../../storage/index.js';
 import { isPrivateKernelProver } from '../pxe_creation_options.js';
@@ -20,10 +21,10 @@ export async function createPXE(aztecNode, config, options = {
     });
     const simulator = new SimulatorRecorderWrapper(new WASMSimulator(simulatorLogger), recorder);
     const loggers = options.loggers ?? {};
-    const { l1ChainId, l1ContractAddresses: l1Contracts, rollupVersion } = await aztecNode.getNodeInfo();
+    const { l1ChainId, l1ContractAddresses, rollupVersion } = await aztecNode.getNodeInfo();
     const configWithContracts = {
         ...config,
-        l1Contracts,
+        ...l1ContractAddresses,
         l1ChainId,
         rollupVersion,
         l2BlockBatchSize: 50
@@ -47,6 +48,11 @@ export async function createPXE(aztecNode, config, options = {
         });
     }
     const protocolContractsProvider = new BundledProtocolContractsProvider();
+    const preloadedContractsProvider = options.preloadedContractsProvider ?? {
+        getPreloadedContracts: async ()=>[
+                await getStandardMultiCallEntrypoint()
+            ]
+    };
     const pxeLogger = loggers.pxe ?? createLogger('pxe:service', {
         actor
     });
@@ -56,8 +62,10 @@ export async function createPXE(aztecNode, config, options = {
         proofCreator: prover,
         simulator,
         protocolContractsProvider,
+        preloadedContractsProvider,
         config: configWithContracts,
-        loggerOrSuffix: pxeLogger
+        loggerOrSuffix: pxeLogger,
+        hooks: options.hooks
     });
     return pxe;
 }

package/dest/events/event_service.d.ts

@@ -1,16 +1,24 @@
-import type { Fr } from '@aztec/foundation/curves/bn254';
-import type { EventSelector } from '@aztec/stdlib/abi';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
-import type { BlockHeader, TxHash } from '@aztec/stdlib/tx';
+import type { BlockHeader, IndexedTxEffect } from '@aztec/stdlib/tx';
+import type { EventValidationRequest } from '../contract_function_simulator/noir-structs/event_validation_request.js';
 import { PrivateEventStore } from '../storage/private_event_store/private_event_store.js';
 export declare class EventService {
+    #private;
     private readonly anchorBlockHeader;
     private readonly aztecNode;
     private readonly privateEventStore;
     private readonly jobId;
     private readonly log;
     constructor(anchorBlockHeader: BlockHeader, aztecNode: AztecNode, privateEventStore: PrivateEventStore, jobId: string, log?: import("@aztec/foundation/log").Logger);
-    validateAndStoreEvent(contractAddress: AztecAddress, selector: EventSelector, randomness: Fr, content: Fr[], eventCommitment: Fr, txHash: TxHash, scope: AztecAddress): Promise<void>;
+    /**
+     * Validates and stores a batch of private events against pre-fetched tx effects.
+     *
+     * @param requests - The events to validate and store.
+     * @param scope - The scope under which the events are being stored.
+     * @param txEffects - Pre-fetched tx effects keyed by `TxHash.toString()`. Must contain entries for every request's
+     *                   txHash; missing entries are treated as a node bug and cause an error.
+     */
+    validateAndStoreEvents(requests: EventValidationRequest[], scope: AztecAddress, txEffects: Map<string, IndexedTxEffect>): Promise<void>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXZlbnRfc2VydmljZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2V2ZW50cy9ldmVudF9zZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLEVBQUUsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBRXpELE9BQU8sS0FBSyxFQUFFLGFBQWEsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRWhFLE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ2pFLE9BQU8sS0FBSyxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUU1RCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSx1REFBdUQsQ0FBQztBQUUxRixxQkFBYSxZQUFZO0lBRXJCLE9BQU8sQ0FBQyxRQUFRLENBQUMsaUJBQWlCO0lBQ2xDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUztJQUMxQixPQUFPLENBQUMsUUFBUSxDQUFDLGlCQUFpQjtJQUNsQyxPQUFPLENBQUMsUUFBUSxDQUFDLEtBQUs7SUFDdEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHO0lBTHRCLFlBQ21CLGlCQUFpQixFQUFFLFdBQVcsRUFDOUIsU0FBUyxFQUFFLFNBQVMsRUFDcEIsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQ3BDLEtBQUssRUFBRSxNQUFNLEVBQ2IsR0FBRyx5Q0FBb0MsRUFDdEQ7SUFFUyxxQkFBcUIsQ0FDaEMsZUFBZSxFQUFFLFlBQVksRUFDN0IsUUFBUSxFQUFFLGFBQWEsRUFDdkIsVUFBVSxFQUFFLEVBQUUsRUFDZCxPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQ2IsZUFBZSxFQUFFLEVBQUUsRUFDbkIsTUFBTSxFQUFFLE1BQU0sRUFDZCxLQUFLLEVBQUUsWUFBWSxHQUNsQixPQUFPLENBQUMsSUFBSSxDQUFDLENBdURmO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXZlbnRfc2VydmljZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2V2ZW50cy9ldmVudF9zZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sS0FBSyxFQUFFLFlBQVksRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRWhFLE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ2pFLE9BQU8sS0FBSyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUVyRSxPQUFPLEtBQUssRUFBRSxzQkFBc0IsRUFBRSxNQUFNLHlFQUF5RSxDQUFDO0FBQ3RILE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLHVEQUF1RCxDQUFDO0FBRTFGLHFCQUFhLFlBQVk7O0lBRXJCLE9BQU8sQ0FBQyxRQUFRLENBQUMsaUJBQWlCO0lBQ2xDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUztJQUMxQixPQUFPLENBQUMsUUFBUSxDQUFDLGlCQUFpQjtJQUNsQyxPQUFPLENBQUMsUUFBUSxDQUFDLEtBQUs7SUFDdEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHO0lBTHRCLFlBQ21CLGlCQUFpQixFQUFFLFdBQVcsRUFDOUIsU0FBUyxFQUFFLFNBQVMsRUFDcEIsaUJBQWlCLEVBQUUsaUJBQWlCLEVBQ3BDLEtBQUssRUFBRSxNQUFNLEVBQ2IsR0FBRyx5Q0FBb0MsRUFDdEQ7SUFFSjs7Ozs7OztPQU9HO0lBQ1Usc0JBQXNCLENBQ2pDLFFBQVEsRUFBRSxzQkFBc0IsRUFBRSxFQUNsQyxLQUFLLEVBQUUsWUFBWSxFQUNuQixTQUFTLEVBQUUsR0FBRyxDQUFDLE1BQU0sRUFBRSxlQUFlLENBQUMsR0FDdEMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQVFmO0NBZ0ZGIn0=

package/dest/events/event_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event_service.d.ts","sourceRoot":"","sources":["../../src/events/event_service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AAEzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAE1F,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,YACmB,iBAAiB,EAAE,WAAW,EAC9B,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,EAAE,MAAM,EACb,GAAG,yCAAoC,EACtD;IAES,qBAAqB,CAChC,eAAe,EAAE,YAAY,EAC7B,QAAQ,EAAE,aAAa,EACvB,UAAU,EAAE,EAAE,EACd,OAAO,EAAE,EAAE,EAAE,EACb,eAAe,EAAE,EAAE,EACnB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAuDf;CACF"}
+{"version":3,"file":"event_service.d.ts","sourceRoot":"","sources":["../../src/events/event_service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAErE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yEAAyE,CAAC;AACtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAE1F,qBAAa,YAAY;;IAErB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,YACmB,iBAAiB,EAAE,WAAW,EAC9B,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,iBAAiB,EACpC,KAAK,EAAE,MAAM,EACb,GAAG,yCAAoC,EACtD;IAEJ;;;;;;;OAOG;IACU,sBAAsB,CACjC,QAAQ,EAAE,sBAAsB,EAAE,EAClC,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAQf;CAgFF"}

package/dest/events/event_service.js

@@ -1,5 +1,5 @@
 import { createLogger } from '@aztec/foundation/log';
-import { siloNullifier } from '@aztec/stdlib/hash';
+import { computePrivateEventCommitment, siloNullifier } from '@aztec/stdlib/hash';
 export class EventService {
     anchorBlockHeader;
     aztecNode;
@@ -13,20 +13,41 @@ export class EventService {
         this.jobId = jobId;
         this.log = log;
     }
-    async validateAndStoreEvent(contractAddress, selector, randomness, content, eventCommitment, txHash, scope) {
+    /**
+   * Validates and stores a batch of private events against pre-fetched tx effects.
+   *
+   * @param requests - The events to validate and store.
+   * @param scope - The scope under which the events are being stored.
+   * @param txEffects - Pre-fetched tx effects keyed by `TxHash.toString()`. Must contain entries for every request's
+   *                   txHash; missing entries are treated as a node bug and cause an error.
+   */ async validateAndStoreEvents(requests, scope, txEffects) {
+        if (requests.length === 0) {
+            return;
+        }
+        const anchorBlockNumber = this.anchorBlockHeader.getBlockNumber();
+        await Promise.all(requests.map((req)=>this.#validateAndStoreEvent(req, scope, txEffects, anchorBlockNumber)));
+    }
+    async #validateAndStoreEvent(request, scope, txEffects, anchorBlockNumber) {
+        const { contractAddress, eventTypeId: selector, randomness, serializedEvent: content, eventCommitment, txHash } = request;
+        // Defense-in-depth: the built-in private-event path derives this commitment from content before enqueueing, but
+        // unconstrained PXE-side code (e.g. a custom message handler) can reach this oracle with arbitrary
+        // (content, commitment) pairs. Without this check it could bind arbitrary content to a legitimate tx nullifier,
+        // causing PXE to surface fabricated event data.
+        const recomputedCommitment = await computePrivateEventCommitment(randomness, selector.toField(), content);
+        if (!recomputedCommitment.equals(eventCommitment)) {
+            this.log.warn(`Skipping event whose content does not hash to the provided commitment. contract=${contractAddress}, selector=${selector}, eventCommitment=${eventCommitment}, txHash=${txHash}, recomputedCommitment=${recomputedCommitment}`);
+            return;
+        }
         // While using 'latest' block number would be fine for private events since they cannot be accessed from Aztec.nr
         // (and thus we're less concerned about being ahead of the synced block), we use the synced block number to
         // maintain consistent behavior in the PXE. Additionally, events should never be ahead of the synced block here
         // since `fetchTaggedLogs` only processes logs up to the synced block.
-        const [siloedEventCommitment, txEffect] = await Promise.all([
-            siloNullifier(contractAddress, eventCommitment),
-            this.aztecNode.getTxEffect(txHash)
-        ]);
-        const anchorBlockNumber = this.anchorBlockHeader.getBlockNumber();
+        const siloedEventCommitment = await siloNullifier(contractAddress, eventCommitment);
+        const txEffect = txEffects.get(txHash.toString());
         if (!txEffect) {
             // We error out instead of just logging a warning and skipping the event because this would indicate a bug. This
-            // is because the node has already served info about this tx either when obtaining the log (TxScopedL2Log contain
-            // tx info) or when getting metadata for the offchain message (before the message got passed to `process_log`).
+            // is because the node has already served info about this tx either when obtaining the log (LogResult carries
+            // the tx info) or when getting metadata for the offchain message (before the message got passed to `process_log`).
             throw new Error(`Could not find tx effect for tx hash ${txHash} when processing an event.`);
         }
         if (txEffect.l2BlockNumber > anchorBlockNumber) {

package/dest/hooks/authorize_utility_call.d.ts

@@ -0,0 +1,41 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { FunctionSelector } from '@aztec/stdlib/abi';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+/** Information about a cross-contract utility call that requires authorization. */
+export type UtilityCallAuthorizationRequest = {
+    /** The contract requesting the cross-contract call. */
+    caller: AztecAddress;
+    /** The contract class ID of the calling contract. */
+    callerClassId: Fr;
+    /** The target contract being called. */
+    target: AztecAddress;
+    /** The contract class ID of the target contract. */
+    targetClassId: Fr;
+    /** The function selector being invoked on the target. */
+    functionSelector: FunctionSelector;
+    /** The name of the function being called, from the contract artifact. */
+    functionName: string;
+    /** The serialized arguments passed to the function. */
+    args: Fr[];
+    /** The execution context from which the call originates. */
+    callerContext: 'private' | 'private view' | 'utility';
+};
+/** Authorization was granted. */
+type Authorized = {
+    authorized: true;
+};
+/** Authorization was denied. */
+type Denied = {
+    authorized: false;
+    /** Reason for denial, included in the error message. */
+    reason?: string;
+};
+/** Result of an authorization hook evaluation. */
+export type UtilityCallAuthorizationResponse = Authorized | Denied;
+/**
+ * Hook called when a utility function attempts a cross-contract call.
+ * Returns a response indicating whether the call is authorized and an optional denial reason.
+ */
+export type AuthorizeUtilityCall = (request: UtilityCallAuthorizationRequest) => Promise<UtilityCallAuthorizationResponse>;
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXplX3V0aWxpdHlfY2FsbC5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2hvb2tzL2F1dGhvcml6ZV91dGlsaXR5X2NhbGwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEVBQUUsRUFBRSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDekQsT0FBTyxLQUFLLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUMxRCxPQUFPLEtBQUssRUFBRSxZQUFZLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUVoRSxtRkFBbUY7QUFDbkYsTUFBTSxNQUFNLCtCQUErQixHQUFHO0lBQzVDLHVEQUF1RDtJQUN2RCxNQUFNLEVBQUUsWUFBWSxDQUFDO0lBQ3JCLHFEQUFxRDtJQUNyRCxhQUFhLEVBQUUsRUFBRSxDQUFDO0lBQ2xCLHdDQUF3QztJQUN4QyxNQUFNLEVBQUUsWUFBWSxDQUFDO0lBQ3JCLG9EQUFvRDtJQUNwRCxhQUFhLEVBQUUsRUFBRSxDQUFDO0lBQ2xCLHlEQUF5RDtJQUN6RCxnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQztJQUNuQyx5RUFBeUU7SUFDekUsWUFBWSxFQUFFLE1BQU0sQ0FBQztJQUNyQix1REFBdUQ7SUFDdkQsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUFDO0lBQ1gsNERBQTREO0lBQzVELGFBQWEsRUFBRSxTQUFTLEdBQUcsY0FBYyxHQUFHLFNBQVMsQ0FBQztDQUN2RCxDQUFDO0FBRUYsaUNBQWlDO0FBQ2pDLEtBQUssVUFBVSxHQUFHO0lBQUUsVUFBVSxFQUFFLElBQUksQ0FBQTtDQUFFLENBQUM7QUFFdkMsZ0NBQWdDO0FBQ2hDLEtBQUssTUFBTSxHQUFHO0lBQ1osVUFBVSxFQUFFLEtBQUssQ0FBQztJQUNsQix3REFBd0Q7SUFDeEQsTUFBTSxDQUFDLEVBQUUsTUFBTSxDQUFDO0NBQ2pCLENBQUM7QUFFRixrREFBa0Q7QUFDbEQsTUFBTSxNQUFNLGdDQUFnQyxHQUFHLFVBQVUsR0FBRyxNQUFNLENBQUM7QUFFbkU7OztHQUdHO0FBQ0gsTUFBTSxNQUFNLG9CQUFvQixHQUFHLENBQ2pDLE9BQU8sRUFBRSwrQkFBK0IsS0FDckMsT0FBTyxDQUFDLGdDQUFnQyxDQUFDLENBQUMifQ==

package/dest/hooks/authorize_utility_call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize_utility_call.d.ts","sourceRoot":"","sources":["../../src/hooks/authorize_utility_call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,mFAAmF;AACnF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,uDAAuD;IACvD,MAAM,EAAE,YAAY,CAAC;IACrB,qDAAqD;IACrD,aAAa,EAAE,EAAE,CAAC;IAClB,wCAAwC;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,aAAa,EAAE,EAAE,CAAC;IAClB,yDAAyD;IACzD,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,IAAI,EAAE,EAAE,EAAE,CAAC;IACX,4DAA4D;IAC5D,aAAa,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,CAAC;CACvD,CAAC;AAEF,iCAAiC;AACjC,KAAK,UAAU,GAAG;IAAE,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEvC,gCAAgC;AAChC,KAAK,MAAM,GAAG;IACZ,UAAU,EAAE,KAAK,CAAC;IAClB,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,kDAAkD;AAClD,MAAM,MAAM,gCAAgC,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnE;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,+BAA+B,KACrC,OAAO,CAAC,gCAAgC,CAAC,CAAC"}

package/dest/hooks/authorize_utility_call.js

@@ -0,0 +1,4 @@
+/**
+ * Hook called when a utility function attempts a cross-contract call.
+ * Returns a response indicating whether the call is authorized and an optional denial reason.
+ */ export { };

package/dest/hooks/execution_hooks.d.ts

@@ -0,0 +1,42 @@
+import type { AuthorizeUtilityCall } from './authorize_utility_call.js';
+/**
+ * Hooks that PXE invokes during client-side simulation to gate operations that the protocol
+ * does not restrict on its own. They give the wallet a chance to apply custom policies (e.g.
+ * prompting the user, consulting a dynamic allowlist, or inspecting call arguments) before the
+ * execution proceeds.
+ *
+ * For example, {@link authorizeUtilityCall} is called whenever a utility function makes a
+ * cross-contract call. A call made by a malicious contract could leak private information, so the
+ * hook lets the wallet decide, per-call, whether to allow it. A static allowlist would not work
+ * here because neither the app nor the wallet can predict ahead of time which contracts will be
+ * invoked during execution.
+ *
+ * Note: hooks are unrelated to authentication witnesses (authwits). Authwits are an on-chain
+ * mechanism where a contract verifies that a caller was authorized by a specific account; hooks
+ * are a client-side PXE concern that gates execution before it proceeds.
+ *
+ * @example
+ * ```ts
+ * const pxe = await PXE.create({
+ *   // ...
+ *   hooks: {
+ *     authorizeUtilityCall: async (req) => {
+ *       // Allow calls to a known helper contract, deny everything else.
+ *       return req.target.equals(trustedHelper)
+ *         ? { authorized: true }
+ *         : { authorized: false, reason: 'Unknown target' };
+ *     },
+ *   },
+ * });
+ * ```
+ */
+export interface ExecutionHooks {
+    /** Called when a contract attempts a cross-contract utility call. */
+    authorizeUtilityCall: AuthorizeUtilityCall;
+}
+/**
+ * Builds an {@link ExecutionHooks} from individually-constructed hook callbacks. Returns `undefined`
+ * when every field is absent, so callers can unconditionally pass the result as `hooks`.
+ */
+export declare function composeHooks(partial: Partial<ExecutionHooks>): ExecutionHooks | undefined;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhlY3V0aW9uX2hvb2tzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaG9va3MvZXhlY3V0aW9uX2hvb2tzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFeEU7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQThCRztBQUNILE1BQU0sV0FBVyxjQUFjO0lBQzdCLHFFQUFxRTtJQUNyRSxvQkFBb0IsRUFBRSxvQkFBb0IsQ0FBQztDQUM1QztBQUVEOzs7R0FHRztBQUNILHdCQUFnQixZQUFZLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxjQUFjLENBQUMsR0FBRyxjQUFjLEdBQUcsU0FBUyxDQUt6RiJ9

package/dest/hooks/execution_hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution_hooks.d.ts","sourceRoot":"","sources":["../../src/hooks/execution_hooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,GAAG,SAAS,CAKzF"}

package/dest/hooks/execution_hooks.js

@@ -0,0 +1,9 @@
+/**
+ * Builds an {@link ExecutionHooks} from individually-constructed hook callbacks. Returns `undefined`
+ * when every field is absent, so callers can unconditionally pass the result as `hooks`.
+ */ export function composeHooks(partial) {
+    if (Object.values(partial).every((v)=>v === undefined)) {
+        return undefined;
+    }
+    return partial;
+}

package/dest/hooks/index.d.ts

@@ -0,0 +1,4 @@
+export type { AuthorizeUtilityCall, UtilityCallAuthorizationRequest, UtilityCallAuthorizationResponse, } from './authorize_utility_call.js';
+export type { ExecutionHooks } from './execution_hooks.js';
+export { composeHooks } from './execution_hooks.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9ob29rcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxZQUFZLEVBQ1Ysb0JBQW9CLEVBQ3BCLCtCQUErQixFQUMvQixnQ0FBZ0MsR0FDakMsTUFBTSw2QkFBNkIsQ0FBQztBQUNyQyxZQUFZLEVBQUUsY0FBYyxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDM0QsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLHNCQUFzQixDQUFDIn0=

package/dest/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hooks/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,oBAAoB,EACpB,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}

package/dest/hooks/index.js

@@ -0,0 +1 @@
+export { composeHooks } from './execution_hooks.js';

package/dest/logs/log_service.d.ts

@@ -3,9 +3,9 @@ import type { KeyStore } from '@aztec/key-store';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { L2TipsProvider } from '@aztec/stdlib/block';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
-import { PendingTaggedLog } from '@aztec/stdlib/logs';
+import { AppTaggingSecret, PendingTaggedLog } from '@aztec/stdlib/logs';
 import type { BlockHeader } from '@aztec/stdlib/tx';
-import type { LogRetrievalRequest } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
+import { type LogRetrievalRequest } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
 import { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
 import { AddressStore } from '../storage/address_store/address_store.js';
 import type { RecipientTaggingStore } from '../storage/tagging_store/recipient_tagging_store.js';
@@ -22,7 +22,8 @@ export declare class LogService {
     private readonly jobId;
     private log;
     constructor(aztecNode: AztecNode, anchorBlockHeader: BlockHeader, l2TipsStore: L2TipsProvider, keyStore: KeyStore, recipientTaggingStore: RecipientTaggingStore, senderAddressBookStore: SenderAddressBookStore, addressStore: AddressStore, jobId: string, bindings?: LoggerBindings);
-    fetchLogsByTag(contractAddress: AztecAddress, logRetrievalRequests: LogRetrievalRequest[]): Promise<(LogRetrievalResponse | null)[]>;
-    fetchTaggedLogs(contractAddress: AztecAddress, recipient: AztecAddress): Promise<PendingTaggedLog[]>;
+    /** Fetches all logs matching each request's tag, returning an array of log arrays (one per request). */
+    fetchLogsByTag(contractAddress: AztecAddress, logRetrievalRequests: LogRetrievalRequest[]): Promise<LogRetrievalResponse[][]>;
+    fetchTaggedLogs(contractAddress: AztecAddress, recipient: AztecAddress, providedSecrets: AppTaggingSecret[]): Promise<PendingTaggedLog[]>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9nX3NlcnZpY2UuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9sb2dzL2xvZ19zZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBZSxLQUFLLGNBQWMsRUFBZ0IsTUFBTSx1QkFBdUIsQ0FBQztBQUN2RixPQUFPLEtBQUssRUFBRSxRQUFRLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNqRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0QsT0FBTyxLQUFLLEVBQUUsY0FBYyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDMUQsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDakUsT0FBTyxFQUF1QyxnQkFBZ0IsRUFBa0IsTUFBTSxvQkFBb0IsQ0FBQztBQUMzRyxPQUFPLEtBQUssRUFBRSxXQUFXLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUVwRCxPQUFPLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHNFQUFzRSxDQUFDO0FBQ2hILE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHVFQUF1RSxDQUFDO0FBQzdHLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSwyQ0FBMkMsQ0FBQztBQUN6RSxPQUFPLEtBQUssRUFBRSxxQkFBcUIsRUFBRSxNQUFNLHFEQUFxRCxDQUFDO0FBQ2pHLE9BQU8sS0FBSyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sdURBQXVELENBQUM7QUFPcEcscUJBQWEsVUFBVTs7SUFJbkIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxTQUFTO0lBQzFCLE9BQU8sQ0FBQyxRQUFRLENBQUMsaUJBQWlCO0lBQ2xDLE9BQU8sQ0FBQyxRQUFRLENBQUMsV0FBVztJQUM1QixPQUFPLENBQUMsUUFBUSxDQUFDLFFBQVE7SUFDekIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxxQkFBcUI7SUFDdEMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxzQkFBc0I7SUFDdkMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZO0lBQzdCLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSztJQVZ4QixPQUFPLENBQUMsR0FBRyxDQUFTO0lBRXBCLFlBQ21CLFNBQVMsRUFBRSxTQUFTLEVBQ3BCLGlCQUFpQixFQUFFLFdBQVcsRUFDOUIsV0FBVyxFQUFFLGNBQWMsRUFDM0IsUUFBUSxFQUFFLFFBQVEsRUFDbEIscUJBQXFCLEVBQUUscUJBQXFCLEVBQzVDLHNCQUFzQixFQUFFLHNCQUFzQixFQUM5QyxZQUFZLEVBQUUsWUFBWSxFQUMxQixLQUFLLEVBQUUsTUFBTSxFQUM5QixRQUFRLENBQUMsRUFBRSxjQUFjLEVBRzFCO0lBRVksY0FBYyxDQUN6QixlQUFlLEVBQUUsWUFBWSxFQUM3QixvQkFBb0IsRUFBRSxtQkFBbUIsRUFBRSxHQUMxQyxPQUFPLENBQUMsQ0FBQyxvQkFBb0IsR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDLENBdUIxQztJQXFEWSxlQUFlLENBQUMsZUFBZSxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLENBa0NoSDtDQTBDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9nX3NlcnZpY2UuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9sb2dzL2xvZ19zZXJ2aWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBZSxLQUFLLGNBQWMsRUFBZ0IsTUFBTSx1QkFBdUIsQ0FBQztBQUN2RixPQUFPLEtBQUssRUFBRSxRQUFRLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUNqRCxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0QsT0FBTyxLQUFLLEVBQWEsY0FBYyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDckUsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDakUsT0FBTyxFQUFFLGdCQUFnQixFQUFrQixnQkFBZ0IsRUFBYSxNQUFNLG9CQUFvQixDQUFDO0FBQ25HLE9BQU8sS0FBSyxFQUFFLFdBQVcsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRXBELE9BQU8sRUFDTCxLQUFLLG1CQUFtQixFQUV6QixNQUFNLHNFQUFzRSxDQUFDO0FBQzlFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHVFQUF1RSxDQUFDO0FBQzdHLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSwyQ0FBMkMsQ0FBQztBQUN6RSxPQUFPLEtBQUssRUFBRSxxQkFBcUIsRUFBRSxNQUFNLHFEQUFxRCxDQUFDO0FBQ2pHLE9BQU8sS0FBSyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sdURBQXVELENBQUM7QUFXcEcscUJBQWEsVUFBVTs7SUFJbkIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxTQUFTO0lBQzFCLE9BQU8sQ0FBQyxRQUFRLENBQUMsaUJBQWlCO0lBQ2xDLE9BQU8sQ0FBQyxRQUFRLENBQUMsV0FBVztJQUM1QixPQUFPLENBQUMsUUFBUSxDQUFDLFFBQVE7SUFDekIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxxQkFBcUI7SUFDdEMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxzQkFBc0I7SUFDdkMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZO0lBQzdCLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSztJQVZ4QixPQUFPLENBQUMsR0FBRyxDQUFTO0lBRXBCLFlBQ21CLFNBQVMsRUFBRSxTQUFTLEVBQ3BCLGlCQUFpQixFQUFFLFdBQVcsRUFDOUIsV0FBVyxFQUFFLGNBQWMsRUFDM0IsUUFBUSxFQUFFLFFBQVEsRUFDbEIscUJBQXFCLEVBQUUscUJBQXFCLEVBQzVDLHNCQUFzQixFQUFFLHNCQUFzQixFQUM5QyxZQUFZLEVBQUUsWUFBWSxFQUMxQixLQUFLLEVBQUUsTUFBTSxFQUM5QixRQUFRLENBQUMsRUFBRSxjQUFjLEVBRzFCO0lBRUQsd0dBQXdHO0lBQzNGLGNBQWMsQ0FDekIsZUFBZSxFQUFFLFlBQVksRUFDN0Isb0JBQW9CLEVBQUUsbUJBQW1CLEVBQUUsR0FDMUMsT0FBTyxDQUFDLG9CQUFvQixFQUFFLEVBQUUsQ0FBQyxDQXNCbkM7SUFrR1ksZUFBZSxDQUMxQixlQUFlLEVBQUUsWUFBWSxFQUM3QixTQUFTLEVBQUUsWUFBWSxFQUN2QixlQUFlLEVBQUUsZ0JBQWdCLEVBQUUsR0FDbEMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLENBQUMsQ0F5QjdCO0NBdUNGIn0=

package/dest/logs/log_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log_service.d.ts","sourceRoot":"","sources":["../../src/logs/log_service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAuC,gBAAgB,EAAkB,MAAM,oBAAoB,CAAC;AAC3G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uEAAuE,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AACjG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAOpG,qBAAa,UAAU;;IAInB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAVxB,OAAO,CAAC,GAAG,CAAS;IAEpB,YACmB,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,WAAW,EAC9B,WAAW,EAAE,cAAc,EAC3B,QAAQ,EAAE,QAAQ,EAClB,qBAAqB,EAAE,qBAAqB,EAC5C,sBAAsB,EAAE,sBAAsB,EAC9C,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,MAAM,EAC9B,QAAQ,CAAC,EAAE,cAAc,EAG1B;IAEY,cAAc,CACzB,eAAe,EAAE,YAAY,EAC7B,oBAAoB,EAAE,mBAAmB,EAAE,GAC1C,OAAO,CAAC,CAAC,oBAAoB,GAAG,IAAI,CAAC,EAAE,CAAC,CAuB1C;IAqDY,eAAe,CAAC,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkChH;CA0CF"}
+{"version":3,"file":"log_service.d.ts","sourceRoot":"","sources":["../../src/logs/log_service.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAa,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAkB,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AACnG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uEAAuE,CAAC;AAC7G,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AACjG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAWpG,qBAAa,UAAU;;IAInB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAVxB,OAAO,CAAC,GAAG,CAAS;IAEpB,YACmB,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,WAAW,EAC9B,WAAW,EAAE,cAAc,EAC3B,QAAQ,EAAE,QAAQ,EAClB,qBAAqB,EAAE,qBAAqB,EAC5C,sBAAsB,EAAE,sBAAsB,EAC9C,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,MAAM,EAC9B,QAAQ,CAAC,EAAE,cAAc,EAG1B;IAED,wGAAwG;IAC3F,cAAc,CACzB,eAAe,EAAE,YAAY,EAC7B,oBAAoB,EAAE,mBAAmB,EAAE,GAC1C,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAsBnC;IAkGY,eAAe,CAC1B,eAAe,EAAE,YAAY,EAC7B,SAAS,EAAE,YAAY,EACvB,eAAe,EAAE,gBAAgB,EAAE,GAClC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyB7B;CAuCF"}

package/dest/logs/log_service.js

@@ -1,8 +1,10 @@
 import { createLogger } from '@aztec/foundation/log';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
-import { ExtendedDirectionalAppTaggingSecret, PendingTaggedLog, SiloedTag } from '@aztec/stdlib/logs';
+import { AppTaggingSecret, PendingTaggedLog, SiloedTag } from '@aztec/stdlib/logs';
+import { LogSource } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
 import { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
-import { getAllPrivateLogsByTags, getAllPublicLogsByTagsFromContract, loadPrivateLogsForSenderRecipientPair } from '../tagging/index.js';
+import { getAllPrivateLogsByTags, getAllPublicLogsByTagsFromContract, syncTaggedPrivateLogs } from '../tagging/index.js';
+const rangeKey = (fromBlock, toBlock)=>`${fromBlock ?? ''}-${toBlock ?? ''}`;
 export class LogService {
     aztecNode;
     anchorBlockHeader;
@@ -24,63 +26,125 @@ export class LogService {
         this.jobId = jobId;
         this.log = createLogger('pxe:log_service', bindings);
     }
-    async fetchLogsByTag(contractAddress, logRetrievalRequests) {
+    /** Fetches all logs matching each request's tag, returning an array of log arrays (one per request). */ async fetchLogsByTag(contractAddress, logRetrievalRequests) {
         for (const request of logRetrievalRequests){
             if (!contractAddress.equals(request.contractAddress)) {
                 throw new Error(`Got a log retrieval request from ${request.contractAddress}, expected ${contractAddress}`);
             }
         }
-        return await Promise.all(logRetrievalRequests.map(async (request)=>{
-            const [publicLog, privateLog] = await Promise.all([
-                this.#getPublicLogByTag(request.tag, request.contractAddress),
-                this.#getPrivateLogByTag(await SiloedTag.computeFromTagAndApp(request.tag, request.contractAddress))
+        if (logRetrievalRequests.length === 0) {
+            return [];
+        }
+        const anchorBlockHash = await this.anchorBlockHeader.hash();
+        const [publicLogsPerRequest, privateLogsPerRequest] = await Promise.all([
+            this.#fetchPublicLogs(contractAddress, logRetrievalRequests, anchorBlockHash),
+            this.#fetchPrivateLogs(logRetrievalRequests, anchorBlockHash)
+        ]);
+        return logRetrievalRequests.map((_request, i)=>[
+                ...publicLogsPerRequest[i].map(LogService.#toLogRetrievalResponse),
+                ...privateLogsPerRequest[i].map(LogService.#toLogRetrievalResponse)
             ]);
-            if (publicLog !== null && privateLog !== null) {
-                this.log.warn(`Found both a public and private log for tag ${request.tag} from contract ${request.contractAddress}. This may indicate a contract bug. Returning the public log.`);
-            }
-            return publicLog ?? privateLog;
+    }
+    async #fetchPublicLogs(contractAddress, requests, anchorBlockHash) {
+        const indices = requests.flatMap((r, i)=>r.source !== LogSource.PRIVATE ? [
+                i
+            ] : []);
+        if (indices.length === 0) {
+            return requests.map(()=>[]);
+        }
+        const resultsPerRequest = requests.map(()=>[]);
+        const groups = LogService.#groupByRange(indices.map((i)=>({
+                index: i,
+                request: requests[i]
+            })));
+        await Promise.all(Array.from(groups.values()).map(async (group)=>{
+            const tags = group.entries.map((e)=>e.request.tag);
+            const results = await getAllPublicLogsByTagsFromContract(this.aztecNode, contractAddress, tags, anchorBlockHash, {
+                fromBlock: group.fromBlock,
+                toBlock: group.toBlock,
+                includeEffects: true
+            });
+            group.entries.forEach((entry, i)=>{
+                resultsPerRequest[entry.index] = results[i];
+            });
         }));
+        return resultsPerRequest;
     }
-    async #getPublicLogByTag(tag, contractAddress) {
-        const anchorBlockHash = await this.anchorBlockHeader.hash();
-        const allLogsPerTag = await getAllPublicLogsByTagsFromContract(this.aztecNode, contractAddress, [
-            tag
-        ], anchorBlockHash);
-        const logsForTag = allLogsPerTag[0];
-        if (logsForTag.length === 0) {
-            return null;
-        } else if (logsForTag.length > 1) {
-            this.log.warn(`Expected at most 1 public log for tag ${tag} and contract ${contractAddress.toString()}, got ${logsForTag.length}. This may indicate a contract bug. Returning the first log.`);
+    async #fetchPrivateLogs(requests, anchorBlockHash) {
+        const indices = requests.flatMap((r, i)=>r.source !== LogSource.PUBLIC ? [
+                i
+            ] : []);
+        if (indices.length === 0) {
+            return requests.map(()=>[]);
         }
-        const scopedLog = logsForTag[0];
-        return new LogRetrievalResponse(scopedLog.logData.slice(1), scopedLog.txHash, scopedLog.noteHashes, scopedLog.firstNullifier);
+        const resultsPerRequest = requests.map(()=>[]);
+        const groups = LogService.#groupByRange(indices.map((i)=>({
+                index: i,
+                request: requests[i]
+            })));
+        await Promise.all(Array.from(groups.values()).map(async (group)=>{
+            const siloedTags = await Promise.all(group.entries.map((e)=>SiloedTag.computeFromTagAndApp(e.request.tag, e.request.contractAddress)));
+            const results = await getAllPrivateLogsByTags(this.aztecNode, siloedTags, anchorBlockHash, {
+                fromBlock: group.fromBlock,
+                toBlock: group.toBlock,
+                includeEffects: true
+            });
+            group.entries.forEach((entry, i)=>{
+                resultsPerRequest[entry.index] = results[i];
+            });
+        }));
+        return resultsPerRequest;
     }
-    async #getPrivateLogByTag(siloedTag) {
-        const anchorBlockHash = await this.anchorBlockHeader.hash();
-        const allLogsPerTag = await getAllPrivateLogsByTags(this.aztecNode, [
-            siloedTag
-        ], anchorBlockHash);
-        const logsForTag = allLogsPerTag[0];
-        if (logsForTag.length === 0) {
-            return null;
-        } else if (logsForTag.length > 1) {
-            this.log.warn(`Expected at most 1 private log for tag ${siloedTag}, got ${logsForTag.length}. This may indicate a contract bug. Returning the first log.`);
+    /**
+   * Groups requests by their (fromBlock, toBlock) range so each distinct range becomes a single node call with
+   * the range pushed down into the query (no in-memory filter).
+   */ static #groupByRange(entries) {
+        const groups = new Map();
+        for (const entry of entries){
+            const key = rangeKey(entry.request.fromBlock, entry.request.toBlock);
+            const existing = groups.get(key);
+            if (existing) {
+                existing.entries.push(entry);
+            } else {
+                groups.set(key, {
+                    fromBlock: entry.request.fromBlock,
+                    toBlock: entry.request.toBlock,
+                    entries: [
+                        entry
+                    ]
+                });
+            }
+        }
+        return groups;
+    }
+    static #toLogRetrievalResponse(log) {
+        // includeEffects: true was used, so noteHashes and nullifiers are populated. Every tx has at least one nullifier
+        // (the first nullifier derived from the tx hash); empty here would indicate a buggy node.
+        const noteHashes = log.noteHashes;
+        const nullifiers = log.nullifiers;
+        if (nullifiers.length === 0) {
+            throw new Error(`Log for tx ${log.txHash} returned no nullifiers from the node`);
         }
-        const scopedLog = logsForTag[0];
-        return new LogRetrievalResponse(scopedLog.logData.slice(1), scopedLog.txHash, scopedLog.noteHashes, scopedLog.firstNullifier);
+        return new LogRetrievalResponse(log.logData.slice(1), log.txHash, noteHashes, nullifiers[0]);
     }
-    async fetchTaggedLogs(contractAddress, recipient) {
+    async fetchTaggedLogs(contractAddress, recipient, providedSecrets) {
         this.log.verbose(`Fetching tagged logs for ${contractAddress.toString()}`);
-        // We only load logs from block up to and including the anchor block number
-        const anchorBlockNumber = this.anchorBlockHeader.getBlockNumber();
-        const anchorBlockHash = await this.anchorBlockHeader.hash();
         const l2Tips = await this.l2TipsStore.getL2Tips();
-        const currentTimestamp = this.anchorBlockHeader.globalVariables.timestamp;
-        // Get all secrets for this recipient (one per sender)
-        const secrets = await this.#getSecretsForSenders(contractAddress, recipient);
-        // Load logs for all sender-recipient pairs in parallel
-        const logArrays = await Promise.all(secrets.map((secret)=>loadPrivateLogsForSenderRecipientPair(secret, this.aztecNode, this.recipientTaggingStore, anchorBlockNumber, anchorBlockHash, currentTimestamp, l2Tips.finalized.block.number, this.jobId)));
-        return logArrays.flat().map((scopedLog)=>new PendingTaggedLog(scopedLog.logData, scopedLog.txHash, scopedLog.noteHashes, scopedLog.firstNullifier));
+        // The secrets PXE derives or stores internally, plus any the app supplies explicitly for secrets PXE cannot
+        // enumerate itself (e.g. handshake-derived ones).
+        const secrets = [
+            ...await this.#getSecretsForSenders(contractAddress, recipient),
+            ...providedSecrets
+        ];
+        const logs = await syncTaggedPrivateLogs(secrets, this.aztecNode, this.recipientTaggingStore, this.anchorBlockHeader, l2Tips.finalized.block.number, this.jobId);
+        return logs.map((log)=>{
+            const noteHashes = log.noteHashes;
+            const nullifiers = log.nullifiers;
+            if (nullifiers.length === 0) {
+                throw new Error(`Log for tx ${log.txHash} returned no nullifiers from the node`);
+            }
+            return new PendingTaggedLog(log.logData, log.txHash, noteHashes, nullifiers[0]);
+        });
     }
     async #getSecretsForSenders(contractAddress, recipient) {
         const recipientCompleteAddress = await this.addressStore.getCompleteAddress(recipient);
@@ -88,8 +152,8 @@ export class LogService {
             return [];
         }
         const recipientIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(recipient);
-        // We implicitly add all PXE accounts as senders, this helps us decrypt tags on notes that we send to ourselves
-        // (recipient = us, sender = us)
+        // We implicitly add all PXE accounts as senders, this helps us find tagged logs with messages that are sent to a
+        // local account (recipient = us, sender = us)
         const allSenders = [
             ...await this.senderAddressBookStore.getSenders(),
             ...await this.keyStore.getAccounts()
@@ -97,7 +161,7 @@ export class LogService {
         // We deduplicate the senders by adding them to a set and then converting the set back to an array
         const deduplicatedSenders = Array.from(new Set(allSenders.map((sender)=>sender.toString()))).map((sender)=>AztecAddress.fromString(sender));
         return Promise.all(deduplicatedSenders.map(async (sender)=>{
-            const secret = await ExtendedDirectionalAppTaggingSecret.compute(recipientCompleteAddress, recipientIvsk, sender, contractAddress, recipient);
+            const secret = await AppTaggingSecret.computeUnconstrained(recipientCompleteAddress, recipientIvsk, sender, contractAddress, recipient);
             if (!secret) {
                 // Note that all senders originate from either the SenderAddressBookStore or the KeyStore.
                 throw new Error(`Failed to compute a tagging secret for sender ${sender} - this implies this is an invalid address, which should not happen as they have been previously registered in PXE.`);

package/dest/messages/message_context_service.d.ts

@@ -14,4 +14,4 @@ export declare class MessageContextService {
      */
     getMessageContextsByTxHash(txHashes: Fr[], anchorBlockNumber: number): Promise<(MessageContext | null)[]>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWVzc2FnZV9jb250ZXh0X3NlcnZpY2UuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9tZXNzYWdlcy9tZXNzYWdlX2NvbnRleHRfc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDcEQsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDakUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBR3BELCtFQUErRTtBQUMvRSxxQkFBYSxxQkFBcUI7SUFDcEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxTQUFTO0lBQXRDLFlBQTZCLFNBQVMsRUFBRSxTQUFTLEVBQUk7SUFFckQ7Ozs7OztPQU1HO0lBQ0gsMEJBQTBCLENBQUMsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLGlCQUFpQixFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsQ0FBQyxjQUFjLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQTBCeEc7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWVzc2FnZV9jb250ZXh0X3NlcnZpY2UuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9tZXNzYWdlcy9tZXNzYWdlX2NvbnRleHRfc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFDcEQsT0FBTyxLQUFLLEVBQUUsU0FBUyxFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDakUsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBR3BELCtFQUErRTtBQUMvRSxxQkFBYSxxQkFBcUI7SUFDcEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxTQUFTO0lBQXRDLFlBQTZCLFNBQVMsRUFBRSxTQUFTLEVBQUk7SUFFckQ7Ozs7OztPQU1HO0lBQ0csMEJBQTBCLENBQUMsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLGlCQUFpQixFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsQ0FBQyxjQUFjLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQTJDOUc7Q0FDRiJ9

package/dest/messages/message_context_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message_context_service.d.ts","sourceRoot":"","sources":["../../src/messages/message_context_service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,+EAA+E;AAC/E,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,SAAS,EAAI;IAErD;;;;;;OAMG;IACH,0BAA0B,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,CA0BxG;CACF"}
+{"version":3,"file":"message_context_service.d.ts","sourceRoot":"","sources":["../../src/messages/message_context_service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,+EAA+E;AAC/E,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,SAAS,EAAI;IAErD;;;;;;OAMG;IACG,0BAA0B,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,CA2C9G;CACF"}

package/dest/messages/message_context_service.js

@@ -1,3 +1,4 @@
+import { uniqueBy } from '@aztec/foundation/collection';
 import { MessageContext } from '@aztec/stdlib/logs';
 import { TxHash } from '@aztec/stdlib/tx';
 /** Resolves transaction hashes into the context needed to process messages. */ export class MessageContextService {
@@ -11,16 +12,34 @@ import { TxHash } from '@aztec/stdlib/tx';
    * For each tx hash, looks up the corresponding tx effect and extracts the note hashes and first nullifier needed to
    * process messages that originated from that transaction. Returns `null` for tx hashes that are zero, not yet
    * available, or in blocks beyond the anchor block.
-   */ getMessageContextsByTxHash(txHashes, anchorBlockNumber) {
-        // TODO: optimize, we might be hitting the node to get the same txHash repeatedly
-        return Promise.all(txHashes.map(async (txHashField)=>{
-            // A zero tx hash indicates a tx-less offchain message (e.g. one not tied to any onchain transaction).
-            // These messages don't have a transaction context to resolve, so we return null.
-            if (txHashField.isZero()) {
-                return null;
+   */ async getMessageContextsByTxHash(txHashes, anchorBlockNumber) {
+        const nonZeroTxHashes = txHashes.filter((h)=>!h.isZero()).map((h)=>TxHash.fromField(h));
+        const uniqueTxHashes = uniqueBy(nonZeroTxHashes, (h)=>h.toString());
+        const fetched = await Promise.all(uniqueTxHashes.map((h)=>this.aztecNode.getTxReceipt(h, {
+                includeTxEffect: true
+            })));
+        const txEffects = new Map(uniqueTxHashes.map((h, i)=>{
+            const receipt = fetched[i];
+            if (!receipt.isMined() || !receipt.txEffect) {
+                return [
+                    h.toString(),
+                    undefined
+                ];
             }
+            return [
+                h.toString(),
+                {
+                    data: receipt.txEffect,
+                    l2BlockNumber: receipt.blockNumber,
+                    l2BlockHash: receipt.blockHash,
+                    txIndexInBlock: receipt.txIndexInBlock,
+                    slotNumber: receipt.slotNumber
+                }
+            ];
+        }).filter((entry)=>entry[1] !== undefined));
+        return txHashes.map((txHashField)=>{
             const txHash = TxHash.fromField(txHashField);
-            const txEffect = await this.aztecNode.getTxEffect(txHash);
+            const txEffect = txEffects.get(txHash.toString());
             if (!txEffect || txEffect.l2BlockNumber > anchorBlockNumber) {
                 return null;
             }
@@ -31,6 +50,6 @@ import { TxHash } from '@aztec/stdlib/tx';
                 throw new Error(`Tx effect for ${txHash} has no nullifiers`);
             }
             return new MessageContext(data.txHash, data.noteHashes, data.nullifiers[0]);
-        }));
+        });
     }
 }