@aztec/pxe 0.0.1-commit.2f68f620 → 0.0.1-commit.3100065

package/src/logs/log_service.ts

@@ -1,20 +1,31 @@
+import { PRIVATE_LOG_CIPHERTEXT_LEN } from '@aztec/constants';
 import type { BlockNumber } from '@aztec/foundation/branded-types';
+import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
 import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
 import type { KeyStore } from '@aztec/key-store';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { BlockHash, L2TipsProvider } from '@aztec/stdlib/block';
+import type { CompleteAddress } from '@aztec/stdlib/contract';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
-import { AppTaggingSecret, type LogResult, PendingTaggedLog, SiloedTag } from '@aztec/stdlib/logs';
+import {
+  AppTaggingSecret,
+  AppTaggingSecretKind,
+  type LogResult,
+  SiloedTag,
+  computeSharedTaggingSecret,
+} from '@aztec/stdlib/logs';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 
 import {
   type LogRetrievalRequest,
   LogSource,
 } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
-import { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
+import type { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
+import type { PendingTaggedLog } from '../contract_function_simulator/noir-structs/pending_tagged_log.js';
+import { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
 import { AddressStore } from '../storage/address_store/address_store.js';
 import type { RecipientTaggingStore } from '../storage/tagging_store/recipient_tagging_store.js';
-import type { SenderAddressBookStore } from '../storage/tagging_store/sender_address_book_store.js';
+import type { TaggingSecretSourcesStore } from '../storage/tagging_store/tagging_secret_sources_store.js';
 import {
   getAllPrivateLogsByTags,
   getAllPublicLogsByTagsFromContract,
@@ -34,7 +45,7 @@ export class LogService {
     private readonly l2TipsStore: L2TipsProvider,
     private readonly keyStore: KeyStore,
     private readonly recipientTaggingStore: RecipientTaggingStore,
-    private readonly senderAddressBookStore: SenderAddressBookStore,
+    private readonly taggingSecretSourcesStore: TaggingSecretSourcesStore,
     private readonly addressStore: AddressStore,
     private readonly jobId: string,
     bindings?: LoggerBindings,
@@ -139,12 +150,14 @@ export class LogService {
   ): Map<RangeKey, { fromBlock?: BlockNumber; toBlock?: BlockNumber; entries: typeof entries }> {
     const groups = new Map<RangeKey, { fromBlock?: BlockNumber; toBlock?: BlockNumber; entries: typeof entries }>();
     for (const entry of entries) {
-      const key = rangeKey(entry.request.fromBlock, entry.request.toBlock);
+      const fromBlock = entry.request.fromBlock.value;
+      const toBlock = entry.request.toBlock.value;
+      const key = rangeKey(fromBlock, toBlock);
       const existing = groups.get(key);
       if (existing) {
         existing.entries.push(entry);
       } else {
-        groups.set(key, { fromBlock: entry.request.fromBlock, toBlock: entry.request.toBlock, entries: [entry] });
+        groups.set(key, { fromBlock, toBlock, entries: [entry] });
       }
     }
     return groups;
@@ -158,12 +171,17 @@ export class LogService {
     if (nullifiers.length === 0) {
       throw new Error(`Log for tx ${log.txHash} returned no nullifiers from the node`);
     }
-    return new LogRetrievalResponse(
-      log.logData.slice(1), // Skip the tag
-      log.txHash,
-      noteHashes,
-      nullifiers[0],
-    );
+    return {
+      // Skip the tag, and clip to the wire cap: public logs can exceed PRIVATE_LOG_CIPHERTEXT_LEN, which is the fixed
+      // size of the oracle's BoundedVec slot. A no-op for private logs, which are already within the cap.
+      logPayload: log.logData.slice(1, 1 + PRIVATE_LOG_CIPHERTEXT_LEN),
+      txHash: log.txHash,
+      uniqueNoteHashesInTx: noteHashes,
+      firstNullifierInTx: nullifiers[0],
+      blockNumber: log.blockNumber,
+      blockTimestamp: log.blockTimestamp,
+      blockHash: log.blockHash,
+    };
   }
 
   public async fetchTaggedLogs(
@@ -171,12 +189,20 @@ export class LogService {
     recipient: AztecAddress,
     providedSecrets: AppTaggingSecret[],
   ): Promise<PendingTaggedLog[]> {
-    this.log.verbose(`Fetching tagged logs for ${contractAddress.toString()}`);
+    this.log.verbose(
+      `Fetching tagged logs for contract ${contractAddress.toString()} and recipient ${recipient.toString()}`,
+    );
 
     const l2Tips = await this.l2TipsStore.getL2Tips();
-    // The secrets PXE derives or stores internally, plus any the app supplies explicitly for secrets PXE cannot
-    // enumerate itself (e.g. handshake-derived ones).
-    const secrets = [...(await this.#getSecretsForSenders(contractAddress, recipient)), ...providedSecrets];
+
+    // Secrets PXE can enumerate for this recipient (senders via ECDH + pre-shared store secrets), plus any the app
+    // supplies explicitly for secrets PXE cannot enumerate itself (e.g. handshake-derived ones). The latter arrive
+    // already computed and are searched even when the recipient's account is unknown locally, since they need no ECDH.
+    const combinedSecrets = [...(await this.#getPointDerivedSecrets(contractAddress, recipient)), ...providedSecrets];
+
+    // These sources can overlap (a sender that is also a PXE account, or a pre-shared secret that coincides with a
+    // sender-derived one), so we deduplicate the combined set.
+    const secrets = Array.from(new Map(combinedSecrets.map(secret => [secret.toString(), secret])).values());
 
     const logs = await syncTaggedPrivateLogs(
       secrets,
@@ -193,44 +219,72 @@ export class LogService {
       if (nullifiers.length === 0) {
         throw new Error(`Log for tx ${log.txHash} returned no nullifiers from the node`);
       }
-      return new PendingTaggedLog(log.logData, log.txHash, noteHashes, nullifiers[0]);
+      return {
+        log: log.logData,
+        context: new ResolvedTx(log.txHash, noteHashes, nullifiers[0], log.blockNumber, log.blockHash.toFr()),
+      };
     });
   }
 
-  async #getSecretsForSenders(contractAddress: AztecAddress, recipient: AztecAddress): Promise<AppTaggingSecret[]> {
+  /**
+   * Computes the tagging secrets PXE can enumerate for a recipient: one per known sender (via ECDH) plus any
+   * pre-shared secrets registered directly for the recipient. Each registered secret is scanned under the tag
+   * streams its kind can back. Deriving the sender-based secrets requires the recipient's address preimage and keys,
+   * so returns an empty array when those are unavailable. App-supplied secrets (e.g. derived from discovered
+   * handshakes) are handled separately by the caller and do not go through here.
+   */
+  async #getPointDerivedSecrets(contractAddress: AztecAddress, recipient: AztecAddress): Promise<AppTaggingSecret[]> {
     const recipientCompleteAddress = await this.addressStore.getCompleteAddress(recipient);
-    if (!recipientCompleteAddress) {
+    if (!recipientCompleteAddress || !(await this.keyStore.hasAccount(recipient))) {
+      this.log.warn(
+        `Skipping sender-derived tag retrieval for ${recipient.toString()} due to unknown address preimage`,
+      );
       return [];
     }
     const recipientIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(recipient);
 
-    // We implicitly add all PXE accounts as senders, this helps us find tagged logs with messages that are sent to a
-    // local account (recipient = us, sender = us)
-    const allSenders = [...(await this.senderAddressBookStore.getSenders()), ...(await this.keyStore.getAccounts())];
+    const [senderPoints, registeredSecrets] = await Promise.all([
+      this.#getSecretsForSenders(recipientCompleteAddress, recipientIvsk),
+      this.taggingSecretSourcesStore.getSharedSecretsForRecipient(recipient),
+    ]);
+    return Promise.all([
+      ...senderPoints.map(secret => AppTaggingSecret.computeDirectional(secret, contractAddress, recipient)),
+      ...registeredSecrets.flatMap(({ kind, secret }) => {
+        switch (kind) {
+          case 'arbitrary-secret':
+            return [AppTaggingSecret.computeDirectional(secret, contractAddress, recipient)];
+          case 'handshake':
+            // A handshake-backed sender tags messages with the bare app-siloed secret, one tag domain per delivery
+            // mode.
+            return [
+              AppTaggingSecret.computeAppSiloed(secret, contractAddress, AppTaggingSecretKind.UNCONSTRAINED),
+              AppTaggingSecret.computeAppSiloed(secret, contractAddress, AppTaggingSecretKind.CONSTRAINED),
+            ];
+        }
+      }),
+    ]);
+  }
 
-    // We deduplicate the senders by adding them to a set and then converting the set back to an array
-    const deduplicatedSenders = Array.from(new Set(allSenders.map(sender => sender.toString()))).map(sender =>
-      AztecAddress.fromString(sender),
-    );
+  async #getSecretsForSenders(
+    recipientCompleteAddress: CompleteAddress,
+    recipientIvsk: GrumpkinScalar,
+  ): Promise<Point[]> {
+    // We implicitly add all PXE accounts as senders, this helps us decrypt tags on notes that we send to ourselves
+    // (recipient = us, sender = us).
+    const allSenders = [...(await this.taggingSecretSourcesStore.getSenders()), ...(await this.keyStore.getAccounts())];
 
     return Promise.all(
-      deduplicatedSenders.map(async sender => {
-        const secret = await AppTaggingSecret.computeUnconstrained(
-          recipientCompleteAddress,
-          recipientIvsk,
-          sender,
-          contractAddress,
-          recipient,
-        );
+      allSenders.map(async sender => {
+        const taggingSecretPoint = await computeSharedTaggingSecret(recipientCompleteAddress, recipientIvsk, sender);
 
-        if (!secret) {
-          // Note that all senders originate from either the SenderAddressBookStore or the KeyStore.
+        if (!taggingSecretPoint) {
+          // Note that all senders originate from either the TaggingSecretSourcesStore or the KeyStore.
           throw new Error(
             `Failed to compute a tagging secret for sender ${sender} - this implies this is an invalid address, which should not happen as they have been previously registered in PXE.`,
           );
         }
 
-        return secret;
+        return taggingSecretPoint;
       }),
     );
   }

package/src/messages/{message_context_service.ts → tx_resolver_service.ts}

@@ -1,21 +1,22 @@
 import { uniqueBy } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
-import { MessageContext } from '@aztec/stdlib/logs';
 import { type IndexedTxEffect, TxHash } from '@aztec/stdlib/tx';
 
-/** Resolves transaction hashes into the context needed to process messages. */
-export class MessageContextService {
+import { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
+
+/** Resolves transaction hashes into their on-chain context (note hashes, first nullifier, and mined block). */
+export class TxResolverService {
   constructor(private readonly aztecNode: AztecNode) {}
 
   /**
-   * Resolves a list of tx hashes into their message contexts.
+   * Resolves a list of tx hashes into their on-chain context.
    *
-   * For each tx hash, looks up the corresponding tx effect and extracts the note hashes and first nullifier needed to
-   * process messages that originated from that transaction. Returns `null` for tx hashes that are zero, not yet
-   * available, or in blocks beyond the anchor block.
+   * For each tx hash, looks up the corresponding tx effect and extracts the note hashes, first nullifier, and the
+   * number and hash of the block it was mined in. Returns `null` for tx hashes that are zero, not yet available, or in
+   * blocks beyond the anchor block.
    */
-  async getMessageContextsByTxHash(txHashes: Fr[], anchorBlockNumber: number): Promise<(MessageContext | null)[]> {
+  async resolveTxs(txHashes: Fr[], anchorBlockNumber: number): Promise<(ResolvedTx | null)[]> {
     const nonZeroTxHashes = txHashes.filter(h => !h.isZero()).map(h => TxHash.fromField(h));
     const uniqueTxHashes = uniqueBy(nonZeroTxHashes, h => h.toString());
     const fetched = await Promise.all(
@@ -56,7 +57,13 @@ export class MessageContextService {
         throw new Error(`Tx effect for ${txHash} has no nullifiers`);
       }
 
-      return new MessageContext(data.txHash, data.noteHashes, data.nullifiers[0]);
+      return new ResolvedTx(
+        data.txHash,
+        data.noteHashes,
+        data.nullifiers[0],
+        txEffect.l2BlockNumber,
+        txEffect.l2BlockHash.toFr(),
+      );
     });
   }
 }

package/src/oracle_version.ts

@@ -10,13 +10,13 @@
 /// used to provide helpful error messages if a contract calls an oracle that doesn't exist. We don't throw immediately
 /// if AZTEC_NR_MINOR > PXE_MINOR because if a contract is updated to use a newer Aztec.nr dependency without actually
 /// using any of the new oracles then there is no reason to throw.
-export const ORACLE_VERSION_MAJOR = 29;
-export const ORACLE_VERSION_MINOR = 0;
+export const ORACLE_VERSION_MAJOR = 30;
+export const ORACLE_VERSION_MINOR = 7;
 
-/// This hash is computed from the Oracle interface and is used to detect when that interface changes. When it does,
-/// you need to either:
+/// This hash is computed from the `ORACLE_REGISTRY` declaration (each oracle's name, ordered parameter names and
+/// types, and return type) and is used to detect when the oracle interface changes. When it does, you need to either:
 /// - increment `ORACLE_VERSION_MAJOR` and reset `ORACLE_VERSION_MINOR` to zero if the change is breaking, or
 /// - increment only `ORACLE_VERSION_MINOR` if the change is additive (a new oracle was added).
 ///
 /// These constants must be kept in sync between this file and `noir-projects/aztec-nr/aztec/src/oracle/version.nr`.
-export const ORACLE_INTERFACE_HASH = '157fe8fa79f0e5a25db3d61341f9bcf5b43cb68367bea497204006daa48751b6';
+export const ORACLE_INTERFACE_HASH = '416b0e7d3e6dca5803ebe2a65ea93f1e79759dc39ef8ec4c52eeba5e2b0f3fca';

package/src/private_kernel/hints/private_kernel_reset_private_inputs_builder.ts

@@ -35,6 +35,7 @@ import {
   findPrivateKernelResetDimensions,
   getNoteHashReadRequestResetActions,
   getNullifierReadRequestResetActions,
+  kernelStateIsForPublic,
   privateKernelResetDimensionNames,
 } from '@aztec/stdlib/kernel';
 import { type PrivateCallExecutionResult, collectNested } from '@aztec/stdlib/tx';
@@ -138,10 +139,19 @@ export class PrivateKernelResetPrivateInputsBuilder {
     // The dimensions found must be big enough to reset all values, i.e. empty remainder.
     const allowRemainder = isInner;
 
+    // Terminal reset picks from the finalTail / finalTailToPublic catalogs; mid-tx resets always
+    // use the inner catalog. The public/private decision must match `kernelStateIsForPublic` - the
+    // same predicate the circuit inputs and the orchestrator use.
+    const mode = isInner
+      ? ('inner' as const)
+      : kernelStateIsForPublic(this.previousKernel)
+        ? ('finalTailToPublic' as const)
+        : ('finalTail' as const);
+
     const dimensions = findPrivateKernelResetDimensions(
       this.requestedDimensions,
       privateKernelResetDimensionsConfig,
-      isInner,
+      mode,
       allowRemainder,
     );
 

package/src/private_kernel/hints/test_utils.ts

@@ -36,7 +36,7 @@ import { PrivateLog } from '@aztec/stdlib/logs';
 import { PrivateCallExecutionResult } from '@aztec/stdlib/tx';
 import { VerificationKeyData } from '@aztec/stdlib/vks';
 
-const DEFAULT_CONTRACT_ADDRESS = AztecAddress.fromBigInt(987654n);
+const DEFAULT_CONTRACT_ADDRESS = AztecAddress.fromBigIntUnsafe(987654n);
 
 /**
  * Builds a ClaimedLengthArray from a list of items, padding to the required size.

package/src/private_kernel/private_kernel_execution_prover.ts

@@ -24,8 +24,8 @@ import {
   PrivateKernelInner2CircuitPrivateInputs,
   PrivateKernelInner3CircuitPrivateInputs,
   PrivateKernelInnerCircuitPrivateInputs,
+  PrivateKernelResetTailCircuitPrivateInputs,
   type PrivateKernelSimulateOutput,
-  PrivateKernelTailCircuitPrivateInputs,
   type PrivateKernelTailCircuitPublicInputs,
   PrivateVerificationKeyHints,
   type UpdatedClassIdHints,
@@ -170,7 +170,6 @@ export class PrivateKernelExecutionProver {
         previousOutput: output,
         txRequest,
         isPrivateOnlyTx,
-        firstNullifierHint: executionResult.firstNullifier,
         minRevertibleSideEffectCounter,
         executionSteps,
         generateWitnesses,
@@ -179,7 +178,8 @@ export class PrivateKernelExecutionProver {
       firstIteration = false;
     }
 
-    // Final reset: include siloing of note hashes, nullifiers and private logs.
+    // Terminal reset+tail. The final reset must be performed exactly once because each tx has at
+    // least one nullifier that requires siloing, and siloing cannot be done multiple times.
     const finalResetBuilder = new PrivateKernelResetPrivateInputsBuilder(
       output,
       [],
@@ -187,29 +187,9 @@ export class PrivateKernelExecutionProver {
       splitCounter,
     );
     if (!finalResetBuilder.needsReset()) {
-      // The final reset must be performed exactly once, because each tx has at least one nullifier that requires
-      // siloing, and siloing cannot be done multiple times.
-      // While, in theory, it might be possible to silo note hashes first and then run another reset to silo nullifiers
-      // and/or private logs, we currently don't have standalone dimensions for the arrays that require siloing. As a
-      // result, all necessary siloing must be done together in a single reset.
+      // Siloing for note hashes, nullifiers, and private logs is dimensioned as one terminal reset.
       // Refer to the possible combinations of dimensions in private_kernel_reset_config.json.
       throw new Error('Nothing to reset for the final reset.');
-    } else {
-      const witgenTimer = new Timer();
-      const privateInputs = await finalResetBuilder.build(this.oracle);
-      output = generateWitnesses
-        ? await this.proofCreator.generateResetOutput(privateInputs)
-        : await this.proofCreator.simulateReset(privateInputs);
-
-      executionSteps.push({
-        functionName: 'private_kernel_reset',
-        bytecode: output.bytecode,
-        witness: output.outputWitness,
-        vk: output.verificationKey.keyAsBytes,
-        timings: {
-          witgen: witgenTimer.ms(),
-        },
-      });
     }
 
     if (output.publicInputs.feePayer.isZero() && skipFeeEnforcement) {
@@ -218,34 +198,35 @@ export class PrivateKernelExecutionProver {
       }
       output.publicInputs.feePayer = new AztecAddress(Fr.MAX_FIELD_VALUE);
     }
-    // Private tail.
-    const vkData = await this.getVkData(output.verificationKey);
-    const previousKernelData = new PrivateKernelData(output.publicInputs, vkData);
-
-    this.log.debug(
-      `Calling private kernel tail with hwm ${previousKernelData.publicInputs.minRevertibleSideEffectCounter}`,
-    );
 
     // TODO: Enable padding once we better understand the final amounts to pad to.
     const paddedSideEffectAmounts = PaddedSideEffectAmounts.empty();
 
     // Round the aggregated expirationTimestamp down to reduce precision and avoid leaking which private
     // functions were called via their exact expiration offsets.
-    const expirationTimestampUpperBound = computeTxExpirationTimestamp(previousKernelData.publicInputs);
-
-    const privateInputs = new PrivateKernelTailCircuitPrivateInputs(
-      previousKernelData,
+    const expirationTimestampUpperBound = computeTxExpirationTimestamp(output.publicInputs);
+
+    const resetInputs = await finalResetBuilder.build(this.oracle);
+    const mergedInputs = new PrivateKernelResetTailCircuitPrivateInputs(
+      resetInputs.previousKernel,
+      resetInputs.paddedSideEffects,
+      resetInputs.hints,
+      resetInputs.dimensions,
       paddedSideEffectAmounts,
       expirationTimestampUpperBound,
     );
 
+    this.log.debug(
+      `Calling terminal private kernel reset+tail (${mergedInputs.isForPublic() ? 'to-public' : 'to-rollup'}) with hwm ${output.publicInputs.minRevertibleSideEffectCounter}`,
+    );
+
     const witgenTimer = new Timer();
     const tailOutput = generateWitnesses
-      ? await this.proofCreator.generateTailOutput(privateInputs)
-      : await this.proofCreator.simulateTail(privateInputs);
+      ? await this.proofCreator.generateResetTailOutput(mergedInputs)
+      : await this.proofCreator.simulateResetTail(mergedInputs);
 
     executionSteps.push({
-      functionName: 'private_kernel_tail',
+      functionName: mergedInputs.isForPublic() ? 'private_kernel_reset_tail_to_public' : 'private_kernel_reset_tail',
       bytecode: tailOutput.bytecode,
       witness: tailOutput.outputWitness,
       vk: tailOutput.verificationKey.keyAsBytes,
@@ -457,7 +438,6 @@ export class PrivateKernelExecutionProver {
     previousOutput: PrivateKernelSimulateOutput<PrivateKernelCircuitPublicInputs>;
     txRequest: TxRequest;
     isPrivateOnlyTx: boolean;
-    firstNullifierHint: Fr;
     minRevertibleSideEffectCounter: number;
     executionSteps: PrivateExecutionStep[];
     generateWitnesses: boolean;
@@ -468,7 +448,6 @@ export class PrivateKernelExecutionProver {
       previousOutput,
       txRequest,
       isPrivateOnlyTx,
-      firstNullifierHint,
       minRevertibleSideEffectCounter,
       executionSteps,
       generateWitnesses,
@@ -488,12 +467,9 @@ export class PrivateKernelExecutionProver {
             ProtocolContractsList,
             apps[0],
             isPrivateOnlyTx,
-            firstNullifierHint,
             minRevertibleSideEffectCounter,
           );
-          this.log.debug(
-            `Calling private kernel init with isPrivateOnly ${isPrivateOnlyTx} and firstNullifierHint ${proofInput.firstNullifierHint}`,
-          );
+          this.log.debug(`Calling private kernel init with isPrivateOnly ${isPrivateOnlyTx}`);
           pushTestData('private-kernel-inputs-init', proofInput);
           output = generateWitnesses
             ? await this.proofCreator.generateInitOutput(proofInput)
@@ -509,12 +485,9 @@ export class PrivateKernelExecutionProver {
             apps[0],
             apps[1],
             isPrivateOnlyTx,
-            firstNullifierHint,
             minRevertibleSideEffectCounter,
           );
-          this.log.debug(
-            `Calling private kernel init_2 with isPrivateOnly ${isPrivateOnlyTx} and firstNullifierHint ${proofInput.firstNullifierHint}`,
-          );
+          this.log.debug(`Calling private kernel init_2 with isPrivateOnly ${isPrivateOnlyTx}`);
           pushTestData('private-kernel-inputs-init-2', proofInput);
           output = generateWitnesses
             ? await this.proofCreator.generateInit2Output(proofInput)
@@ -531,12 +504,9 @@ export class PrivateKernelExecutionProver {
             apps[1],
             apps[2],
             isPrivateOnlyTx,
-            firstNullifierHint,
             minRevertibleSideEffectCounter,
           );
-          this.log.debug(
-            `Calling private kernel init_3 with isPrivateOnly ${isPrivateOnlyTx} and firstNullifierHint ${proofInput.firstNullifierHint}`,
-          );
+          this.log.debug(`Calling private kernel init_3 with isPrivateOnly ${isPrivateOnlyTx}`);
           pushTestData('private-kernel-inputs-init-3', proofInput);
           output = generateWitnesses
             ? await this.proofCreator.generateInit3Output(proofInput)

package/src/private_kernel/private_kernel_oracle.ts

@@ -22,30 +22,45 @@ import type { NullifierMembershipWitness } from '@aztec/stdlib/trees';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 import type { VerificationKeyAsFields } from '@aztec/stdlib/vks';
 
+import type { ContractClassService } from '../contract/contract_class_service.js';
+import { AnchoredContractData } from '../contract_function_simulator/anchored_contract_data.js';
 import type { ContractStore } from '../storage/contract_store/contract_store.js';
 
 /**
  * Provides functionality needed by the private kernel for interacting with our state trees.
  */
 export class PrivateKernelOracle {
+  private readonly anchoredContractData: AnchoredContractData;
+
   constructor(
     private contractStore: ContractStore,
+    contractClassService: ContractClassService,
     private keyStore: KeyStore,
     private node: AztecNode,
     private blockHeader: BlockHeader,
-  ) {}
+  ) {
+    // Kernels never use contract overrides (those are confined to simulations, which skip proving), so this view is
+    // built without them.
+    this.anchoredContractData = new AnchoredContractData(contractStore, contractClassService, blockHeader);
+  }
 
   /** Retrieves the preimage of a contract address from the registered contract instances db. */
   public async getContractAddressPreimage(
     address: AztecAddress,
   ): Promise<ContractInstanceWithAddress & { saltedInitializationHash: Fr }> {
-    const instance = await this.contractStore.getContractInstance(address);
+    const instance = await this.anchoredContractData.getContractInstance(address);
     if (!instance) {
       throw new Error(`Contract instance not found when getting address preimage. Contract address: ${address}.`);
     }
+    // Local instance existence was checked above, so resolution below cannot come back empty.
+    const currentContractClassId = await this.anchoredContractData.getCurrentClassId(address);
+    if (!currentContractClassId) {
+      throw new Error(`Could not resolve the current class id for registered contract ${address}.`);
+    }
     return {
       saltedInitializationHash: await computeSaltedInitializationHash(instance),
       ...instance,
+      currentContractClassId,
     };
   }
 
@@ -114,8 +129,12 @@ export class PrivateKernelOracle {
   }
 
   /** Use debug data to get the function name corresponding to a selector. */
-  public getDebugFunctionName(contractAddress: AztecAddress, selector: FunctionSelector): Promise<string | undefined> {
-    return this.contractStore.getDebugFunctionName(contractAddress, selector);
+  public async getDebugFunctionName(
+    contractAddress: AztecAddress,
+    selector: FunctionSelector,
+  ): Promise<string | undefined> {
+    const classId = await this.anchoredContractData.getCurrentClassId(contractAddress);
+    return classId ? this.contractStore.getDebugFunctionName(classId, selector) : undefined;
   }
 
   /**