@aztec/pxe 0.0.1-commit.87a0206 → 0.0.1-commit.8f9871590

package/src/contract_function_simulator/oracle/oracle.ts

@@ -417,7 +417,7 @@ export class Oracle {
     return Promise.resolve([]);
   }
 
-  utilityDebugLog(
+  async utilityLog(
     level: ACVMField[],
     message: ACVMField[],
     _ignoredFieldsSize: ACVMField[],
@@ -426,8 +426,8 @@ export class Oracle {
     const levelFr = Fr.fromString(level[0]);
     const messageStr = message.map(acvmField => String.fromCharCode(Fr.fromString(acvmField).toNumber())).join('');
     const fieldsFr = fields.map(Fr.fromString);
-    this.handlerAsMisc().utilityDebugLog(levelFr.toNumber(), messageStr, fieldsFr);
-    return Promise.resolve([]);
+    await this.handlerAsMisc().utilityLog(levelFr.toNumber(), messageStr, fieldsFr);
+    return [];
   }
 
   // This function's name is directly hardcoded in `circuit_recorder.ts`. Don't forget to update it there if you

package/src/contract_function_simulator/oracle/private_execution_oracle.ts

@@ -2,7 +2,6 @@ import { MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS, PRIVATE_CONTEXT_INPUTS_LENGTH }
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { createLogger } from '@aztec/foundation/log';
 import { Timer } from '@aztec/foundation/timer';
-import type { KeyStore } from '@aztec/key-store';
 import { type CircuitSimulator, toACVMWitness } from '@aztec/simulator/client';
 import {
   type FunctionAbi,
@@ -12,33 +11,23 @@ import {
   type NoteSelector,
   countArgumentsSize,
 } from '@aztec/stdlib/abi';
-import type { AuthWitness } from '@aztec/stdlib/auth-witness';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { siloNullifier } from '@aztec/stdlib/hash';
-import type { AztecNode } from '@aztec/stdlib/interfaces/client';
 import { PrivateContextInputs } from '@aztec/stdlib/kernel';
 import { type ContractClassLog, DirectionalAppTaggingSecret, type PreTag } from '@aztec/stdlib/logs';
 import { Tag } from '@aztec/stdlib/logs';
 import { Note, type NoteStatus } from '@aztec/stdlib/note';
 import {
-  type BlockHeader,
   CallContext,
-  Capsule,
   CountedContractClassLog,
   NoteAndSlot,
   PrivateCallExecutionResult,
   type TxContext,
 } from '@aztec/stdlib/tx';
 
+import type { AccessScopes } from '../../access_scopes.js';
 import type { ContractSyncService } from '../../contract_sync/contract_sync_service.js';
 import { NoteService } from '../../notes/note_service.js';
-import type { AddressStore } from '../../storage/address_store/address_store.js';
-import type { CapsuleStore } from '../../storage/capsule_store/capsule_store.js';
-import type { ContractStore } from '../../storage/contract_store/contract_store.js';
-import type { NoteStore } from '../../storage/note_store/note_store.js';
-import type { PrivateEventStore } from '../../storage/private_event_store/private_event_store.js';
-import type { RecipientTaggingStore } from '../../storage/tagging_store/recipient_tagging_store.js';
-import type { SenderAddressBookStore } from '../../storage/tagging_store/sender_address_book_store.js';
 import type { SenderTaggingStore } from '../../storage/tagging_store/sender_tagging_store.js';
 import { syncSenderTaggingIndexes } from '../../tagging/index.js';
 import type { ExecutionNoteCache } from '../execution_note_cache.js';
@@ -47,7 +36,25 @@ import type { HashedValuesCache } from '../hashed_values_cache.js';
 import { pickNotes } from '../pick_notes.js';
 import type { IPrivateExecutionOracle, NoteData } from './interfaces.js';
 import { executePrivateFunction } from './private_execution.js';
-import { UtilityExecutionOracle } from './utility_execution_oracle.js';
+import { UtilityExecutionOracle, type UtilityExecutionOracleArgs } from './utility_execution_oracle.js';
+
+/** Args for PrivateExecutionOracle constructor. */
+export type PrivateExecutionOracleArgs = Omit<UtilityExecutionOracleArgs, 'contractAddress'> & {
+  argsHash: Fr;
+  txContext: TxContext;
+  callContext: CallContext;
+  /** Needed to trigger contract synchronization before nested calls */
+  utilityExecutor: (call: FunctionCall, scopes: AccessScopes) => Promise<void>;
+  executionCache: HashedValuesCache;
+  noteCache: ExecutionNoteCache;
+  taggingIndexCache: ExecutionTaggingIndexCache;
+  senderTaggingStore: SenderTaggingStore;
+  contractSyncService: ContractSyncService;
+  totalPublicCalldataCount?: number;
+  sideEffectCounter?: number;
+  senderForTags?: AztecAddress;
+  simulator?: CircuitSimulator;
+};
 
 /**
  * The execution oracle for the private part of a transaction.
@@ -69,57 +76,39 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
   private offchainEffects: { data: Fr[] }[] = [];
   private nestedExecutionResults: PrivateCallExecutionResult[] = [];
 
-  constructor(
-    private readonly argsHash: Fr,
-    private readonly txContext: TxContext,
-    private readonly callContext: CallContext,
-    /** Header of a block whose state is used during private execution (not the block the transaction is included in). */
-    protected override readonly anchorBlockHeader: BlockHeader,
-    /** Needed to trigger contract synchronization before nested calls */
-    private readonly utilityExecutor: (call: FunctionCall) => Promise<void>,
-    /** List of transient auth witnesses to be used during this simulation */
-    authWitnesses: AuthWitness[],
-    capsules: Capsule[],
-    private readonly executionCache: HashedValuesCache,
-    private readonly noteCache: ExecutionNoteCache,
-    private readonly taggingIndexCache: ExecutionTaggingIndexCache,
-    contractStore: ContractStore,
-    noteStore: NoteStore,
-    keyStore: KeyStore,
-    addressStore: AddressStore,
-    aztecNode: AztecNode,
-    private readonly senderTaggingStore: SenderTaggingStore,
-    recipientTaggingStore: RecipientTaggingStore,
-    senderAddressBookStore: SenderAddressBookStore,
-    capsuleStore: CapsuleStore,
-    privateEventStore: PrivateEventStore,
-    private readonly contractSyncService: ContractSyncService,
-    jobId: string,
-    private totalPublicCalldataCount: number = 0,
-    protected sideEffectCounter: number = 0,
-    log = createLogger('simulator:client_execution_context'),
-    scopes?: AztecAddress[],
-    private senderForTags?: AztecAddress,
-    private simulator?: CircuitSimulator,
-  ) {
-    super(
-      callContext.contractAddress,
-      authWitnesses,
-      capsules,
-      anchorBlockHeader,
-      contractStore,
-      noteStore,
-      keyStore,
-      addressStore,
-      aztecNode,
-      recipientTaggingStore,
-      senderAddressBookStore,
-      capsuleStore,
-      privateEventStore,
-      jobId,
-      log,
-      scopes,
-    );
+  private readonly argsHash: Fr;
+  private readonly txContext: TxContext;
+  private readonly callContext: CallContext;
+  private readonly utilityExecutor: (call: FunctionCall, scopes: AccessScopes) => Promise<void>;
+  private readonly executionCache: HashedValuesCache;
+  private readonly noteCache: ExecutionNoteCache;
+  private readonly taggingIndexCache: ExecutionTaggingIndexCache;
+  private readonly senderTaggingStore: SenderTaggingStore;
+  private readonly contractSyncService: ContractSyncService;
+  private totalPublicCalldataCount: number;
+  protected sideEffectCounter: number;
+  private senderForTags?: AztecAddress;
+  private readonly simulator?: CircuitSimulator;
+
+  constructor(args: PrivateExecutionOracleArgs) {
+    super({
+      ...args,
+      contractAddress: args.callContext.contractAddress,
+      log: args.log ?? createLogger('simulator:client_execution_context'),
+    });
+    this.argsHash = args.argsHash;
+    this.txContext = args.txContext;
+    this.callContext = args.callContext;
+    this.utilityExecutor = args.utilityExecutor;
+    this.executionCache = args.executionCache;
+    this.noteCache = args.noteCache;
+    this.taggingIndexCache = args.taggingIndexCache;
+    this.senderTaggingStore = args.senderTaggingStore;
+    this.contractSyncService = args.contractSyncService;
+    this.totalPublicCalldataCount = args.totalPublicCalldataCount ?? 0;
+    this.sideEffectCounter = args.sideEffectCounter ?? 0;
+    this.senderForTags = args.senderForTags;
+    this.simulator = args.simulator;
   }
 
   public getPrivateContextInputs(): PrivateContextInputs {
@@ -538,12 +527,22 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
 
     isStaticCall = isStaticCall || this.callContext.isStaticCall;
 
+    // When scopes are set and the target contract is a registered account (has keys in the keyStore),
+    // expand scopes to include it so nested private calls can sync and read the contract's own notes.
+    // We only expand for registered accounts because the log service needs the recipient's keys to derive
+    // tagging secrets, which are only available for registered accounts.
+    const expandedScopes =
+      this.scopes !== 'ALL_SCOPES' && (await this.keyStore.hasAccount(targetContractAddress))
+        ? [...this.scopes, targetContractAddress]
+        : this.scopes;
+
     await this.contractSyncService.ensureContractSynced(
       targetContractAddress,
       functionSelector,
       this.utilityExecutor,
       this.anchorBlockHeader,
       this.jobId,
+      expandedScopes,
     );
 
     const targetArtifact = await this.contractStore.getFunctionArtifactWithDebugMetadata(
@@ -555,41 +554,41 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
 
     const derivedCallContext = await this.deriveCallContext(targetContractAddress, targetArtifact, isStaticCall);
 
-    const privateExecutionOracle = new PrivateExecutionOracle(
+    const privateExecutionOracle = new PrivateExecutionOracle({
       argsHash,
-      derivedTxContext,
-      derivedCallContext,
-      this.anchorBlockHeader,
-      this.utilityExecutor,
-      this.authWitnesses,
-      this.capsules,
-      this.executionCache,
-      this.noteCache,
-      this.taggingIndexCache,
-      this.contractStore,
-      this.noteStore,
-      this.keyStore,
-      this.addressStore,
-      this.aztecNode,
-      this.senderTaggingStore,
-      this.recipientTaggingStore,
-      this.senderAddressBookStore,
-      this.capsuleStore,
-      this.privateEventStore,
-      this.contractSyncService,
-      this.jobId,
-      this.totalPublicCalldataCount,
+      txContext: derivedTxContext,
+      callContext: derivedCallContext,
+      anchorBlockHeader: this.anchorBlockHeader,
+      utilityExecutor: this.utilityExecutor,
+      authWitnesses: this.authWitnesses,
+      capsules: this.capsules,
+      executionCache: this.executionCache,
+      noteCache: this.noteCache,
+      taggingIndexCache: this.taggingIndexCache,
+      contractStore: this.contractStore,
+      noteStore: this.noteStore,
+      keyStore: this.keyStore,
+      addressStore: this.addressStore,
+      aztecNode: this.aztecNode,
+      senderTaggingStore: this.senderTaggingStore,
+      recipientTaggingStore: this.recipientTaggingStore,
+      senderAddressBookStore: this.senderAddressBookStore,
+      capsuleStore: this.capsuleStore,
+      privateEventStore: this.privateEventStore,
+      contractSyncService: this.contractSyncService,
+      jobId: this.jobId,
+      totalPublicCalldataCount: this.totalPublicCalldataCount,
       sideEffectCounter,
-      this.log,
-      this.scopes,
-      this.senderForTags,
-      this.simulator,
-    );
+      log: this.log,
+      scopes: expandedScopes,
+      senderForTags: this.senderForTags,
+      simulator: this.simulator!,
+    });
 
     const setupTime = simulatorSetupTimer.ms();
 
     const childExecutionResult = await executePrivateFunction(
-      this.simulator,
+      this.simulator!,
       privateExecutionOracle,
       targetArtifact,
       targetContractAddress,

package/src/contract_function_simulator/oracle/utility_execution_oracle.ts

@@ -3,7 +3,7 @@ import type { BlockNumber } from '@aztec/foundation/branded-types';
 import { Aes128 } from '@aztec/foundation/crypto/aes128';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { Point } from '@aztec/foundation/curves/grumpkin';
-import { LogLevels, applyStringFormatting, createLogger } from '@aztec/foundation/log';
+import { LogLevels, type Logger, applyStringFormatting, createLogger } from '@aztec/foundation/log';
 import type { MembershipWitness } from '@aztec/foundation/trees';
 import type { KeyStore } from '@aztec/key-store';
 import type { AuthWitness } from '@aztec/stdlib/auth-witness';
@@ -20,6 +20,7 @@ import type { NoteStatus } from '@aztec/stdlib/note';
 import { MerkleTreeId, type NullifierMembershipWitness, PublicDataWitness } from '@aztec/stdlib/trees';
 import type { BlockHeader, Capsule } from '@aztec/stdlib/tx';
 
+import type { AccessScopes } from '../../access_scopes.js';
 import { EventService } from '../../events/event_service.js';
 import { LogService } from '../../logs/log_service.js';
 import { NoteService } from '../../notes/note_service.js';
@@ -40,6 +41,27 @@ import { pickNotes } from '../pick_notes.js';
 import type { IMiscOracle, IUtilityExecutionOracle, NoteData } from './interfaces.js';
 import { MessageLoadOracleInputs } from './message_load_oracle_inputs.js';
 
+/** Args for UtilityExecutionOracle constructor. */
+export type UtilityExecutionOracleArgs = {
+  contractAddress: AztecAddress;
+  /** List of transient auth witnesses to be used during this simulation */
+  authWitnesses: AuthWitness[];
+  capsules: Capsule[]; // TODO(#12425): Rename to transientCapsules
+  anchorBlockHeader: BlockHeader;
+  contractStore: ContractStore;
+  noteStore: NoteStore;
+  keyStore: KeyStore;
+  addressStore: AddressStore;
+  aztecNode: AztecNode;
+  recipientTaggingStore: RecipientTaggingStore;
+  senderAddressBookStore: SenderAddressBookStore;
+  capsuleStore: CapsuleStore;
+  privateEventStore: PrivateEventStore;
+  jobId: string;
+  log?: ReturnType<typeof createLogger>;
+  scopes: AccessScopes;
+};
+
 /**
  * The oracle for an execution of utility contract functions.
  */
@@ -47,27 +69,43 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
   isMisc = true as const;
   isUtility = true as const;
 
-  private aztecNrDebugLog = createLogger('aztec-nr:debug_log');
-
-  constructor(
-    protected readonly contractAddress: AztecAddress,
-    /** List of transient auth witnesses to be used during this simulation */
-    protected readonly authWitnesses: AuthWitness[],
-    protected readonly capsules: Capsule[], // TODO(#12425): Rename to transientCapsules
-    protected readonly anchorBlockHeader: BlockHeader,
-    protected readonly contractStore: ContractStore,
-    protected readonly noteStore: NoteStore,
-    protected readonly keyStore: KeyStore,
-    protected readonly addressStore: AddressStore,
-    protected readonly aztecNode: AztecNode,
-    protected readonly recipientTaggingStore: RecipientTaggingStore,
-    protected readonly senderAddressBookStore: SenderAddressBookStore,
-    protected readonly capsuleStore: CapsuleStore,
-    protected readonly privateEventStore: PrivateEventStore,
-    protected readonly jobId: string,
-    protected log = createLogger('simulator:client_view_context'),
-    protected readonly scopes?: AztecAddress[],
-  ) {}
+  private contractLogger: Logger | undefined;
+
+  protected readonly contractAddress: AztecAddress;
+  protected readonly authWitnesses: AuthWitness[];
+  protected readonly capsules: Capsule[];
+  protected readonly anchorBlockHeader: BlockHeader;
+  protected readonly contractStore: ContractStore;
+  protected readonly noteStore: NoteStore;
+  protected readonly keyStore: KeyStore;
+  protected readonly addressStore: AddressStore;
+  protected readonly aztecNode: AztecNode;
+  protected readonly recipientTaggingStore: RecipientTaggingStore;
+  protected readonly senderAddressBookStore: SenderAddressBookStore;
+  protected readonly capsuleStore: CapsuleStore;
+  protected readonly privateEventStore: PrivateEventStore;
+  protected readonly jobId: string;
+  protected log: ReturnType<typeof createLogger>;
+  protected readonly scopes: AccessScopes;
+
+  constructor(args: UtilityExecutionOracleArgs) {
+    this.contractAddress = args.contractAddress;
+    this.authWitnesses = args.authWitnesses;
+    this.capsules = args.capsules;
+    this.anchorBlockHeader = args.anchorBlockHeader;
+    this.contractStore = args.contractStore;
+    this.noteStore = args.noteStore;
+    this.keyStore = args.keyStore;
+    this.addressStore = args.addressStore;
+    this.aztecNode = args.aztecNode;
+    this.recipientTaggingStore = args.recipientTaggingStore;
+    this.senderAddressBookStore = args.senderAddressBookStore;
+    this.capsuleStore = args.capsuleStore;
+    this.privateEventStore = args.privateEventStore;
+    this.jobId = args.jobId;
+    this.log = args.log ?? createLogger('simulator:client_view_context');
+    this.scopes = args.scopes;
+  }
 
   public utilityAssertCompatibleOracleVersion(version: number): void {
     if (version !== ORACLE_VERSION) {
@@ -91,11 +129,16 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @throws If scopes are defined and the account is not in the scopes.
    */
   public async utilityGetKeyValidationRequest(pkMHash: Fr): Promise<KeyValidationRequest> {
-    // If scopes are defined, check that the key belongs to an account in the scopes
-    if (this.scopes && this.scopes.length > 0) {
-      const [, account] = await this.keyStore.getKeyPrefixAndAccount(pkMHash);
-      if (!this.scopes.some(scope => scope.equals(account))) {
-        throw new Error(`Key validation request denied: account ${account.toString()} is not in the allowed scopes.`);
+    // If scopes are defined, check that the key belongs to an account in the scopes.
+    if (this.scopes !== 'ALL_SCOPES' && this.scopes.length > 0) {
+      let hasAccess = false;
+      for (let i = 0; i < this.scopes.length && !hasAccess; i++) {
+        if (await this.keyStore.accountHasKey(this.scopes[i], pkMHash)) {
+          hasAccess = true;
+        }
+      }
+      if (!hasAccess) {
+        throw new Error(`Key validation request denied: no scoped account has a key with hash ${pkMHash.toString()}.`);
       }
     }
     return this.keyStore.getKeyValidationRequest(pkMHash, this.contractAddress);
@@ -354,12 +397,28 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
     return values;
   }
 
-  public utilityDebugLog(level: number, message: string, fields: Fr[]): void {
+  /**
+   * Returns a per-contract logger whose output is prefixed with `contract_log::<name>(<addrAbbrev>)`.
+   */
+  async #getContractLogger(): Promise<Logger> {
+    if (!this.contractLogger) {
+      const addrAbbrev = this.contractAddress.toString().slice(0, 10);
+      const name = await this.contractStore.getDebugContractName(this.contractAddress);
+      const module = name ? `contract_log::${name}(${addrAbbrev})` : `contract_log::${addrAbbrev}`;
+      // Purpose of instanceId is to distinguish logs from different instances of the same component. It makes sense
+      // to re-use jobId as instanceId here as executions of different PXE jobs are isolated.
+      this.contractLogger = createLogger(module, { instanceId: this.jobId });
+    }
+    return this.contractLogger;
+  }
+
+  public async utilityLog(level: number, message: string, fields: Fr[]): Promise<void> {
     if (!LogLevels[level]) {
-      throw new Error(`Invalid debug log level: ${level}`);
+      throw new Error(`Invalid log level: ${level}`);
     }
     const levelName = LogLevels[level];
-    this.aztecNrDebugLog[levelName](`${applyStringFormatting(message, fields)}`);
+    const logger = await this.#getContractLogger();
+    logger[levelName](`${applyStringFormatting(message, fields)}`);
   }
 
   public async utilityFetchTaggedLogs(pendingTaggedLogArrayBaseSlot: Fr) {

package/src/contract_sync/contract_sync_service.ts

@@ -4,6 +4,7 @@ import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { AztecNode } from '@aztec/stdlib/interfaces/client';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 
+import type { AccessScopes } from '../access_scopes.js';
 import type { StagedStore } from '../job_coordinator/job_coordinator.js';
 import type { ContractStore } from '../storage/contract_store/contract_store.js';
 import type { NoteStore } from '../storage/note_store/note_store.js';
@@ -18,8 +19,9 @@ import { syncState, verifyCurrentClassId } from './helpers.js';
 export class ContractSyncService implements StagedStore {
   readonly storeName = 'contract_sync';
 
-  // Tracks contracts synced since last wipe. Key is contract address string, value is a promise that resolves when
-  // the contract is synced.
+  // Tracks contracts synced since last wipe. The cache is keyed per individual scope address
+  // (`contractAddress:scopeAddress`), or `contractAddress:*` for undefined scopes (all accounts).
+  // The value is a promise that resolves when the contract is synced.
   private syncedContracts: Map<string, Promise<void>> = new Map();
 
   // Per-job overridden contract addresses - these contracts should not be synced.
@@ -44,51 +46,63 @@ export class ContractSyncService implements StagedStore {
    * @param functionToInvokeAfterSync - The function selector that will be called after sync (used to validate it's
    * not sync_state itself).
    * @param utilityExecutor - Executor function for running the sync_state utility function.
+   * @param scopes - Access scopes to pass through to the utility executor (affects whose account's private state is discovered).
    */
   async ensureContractSynced(
     contractAddress: AztecAddress,
     functionToInvokeAfterSync: FunctionSelector | null,
-    utilityExecutor: (call: FunctionCall) => Promise<any>,
+    utilityExecutor: (call: FunctionCall, scopes: AccessScopes) => Promise<any>,
     anchorBlockHeader: BlockHeader,
     jobId: string,
+    scopes: AccessScopes,
   ): Promise<void> {
-    const key = contractAddress.toString();
-
-    // Skip sync if this contract has an override for this job
+    // Skip sync if this contract has an override for this job (overrides are keyed by contract address only)
     const overrides = this.overriddenContracts.get(jobId);
-    if (overrides?.has(key)) {
+    if (overrides?.has(contractAddress.toString())) {
       return;
     }
 
-    const existing = this.syncedContracts.get(key);
-    if (existing) {
-      return existing;
+    // Skip sync if we already synced for "all scopes", or if we have an empty list of scopes
+    const allScopesKey = toKey(contractAddress, 'ALL_SCOPES');
+    const allScopesExisting = this.syncedContracts.get(allScopesKey);
+    if (allScopesExisting || (scopes !== 'ALL_SCOPES' && scopes.length == 0)) {
+      return;
     }
 
-    const syncPromise = this.#doSync(
-      contractAddress,
-      functionToInvokeAfterSync,
-      utilityExecutor,
-      anchorBlockHeader,
-      jobId,
-    );
-    this.syncedContracts.set(key, syncPromise);
-
-    try {
-      await syncPromise;
-    } catch (err) {
-      // There was an error syncing the contract, so we remove it from the cache so that it can be retried.
-      this.syncedContracts.delete(key);
-      throw err;
+    const unsyncedScopes =
+      scopes === 'ALL_SCOPES'
+        ? scopes
+        : scopes.filter(scope => !this.syncedContracts.has(toKey(contractAddress, scope)));
+    const unsyncedScopesKeys = toKeys(contractAddress, unsyncedScopes);
+
+    if (unsyncedScopesKeys.length > 0) {
+      // Start sync and store the promise for all unsynced scopes
+      const promise = this.#doSync(
+        contractAddress,
+        functionToInvokeAfterSync,
+        utilityExecutor,
+        anchorBlockHeader,
+        jobId,
+        unsyncedScopes,
+      ).catch(err => {
+        // There was an error syncing the contract, so we remove it from the cache so that it can be retried.
+        unsyncedScopesKeys.forEach(key => this.syncedContracts.delete(key));
+        throw err;
+      });
+      unsyncedScopesKeys.forEach(key => this.syncedContracts.set(key, promise));
     }
+
+    const promises = toKeys(contractAddress, scopes).map(key => this.syncedContracts.get(key)!);
+    await Promise.all(promises);
   }
 
   async #doSync(
     contractAddress: AztecAddress,
     functionToInvokeAfterSync: FunctionSelector | null,
-    utilityExecutor: (call: FunctionCall) => Promise<any>,
+    utilityExecutor: (call: FunctionCall, scopes: AccessScopes) => Promise<any>,
     anchorBlockHeader: BlockHeader,
     jobId: string,
+    scopes: AccessScopes,
   ): Promise<void> {
     this.log.debug(`Syncing contract ${contractAddress}`);
     await Promise.all([
@@ -101,6 +115,7 @@ export class ContractSyncService implements StagedStore {
         this.aztecNode,
         anchorBlockHeader,
         jobId,
+        scopes,
       ),
       verifyCurrentClassId(contractAddress, this.aztecNode, this.contractStore, anchorBlockHeader),
     ]);
@@ -127,3 +142,11 @@ export class ContractSyncService implements StagedStore {
     return Promise.resolve();
   }
 }
+
+function toKeys(contract: AztecAddress, scopes: AccessScopes) {
+  return scopes === 'ALL_SCOPES' ? [toKey(contract, scopes)] : scopes.map(scope => toKey(contract, scope));
+}
+
+function toKey(contract: AztecAddress, scope: AztecAddress | 'ALL_SCOPES') {
+  return scope === 'ALL_SCOPES' ? `${contract.toString()}:*` : `${contract.toString()}:${scope.toString()}`;
+}

package/src/contract_sync/helpers.ts

@@ -6,6 +6,7 @@ import { DelayedPublicMutableValues, DelayedPublicMutableValuesWithHash } from '
 import type { AztecNode } from '@aztec/stdlib/interfaces/client';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 
+import type { AccessScopes } from '../access_scopes.js';
 import { NoteService } from '../notes/note_service.js';
 import type { ContractStore } from '../storage/contract_store/contract_store.js';
 import type { NoteStore } from '../storage/note_store/note_store.js';
@@ -42,11 +43,12 @@ export async function syncState(
   contractAddress: AztecAddress,
   contractStore: ContractStore,
   functionToInvokeAfterSync: FunctionSelector | null,
-  utilityExecutor: (privateSyncCall: FunctionCall) => Promise<any>,
+  utilityExecutor: (privateSyncCall: FunctionCall, scopes: AccessScopes) => Promise<any>,
   noteStore: NoteStore,
   aztecNode: AztecNode,
   anchorBlockHeader: BlockHeader,
   jobId: string,
+  scopes: AccessScopes,
 ) {
   // Protocol contracts don't have private state to sync
   if (!isProtocolContract(contractAddress)) {
@@ -61,7 +63,10 @@ export async function syncState(
 
     // Both sync_state and syncNoteNullifiers interact with the note store, but running them in parallel is safe
     // because note store is designed to handle concurrent operations.
-    await Promise.all([utilityExecutor(syncStateFunctionCall), noteService.syncNoteNullifiers(contractAddress)]);
+    await Promise.all([
+      utilityExecutor(syncStateFunctionCall, scopes),
+      noteService.syncNoteNullifiers(contractAddress, scopes),
+    ]);
   }
 }
 

package/src/debug/pxe_debug_utils.ts

@@ -1,12 +1,13 @@
 import type { FunctionCall } from '@aztec/stdlib/abi';
 import type { AuthWitness } from '@aztec/stdlib/auth-witness';
-import type { AztecAddress } from '@aztec/stdlib/aztec-address';
-import type { NoteDao, NotesFilter } from '@aztec/stdlib/note';
+import type { NoteDao } from '@aztec/stdlib/note';
 import type { ContractOverrides } from '@aztec/stdlib/tx';
 
+import type { AccessScopes } from '../access_scopes.js';
 import type { BlockSynchronizer } from '../block_synchronizer/block_synchronizer.js';
 import type { ContractFunctionSimulator } from '../contract_function_simulator/contract_function_simulator.js';
 import type { ContractSyncService } from '../contract_sync/contract_sync_service.js';
+import type { NotesFilter } from '../notes_filter.js';
 import type { AnchorBlockStore } from '../storage/index.js';
 import type { NoteStore } from '../storage/note_store/note_store.js';
 
@@ -21,7 +22,7 @@ export class PXEDebugUtils {
     contractFunctionSimulator: ContractFunctionSimulator,
     call: FunctionCall,
     authWitnesses: AuthWitness[] | undefined,
-    scopes: AztecAddress[] | undefined,
+    scopes: AccessScopes,
     jobId: string,
   ) => Promise<any>;
 
@@ -40,7 +41,7 @@ export class PXEDebugUtils {
       contractFunctionSimulator: ContractFunctionSimulator,
       call: FunctionCall,
       authWitnesses: AuthWitness[] | undefined,
-      scopes: AztecAddress[] | undefined,
+      scopes: AccessScopes,
       jobId: string,
     ) => Promise<any>,
   ) {
@@ -71,10 +72,11 @@ export class PXEDebugUtils {
       await this.contractSyncService.ensureContractSynced(
         filter.contractAddress,
         null,
-        async privateSyncCall =>
-          await this.#simulateUtility(contractFunctionSimulator, privateSyncCall, [], undefined, jobId),
+        async (privateSyncCall, execScopes) =>
+          await this.#simulateUtility(contractFunctionSimulator, privateSyncCall, [], execScopes, jobId),
         anchorBlockHeader,
         jobId,
+        filter.scopes,
       );
 
       return this.noteStore.getNotes(filter, jobId);

package/src/entrypoints/client/bundle/index.ts

@@ -1,3 +1,5 @@
+export * from '../../../access_scopes.js';
+export * from '../../../notes_filter.js';
 export * from '../../../pxe.js';
 export * from '../../../config/index.js';
 export * from '../../../error_enriching.js';