@aztec/pxe 0.0.1-commit.9b94fc1 → 0.0.1-commit.9badcec54

package/src/private_kernel/hints/test_utils.ts

@@ -0,0 +1,325 @@
+import {
+  MAX_KEY_VALIDATION_REQUESTS_PER_CALL,
+  MAX_KEY_VALIDATION_REQUESTS_PER_TX,
+  MAX_NOTE_HASHES_PER_CALL,
+  MAX_NOTE_HASHES_PER_TX,
+  MAX_NOTE_HASH_READ_REQUESTS_PER_CALL,
+  MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+  MAX_NULLIFIERS_PER_CALL,
+  MAX_NULLIFIERS_PER_TX,
+  MAX_NULLIFIER_READ_REQUESTS_PER_CALL,
+  MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+  MAX_PRIVATE_LOGS_PER_CALL,
+  MAX_PRIVATE_LOGS_PER_TX,
+} from '@aztec/constants';
+import { makeTuple } from '@aztec/foundation/array';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { Point } from '@aztec/foundation/curves/grumpkin';
+import type { Serializable } from '@aztec/foundation/serialize';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import {
+  ClaimedLengthArray,
+  KeyValidationRequest,
+  KeyValidationRequestAndSeparator,
+  NoteHash,
+  Nullifier,
+  PrivateCircuitPublicInputs,
+  PrivateKernelCircuitPublicInputs,
+  type PrivateKernelSimulateOutput,
+  ReadRequest,
+  ScopedKeyValidationRequestAndSeparator,
+  ScopedNoteHash,
+  ScopedNullifier,
+  ScopedReadRequest,
+} from '@aztec/stdlib/kernel';
+import { PrivateLogData, ScopedPrivateLogData } from '@aztec/stdlib/kernel';
+import { PrivateLog } from '@aztec/stdlib/logs';
+import { PrivateCallExecutionResult } from '@aztec/stdlib/tx';
+import { VerificationKeyData } from '@aztec/stdlib/vks';
+
+const DEFAULT_CONTRACT_ADDRESS = AztecAddress.fromBigInt(987654n);
+
+/**
+ * Builds a ClaimedLengthArray from a list of items, padding to the required size.
+ */
+function makeClaimed<T extends Serializable, N extends number>(items: T[], emptyFactory: { empty(): T }, maxSize: N) {
+  const padded = makeTuple(maxSize, i => items[i] ?? emptyFactory.empty());
+  return new ClaimedLengthArray<T, typeof maxSize>(padded, items.length);
+}
+
+/** Builder for PrivateKernelCircuitPublicInputs with fluent API for adding side effects. */
+export class PrivateKernelCircuitPublicInputsBuilder {
+  private noteHashes: ScopedNoteHash[] = [];
+  private nullifiers: ScopedNullifier[] = [];
+  private noteHashReadRequests: ScopedReadRequest[] = [];
+  private nullifierReadRequests: ScopedReadRequest[] = [];
+  private keyValidationRequests: ScopedKeyValidationRequestAndSeparator[] = [];
+  private privateLogs: ScopedPrivateLogData[] = [];
+  private nextCounter: number;
+
+  constructor(
+    private contractAddress: AztecAddress = DEFAULT_CONTRACT_ADDRESS,
+    startCounter = 1,
+  ) {
+    this.nextCounter = startCounter;
+  }
+
+  private getCounter(sideEffectCounter?: number): number {
+    if (sideEffectCounter !== undefined) {
+      this.nextCounter = sideEffectCounter + 1;
+      return sideEffectCounter;
+    }
+    return this.nextCounter++;
+  }
+
+  /** Adds a note hash to the accumulated data. Defaults are generated randomly. */
+  addNoteHash(opts?: { value?: Fr; counter?: number; contractAddress?: AztecAddress }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    const addr = opts?.contractAddress ?? this.contractAddress;
+    this.noteHashes.push(new NoteHash(value, counter).scope(addr));
+    return this;
+  }
+
+  /** Adds a nullifier to the accumulated data. Defaults are generated randomly. */
+  addNullifier(opts?: { value?: Fr; noteHash?: Fr; counter?: number; contractAddress?: AztecAddress }): this {
+    const value = opts?.value ?? Fr.random();
+    const noteHash = opts?.noteHash ?? Fr.ZERO;
+    const counter = this.getCounter(opts?.counter);
+    const addr = opts?.contractAddress ?? this.contractAddress;
+    this.nullifiers.push(new Nullifier(value, noteHash, counter).scope(addr));
+    return this;
+  }
+
+  /** Adds a pending note hash read request (non-empty contract address, can match a pending note hash). */
+  addPendingNoteHashReadRequest(opts?: { value?: Fr; counter?: number; contractAddress?: AztecAddress }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    const addr = opts?.contractAddress ?? this.contractAddress;
+    this.noteHashReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), addr));
+    return this;
+  }
+
+  /** Adds a settled note hash read request (empty contract address, resolved against the note hash tree). */
+  addSettledNoteHashReadRequest(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.noteHashReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), AztecAddress.ZERO));
+    return this;
+  }
+
+  /** Adds a pending nullifier read request (non-empty contract address, can match a pending nullifier). */
+  addPendingNullifierReadRequest(opts?: { value?: Fr; counter?: number; contractAddress?: AztecAddress }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    const addr = opts?.contractAddress ?? this.contractAddress;
+    this.nullifierReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), addr));
+    return this;
+  }
+
+  /** Adds a settled nullifier read request (empty contract address, resolved against the nullifier tree). */
+  addSettledNullifierReadRequest(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.nullifierReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), AztecAddress.ZERO));
+    return this;
+  }
+
+  /** Adds a key validation request to validation requests. */
+  addKeyValidationRequest(opts?: { contractAddress?: AztecAddress }): this {
+    const addr = opts?.contractAddress ?? this.contractAddress;
+    this.keyValidationRequests.push(
+      new ScopedKeyValidationRequestAndSeparator(
+        new KeyValidationRequestAndSeparator(
+          new KeyValidationRequest(new Point(Fr.random(), Fr.random(), false), Fr.random()),
+          Fr.random(),
+        ),
+        addr,
+      ),
+    );
+    return this;
+  }
+
+  /** Adds a private log to the accumulated data. Defaults are generated randomly. */
+  addPrivateLog(opts?: { noteHashCounter?: number; counter?: number; contractAddress?: AztecAddress }): this {
+    const noteHashCounter = opts?.noteHashCounter ?? 0;
+    const counter = this.getCounter(opts?.counter);
+    const addr = opts?.contractAddress ?? this.contractAddress;
+    this.privateLogs.push(
+      new ScopedPrivateLogData(new PrivateLogData(PrivateLog.empty(), noteHashCounter, counter), addr),
+    );
+    return this;
+  }
+
+  /** Builds the PrivateKernelCircuitPublicInputs with all added side effects. */
+  build(): PrivateKernelCircuitPublicInputs {
+    const publicInputs = PrivateKernelCircuitPublicInputs.empty();
+    publicInputs.end.noteHashes = makeClaimed(this.noteHashes, ScopedNoteHash, MAX_NOTE_HASHES_PER_TX);
+    publicInputs.end.nullifiers = makeClaimed(this.nullifiers, ScopedNullifier, MAX_NULLIFIERS_PER_TX);
+    publicInputs.end.privateLogs = makeClaimed(this.privateLogs, ScopedPrivateLogData, MAX_PRIVATE_LOGS_PER_TX);
+    publicInputs.validationRequests.noteHashReadRequests = makeClaimed(
+      this.noteHashReadRequests,
+      ScopedReadRequest,
+      MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+    );
+    publicInputs.validationRequests.nullifierReadRequests = makeClaimed(
+      this.nullifierReadRequests,
+      ScopedReadRequest,
+      MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+    );
+    publicInputs.validationRequests.scopedKeyValidationRequestsAndSeparators = makeClaimed(
+      this.keyValidationRequests,
+      ScopedKeyValidationRequestAndSeparator,
+      MAX_KEY_VALIDATION_REQUESTS_PER_TX,
+    );
+    return publicInputs;
+  }
+}
+
+/** Builder for PrivateCircuitPublicInputs (call-level) with fluent API for adding side effects. */
+export class PrivateCircuitPublicInputsBuilder {
+  private noteHashes: NoteHash[] = [];
+  private nullifiers: Nullifier[] = [];
+  private noteHashReadRequests: ScopedReadRequest[] = [];
+  private nullifierReadRequests: ScopedReadRequest[] = [];
+  private keyValidationRequests: KeyValidationRequestAndSeparator[] = [];
+  private privateLogs: PrivateLogData[] = [];
+  private nextCounter: number;
+
+  constructor(
+    private contractAddress: AztecAddress = DEFAULT_CONTRACT_ADDRESS,
+    startCounter = 1,
+  ) {
+    this.nextCounter = startCounter;
+  }
+
+  private getCounter(sideEffectCounter?: number): number {
+    if (sideEffectCounter !== undefined) {
+      this.nextCounter = sideEffectCounter + 1;
+      return sideEffectCounter;
+    }
+    return this.nextCounter++;
+  }
+
+  /** Adds a note hash. Defaults are generated randomly. */
+  addNoteHash(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.noteHashes.push(new NoteHash(value, counter));
+    return this;
+  }
+
+  /** Adds a nullifier. Defaults are generated randomly. */
+  addNullifier(opts?: { value?: Fr; noteHash?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const noteHash = opts?.noteHash ?? Fr.ZERO;
+    const counter = this.getCounter(opts?.counter);
+    this.nullifiers.push(new Nullifier(value, noteHash, counter));
+    return this;
+  }
+
+  /** Adds a pending note hash read request (non-empty contract address, can match a pending note hash). */
+  addPendingNoteHashReadRequest(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.noteHashReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), this.contractAddress));
+    return this;
+  }
+
+  /** Adds a settled note hash read request (empty contract address, resolved against the note hash tree). */
+  addSettledNoteHashReadRequest(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.noteHashReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), AztecAddress.ZERO));
+    return this;
+  }
+
+  /** Adds a pending nullifier read request (non-empty contract address, can match a pending nullifier). */
+  addPendingNullifierReadRequest(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.nullifierReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), this.contractAddress));
+    return this;
+  }
+
+  /** Adds a settled nullifier read request (empty contract address, resolved against the nullifier tree). */
+  addSettledNullifierReadRequest(opts?: { value?: Fr; counter?: number }): this {
+    const value = opts?.value ?? Fr.random();
+    const counter = this.getCounter(opts?.counter);
+    this.nullifierReadRequests.push(new ScopedReadRequest(new ReadRequest(value, counter), AztecAddress.ZERO));
+    return this;
+  }
+
+  /** Adds a key validation request. */
+  addKeyValidationRequest(): this {
+    this.keyValidationRequests.push(
+      new KeyValidationRequestAndSeparator(
+        new KeyValidationRequest(new Point(Fr.random(), Fr.random(), false), Fr.random()),
+        Fr.random(),
+      ),
+    );
+    return this;
+  }
+
+  /** Adds a private log. Defaults are generated randomly. */
+  addPrivateLog(opts?: { noteHashCounter?: number; counter?: number }): this {
+    const noteHashCounter = opts?.noteHashCounter ?? 0;
+    const counter = this.getCounter(opts?.counter);
+    this.privateLogs.push(new PrivateLogData(PrivateLog.empty(), noteHashCounter, counter));
+    return this;
+  }
+
+  /** Builds the PrivateCircuitPublicInputs with all added side effects. */
+  build(): PrivateCircuitPublicInputs {
+    const publicInputs = PrivateCircuitPublicInputs.empty();
+    publicInputs.callContext.contractAddress = this.contractAddress;
+    publicInputs.noteHashes = makeClaimed(this.noteHashes, NoteHash, MAX_NOTE_HASHES_PER_CALL);
+    publicInputs.nullifiers = makeClaimed(this.nullifiers, Nullifier, MAX_NULLIFIERS_PER_CALL);
+    publicInputs.privateLogs = makeClaimed(this.privateLogs, PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL);
+    publicInputs.noteHashReadRequests = makeClaimed(
+      this.noteHashReadRequests,
+      ScopedReadRequest,
+      MAX_NOTE_HASH_READ_REQUESTS_PER_CALL,
+    );
+    publicInputs.nullifierReadRequests = makeClaimed(
+      this.nullifierReadRequests,
+      ScopedReadRequest,
+      MAX_NULLIFIER_READ_REQUESTS_PER_CALL,
+    );
+    publicInputs.keyValidationRequestsAndSeparators = makeClaimed(
+      this.keyValidationRequests,
+      KeyValidationRequestAndSeparator,
+      MAX_KEY_VALIDATION_REQUESTS_PER_CALL,
+    );
+    return publicInputs;
+  }
+}
+
+/** Wraps a PrivateKernelCircuitPublicInputs in a PrivateKernelSimulateOutput. */
+export function makeKernelOutput(
+  publicInputs?: PrivateKernelCircuitPublicInputs,
+): PrivateKernelSimulateOutput<PrivateKernelCircuitPublicInputs> {
+  return {
+    publicInputs: publicInputs ?? PrivateKernelCircuitPublicInputs.empty(),
+    verificationKey: VerificationKeyData.empty(),
+    outputWitness: new Map(),
+    bytecode: Buffer.from([]),
+  };
+}
+
+/** Wraps a PrivateCircuitPublicInputs in a PrivateCallExecutionResult. */
+export function makeExecutionResult(publicInputs?: PrivateCircuitPublicInputs): PrivateCallExecutionResult {
+  return new PrivateCallExecutionResult(
+    Buffer.alloc(0),
+    Buffer.alloc(0),
+    new Map(),
+    publicInputs ?? PrivateCircuitPublicInputs.empty(),
+    [],
+    new Map(),
+    [],
+    [],
+    [],
+    [],
+    [],
+  );
+}

package/src/private_kernel/private_kernel_execution_prover.ts

@@ -1,6 +1,6 @@
-import { vkAsFieldsMegaHonk } from '@aztec/foundation/crypto';
-import { Fr } from '@aztec/foundation/fields';
-import { createLogger } from '@aztec/foundation/log';
+import { vkAsFieldsMegaHonk } from '@aztec/foundation/crypto/keys';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
 import { pushTestData } from '@aztec/foundation/testing';
 import { Timer } from '@aztec/foundation/timer';
 import { getVKTreeRoot } from '@aztec/noir-protocol-circuits-types/vk-tree';
@@ -28,13 +28,13 @@ import {
   type PrivateCallExecutionResult,
   type PrivateExecutionResult,
   TxRequest,
-  collectNoteHashLeafIndexMap,
   collectNoteHashNullifierCounterMap,
   getFinalMinRevertibleSideEffectCounter,
 } from '@aztec/stdlib/tx';
 import { VerificationKeyAsFields, VerificationKeyData, VkData } from '@aztec/stdlib/vks';
 
-import { PrivateKernelResetPrivateInputsBuilder } from './hints/build_private_kernel_reset_private_inputs.js';
+import { computeTxExpirationTimestamp } from './hints/compute_tx_expiration_timestamp.js';
+import { PrivateKernelResetPrivateInputsBuilder } from './hints/private_kernel_reset_private_inputs_builder.js';
 import type { PrivateKernelOracle } from './private_kernel_oracle.js';
 
 const NULL_SIMULATE_OUTPUT: PrivateKernelSimulateOutput<PrivateKernelCircuitPublicInputs> = {
@@ -57,13 +57,16 @@ export interface PrivateKernelExecutionProverConfig {
  * inform state tree updates.
  */
 export class PrivateKernelExecutionProver {
-  private log = createLogger('pxe:private-kernel-execution-prover');
+  private log: Logger;
 
   constructor(
     private oracle: PrivateKernelOracle,
     private proofCreator: PrivateKernelProver,
     private fakeProofs = false,
-  ) {}
+    bindings?: LoggerBindings,
+  ) {
+    this.log = createLogger('pxe:private-kernel-execution-prover', bindings);
+  }
 
   /**
    * Generate a proof for a given transaction request and execution result.
@@ -101,7 +104,6 @@ export class PrivateKernelExecutionProver {
 
     const executionSteps: PrivateExecutionStep[] = [];
 
-    const noteHashLeafIndexMap = collectNoteHashLeafIndexMap(executionResult);
     const noteHashNullifierCounterMap = collectNoteHashNullifierCounterMap(executionResult);
     const minRevertibleSideEffectCounter = getFinalMinRevertibleSideEffectCounter(executionResult);
     const splitCounter = isPrivateOnlyTx ? 0 : minRevertibleSideEffectCounter;
@@ -115,8 +117,9 @@ export class PrivateKernelExecutionProver {
           splitCounter,
         );
         while (resetBuilder.needsReset()) {
+          // Inner reset: without siloing.
           const witgenTimer = new Timer();
-          const privateInputs = await resetBuilder.build(this.oracle, noteHashLeafIndexMap);
+          const privateInputs = await resetBuilder.build(this.oracle);
           output = generateWitnesses
             ? await this.proofCreator.generateResetOutput(privateInputs)
             : await this.proofCreator.simulateReset(privateInputs);
@@ -215,16 +218,24 @@ export class PrivateKernelExecutionProver {
       firstIteration = false;
     }
 
-    // Reset.
-    let resetBuilder = new PrivateKernelResetPrivateInputsBuilder(
+    // Final reset: include siloing of note hashes, nullifiers and private logs.
+    const finalResetBuilder = new PrivateKernelResetPrivateInputsBuilder(
       output,
       [],
       noteHashNullifierCounterMap,
       splitCounter,
     );
-    while (resetBuilder.needsReset()) {
+    if (!finalResetBuilder.needsReset()) {
+      // The final reset must be performed exactly once, because each tx has at least one nullifier that requires
+      // siloing, and siloing cannot be done multiple times.
+      // While, in theory, it might be possible to silo note hashes first and then run another reset to silo nullifiers
+      // and/or private logs, we currently don't have standalone dimensions for the arrays that require siloing. As a
+      // result, all necessary siloing must be done together in a single reset.
+      // Refer to the possible combinations of dimensions in private_kernel_reset_config.json.
+      throw new Error('Nothing to reset for the final reset.');
+    } else {
       const witgenTimer = new Timer();
-      const privateInputs = await resetBuilder.build(this.oracle, noteHashLeafIndexMap);
+      const privateInputs = await finalResetBuilder.build(this.oracle);
       output = generateWitnesses
         ? await this.proofCreator.generateResetOutput(privateInputs)
         : await this.proofCreator.simulateReset(privateInputs);
@@ -238,8 +249,6 @@ export class PrivateKernelExecutionProver {
           witgen: witgenTimer.ms(),
         },
       });
-
-      resetBuilder = new PrivateKernelResetPrivateInputsBuilder(output, [], noteHashNullifierCounterMap, splitCounter);
     }
 
     if (output.publicInputs.feePayer.isZero() && skipFeeEnforcement) {
@@ -259,20 +268,14 @@ export class PrivateKernelExecutionProver {
     // TODO: Enable padding once we better understand the final amounts to pad to.
     const paddedSideEffectAmounts = PaddedSideEffectAmounts.empty();
 
-    // Use the aggregated includeByTimestamp set throughout the tx execution.
-    // TODO: Call `computeTxIncludeByTimestamp` to round the value down and reduce precision, improving privacy.
-    const includeByTimestampUpperBound = previousKernelData.publicInputs.includeByTimestamp;
-    const anchorBlockTimestamp = previousKernelData.publicInputs.constants.anchorBlockHeader.globalVariables.timestamp;
-    if (includeByTimestampUpperBound <= anchorBlockTimestamp) {
-      throw new Error(
-        `Include-by timestamp must be greater than the anchor block timestamp. Anchor block timestamp: ${anchorBlockTimestamp}. Include-by timestamp: ${includeByTimestampUpperBound}.`,
-      );
-    }
+    // Round the aggregated expirationTimestamp down to reduce precision and avoid leaking which private
+    // functions were called via their exact expiration offsets.
+    const expirationTimestampUpperBound = computeTxExpirationTimestamp(previousKernelData.publicInputs);
 
     const privateInputs = new PrivateKernelTailCircuitPrivateInputs(
       previousKernelData,
       paddedSideEffectAmounts,
-      includeByTimestampUpperBound,
+      expirationTimestampUpperBound,
     );
 
     const witgenTimer = new Timer();
@@ -290,8 +293,8 @@ export class PrivateKernelExecutionProver {
       },
     });
 
-    // Hiding circuit is only executed if we are generating witnesses.
-    // For simulation, we can end with the tail, since the hiding circuit will simply return the same tail output.
+    // Hiding kernel is only executed if we are generating witnesses.
+    // For simulation, we can end with the tail, since the Hiding kernel will simply return the same tail output.
     if (generateWitnesses) {
       const previousKernelVkData = await this.getVkData(tailOutput.verificationKey);
 
@@ -415,6 +418,7 @@ export class PrivateKernelExecutionProver {
       await this.oracle.getContractClassIdPreimage(currentContractClassId);
 
     const updatedClassIdHints = await this.oracle.getUpdatedClassIdHints(contractAddress);
+
     return PrivateCallData.from({
       publicInputs,
       vk,

package/src/private_kernel/private_kernel_oracle.ts

@@ -1,71 +1,152 @@
-import { FUNCTION_TREE_HEIGHT, NOTE_HASH_TREE_HEIGHT, VK_TREE_HEIGHT } from '@aztec/constants';
-import type { Fr, GrumpkinScalar, Point } from '@aztec/foundation/fields';
+import { FUNCTION_TREE_HEIGHT, NOTE_HASH_TREE_HEIGHT, PUBLIC_DATA_TREE_HEIGHT, VK_TREE_HEIGHT } from '@aztec/constants';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
 import { MembershipWitness } from '@aztec/foundation/trees';
+import type { KeyStore } from '@aztec/key-store';
+import { getVKIndex, getVKSiblingPath } from '@aztec/noir-protocol-circuits-types/vk-tree';
+import { ProtocolContractAddress } from '@aztec/protocol-contracts';
 import type { FunctionSelector } from '@aztec/stdlib/abi';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import { type ContractInstanceWithAddress, computeSaltedInitializationHash } from '@aztec/stdlib/contract';
+import { DelayedPublicMutableValues, DelayedPublicMutableValuesWithHash } from '@aztec/stdlib/delayed-public-mutable';
+import { computePublicDataTreeLeafSlot } from '@aztec/stdlib/hash';
+import type { AztecNode } from '@aztec/stdlib/interfaces/client';
 import { UpdatedClassIdHints } from '@aztec/stdlib/kernel';
-import type { PublicKeys } from '@aztec/stdlib/keys';
 import type { NullifierMembershipWitness } from '@aztec/stdlib/trees';
+import type { BlockHeader } from '@aztec/stdlib/tx';
 import type { VerificationKeyAsFields } from '@aztec/stdlib/vks';
 
+import type { ContractStore } from '../storage/contract_store/contract_store.js';
+
 /**
  * Provides functionality needed by the private kernel for interacting with our state trees.
- * This is either PrivateKernelOracleImpl, or a mocked test implementation.
  */
-export interface PrivateKernelOracle {
+export class PrivateKernelOracle {
+  constructor(
+    private contractStore: ContractStore,
+    private keyStore: KeyStore,
+    private node: AztecNode,
+    private blockHeader: BlockHeader,
+  ) {}
+
   /** Retrieves the preimage of a contract address from the registered contract instances db. */
-  getContractAddressPreimage(address: AztecAddress): Promise<{
-    saltedInitializationHash: Fr;
-    publicKeys: PublicKeys;
-    currentContractClassId: Fr;
-    originalContractClassId: Fr;
-  }>;
+  public async getContractAddressPreimage(
+    address: AztecAddress,
+  ): Promise<ContractInstanceWithAddress & { saltedInitializationHash: Fr }> {
+    const instance = await this.contractStore.getContractInstance(address);
+    if (!instance) {
+      throw new Error(`Contract instance not found when getting address preimage. Contract address: ${address}.`);
+    }
+    return {
+      saltedInitializationHash: await computeSaltedInitializationHash(instance),
+      ...instance,
+    };
+  }
 
   /** Retrieves the preimage of a contract class id from the contract classes db. */
-  getContractClassIdPreimage(
-    contractClassId: Fr,
-  ): Promise<{ artifactHash: Fr; publicBytecodeCommitment: Fr; privateFunctionsRoot: Fr }>;
+  public async getContractClassIdPreimage(contractClassId: Fr) {
+    const contractClass = await this.contractStore.getContractClassWithPreimage(contractClassId);
+    if (!contractClass) {
+      throw new Error(`Contract class not found when getting class id preimage. Class id: ${contractClassId}.`);
+    }
+    return {
+      artifactHash: contractClass.artifactHash,
+      privateFunctionsRoot: contractClass.privateFunctionsRoot,
+      publicBytecodeCommitment: contractClass.publicBytecodeCommitment,
+    };
+  }
 
-  /**
-   * Returns a membership witness with the sibling path and leaf index in our private functions tree.
-   */
-  getFunctionMembershipWitness(
+  /** Returns a membership witness with the sibling path and leaf index in our private functions tree. */
+  public async getFunctionMembershipWitness(
     contractClassId: Fr,
     selector: FunctionSelector,
-  ): Promise<MembershipWitness<typeof FUNCTION_TREE_HEIGHT>>;
+  ): Promise<MembershipWitness<typeof FUNCTION_TREE_HEIGHT>> {
+    const membershipWitness = await this.contractStore.getFunctionMembershipWitness(contractClassId, selector);
+    if (!membershipWitness) {
+      throw new Error(
+        `Membership witness not found for contract class id ${contractClassId} and selector ${selector}.`,
+      );
+    }
+    return membershipWitness;
+  }
 
   /**
    * Returns a membership witness with the sibling path and leaf index in our protocol VK indexed merkle tree.
    * Used to validate the previous kernel's verification key.
    */
-  getVkMembershipWitness(vk: VerificationKeyAsFields): Promise<MembershipWitness<typeof VK_TREE_HEIGHT>>;
+  public getVkMembershipWitness(vk: VerificationKeyAsFields): Promise<MembershipWitness<typeof VK_TREE_HEIGHT>> {
+    const leafIndex = getVKIndex(vk);
+    return Promise.resolve(new MembershipWitness(VK_TREE_HEIGHT, BigInt(leafIndex), getVKSiblingPath(leafIndex)));
+  }
 
-  /**
-   * Returns a membership witness with the sibling path and leaf index in our private function indexed merkle tree.
-   */ getNoteHashMembershipWitness(leafIndex: bigint): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT>>;
+  /** Returns a membership witness with the sibling path and leaf index in our note hash tree. */
+  async getNoteHashMembershipWitness(
+    noteHash: Fr,
+  ): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT> | undefined> {
+    return this.node.getNoteHashMembershipWitness(await this.blockHeader.hash(), noteHash);
+  }
 
-  /**
-   * Returns a membership witness with the sibling path and leaf index in our nullifier indexed merkle tree.
-   */
-  getNullifierMembershipWitness(nullifier: Fr): Promise<NullifierMembershipWitness | undefined>;
-  /**
-   * Returns the root of our note hash merkle tree.
-   */
-  getNoteHashTreeRoot(): Promise<Fr>;
+  /** Returns a membership witness with the sibling path and leaf index in our nullifier indexed merkle tree. */
+  async getNullifierMembershipWitness(nullifier: Fr): Promise<NullifierMembershipWitness | undefined> {
+    return this.node.getNullifierMembershipWitness(await this.blockHeader.hash(), nullifier);
+  }
+
+  /** Returns the root of our note hash merkle tree. */
+  getNoteHashTreeRoot(): Fr {
+    return this.blockHeader.state.partial.noteHashTree.root;
+  }
 
   /**
    * Retrieves the sk_m corresponding to the pk_m.
    * @throws If the provided public key is not associated with any of the registered accounts.
-   * @param pkM - The master public key to get secret key for.
+   * @param masterPublicKey - The master public key to get secret key for.
    * @returns A Promise that resolves to sk_m.
    * @dev Used when feeding the sk_m to the kernel circuit for keys verification.
    */
-  getMasterSecretKey(masterPublicKey: Point): Promise<GrumpkinScalar>;
+  public getMasterSecretKey(masterPublicKey: Point): Promise<GrumpkinScalar> {
+    return this.keyStore.getMasterSecretKey(masterPublicKey);
+  }
 
   /** Use debug data to get the function name corresponding to a selector. */
-  getDebugFunctionName(contractAddress: AztecAddress, selector: FunctionSelector): Promise<string | undefined>;
+  public getDebugFunctionName(contractAddress: AztecAddress, selector: FunctionSelector): Promise<string | undefined> {
+    return this.contractStore.getDebugFunctionName(contractAddress, selector);
+  }
+
+  /**
+   * Returns a membership witness and leaf index to our public data indexed merkle tree,
+   * along with an associated DelayedPublicMutable containing the class ID to update.
+   */
+  public async getUpdatedClassIdHints(contractAddress: AztecAddress): Promise<UpdatedClassIdHints> {
+    const { delayedPublicMutableSlot, delayedPublicMutableHashSlot } =
+      await DelayedPublicMutableValuesWithHash.getContractUpdateSlots(contractAddress);
+
+    const hashLeafSlot = await computePublicDataTreeLeafSlot(
+      ProtocolContractAddress.ContractInstanceRegistry,
+      delayedPublicMutableHashSlot,
+    );
+    const blockHash = await this.blockHeader.hash();
+
+    const updatedClassIdWitness = await this.node.getPublicDataWitness(blockHash, hashLeafSlot);
+
+    if (!updatedClassIdWitness) {
+      throw new Error(`No public data tree witness found for ${hashLeafSlot}`);
+    }
+
+    const readStorage = (storageSlot: Fr) =>
+      this.node.getPublicStorageAt(blockHash, ProtocolContractAddress.ContractInstanceRegistry, storageSlot);
+    const delayedPublicMutableValues = await DelayedPublicMutableValues.readFromTree(
+      delayedPublicMutableSlot,
+      readStorage,
+    );
 
-  /** Returns a membership witness and leaf index to our public data indexed merkle tree,
-   * along with an associated DelayedPublicMutable containing the class ID to update. */
-  getUpdatedClassIdHints(contractAddress: AztecAddress): Promise<UpdatedClassIdHints>;
+    return new UpdatedClassIdHints(
+      new MembershipWitness(
+        PUBLIC_DATA_TREE_HEIGHT,
+        updatedClassIdWitness.index,
+        updatedClassIdWitness.siblingPath.toTuple(),
+      ),
+      updatedClassIdWitness.leafPreimage,
+      delayedPublicMutableValues,
+    );
+  }
 }